This guide explains what RAMS are, why they exist, what goes in them, and when you legally need them.

What does RAMS stand for?

RAMS stands for Risk Assessment and Method Statement. It's a package of two documents that together describe:

1. The hazards present in a piece of work and how you'll control them (the risk assessment)
2. The step-by-step method for carrying out the work safely (the method statement)

The two documents serve different but complementary purposes. The risk assessment is analytical — it identifies what could go wrong. The method statement is procedural — it describes how the work will actually be done, with the control measures built into each step.

On most UK construction sites, RAMS are submitted as a single package, reviewed by the principal contractor or client before work begins.

When do you need RAMS?

The legal position

There is no single regulation that says "you must produce a document called RAMS." But several regulations create duties that RAMS fulfil:

Management of Health and Safety at Work Regulations 1999, Regulation 3 requires every employer and self-employed person to make a "suitable and sufficient assessment" of the risks to workers and others affected by their work. Employers with five or more employees must record the significant findings in writing.

CDM 2015, Regulation 15 requires every contractor to plan, manage, and monitor construction work so that it is carried out without risks to health and safety, so far as is reasonably practicable. A risk assessment and method statement is the standard way to demonstrate that planning.

CDM 2015, Regulation 15(10) requires the contractor on a single-contractor project to draw up a construction phase plan. RAMS form part of that plan.

The practical position

Whatever the regulations say about document names, the practical reality is:

• Every principal contractor requires RAMS from subcontractors before allowing them on site
• Most commercial clients require RAMS as part of the tender or pre-start process
• Many domestic clients are beginning to ask for them, particularly on larger projects
• HSE inspectors expect to see written risk assessments and will ask to review them during site visits

If you're doing construction work in the UK and you don't have RAMS, you're either not getting on managed sites or you're taking an enforcement risk.

Not sure exactly which documents your project requires? Our RAMS Requirements Checker helps you work it out based on your trade and project type.

What goes in a risk assessment?

The risk assessment is the "what could go wrong" document. HSE's five-step framework (from INDG163) provides the structure:

1. Identify the hazards — What on this site, in this work, could cause harm? Walk the site (not your kitchen table). Look at access, the work area, existing services, other trades, the condition of the building.

2. Decide who might be harmed and how — Your operatives, other trades, the public, building occupants. Be specific about the type of harm: not just "injury" but "fall from height," "electric shock," "silicosis from silica dust."

3. Evaluate the risks and decide on precautions — For each hazard, assess likelihood and severity. Apply the hierarchy of controls: eliminate, substitute, engineering controls, administrative controls, PPE (in that order). PPE is the last resort, not the first line.

4. Record your significant findings — Who's at risk, what you're doing about it. Specific enough that a competent person unfamiliar with the site could read it and understand the plan.

5. Review and update — When conditions change, after incidents, at regular intervals. Date each review.

For a full walkthrough of what to include and common mistakes, see our construction risk assessment template guide.

What goes in a method statement?

The method statement is the "how we'll do it" document. It describes the work in chronological sequence, with safety measures built into each step.

A method statement should include:

• Project details — site, client, your company, dates, document reference
• Scope of works — what this method statement covers
• Sequence of operations — numbered steps in chronological order, each describing the activity, the safety measures in place, the equipment used, and who's responsible
• Resources — number and competence of operatives, relevant qualifications
• Plant and equipment — everything you'll bring to site
• Emergency procedures — what happens if something goes wrong
• Permits to work — any permits required (hot works, electrical isolation, confined space)
• Communication — how operatives will be briefed, toolbox talk records

The key difference between a good method statement and a poor one is specificity. "Install pipework" is not a method statement step. "Step 4: Install LTHW flow and return from boiler to manifold. Copper pipework brazed — hot works permit obtained before brazing. CO2 extinguisher and fire blanket within 2m. Fire watch 60 minutes after final joint" is a method statement step.

For trade-specific examples, see our method statement examples by trade.

How risk assessments and method statements work together

The risk assessment identifies the hazards and specifies the controls. The method statement takes those controls and weaves them into the work sequence.

For example:

A risk assessment without a method statement identifies problems without describing how they're managed in practice. A method statement without a risk assessment describes a process without demonstrating that hazards have been considered. Principal contractors expect both.

Common RAMS mistakes

Using the same RAMS for every job

A risk assessment must be "suitable and sufficient" under Regulation 3 of MHSWR 1999. That means it must reflect the specific hazards of the specific work on the specific site. A document that could apply anywhere isn't suitable for anywhere in particular. Principal contractors spot recycled RAMS immediately — they've seen the same templates submitted by other contractors.

Listing hazards that don't exist on your job

"Crane operations" in an electrician's RAMS for a domestic rewire. "Excavation" in a painter's RAMS for an internal redecoration. If the hazard doesn't apply, don't include it. Padding the document with irrelevant hazards doesn't demonstrate thoroughness — it demonstrates copy-paste.

Vague control measures

"Appropriate PPE will be worn" tells nobody anything. Which PPE? For which hazard? To which standard? "RPE: FFP3 disposable mask, face-fit tested, for silica dust during chasing" — that's a control measure.

No COSHH assessments

If your work involves hazardous substances — adhesives, solvents, dust, flux — your RAMS should reference COSHH assessments for those substances. Saying "follow manufacturer's instructions" without a COSHH assessment attached doesn't meet the requirements of the COSHH Regulations 2002.

Never reviewing the document

A RAMS package written three months ago for a site that's changed twice since isn't current. Review dates, version numbers, and notes on what changed — these show the document is alive, not filed and forgotten.

What does a simple RAMS package look like?

To make this concrete, here's a simplified example for a plasterer's first RAMS on a domestic project — a skim coat in a 1990s semi-detached house:

Risk assessment extract:

Method statement extract:

1. Prepare surfaces — hack off loose plaster, brush down. RPE worn during preparation.
2. Apply PVA bonding coat. Allow to go tacky (30-60 mins).
3. Mix plaster in batches at hop-up height. Apply base coat to walls, feather at edges.
4. Apply skim coat once base coat has pulled. Flatten and trowel finish.
5. Clean tools and area. HEPA vacuum dust. Remove dust sheets.

That's a RAMS package in miniature — hazards identified, controls specified, method sequenced. The real document would include project details, emergency procedures, review dates, and competence evidence, but the core is this: what could go wrong, what you're doing about it, and how you'll do the work.

Do subcontractors need their own RAMS?

Yes. Under CDM 2015, every contractor has duties under Regulation 15 to plan, manage, and monitor their own work. The principal contractor's RAMS cover site-wide coordination, but each subcontractor must assess the risks specific to their own activities.

We've covered this in detail in our guide on whether subcontractors need their own RAMS.

Making RAMS practical

The purpose of RAMS isn't to produce a stack of paper. It's to think through how work will be done safely, communicate that plan to everyone involved, and create a record that demonstrates the thinking happened.

If you're spending hours assembling documents from scratch for every job, something's broken. The thinking should take time — that's the valuable part. Turning that thinking into a structured, compliant document shouldn't.

TradeRAMS is built to handle the document side. You provide the project details and site observations, and it produces RAMS that reflect your actual work — not a template with blanks filled in. We're opening access through a waitlist. Join the waitlist to get early access.

If you're a small builder, sole trader, or subcontractor, these regulations apply to you. Full stop. There's no exemption for small projects, domestic work, or one-person operations. The full text is on legislation.gov.uk — that's the primary source and the one you should bookmark.

This guide breaks down the CDM 2015 responsibilities in plain English so you know exactly where you stand.

The five duty holder roles

CDM 2015 creates five duty holder roles. On a large commercial project, these might be five different organisations. On a small domestic job, one or two people might wear several hats at once.

Client

The client is whoever the construction work is being carried out for (Regulation 2(1)). On a home extension, that's the homeowner. On a commercial fit-out, it's the business commissioning the work.

Clients must make sure the project is set up so it can be carried out safely. Under Regulation 4, they need to make suitable arrangements for managing the project, allocate enough time and resources, and make sure relevant information (like existing asbestos surveys or structural drawings) gets passed to the people who need it.

For domestic clients — homeowners or anyone having work done on their own home — the duties under Regulations 4 and 6 normally transfer to the contractor or principal contractor (Regulation 7). So if you're a builder working directly for a homeowner, you're likely picking up those client duties too.

Designer

A designer is anyone who prepares or modifies designs for a building, product, or system relating to construction work (Regulation 2(1)). This doesn't just mean architects. If you're a plumber designing a heating layout, or an electrician planning a distribution board, you're acting as a designer.

Designers must not start work unless the client is aware of their duties (Regulation 9). When preparing designs, they must eliminate foreseeable risks where possible, reduce risks that can't be eliminated, and provide information about remaining risks (Regulation 9(3)).

Principal designer

On projects with more than one contractor, the client must appoint a principal designer (Regulation 5(1)(a)). This person plans, manages, monitors, and coordinates the pre-construction phase to make sure health and safety risks are addressed in the design. On smaller projects with only one contractor, no principal designer appointment is needed.

Contractor

This is the role most small builders and tradespeople fall into. A contractor is any person who carries out, manages, or controls construction work (Regulation 2(1)). That includes sole traders, partnerships, and limited companies of any size.

Contractor duties sit under Regulation 15, and we'll go through them in detail below.

Principal contractor

On multi-contractor projects, the client must also appoint a principal contractor (Regulation 5(1)(b)). The principal contractor plans, manages, monitors, and coordinates the construction phase. They draw up the construction phase plan, organise cooperation between contractors, and make sure everyone on site has the right inductions.

If no principal contractor is appointed on a project that needs one, the contractor takes on those duties by default (Regulation 5(3)).

When CDM 2015 applies

All construction work in Great Britain. That means every loft conversion, kitchen refit, re-roof, rewire, garden wall, and driveway. Regulation 3 makes this clear: the regulations apply to construction work as defined in Regulation 2 — and that definition is broad, covering building, alteration, fitting-out, commissioning, repair, upkeep, redecoration, demolition, and more.

The common misconception is that CDM only applies to big sites with cranes and hard hats. It doesn't. If you're doing construction work, CDM 2015 applies.

Notifiable vs non-notifiable projects

Not every project needs to be formally notified to the HSE, but CDM duties still apply either way.

A project becomes notifiable under Regulation 6(1) when it meets either of these thresholds:

• The construction phase will last longer than 30 working days and have more than 20 workers on site at any one time, OR
• The construction phase will exceed 500 person-days

If your project is notifiable, the client (or the principal designer on their behalf) must give notice to the HSE before the construction phase begins.

Most small builder projects — extensions, renovations, domestic work — fall below these thresholds. But that changes nothing about your contractor duties.

What a small builder actually has to do (Regulation 15)

Here's the practical bit. Regulation 15 sets out contractor duties, and for a small builder or sole trader, this is your core compliance checklist:

1. Plan, manage, and monitor your work so it's carried out without risks to health and safety, so far as is reasonably practicable (Reg 15(1)).
2. Have (or make arrangements for) adequate supervision, instructions, and information for workers, including any you engage as subcontractors.
3. Do not start work on a project unless the client is aware of their duties and there is a construction phase plan in place for the project (Reg 15(4) and Reg 15(5)).
4. Provide every worker under your control with appropriate site inductions, information, and training (Reg 15(8)).
5. Ensure suitable welfare facilities are available before work starts (Reg 15(11), cross-referencing Schedule 2).
6. Prepare a written construction phase plan if you are the only contractor on the project (Reg 15(10)) — because on a single-contractor project, the contractor must prepare the plan.
7. Carry out risk assessments and produce method statements — your RAMS — covering the specific hazards of the work you're doing. For a walkthrough of how to set these up, see our risk assessment template guide for construction.

If you're using subcontractors, their CDM obligations don't replace yours. You still need to manage and coordinate the work. That said, subs have their own duties too — we've covered whether subcontractors need their own RAMS separately.

Common CDM mistakes small builders make

"CDM doesn't apply to me — I'm too small." It does. There is no size exemption. Regulation 3 applies CDM to all construction work.

"The homeowner is the client, so it's their problem." On domestic projects, Regulation 7 transfers client duties to the contractor. You can't hand responsibility back to a homeowner who has no construction expertise.

"I don't need a construction phase plan for a two-week bathroom refit." If you're the only contractor on the project, Regulation 15(10) says you prepare the construction phase plan. It doesn't need to be a fifty-page document — it needs to be proportionate to the risks — but it needs to exist.

"Risk assessments are optional for small jobs." They aren't. Your duty to plan, manage, and monitor under Regulation 15(1) includes identifying hazards and managing risks. A risk assessment is how you demonstrate that.

"I told my subcontractors to sort their own safety." Coordination is a contractor duty. You can't subcontract away your management obligations.

Quick reference: CDM 2015 roles and responsibilities

Important note

This guide explains CDM 2015 duties in plain English for general awareness. It is not legal advice. CDM 2015 applies in Great Britain (England, Wales, and Scotland) — Northern Ireland has separate regulations (CDM (NI) 2016). For the definitive text, refer to the full CDM 2015 regulations on legislation.gov.uk. If you need advice on your specific legal obligations, consult a qualified health and safety professional.

Keeping on top of it

CDM 2015 compliance boils down to knowing your role on each project, documenting your risk management, and coordinating properly with everyone else involved. For most small builders, that means having solid RAMS for every job and a proportionate construction phase plan.

If you're spending too long wrestling with Word templates and copying the same boilerplate hazards from job to job, that's exactly the problem we built TradeRAMS to solve. It generates structured RAMS documents tailored to your trade and the specific job. We're rolling out access through a waitlist — you can join the TradeRAMS waitlist to get early access when it opens.

Most risk assessments that fail inspection don't fail because the person who wrote them is incompetent. They fail because the document doesn't reflect reality. An inspector walks onto your site, looks at what's happening, then looks at what you've written down — and the two don't match.

The legal foundation is Regulation 3 of the Management of Health and Safety at Work Regulations 1999, which requires every employer and self-employed person to carry out a suitable and sufficient risk assessment. HSE's guidance document INDG163 sets out the five-step approach. What follows is that framework with the practical detail INDG163 leaves to you.

What HSE Inspectors Actually Check

An inspector isn't reading your risk assessment cover to cover. They're scanning for specific things:

• Site-specificity. Does this describe this site, or could it be about any site in the country? Mentioning "the excavation adjacent to the south boundary wall" tells them you've looked at the job. "Excavation work" tells them nothing.
• Real hazards. They want hazards that genuinely exist on your site — not twenty generic items copied from a template.
• Sensible control measures. Not "workers will be careful." Guardrails, not just harnesses. Extraction, not just masks. Controls that follow the hierarchy and are demonstrably in place.
• Evidence of review. Dates, signatures, version numbers. A risk assessment dated six months ago on a site that's changed three times is a problem.

Our breakdown of recent HSE construction fines shows what happens when these things aren't in order.

Compliant vs. Good

A compliant risk assessment ticks the legal boxes: hazards identified, people at risk named, control measures listed, findings recorded. Enough to avoid prosecution for not having one.

A good risk assessment reflects what's actually happening on site. The workers recognise it as describing their job. The controls are genuinely in place. When something changes, the document gets updated. HSE will assess whether yours was "suitable and sufficient" — a generic document that doesn't match site conditions won't meet that test.

Step-by-Step: Writing a Risk Assessment That Holds Up

Step 1: Identify the Hazards

Walk the site. Not your kitchen table the night before — the actual site. Look at access routes, ground conditions, what's overhead, what's underground, where the public can get close, where other trades are working.

Commonly missed hazards: overhead services near scaffold positions, underground services on sites with poor drawings, interface with other trades, access at height, and temporary conditions like the site after heavy rain.

If you're listing "asbestos" on a new-build, you've stopped thinking and started copying.

For a template to build on, our construction risk assessment template guide breaks down what to include section by section.

Step 2: Decide Who Might Be Harmed and How

Be specific beyond "the workers":

• Your operatives — what tasks, what experience level?
• Other trades on site — does your work create dust, noise, falling object risks for them?
• Members of the public — pedestrians near hoarding, residents in occupied buildings
• Young workers and apprentices — less experience, less awareness of risk

"Operative could fall from scaffold" is better than "fall from height." Specificity shows you've thought about it.

Step 3: Evaluate Risks and Decide on Controls

Apply the hierarchy of controls — it's embedded in the regulations, not optional:

1. Eliminate — remove the hazard entirely
2. Substitute — replace with something less hazardous
3. Engineering controls — guardrails, LEV, scaffold instead of ladders
4. Administrative controls — permits to work, training, supervision
5. PPE — the last resort, not the first. If every hazard's control reads "hard hat, hi-vis, safety boots," you haven't applied the hierarchy.

Be specific: not "edge protection will be provided" but "double guardrail and toe board to all open edges above 2m, installed before work begins at each level, inspected weekly by [name]."

Step 4: Record and Implement

If you employ five or more people, recording in writing is legally required. Do it regardless — "I did it in my head" won't satisfy an inspector.

Record the hazards, who's at risk, your control measures, who's responsible, and the date. Then actually implement the controls. A toolbox talk with a sign-off sheet is the minimum. HSE inspectors will ask your operatives what's in the RAMS. If they look blank, your paperwork is worthless.

Step 5: Review and Update

Review when the work changes, after incidents or near misses, when new information surfaces, at regular intervals on longer projects, and when new workers join. Date each review and note what changed. "Rev 2, updated 15 March to reflect revised scaffold design" is adequate.

Red Flags Inspectors Spot Immediately

• Identical documents for different sites. A loft conversion in Croydon reading the same as a fit-out in Manchester.
• No dates or names. When was this written? Who's responsible? "The site manager" isn't a name.
• No evidence of review. A document dated eighteen months ago with no update history.
• Generic hazards without site detail. Every assessment lists "slips, trips, and falls." What matters is what's causing them here.
• PPE as the only control. Tells an inspector you skipped the hierarchy entirely.

A Practical Risk Scoring Approach

INDG163 doesn't mandate a scoring system — HSE cares more about sensible controls than correct numbers. But a simple approach helps prioritise:

Score each hazard before and after controls. If residual risk is still high, your controls aren't sufficient. A 3x3 matrix is plenty — a 5x5 with decimal weightings just makes it harder to maintain.

Common Mistakes That Invite Scrutiny

• Writing the assessment after work has started. The whole point is to do it before.
• Not involving the people doing the work. Your bricklayer knows things you'll miss from the office.
• Listing irrelevant hazards. "Work near water" on a site in central Birmingham with no water in sight — obviously pasted from a template.
• Risk assessment and method statement don't match. If the method statement says "install scaffold to TG20" but the risk assessment doesn't mention working at height during erection, that's a disconnect.
• Forgetting COSHH. Resins, solvents, wood dust, silica — if they're on your job, you need COSHH assessments alongside. Inspectors check.

Making This Easier

Writing a site-specific risk assessment for every job takes time. There's no shortcut around the thinking. But turning that thinking into a structured document shouldn't take all evening.

TradeRAMS is built for exactly this. You work through your job details and it produces a site-specific risk assessment that reflects what you've told it. No generic filler, no copy-paste from the last job.

We're opening access in stages. If you want to be first in line, join the waitlist at traderams.co.uk — it's free to sign up.

Walk the site, think about what could go wrong, write down what you're doing about it, and keep it current. That's a risk assessment that passes inspection — because it's one that actually works.

Quite a lot — and it varies by trade. A method statement example for a plumber looks nothing like one for a scaffolder. This guide breaks down what each trade needs to include, with enough specifics to reference next time you write one.

What Is a Method Statement?

A method statement is the "how" document. It describes, step by step, how work will be carried out safely on site. It is not a risk assessment — that covers "what could go wrong." A method statement answers: given these risks, what is the actual sequence of work, and what controls are in place at each stage?

The two are usually submitted together as a RAMS package, but they serve different purposes. If you need help with the risk assessment side, we have covered risk assessment templates for construction separately.

Method Statement vs Risk Assessment

This trips up a surprising number of experienced tradespeople:

• Risk assessment: identifies hazards, evaluates likelihood and severity, lists control measures. Analytical.
• Method statement: describes the planned work sequence, incorporating those control measures into each step. Procedural.

A risk assessment says "working at height — risk of fall — use edge protection." A method statement says "Step 4: Before ridge tile replacement, erect temporary edge protection to all open edges using a proprietary guardrail system at 950mm height with mid-rail and toe board."

Standard Sections Every Method Statement Needs

Regardless of trade, a solid method statement covers:

1. Scope of works — what is being done, where, and over what duration
2. Sequence of operations — the step-by-step work method, in chronological order
3. Resources — personnel, competency requirements, supervision
4. Plant and equipment — tools, machinery, access equipment, PPE
5. Safety measures — specific controls at each stage (not generic statements)
6. Emergency procedures — what happens if something goes wrong, first aid, nearest A&E

Here is where the generic advice stops and the trade-specific detail starts.

Method Statement Example: Electrician (First Fix Domestic Rewire)

Scope: Full rewire of a 3-bed semi-detached. Strip out existing wiring to the consumer unit. New circuits: lighting, ring finals, cooker, shower, smoke detection.

Isolation procedures: This separates a good method statement from a poor one. Not just "isolate the supply" but "isolate at the DNO cut-out, lock off with a personal padlock, confirm dead using a GS38-compliant voltage indicator, test the tester before and after on a known source."

Cable routing: "Cables within safe zones per BS 7671 Regulation 522.6.6. Vertical drops within 150mm of wall corners. Horizontal runs within 150mm of ceiling or finished floor level."

Testing sequence: Dead testing (continuity, insulation resistance, polarity) then live testing (earth fault loop impedance, RCD operation times). Reference BS 7671 and IET Guidance Note 3. Electrical Installation Certificate issued on completion.

Method Statement Example: Scaffolder

Scaffolding method statements face heavy scrutiny because the scaffold is a temporary structure that other trades rely on.

Erection sequence: "Base plates on sole boards (225mm x 38mm softwood, 1.5m length) on level ground. Standards at maximum 2.1m centres. Ledgers at maximum 2.0m lift heights. Transoms at each standard and mid-bay."

Load calculations: State the duty — general purpose (2.00 kN/m2) or heavy duty (2.50 kN/m2). Reference TG20 compliance where applicable.

Tie patterns: "Ties at every other lift on alternate standards — 4.2m horizontally, 4.0m vertically. Through-ties where possible; otherwise proprietary anchor ties into solid masonry." Never write "ties as required" — that gets your method statement rejected every time.

Inspection schedule: Weekly inspections by a competent person, recorded on a scaffold register. Additional inspections after adverse weather or any alteration.

Method Statement Example: Roofer

Falls from height remain the biggest killer in UK construction, and principal contractors know it. Roofing method statements get scrutinised accordingly.

Access arrangements: "Access via an independent scaffold with a full platform at eaves level. Ladder access via an internal ladder bay with self-closing gate." If using a roof ladder, describe how it is secured — hooked over the ridge, not just resting on tiles.

Edge protection: State that the top guardrail extends at least 950mm above the roof surface at the eaves. For gable ends, describe how protection is provided — a proprietary guardrail or a restraint lanyard system with a defined anchor.

Material handling at height: "Tiles delivered to roof level by mechanical hoist. Distributed evenly across battens to avoid point loading. No materials stacked higher than three courses on the batten." This section is often missing from roofing method statements, and it should not be.

Weather restrictions: "Work ceases when wind exceeds 35 km/h, during lightning, or when surfaces are icy. Partially completed work made safe with temporary weatherproofing before operatives leave the roof."

Method Statement Example: Plumber

A commercial hot water system installation is a common scenario.

Hot works permits: "Hot works permit obtained from the site manager before brazing. CO2 extinguisher and fire blanket within 2m of the work area. Fire watch maintained for 60 minutes after hot works." Skip this section and the PC will return your paperwork the same day.

Isolation of services: "Relevant section isolated at the nearest upstream valve. System drained down and confirmed depressurised before any joints are broken. Any glycol-based antifreeze captured and disposed of per site waste management procedures."

Testing and commissioning: "System pressurised to 1.5 times working pressure (minimum 3 bar) for two hours. Pressure recorded at start and end. Maximum permissible drop: 0.1 bar. Commissioning certificate issued on completion."

Why Method Statements Get Rejected

The most common reasons:

• Too generic — copy-pasted from a template with no site-specific detail. If it could apply to any site in the country, it is not specific enough.
• Missing the sequence — listing controls without describing order of operations. A method statement is a method. Beginning, middle, end.
• No emergency procedures — include the site address, nearest A&E with postcode, and the incident reporting procedure.
• Unsigned — many PCs will not accept without a signature from the person responsible and evidence that operatives have been briefed.

If you are spending hours on RAMS documents and still getting them knocked back, it might be worth looking at whether a dedicated RAMS generator beats templates for your workflow.

Tips for First-Time Acceptance

1. Read the PC's requirements first. Some principal contractors have specific formats or cover sheets. Ask before you write.
2. Be specific about your site. Name the address. Reference floor levels, room numbers, grid references.
3. Include sketches. A drawing of scaffold tie positions or cable routes beats a paragraph of text.
4. Brief your team and record it. A toolbox talk record with signatures shows the method statement is a working document, not a filing exercise.
5. Version control. If the scope changes, reissue with a new revision number.

Writing method statements that reflect the actual job is not glamorous, but it is the difference between starting on time and waiting days for resubmission approval. If you build RAMS packages regularly, TradeRAMS generates trade-specific, site-specific documents without the blank-page problem. We are taking names for the waitlist ahead of launch.

What COSHH Actually Is

COSHH stands for the Control of Substances Hazardous to Health Regulations 2002. It's a specific set of regulations (separate from the general risk assessment duties under MHSWR 1999) that requires employers and the self-employed to assess and control exposure to hazardous substances at work.

"Hazardous substance" doesn't just mean chemicals in labelled containers. It covers dusts, fumes, vapours, mists, gases, and biological agents. If a substance can damage your health through inhalation, skin contact, ingestion, or absorption, COSHH applies.

The penalty for getting this wrong isn't theoretical. HSE inspectors routinely check COSHH assessments on construction site visits, and fines for health and safety breaches keep climbing. More importantly, the substances covered by COSHH are responsible for thousands of occupational disease cases every year in UK construction — occupational lung disease and skin disease remain two of the biggest health problems in the industry.

If you need a refresher on how COSHH assessments fit into your wider project documentation, our risk assessment template guide for construction covers the broader picture.

Substances Most Tradespeople Miss

The substances that cause the most harm on construction sites aren't exotic chemicals. They're materials tradespeople work with so routinely they stop thinking about them.

Silica Dust (Respirable Crystalline Silica)

Cutting, grinding, drilling, or chasing concrete, brick, block, sandstone, or engineered stone releases respirable crystalline silica (RCS) dust. Silica dust causes silicosis — irreversible lung scarring — and is a Group 1 carcinogen. The WEL for RCS is just 0.1 mg/m3 (8-hour TWA) per HSE's EH40. That's extremely low. A single uncontrolled cut on a concrete slab can exceed it within minutes. No water suppression or extraction? You're almost certainly overexposing yourself and everyone nearby.

Wood Dust

Hardwood dust is classified as a carcinogen (nasal cancer). The WEL is 3 mg/m3 (8-hour TWA); softwood dust is 5 mg/m3. Machining, sanding, or routing timber without extraction means you need a COSHH assessment and you're probably overexposed. MDF is particularly bad — it releases wood dust and formaldehyde resin, and the fine particles stay airborne far longer than solid timber dust.

Cement and Wet Concrete

Ordinary Portland cement is alkaline enough to cause chemical burns on prolonged skin contact. But the hidden hazard is hexavalent chromium (chromium VI), a sensitiser that causes allergic contact dermatitis. Once you're sensitised, you're sensitised for life. Wet concrete, grout, screed, and render all carry the same risk. If your hands touch cement products without suitable gloves (nitrile, not latex), sort that out today.

Solvent-Based Paints, Adhesives, and Sealants

Any product containing organic solvents — toluene, xylene, white spirit, acetone, MEK — requires a COSHH assessment. These substances cause headaches, dizziness, and respiratory irritation at low concentrations, and liver and kidney damage at higher levels. Many have specific WELs listed in EH40.

The Safety Data Sheet (SDS) for each product tells you what solvents are present, at what concentration, and what controls are needed. If you don't have the SDS, you can't do a COSHH assessment.

Lead

If you work on buildings constructed before the 1960s, you will encounter lead — paint, pipes, flashing. Sanding, scraping, or burning lead paint generates lead fumes and dust. The WEL for lead is 0.15 mg/m3 (8-hour TWA), and there are additional requirements under the Control of Lead at Work Regulations 2002 including biological monitoring for workers with significant exposure. Lead exposure is cumulative and the damage builds over years.

Isocyanates

If you work with spray foam insulation, two-pack paints, or certain polyurethane adhesives, you're exposed to isocyanates. These are potent respiratory sensitisers — once sensitised, even trace amounts trigger asthma attacks. Workers using these products must have adequate RPE (typically supplied air for spray applications), health surveillance, and proper COSHH assessments.

A Note on Asbestos

Asbestos isn't covered by COSHH — it has its own regulations (the Control of Asbestos Regulations 2012). But tradespeople frequently confuse the two. Asbestos work falls into three categories: licensed work (highest risk, requires an HSE licence), notifiable non-licensed work (NNLW, must be notified to HSE), and non-licensed work (no notification but still requires controls). If you're working on any pre-2000 building, you need to know where the asbestos is before you start.

What a COSHH Assessment Must Contain

HSE's guidance document INDG136 ("Working with substances hazardous to health") sets out 8 steps for a COSHH assessment:

1. Assess the risks — identify hazardous substances present and who's exposed
2. Decide what precautions are needed — eliminate, substitute, or reduce exposure
3. Prevent or control exposure — hierarchy of control: elimination > substitution > engineering controls > admin controls > PPE
4. Ensure controls are used and maintained — LEV needs testing every 14 months, RPE needs fit-testing
5. Monitor exposure — air monitoring for substances like silica, lead, isocyanates
6. Health surveillance — legally required for silica, lead, isocyanates, wood dust
7. Emergency procedures — spills, overexposure, first aid
8. Information, training, supervision — workers must know the hazards and controls

This isn't a tick-box exercise. It needs to reflect what actually happens on your site with the specific products you use.

Where to Find Safety Data Sheets

You cannot complete a COSHH assessment without the Safety Data Sheet (SDS) for each product. SDSs follow a standardised 16-section format under REACH and contain the hazard data, exposure limits, and controls you need. Get them from manufacturer websites, supplier product pages (Travis Perkins, Jewson, etc.), or by direct request — suppliers are legally required to provide them. HSE's COSHH Essentials tool is also useful for matching hazards to controls.

You can use our COSHH substance lookup tool to find common construction substances, their hazard classifications, and the control measures that apply.

Common COSHH Mistakes on Small Sites

On larger sites, the principal contractor enforces compliance. On smaller jobs, standards slip. The most common mistakes:

• No assessment at all. "We've always used it and been fine" is not a COSHH assessment.
• Generic assessments that don't name the actual products or site conditions.
• Relying on PPE alone without considering elimination, substitution, or engineering controls.
• Missing health surveillance for silica, wood dust, isocyanates, or lead — it's a legal requirement, not optional.
• No SDS on site. The assessment is in a filing cabinet at the office and nobody on the ground knows the controls.

Quick Reference: Common Construction Substances

All WELs referenced above are from EH40/2005 (Fourth Edition, 2020) published by HSE. Check the current edition for any updates.

Getting COSHH Right Without Burying Yourself in Paperwork

COSHH assessments aren't difficult once you understand the process. The hard part is doing them consistently for every substance on every job and making sure the people doing the work actually know what the controls are.

That's one of the things TradeRAMS is being built to handle — substance identification for your specific trade activities, with COSHH assessments generated alongside your RAMS so nothing gets missed. If that sounds useful, join the waitlist at traderams.co.uk and you'll get access as soon as it's ready.

Your lungs don't care whether the job was big or small. Assess the substances. Control the exposure. Do it every time.

The short version: if someone's paying you to do work on a construction site, you need RAMS that cover your specific scope.

The Legal Basis: CDM 2015 Regulation 15

CDM 2015 applies to all construction work in the UK, regardless of project size. Regulation 15 sets out the duties of contractors — and that includes subcontractors. You must:

• Plan, manage, and monitor your own work so it's carried out without risk to health and safety (so far as is reasonably practicable)
• Not start work on site unless you're satisfied that appropriate welfare facilities are in place
• Provide information and instruction to your workers, including site induction where needed

Nowhere in the regulations does it say "unless the principal contractor has done a RAMS for you." The principal contractor has their own coordination obligations, but that doesn't replace your responsibility to assess the risks of your own trade activities.

Separately, Regulation 3 of the MHSWR 1999 requires every employer and self-employed person to carry out a suitable and sufficient risk assessment. This applies whether you're on a massive commercial build or fitting a kitchen in a semi-detached.

When You Definitely Need Your Own RAMS

There's no grey area in these situations:

• The principal contractor asks for them. On any notifiable project (more than 30 working days with 20+ workers, or exceeding 500 person-days), the principal contractor will require your RAMS before you set foot on site. Many won't issue a site pass without them.
• You're working on a multi-contractor site. If there's more than one contractor, a principal contractor must be appointed under CDM 2015. They need your RAMS to coordinate work and make sure one trade's activities don't create risks for another.
• Your trade involves specific hazards. Working at height, hot works, confined spaces, electrical work, asbestos, demolition — if your scope involves any of these, your risk assessment needs to address them in detail. Generic site-level RAMS won't cover the specifics of what you're doing.
• You employ or supervise others. If you have even one labourer or apprentice working with you, you have employer duties. RAMS are how you demonstrate you've thought about the risks they'll face.

For a deeper look at what goes into a solid risk assessment, have a read of our risk assessment template guide for construction.

When You Might Rely on the Principal Contractor's RAMS

There are limited situations where you might not produce a full standalone RAMS document:

• Very small domestic jobs where you're the only contractor — fitting a bathroom, rewiring a house. There's no principal contractor, no construction phase plan required, and the scale is small.

But even here, you still need a risk assessment under MHSWR 1999 Regulation 3. You can't just wing it. On a small domestic job, your risk assessment might be simpler than a full method statement with permit-to-work references — but it still needs to exist.

Even on small jobs, having proper RAMS puts you ahead. If a client asks and you can hand something over in five minutes, that's the difference between getting the job and getting passed over.

What Happens If You Don't Have RAMS

Turning up to site without RAMS isn't just embarrassing — it has real consequences:

• Denied site access. The principal contractor can (and regularly does) turn you away at the gate if your paperwork isn't in order. That's a wasted day and a dent in your reputation.
• Contract termination. Many subcontract agreements require CDM 2015 compliance. No RAMS means you're in breach, and the main contractor can terminate your appointment.
• HSE enforcement action. If the Health and Safety Executive finds subcontractors working without risk assessments, they can issue improvement notices, prohibition notices, or prosecute. Fines aren't capped in the Crown Court and are assessed against turnover — not profit. See our analysis of recent HSE construction fines for specific cases.
• Personal liability. If someone gets hurt and you can't show you assessed the risks and planned the work safely, you're personally exposed. Sole traders and directors have been prosecuted and jailed for this.

None of this is theoretical. The HSE publishes enforcement data regularly, and missing risk assessments are one of the most common findings on site inspections.

What Your RAMS Should Actually Cover

Here's where a lot of subcontractors go wrong: they download a generic template, swap in their company name, and call it done. That gives a false sense of security without actually addressing the risks on your specific job.

Your RAMS need to be site-specific. That means they reflect:

• The actual site conditions (access, ground conditions, proximity to live services, occupied areas)
• The specific tasks you'll be carrying out on this project
• The plant and equipment you'll be using
• How your work interfaces with other trades on site
• The control measures you'll actually put in place — not ones copied from a textbook

If your RAMS read the same for every job, they're not doing their job.

Not sure whether your project triggers formal RAMS requirements? Use our RAMS requirements checker tool to find out in a couple of minutes.

Quick Checklist: What to Include in Subcontractor RAMS

Every RAMS document you produce should cover:

• Project details — site address, client, principal contractor, your contract scope
• Task descriptions — what you're actually doing, step by step
• Hazard identification — what could go wrong at each stage
• Risk ratings — likelihood and severity, before and after controls
• Control measures — specific actions to reduce each risk (PPE is the last resort, not the first line of defence)
• Emergency procedures — what to do if things go sideways, who to contact
• COSHH assessments — if you're using any hazardous substances (adhesives, solvents, dust-generating materials)
• Permit-to-work requirements — hot works, confined space entry, electrical isolation
• Signatures and dates — who prepared it, who reviewed it, when it was last updated
• Communication record — evidence your workers have read and understood the RAMS

Getting Your RAMS Sorted Without the Headache

Writing RAMS from scratch for every job is tedious. Copying and pasting from old documents means details from a different site end up baked into your current paperwork. Neither option is great.

That's exactly the problem TradeRAMS is built to solve — a RAMS generator for UK tradespeople. You answer questions about your actual job, and it produces site-specific, CDM-compliant documents you can hand over with confidence.

We're opening access to tradespeople in stages. Join the TradeRAMS waitlist at traderams.co.uk and you'll be first in line when it goes live.

Your RAMS are your responsibility. Might as well make them easy to get right.

There are really only three routes: write it yourself from a blank page, grab a template, or use a RAMS generator tool. Each has genuine trade-offs, and the right choice depends on how often you need RAMS and how much time you can spend on paperwork.

Option 1: Writing RAMS from scratch

This means opening a blank Word document and typing the whole thing out — risk assessments, method statements, control measures, the lot.

What it involves: You write every section yourself — structure, wording, hazard identification, control measures — referencing HSE guidance and CDM 2015 requirements as you go.

Who it suits: Tradespeople doing complex work where every job is genuinely unique — demolition specialists, for example, or firms doing structural alterations where a generic approach would be dangerous.

Genuine pros:

• Total control over every word
• Document is precisely tailored to the site and the work
• No ongoing costs for tools or subscriptions

Genuine cons:

• Takes hours, sometimes a full day for a detailed RAMS pack
• Requires document writing skills most tradespeople didn't get into the trade to use
• Easy to miss hazards, especially on unfamiliar site types
• No built-in version control — you end up with "RAMS_final_v3_FINAL.docx" on your desktop

If you only produce RAMS a few times a year, this can work. For most sole traders juggling multiple jobs, the time cost is brutal.

Option 2: Using static RAMS templates

This is the most common starting point. You download a free template from a trade body website, buy a pack online, or use one a mate sent over. You then edit it for each job.

What it involves: You open a pre-written document, fill in your company details, swap out the job description, and adjust the hazard list. In theory, you review every section and tailor it. In practice, most people change the site address and the client name, then send it off.

Who it suits: Tradespeople who need RAMS occasionally and want to keep costs low.

Genuine pros:

• Cheap or free to get started
• Gives you a sensible structure to follow
• Faster than writing from blank
• Good templates cover the key sections (scope of work, hazard identification, control measures, emergency procedures)

Genuine cons:

• Generic by design — a template for "electrical installation" won't know whether your job is a kitchen rewire in a Victorian terrace or a fit-out in a live hospital
• The copy-paste problem: when hazards from a previous job appear in your current RAMS, it shows you haven't actually assessed the risks
• Clients are getting better at spotting template RAMS that haven't been adapted. Rejection means delays
• HSE enforcement has increased, and if an inspector reviews your RAMS after an incident, a generic template with irrelevant hazards is a serious problem
• No automatic updates when regulations change — your template from 2021 stays a 2021 template unless you revise it

Templates are only as good as the effort you put into editing them. A well-adapted template can be perfectly adequate — but "well-adapted" takes nearly as long as writing from scratch, which defeats the purpose.

For a deeper look at what a proper risk assessment template should contain, see our risk assessment template guide.

Option 3: Using a RAMS generator tool

Generator tools ask you questions about your job — trade, site conditions, scope of work — and produce a RAMS document based on your answers. The output is meant to be site-specific without requiring you to write the document yourself.

What it involves: You answer questions or fill in a form. The tool assembles a RAMS document using your inputs combined with a library of hazards, control measures, and method statement content for your trade. You review the output, make edits, and export a PDF.

Who it suits: Sole traders and small firms who produce RAMS regularly — the electrician who needs a fresh RAMS pack for each new site, the roofer who gets asked for documentation weekly.

Genuine pros:

• Much faster than writing from scratch or properly editing a template
• Output is tailored to the specific job, not just your trade in general
• Good generators include hazards you might not have considered for that site type
• Consistent formatting across all your documents
• Easier version control — your documents are stored and retrievable

Genuine cons:

• Costs money (subscriptions or per-document fees)
• You're trusting the tool to get the content right — if the underlying hazard library is poor, your RAMS will be poor
• Some tools produce bloated documents padded with irrelevant content to look thorough
• You still need to review the output. A generator doesn't replace your duty to understand and own your risk assessments

The critical question with any RAMS generator is: does it actually know your trade? A tool that asks whether you're working at height and near live services is more useful than one that dumps every construction hazard into a 40-page document. Not sure what documentation your project actually requires? Our RAMS requirements checker takes two minutes and tells you exactly what you need.

What to look for in any RAMS approach

Whichever route you take, your RAMS needs to pass the same tests:

• Trade-specific hazards — Does it cover actual hazards for your trade, not just generic construction risks? An electrician's RAMS should address isolation procedures, not just "slips and trips."
• Site-specific conditions — Does it reflect this particular site? Working in a hospital is different from a new-build. A basement brings different risks to a rooftop.
• CDM 2015 compliance — Does it align with the Construction (Design and Management) Regulations 2015? This isn't optional for construction work in the UK.
• PDF or shareable output — Can you produce a clean document to send to the client? Contractors want a PDF, not a link to an app they don't use.
• Version control — Can you track which version was sent to which client? When something goes wrong, you need to know exactly which RAMS was in force.
• Your own review — Have you personally read and understood the document? Your name is on it.

The honest verdict

No approach is perfect. Writing from scratch gives you control but costs time most tradespeople don't have. Templates are accessible but breed complacency. Generators save time and improve specificity, but you're paying for the convenience and still need to verify the output.

The single most important thing is site-specificity. A beautifully formatted RAMS that doesn't reflect the actual job is worse than a rough document that does. Clients reject generic RAMS. HSE inspectors see through them. And if someone gets hurt on your site, a RAMS that doesn't match the real conditions offers no protection at all.

We're building TradeRAMS around this problem — a RAMS generator designed for UK trades that asks the right questions and produces documents that actually reflect the site. It's not ready yet, but if you want early access, you can join the waitlist.

Whatever method you choose, the goal is the same: RAMS that are specific enough to be useful, professional enough to be accepted, and accurate enough to keep you and your workers safe.

Construction fatalities and HSE enforcement

Construction accounted for 51 fatal injuries to workers in 2023/24, up from 47 the previous year. That makes it the sector with the most workplace deaths in Britain — 37% of all work-related fatalities — as it has been for decades. Falls from height remain the single biggest killer, responsible for over half of construction deaths.

In 2023/24, HSE completed 248 criminal prosecutions across all sectors with a 92% conviction rate. The regulator also issued over 7,000 enforcement notices, including approximately 1,800 prohibition notices that stopped dangerous work immediately. The average fine per offence has risen sharply since the Sentencing Council guidelines came into effect in February 2016. Before those guidelines, average fines sat around £20,000–£50,000. Seven-figure fines are now routine for larger organisations.

Source: HSE Annual Report and Accounts 2023/24, HSE Workplace fatal injuries in Great Britain 2024

High-profile cases: 2024–2025

Veolia ES (UK) Ltd — £3 million (July 2024)

In October 2019, two demolition operatives were dismantling a decommissioned North Sea gas rig at an onshore facility in Great Yarmouth. A 27-tonne piece of overhanging metal pipework — known as a skirt pile — gave way and struck the mobile elevating work platform (MEWP) they were working from. Both workers fell 12 metres to the ground. Stephen Picken, 62, died at the scene. His colleague Mark Kumar suffered life-changing injuries.

HSE's investigation found that Veolia ES (UK) Limited had not risk-assessed the removal of the skirt pile because it considered the task low risk. There was no cutting plan and no safe system of work in place. Supervision and monitoring at the site were inconsistent.

At Ipswich Crown Court on 22 July 2024, Veolia pleaded guilty to breaching Section 2(1) of the Health and Safety at Work Act and was fined £3 million plus £60,000 in costs — the largest single HSE fine of 2024.

Openreach Ltd — £1.34 million (June 2024)

In October 2020, Openreach engineer Alun Owen, 32, from Bethesda in Gwynedd, was attempting to repair telephone lines running across the River Aber in Abergwyngregyn. The river had burst its banks after heavy rain and was flowing much higher and faster than normal. Owen waded into the water to reach an island in the centre of the river, attempting to throw a new cable across by taping it to a hammer. While crossing a deeper section, he slipped and was swept away by the current.

HSE and North Wales Police found that Openreach had no safe system of work in place for work on or near water. Owen and other engineers working at the same location had received no training, information, or instruction on safe working near water.

At Llandudno Magistrates' Court on 5 June 2024, BT Openreach Limited pleaded guilty to breaching Section 2(1) of the Health and Safety at Work Act and was fined £1.34 million plus £15,858 in costs.

Cambridgeshire County Council — £6 million (April 2025)

Cambridgeshire County Council's Guided Busway opened in 2011. Over the following decade, three people died and multiple others suffered serious injuries in separate incidents at the facility:

• Jennifer Taylor, 81, died at an unlit crossing in November 2015
• Steve Moir, 50, was killed when his bicycle struck a kerb and he fell into the path of a bus
• Kathleen Pitts, 52, lost her life in October 2021

The council did not carry out a risk assessment of the busway until August 2016 — five years after it opened and months after the first death. Even then, the assessment covered only one location and did not examine other areas of the busway system. HSE issued two improvement notices during this period, but the council appealed the enforcement action rather than acting on the concerns.

At Cambridge Crown Court on 16 April 2025, the council pleaded guilty to two offences under Section 3(1) of the Health and Safety at Work Act and was fined £6 million plus £292,460 in costs — the largest HSE fine of 2025.

The common thread: risk assessments that don't do the job

Every case above centres on risk assessments that were either missing, delayed, or disconnected from the actual work:

• Veolia didn't assess a task because they assumed it was low-risk — the assumption killed a man
• Openreach had no safe working procedures for an entire category of work (near water)
• Cambridgeshire delayed assessing known risks for five years, during which three people died

HSE inspectors are not looking for perfect documents. They want evidence that you identified hazards specific to your site, assessed who could be harmed, and put control measures in place that match the work. A proper risk assessment is not a compliance exercise — it is the thing that stops someone getting hurt.

Generic templates downloaded from the internet and edited with a new company name are exactly what falls apart under scrutiny. HSE's published enforcement cases repeatedly reference "generic" assessments as a factor in prosecution decisions.

How HSE calculates fines

The Sentencing Council's definitive guideline for health and safety offences (February 2016) sets the framework courts use:

1. Offence category. The court assesses culpability (how far the defendant fell below the standard) and harm (seriousness and likelihood). Harm categories range from 1 (most serious) to 4. Culpability ranges from low to very high.

2. Starting point by turnover. Guidelines set starting points for micro organisations (under £2M turnover), small (£2M–£10M), medium (£10M–£50M), and large (over £50M). For a large organisation with very high culpability at harm category 1, the starting point is £4 million with a range of £2.6 million to £10 million. For a micro organisation at the same level, the starting point is £250,000.

3. Aggravating and mitigating factors. Previous convictions and cost-cutting push fines up. Early guilty pleas (up to one-third discount) and genuine remedial steps bring them down.

4. Proportionality check. The fine must be proportionate to the organisation's means, but "sufficiently substantial to have a real economic impact."

A sole trader with £100K turnover faces a different starting point than a PLC with £500M turnover — but the proportional impact can be devastating either way. You can estimate your exposure using our HSE fine calculator.

What small firms and sole traders need to know

There is a persistent myth that HSE only goes after large companies. The enforcement data says otherwise. HSE prosecutes small builders, sole-trader electricians, and one-person roofing firms. The Sentencing Council guidelines set fines relative to turnover, so even a micro organisation (under £2M turnover) faces starting points ranging from £1,400 at the lowest category up to £250,000 at the most serious. For a sole trader earning £40K–£60K, even a lower-category fine of several thousand pounds plus costs is a serious blow.

HSE tends to investigate construction firms after:

• A reportable incident. Someone is injured, a RIDDOR report is filed, and HSE finds the risk assessment was missing or inadequate.
• A complaint. Workers or members of the public report concerns. Inspectors follow up.
• A proactive inspection. HSE runs targeted campaigns focused on specific hazards — working at height, asbestos, demolition. If your RAMS are not in order when inspectors arrive, you have a problem.
• Fee for Intervention (FFI). HSE charges £183 per hour (as of April 2025) for time spent on material breaches. This is not a fine — it is an invoice, and it arrives before any prosecution decision.

The threshold for enforcement is not size. Under the Management of Health and Safety at Work Regulations 1999, every employer and every self-employed person whose work could affect others must carry out a suitable and sufficient risk assessment. No exceptions.

How to protect yourself

1. Make risk assessments site-specific. Each site has different hazards. Your assessment needs to reflect the actual conditions, not a generic template.

2. Do the assessment before work starts. The Cambridgeshire case shows timing matters. A risk assessment completed after an incident is evidence against you — and five years of delay cost three lives.

3. Don't assume any task is low-risk. Veolia skipped a risk assessment because they considered a 27-tonne piece of pipework "low risk." That assumption was fatal.

4. Cover every category of work. Openreach had no procedure for an entire type of work activity (near water). If your workers encounter conditions outside your standard scope, you need a system for that.

5. Keep records. If HSE investigates, you need to show what you assessed, when, and what you did about it.

6. Understand your fine exposure. The HSE fine calculator gives you a rough indication based on your organisation size and offence category.

7. Do not treat RAMS as a tick-box exercise. Copying and pasting without thinking is exactly what leads to the failures described in every case above.

The bottom line

HSE construction fines in 2024–2025 show a regulator that actively enforces, targets inadequate risk assessments specifically, and produces fines that genuinely hurt. The pattern in every major prosecution is the same: the risk assessment was either missing, delayed, or did not match the work.

For sole traders and small firms, the fix is straightforward but time-consuming — site-specific risk assessments for every project, before work starts, updated as conditions change. That is exactly the problem TradeRAMS is built to solve: generating RAMS that reflect your actual site, trade, and hazards, in minutes rather than hours. If that sounds useful, join the TradeRAMS waitlist for early access when we launch.

Sources: HSE Annual Report and Accounts 2023/24, HSE Workplace fatal injuries in Great Britain 2024, Sentencing Council definitive guideline for health and safety offences (2016), HSE Press Office — Veolia prosecution, IOSH Magazine — Openreach prosecution, HSE Press Office — Cambridgeshire County Council.

That might get you through the gate on a lenient site. It won't hold up when a principal contractor reads it properly, and it definitely won't help you if HSE turns up after an incident.

This guide covers exactly what UK law requires in a construction risk assessment template, how to write one that reflects your actual work, and where common templates fall short. We've researched the regulations, the enforcement data, and the reasons documents get rejected — so you don't have to piece it together from twenty different HSE pages.

What is a construction risk assessment?

A risk assessment is a structured record of the hazards present in your work, who could be harmed, and what you're doing to control those risks. Under UK law, it isn't optional — it's a specific legal duty.

The legal basis sits in Regulation 3 of the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242). Regulation 3(1) states:

Every employer shall make a suitable and sufficient assessment of the risks to the health and safety of his employees to which they are exposed whilst they are at work.

Regulation 3(1)(b) extends this to risks to people who aren't your employees — members of the public, other contractors on site, clients walking through.

The phrase "suitable and sufficient" is doing heavy lifting here. HSE's own guidance (INDG163, Risk Assessment: A Brief Guide to Controlling Risks in the Workplace) clarifies that this means the assessment must:

• Identify the real hazards present
• Address who might actually be harmed and how
• Evaluate whether existing precautions are enough or whether more needs doing
• Be proportionate to the level of risk

A suitable and sufficient risk assessment for a domestic rewire looks completely different from one for a commercial demolition project. That difference is exactly where generic templates break down. If your work involves hazardous substances, you'll also need separate COSHH assessments alongside your risk assessment — see our COSHH guide for construction for which substances most tradespeople miss.

When do you legally need a risk assessment?

The short answer: always, if you employ anyone or are self-employed and your work could affect others.

Here's the breakdown:

Under the Management of Health and Safety at Work Regulations 1999

• Employers with 5 or more employees must record the significant findings in writing (Regulation 3(6)).
• Employers with fewer than 5 employees still need to carry out the assessment — they're just not required to write it down. In practice, every principal contractor and most clients will demand a written one regardless.
• Self-employed persons must assess risks to others who may be affected by their work (Regulation 3(1)(b) and Section 3(2) of the Health and Safety at Work etc. Act 1974).

Under the Construction (Design and Management) Regulations 2015

CDM 2015 adds specific construction duties on top of the general risk assessment requirement:

The practical effect: if you're a subcontractor on any construction site in the UK, the principal contractor will ask for your risk assessment before you're allowed to start. This isn't bureaucratic box-ticking — it's a legal requirement flowing from Regulations 13 and 15 of CDM 2015.

For more detail on whether subcontractors specifically need their own documents, see our guide on whether subcontractors need their own RAMS.

What must a construction risk assessment contain?

HSE outlines five steps to risk assessment. These aren't suggestions — they form the framework that HSE inspectors use to evaluate whether your assessment is "suitable and sufficient."

The five steps

1. Identify the hazards — What could cause harm? Walk the site (or review the site information provided). Think about the activities you'll carry out, the materials you'll use, and the environment you'll work in.

2. Decide who might be harmed and how — Not just your own workers. Consider other trades on site, visitors, members of the public nearby. Be specific about the type of harm: electric shock, fall from height, musculoskeletal injury from manual handling.

3. Evaluate the risks and decide on precautions — For each hazard, assess how likely harm is and how severe it would be. Then record what control measures you'll use. Apply the hierarchy of control: eliminate, substitute, engineering controls, administrative controls, PPE (in that order of preference).

4. Record your significant findings — Write it down. Who is at risk, what you've decided to do about it. The record should be specific enough that someone else could read it and understand the plan.

5. Review and update — A risk assessment is a living document. Review it when the work changes, when something goes wrong, or at regular intervals. HSE suggests reviewing at least annually for ongoing work, and whenever there's a significant change in the work activity.

Source: HSE INDG163 (rev5), hse.gov.uk/simple-health-safety/risk

What the written record should include

A construction risk assessment that meets legal requirements and will actually be accepted by a principal contractor should include all of the following:

Why generic construction risk assessment templates fail

We researched the reasons RAMS documents get rejected by principal contractors. The same problems come up repeatedly.

1. They're not site-specific

A template that says "working at height — use appropriate PPE" is meaningless. It doesn't describe the specific height, the specific access equipment, or the specific fall protection. A principal contractor reading this learns nothing about how you'll actually work safely on their site.

HSE's enforcement position is clear. Their guidance on risk assessment (INDG163) states the assessment must address the specific hazards of the specific work. An assessment that could apply to any site, for any project, is not "suitable and sufficient" under Regulation 3.

2. Hazards don't match the actual work

A generic electrical risk assessment template might list hazards for industrial three-phase installations when you're doing a domestic consumer unit replacement. Or it might miss hazards entirely — like asbestos exposure in a pre-2000 property, or confined space risks in a plant room.

An electrician working in a residential loft conversion faces different hazards from one doing a commercial fit-out: limited headroom, existing insulation (potential asbestos in older properties), temporary lighting requirements, shared access with other trades in a confined space. A template written for general electrical work won't capture any of this.

3. Risk ratings are arbitrary

Many templates come with pre-filled risk matrices where every hazard is rated "Medium" before controls and "Low" after. If every risk conveniently lands on the same rating, that's a clear sign nobody actually evaluated anything. Principal contractors spot this immediately, and HSE inspectors certainly will.

4. Control measures are vague

"Ensure adequate ventilation" — how? "Use appropriate PPE" — which PPE? "Follow safe working procedures" — whose procedures? Control measures need to be specific enough to be actionable. If a worker reads the risk assessment, they should know exactly what equipment to use, what procedure to follow, and what to do if conditions change.

5. Enforcement consequences are real

The consequences of inadequate risk assessments go beyond rejected paperwork. HSE issued 7,013 enforcement notices in 2023/24, and construction remains the most-inspected sector. Fines for health and safety failures in construction regularly reach six and seven figures. For specific enforcement examples and fine data, see our breakdown of HSE construction fines in 2024-2025.

How to write a site-specific risk assessment: step by step

Here's a practical process for writing a risk assessment that reflects real site conditions. We'll use the example of an electrician carrying out a full rewire on a 1970s semi-detached house.

Step 1: Gather site information

Before writing anything, collect the facts:

• Site address and access arrangements — Where is the property? How do you get in? Is parking available for your van?
• Building details — Age of property (1970s = potential for asbestos in textured coatings, floor tiles, fuse box backing boards), construction type, number of storeys, loft access.
• Existing services — Current electrical installation condition (is there an existing EICR?), gas supply location, water services.
• Other people on site — Will the homeowner be present? Are other trades working simultaneously? Children or pets?
• Client requirements — Has the client or principal contractor specified any particular requirements for documentation format or content?

Use the RAMS requirements checker to see what specific documentation your project may need based on CDM 2015 and the client's requirements.

Step 2: List every task you'll perform

Break the job down into specific activities:

1. Initial survey and isolation of existing circuits
2. Lifting floorboards for cable runs
3. Working in the loft space to run cables
4. Chasing walls for new cable routes
5. Installing new consumer unit
6. First fix — running cables to all positions
7. Second fix — installing sockets, switches, and light fittings
8. Testing and commissioning
9. Reinstatement and making good

Each of these tasks has different hazards, and your risk assessment should address each one.

Step 3: Identify hazards for each task

For our 1970s rewire example:

Lifting floorboards:

• Manual handling injury (repetitive bending, heavy boards)
• Nail puncture wounds
• Damage to hidden services (gas pipes, water pipes under floors)
• Dust inhalation (accumulated dust under floors in a 50-year-old house)

Working in the loft space:

• Working at height (access via loft ladder)
• Limited headroom — head injury risk
• Heat stress (lofts in warm weather)
• Stepping through ceiling between joists
• Exposure to mineral wool insulation (skin and respiratory irritation)
• Potential asbestos in older insulation materials or textured ceiling coatings below

Chasing walls:

• Vibration exposure (HAVS risk from prolonged chaser use)
• Silica dust from cutting masonry
• Noise exposure exceeding 85dB(A) action level
• Hitting hidden cables or pipes

Installing new consumer unit:

• Electrical shock risk during changeover from old to new
• Working in a confined cupboard space
• Isolation verification requirements (GS38 guidance on test equipment)

Step 4: Assess and rate each risk

Use a consistent risk matrix. The standard 5x5 matrix multiplies likelihood (1-5) by severity (1-5):

Risk level thresholds:

• 1-4: Low risk — manage by routine procedures
• 5-9: Medium risk — specific controls required
• 10-15: High risk — immediate action needed, senior management attention
• 16-25: Very high risk — stop work, reassess, consider whether the task can be done differently

For our example — electrical shock during consumer unit changeover:

• Uncontrolled: Likelihood 3 (possible) x Severity 5 (catastrophic) = 15 (High)
• With controls (isolation procedures, lock-off, GS38-compliant test equipment, competent person carrying out the work, safe isolation procedure verified): Likelihood 1 (rare) x Severity 5 (catastrophic) = 5 (Medium)

The severity stays at 5 because electrical shock can still be fatal if controls fail — but the likelihood drops because the controls make contact with live parts extremely unlikely. This is realistic risk rating. If your template shows electrical shock dropping to "Low" after controls, that should raise questions.

Step 5: Specify control measures precisely

Vague control measures are the single most common reason risk assessments get rejected. Compare:

Weak (typical template):

"Ensure safe isolation before working on electrical systems. Use appropriate PPE."

Specific (site-specific):

"Before commencing work on the existing installation, the competent electrician will follow the safe isolation procedure per BS 7671 and HSE GS38. The specific steps are: (1) Identify the circuit at the existing fuse board, (2) Switch off and isolate using the main switch and individual MCBs/fuse carriers, (3) Lock off using a personal lock-off kit with unique key, (4) Prove the voltage tester is working using a known source (proving unit), (5) Test for dead at the point of work, (6) Prove the tester again. Only GS38-compliant test probes with retractable tips will be used. The operative holds a current ECS card (JIB Approved Electrician grade) and has completed safe isolation training within the last 3 years."

The second version tells the principal contractor exactly what will happen. It references specific standards (BS 7671, GS38), describes the actual procedure, and confirms the competence of the person doing the work.

Step 6: Document emergency procedures

Your risk assessment should state:

• First aid provision — Who is the appointed first aider? What first aid kit is on site? For lone working, what's the check-in procedure?
• Emergency contact numbers — Site-specific: nearest A&E (name and address, not just "local hospital"), client contact, your company emergency contact.
• Specific emergency procedures — For electrical work: what to do in case of electric shock (isolate supply, do not touch the casualty until supply confirmed off, call 999). For asbestos discovery: stop work immediately, do not disturb, seal the area, contact the client and a licensed asbestos removal contractor.

Step 7: Get it signed and communicate it

A risk assessment sitting in a filing cabinet is worthless. Every worker covered by the assessment must:

• Read it (or have it read to them, if English isn't their first language)
• Understand the controls
• Sign to confirm they've understood
• Know where to find it on site

Under CDM 2015 Regulation 14, workers have a duty to report unsafe conditions — but they can only do that if they know what the safe conditions are supposed to look like.

Common mistakes that get risk assessments rejected

Based on our research into why principal contractors reject RAMS submissions, here are the recurring issues:

1. Company name changed, nothing else — The fastest way to get rejected. Principal contractors have seen the same template from multiple companies. Some keep a library of previously submitted templates specifically to catch this.

2. Site address missing or wrong — Sounds obvious, but it happens frequently. If the risk assessment doesn't name the specific site, it's not site-specific.

3. Dates don't align — A risk assessment dated six months ago for a project that was only tendered last week. Or a review date that's already passed. Both raise immediate red flags.

4. Hazards that don't match the project scope — Listing "crane operations" when you're a domestic electrician. Or listing "excavation" hazards when you're working on an internal fit-out. It shows the assessment was copied, not written.

5. No COSHH assessments referenced — If your work involves substances hazardous to health (adhesives, sealants, dust, solvents), the risk assessment should reference specific COSHH assessments for those products. Saying "use in a well-ventilated area" without referencing the material safety data sheet isn't sufficient.

6. Missing method statement — A risk assessment identifies hazards and controls. A method statement describes the sequence of work. Many principal contractors require both — this is what "RAMS" means (Risk Assessment and Method Statement). Submitting one without the other often results in a rejection.

7. No evidence of competence — The risk assessment should reference relevant qualifications, training, and experience. For electrical work: ECS card details, BS 7671 certification date, any specialist training (e.g., 18th Edition). For work at height: PASMA or IPAF certification where relevant.

8. Review section left blank — If the review section says "to be reviewed as necessary" with no date, no reviewer named, and no trigger events listed, it signals the document was written once and never looked at again.

Frequently asked questions

Do I need a risk assessment for every job?

Legally, yes — you must assess the risks of every work activity. Under Regulation 3 of the Management of Health and Safety at Work Regulations 1999, this applies to all employers and to self-employed persons whose work could affect others. For routine, low-risk tasks you repeat frequently (like installing a standard socket outlet in a new-build), you can use a generic risk assessment — but it must still be reviewed against site-specific conditions each time. For any non-routine work, or work on sites with particular hazards, you need a site-specific assessment.

Can I use a free risk assessment template I found online?

You can use a template as a starting framework, but you cannot submit it as-is. The assessment must reflect the specific hazards, site conditions, and control measures for your actual project. HSE guidance (INDG163) is explicit that the assessment must address your specific work situation. A template with your name added is not "suitable and sufficient" under the Regulations. Principal contractors reject these regularly because they can tell when a document is generic.

Who is qualified to write a construction risk assessment?

The Regulations require the assessment to be carried out by a "competent person." Under Regulation 7 of the Management of Health and Safety at Work Regulations 1999, a competent person is someone with sufficient training, experience, knowledge, and other qualities to properly carry out the task. For most trades, a skilled tradesperson with health and safety awareness training (like the CITB Site Safety Plus courses) is considered competent to assess the risks of their own trade activities. Complex or high-risk projects may require input from a specialist health and safety consultant.

How often do risk assessments need to be reviewed?

There is no fixed legal frequency. Regulation 3(3) requires you to review and update when there is reason to suspect the assessment is no longer valid, or when there has been a significant change in the work. In practice, HSE recommends reviewing at least annually for ongoing activities. For construction projects, review whenever site conditions change — new trades arriving, weather conditions affecting the work, unexpected hazards discovered (such as asbestos or contaminated ground), or if there's a near-miss or accident.

What's the difference between a risk assessment and a method statement?

A risk assessment identifies hazards, evaluates risks, and specifies control measures. A method statement describes the step-by-step sequence of work, incorporating those control measures into a practical plan. Together they form a RAMS package. Most principal contractors and clients require both. The risk assessment answers "what could go wrong and how do we prevent it?" The method statement answers "how will we actually do the work, safely, in order?"

Can HSE fine me for not having a risk assessment?

Yes. Failure to carry out a suitable and sufficient risk assessment is a breach of Regulation 3 of the Management of Health and Safety at Work Regulations 1999, enforceable under the Health and Safety at Work etc. Act 1974. HSE can issue improvement notices, prohibition notices, or prosecute. For construction specifically, the HSE inspection regime targets risk assessment compliance as a standard check. Fines are set according to the Sentencing Council's Health and Safety Offences guidelines (2016), and even for small organisations, fines for inadequate risk assessments — particularly after an incident — can reach tens of thousands of pounds. For larger companies, fines regularly exceed six figures. See our analysis of recent HSE construction fines for specific cases.

Do subcontractors need separate risk assessments from the principal contractor?

Yes. Under CDM 2015, every contractor (including subcontractors) has duties under Regulation 15 to plan, manage, and monitor their own work. The principal contractor's risk assessment covers site-wide coordination, but each subcontractor must assess the risks specific to their own work activities. We cover this in detail in our guide on whether subcontractors need their own RAMS.

Writing risk assessments that actually work

The whole point of a risk assessment isn't to produce a document. It's to think through the hazards before you get on site and make sure you've got a plan to deal with them. The written record is evidence of that thinking.

If your current process involves downloading a template, changing the company name, and printing it out — you're meeting neither the legal standard nor the practical purpose. The document should reflect the work you're actually going to do, on the site you're actually going to do it, with the equipment you're actually going to use.

That said, writing site-specific risk assessments from scratch for every project is genuinely time-consuming. It's one of the main reasons tradespeople end up reusing generic documents — not because they don't understand the risks, but because formalising that knowledge into a compliant document takes hours.

That's the problem we're building TradeRAMS to solve. Rather than starting from a blank template, you answer guided questions about your trade, your project, and your site conditions — and get a site-specific risk assessment that reflects the actual work. It's not a template with blanks filled in; it's a document built around your answers.

We're currently in development and taking names for the waitlist. If you're a tradesperson who'd rather spend time on tools than on paperwork, join the TradeRAMS waitlist and we'll let you know when it's ready.