How to Write a Risk Assessment That Passes HSE Inspection

No document guarantees a positive inspection outcome — HSE inspectors assess the full picture, not just paperwork. But a risk assessment that reflects reality, covers the right hazards, and shows you've applied the hierarchy of controls puts you in the strongest possible position.

Most risk assessments that fail inspection don't fail because the person who wrote them is incompetent. They fail because the document doesn't reflect reality. An inspector walks onto your site, looks at what's happening, then looks at what you've written down — and the two don't match.

The legal foundation is Regulation 3 of the Management of Health and Safety at Work Regulations 1999, which requires every employer and self-employed person to carry out a suitable and sufficient risk assessment. HSE's guidance document INDG163 sets out the five-step approach. What follows is that framework with the practical detail INDG163 leaves to you.

What HSE Inspectors Actually Check

An inspector isn't reading your risk assessment cover to cover. They're scanning for specific things:

• Site-specificity. Does this describe this site, or could it be about any site in the country? Mentioning "the excavation adjacent to the south boundary wall" tells them you've looked at the job. "Excavation work" tells them nothing.
• Real hazards. They want hazards that genuinely exist on your site — not twenty generic items copied from a template.
• Sensible control measures. Not "workers will be careful." Guardrails, not just harnesses. Extraction, not just masks. Controls that follow the hierarchy and are demonstrably in place.
• Evidence of review. Dates, signatures, version numbers. A risk assessment dated six months ago on a site that's changed three times is a problem.

Our breakdown of recent HSE construction fines shows what happens when these things aren't in order.

Compliant vs. Good

A compliant risk assessment ticks the legal boxes: hazards identified, people at risk named, control measures listed, findings recorded. Enough to avoid prosecution for not having one.

A good risk assessment reflects what's actually happening on site. The workers recognise it as describing their job. The controls are genuinely in place. When something changes, the document gets updated. HSE will assess whether yours was "suitable and sufficient" — a generic document that doesn't match site conditions won't meet that test.

Step-by-Step: Writing a Risk Assessment That Holds Up

Step 1: Identify the Hazards

Walk the site. Not your kitchen table the night before — the actual site. Look at access routes, ground conditions, what's overhead, what's underground, where the public can get close, where other trades are working.

Commonly missed hazards: overhead services near scaffold positions, underground services on sites with poor drawings, interface with other trades, access at height, and temporary conditions like the site after heavy rain.

If you're listing "asbestos" on a new-build, you've stopped thinking and started copying.

For a template to build on, our construction risk assessment template guide breaks down what to include section by section.

Step 2: Decide Who Might Be Harmed and How

Be specific beyond "the workers":

• Your operatives — what tasks, what experience level?
• Other trades on site — does your work create dust, noise, falling object risks for them?
• Members of the public — pedestrians near hoarding, residents in occupied buildings
• Young workers and apprentices — less experience, less awareness of risk

"Operative could fall from scaffold" is better than "fall from height." Specificity shows you've thought about it.

Step 3: Evaluate Risks and Decide on Controls

Apply the hierarchy of controls — it's embedded in the regulations, not optional:

1. Eliminate — remove the hazard entirely
2. Substitute — replace with something less hazardous
3. Engineering controls — guardrails, LEV, scaffold instead of ladders
4. Administrative controls — permits to work, training, supervision
5. PPE — the last resort, not the first. If every hazard's control reads "hard hat, hi-vis, safety boots," you haven't applied the hierarchy.

Be specific: not "edge protection will be provided" but "double guardrail and toe board to all open edges above 2m, installed before work begins at each level, inspected weekly by [name]."

Step 4: Record and Implement

If you employ five or more people, recording in writing is legally required. Do it regardless — "I did it in my head" won't satisfy an inspector.

Record the hazards, who's at risk, your control measures, who's responsible, and the date. Then actually implement the controls. A toolbox talk with a sign-off sheet is the minimum. HSE inspectors will ask your operatives what's in the RAMS. If they look blank, your paperwork is worthless.

Step 5: Review and Update

Review when the work changes, after incidents or near misses, when new information surfaces, at regular intervals on longer projects, and when new workers join. Date each review and note what changed. "Rev 2, updated 15 March to reflect revised scaffold design" is adequate.

Red Flags Inspectors Spot Immediately

• Identical documents for different sites. A loft conversion in Croydon reading the same as a fit-out in Manchester.
• No dates or names. When was this written? Who's responsible? "The site manager" isn't a name.
• No evidence of review. A document dated eighteen months ago with no update history.
• Generic hazards without site detail. Every assessment lists "slips, trips, and falls." What matters is what's causing them here.
• PPE as the only control. Tells an inspector you skipped the hierarchy entirely.

A Practical Risk Scoring Approach

INDG163 doesn't mandate a scoring system — HSE cares more about sensible controls than correct numbers. But a simple approach helps prioritise:

	Low Severity	Medium Severity	High Severity
Unlikely	1 (Low)	2 (Low)	3 (Medium)
Possible	2 (Low)	4 (Medium)	6 (High)
Likely	3 (Medium)	6 (High)	9 (High)

Score each hazard before and after controls. If residual risk is still high, your controls aren't sufficient. A 3x3 matrix is plenty — a 5x5 with decimal weightings just makes it harder to maintain.

Common Mistakes That Invite Scrutiny

• Writing the assessment after work has started. The whole point is to do it before.
• Not involving the people doing the work. Your bricklayer knows things you'll miss from the office.
• Listing irrelevant hazards. "Work near water" on a site in central Birmingham with no water in sight — obviously pasted from a template.
• Risk assessment and method statement don't match. If the method statement says "install scaffold to TG20" but the risk assessment doesn't mention working at height during erection, that's a disconnect.
• Forgetting COSHH. Resins, solvents, wood dust, silica — if they're on your job, you need COSHH assessments alongside. Inspectors check.

Making This Easier

Writing a site-specific risk assessment for every job takes time. There's no shortcut around the thinking. But turning that thinking into a structured document shouldn't take all evening.

TradeRAMS is built for exactly this. You work through your job details and it produces a site-specific risk assessment that reflects what you've told it. No generic filler, no copy-paste from the last job.

We're opening access in stages. If you want to be first in line, join the waitlist at traderams.co.uk — it's free to sign up.

Walk the site, think about what could go wrong, write down what you're doing about it, and keep it current. That's a risk assessment that passes inspection — because it's one that actually works.