Is a health and safety risk assessment a legal requirement in the UK?

Yes. The Management of Health and Safety at Work Regulations 1999 require every employer and most self employed people to assess the risks to their workers and to anyone else affected by their work.

Do I need to write down my risk assessment?

Once you have five or more employees you must record the significant findings and any group of employees especially at risk. Below five it is not a legal requirement to write it down. You still have to do the assessment and writing it down is the only way to prove you did. A fire risk assessment is different. That must be recorded in full whatever your size.

What are the different types of risk assessment?

The general health and safety risk assessment is the starting point. Specific assessments then cover particular hazards such as fire and legionella and asbestos. COSHH for chemicals. DSE for screen work. Manual handling. Noise and vibration. Most workplaces need the general one plus two or three specific ones.

How often should a risk assessment be reviewed?

The law says review it when there is reason to think it is no longer valid or when there has been a significant change. There is no statutory interval. An annual review is sensible practice and costs you an hour. A paid annual reassessment is not required.

How much does a risk assessment cost?

Where someone competent on your team does it, it costs their time. Bought in it is £300 for a small low risk premises and £420 for an office or shop with 5 to 19 people. Higher risk or larger sites run above that. If you are being quoted for a general risk assessment of a low risk office, ask whether anyone on your team is competent to do it first.

Do I need a health and safety policy as well?

If you have five or more employees you must have a written health and safety policy. Below five you must still have a policy but it does not have to be written. The risk assessment and the policy are different documents that reference each other.

What happens if I do not do a risk assessment?

It is a breach of the Regulations. If someone is hurt it is the first thing an HSE inspector or an insurer or a claimant solicitor will ask for. Fines are unlimited. Not having one also makes any other compliance you have bought much harder to defend.

What is a competent person and do I have to appoint one?

The law requires you to have access to competent help with health and safety. For a low risk business that can be you or a manager with training. Without the training it is not competent help and you need to buy some. You do not have to buy a retained consultancy service to satisfy it, whatever the sales call says.

Do landlords need risk assessments?

If a landlord employs people or controls premises where others work, yes. A landlord of commercial premises typically holds the assessments for common parts and the building fabric. Tenants hold them for their own activities.

Buyer guide

Required by law

Do I need a health and safety risk assessment?

Yes. Every employer does. It is the one assessment the law lets a trained person in the business do. When it has to be written down. What it covers. What a consultant should cost and what you should not be sold.

Written by David SmithFounder & Editor, Compliance Buyer

Legal position checked 10 September 2026Updated 10 September 2026

Applies to: England, Wales and Scotland under the 1999 Regulations. Northern Ireland has the same duty under its 2000 Regulations.

This is the starting point for UK workplace compliance. If you are not sure where to begin, start here. Every specific assessment on this site hangs off the general duty explained on this page.

Looking for the technical detail? Read the version for professionals → MHSWR 1999 Regulation 3. The hierarchy of control and how it fits with the other regimes.

Do I need one? Yes. If you employ anyone or your work could put anyone else at risk, the law requires you to assess the risks.

Do I have to write it down? Once you have five or more employees the answer is yes. The significant findings must be recorded by law. Below five there is no duty to write it down. Do it anyway. An assessment you cannot produce is an assessment you cannot prove.

Do I have to pay someone? Not by law for a low risk business. The regulator allows the person who runs it to do this one if they are competent to. Competent means trained, not willing. If nobody on the staff is then pay for it once. Put the rest of the money on the specific assessments that need specialist knowledge.

What the law actually requires

Required by lawThe general duty

The Health and Safety at Work etc. Act 1974 places the duty on every employer. Section 2 covers the health and safety and welfare of employees. Section 3 covers anyone else affected by the business. The test in both is what is reasonably practicable.

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 turns that into a task. Every employer and self employed person must make a suitable and sufficient assessment of the risks arising from the work. That covers risks to employees and to others. Since 2015 a self employed person whose work creates no risk to anyone else is outside the Act.

Required if…Recording: the five employee rule

Regulation 3(6): where you employ five or more people you must record the significant findings of the assessment, and any group of employees identified as being especially at risk.

Below five employees the assessment is still mandatory. Recording it is not. Record it anyway.

Do not confuse this with fire. Since 1 October 2023 a fire risk assessment must be recorded in full whatever your headcount. The five employee threshold survives for the general health and safety assessment. Two different laws and two different rules. Plenty of websites have muddled them.

Required by lawRelated duties that switch on at five employees

A written health and safety policy (Act, section 2(3)).
Recorded arrangements for planning and organising and controlling and monitoring and reviewing your preventive measures (regulation 5).

Optional, often oversoldNot required by law

A consultant for an ordinary low risk workplace, where someone trained is on the staff.
A particular format, template or software.
A fixed review interval.
A certificate, badge or "compliance pack".

Insurers, landlords or clients ask for itInsurers, clients and tenders

Employers' liability insurers can ask to see your assessments after a claim. More of them now ask at renewal. Larger clients and public sector tenders ask for them as a condition of bidding. They usually want a policy and evidence of training as well. Those are contractual conditions with their own wording. Meet the wording and not the sales pitch that grows up around it.

Northern Ireland: the same duties apply under the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, with the same five employee threshold.

What this means for your premises

HSE's own position is that risk assessment is about sensible measures to control real risks and not about paperwork. For a small low risk business the person who runs it can be the right person to do it, provided they are trained for it. That is the regulator telling you not to buy this if you already have the competence in house.

Where it changes is the nature of the work:

Ordinary workplaces such as offices and shops and cafés and small warehouses. The hazards are general. Slips and manual handling. Electricity and fire. Screen work. A trained manager can do it.

Higher risk work such as construction and manufacturing and chemicals and working at height. The general assessment is still yours. The specific assessments need someone who knows the hazard. The consequences of getting it wrong are serious enough to pay for that.

Specialist assessments such as fire and legionella and asbestos and COSHH. Each has its own page on this site and its own rules on who should do it. This page is about the general one that sits above them.

Your options

Option A: do it yourself, only if you are competent

Regulation 7 of the Management Regulations says you must have competent help. For a low risk business that help can be you or someone who works for you. HSE expects it and provides the template. Walk the workplace with the people who do the work. Identify the hazards and who could be harmed and how. Note what you already do about it and what more you should do. Name who will do it and by when. Write it down. Sign it and date it. Review it when something changes and once a year regardless.

What competent means here. You understand what the law asks of an employer and what the significant hazards in your kind of work are. You can tell a hazard from a risk and judge how likely and how serious each one is. You know the specific rules that touch your work well enough to know when one applies. Manual handling. Display screens. COSHH. Work at height. You have had training, which means a short course or a recognised certificate or real experience of managing safety in this kind of workplace. You can show an inspector why each control you chose is enough. If you would struggle with any of those for your workplace then you are not competent for it yet.

Who it fits: low risk offices, shops and similar premises where the person doing it has the training or experience above and knows the work.

Cost: half a day, once, then an hour a year.

The risk if you get it wrong. A generic assessment downloaded from somewhere that does not describe your workplace is not suitable and sufficient and an inspector will say so. After an accident the assessment is the first thing examined. Where it missed the hazard that hurt someone, the question becomes why the person who wrote it thought they were able to. That is where improvement notices, fee for intervention at £174 an hour and civil claims start.

Option B: a consultant for the general assessment

A competent consultant visits and assesses and writes it up with an action plan. That is the right call where nobody on the staff is trained to do it. It is sensible where the work is higher risk. It is sensible after an incident or an enforcement visit. It is sensible where a client or tender demands outside input. And it is sensible where nobody in the business is willing to own it.

What to look for: a NEBOSH General Certificate as a minimum for general work. Chartered IOSH membership or OSHCR registration for higher risk or specialist work. Evidence of experience in your sector. A report that describes your workplace rather than a template with your name typed in.

Cost: £300 for a small ordinary premises and £420 for 5 to 19 people. Larger or higher risk sites run above that.

What most small businesses should actually do

Option A for the general assessment if someone on the staff is trained to do it. If not, Option B once and your own review every year after. Spend the money you save on the specific assessments that need expertise: fire and depending on the building legionella and asbestos.

How often

Review it when there is a significant change. New equipment or a new process. New premises or more people. An accident or a near miss. A change in the law. Otherwise once a year by you and it takes about an hour. There is no legal requirement for an annual paid reassessment. Being sold one for a low risk workplace is the oldest trick in this market.

What it should cost

Where someone on your team is competent to do it, it costs their time. Where it is bought in: £300 for a small low risk premises and £420 for an office or shop with 5 to 19 people. Higher risk work: £350 for the smallest and £490 for 5 to 19 people. Larger or hazardous sites run well above that. A retained "competent person" or advice line contract is a separate product with a separate price. It is not required by law however it is described on the call.

Figures are typical prices taken from published commercial price guides and checked October 2026. Same method on every page. Larger or more complex premises sit above them.

What you shouldn’t be sold

"You need a consultant to do your risk assessment." For an ordinary workplace with a trained person on the staff you do not. The regulator says so. Without one, pay for it once.
The "competent person" service as a legal necessity. The law requires access to competent help. For a low risk business that can be you or a trained manager. A retained consultancy is a choice, not a requirement.
A pack of generic template assessments. Forty documents that do not describe your workplace are worth less than one that does.
Annual paid reassessment. The annual job is your own review. A paid reassessment is for when something significant has changed.
An advice line on a three or five year term. Work out how many times you will actually call it, then price the contract per call. Then read the notice clause.
A "certificate of compliance". There is no such document. The assessment and the policy are the documents.

Check what else your business needs

This general assessment tells you which specific assessments you need. The ones almost every premises needs are fire risk assessment and where there is a water system legionella. Run the Compliance Check to see the full list for your kind of business.

Quick answers

Is a health and safety risk assessment a legal requirement in the UK?: Yes. The Management of Health and Safety at Work Regulations 1999 require every employer and most self employed people to assess the risks to their workers and to anyone else affected by their work.
Do I need to write down my risk assessment?: Once you have five or more employees you must record the significant findings and any group of employees especially at risk. Below five it is not a legal requirement to write it down. You still have to do the assessment and writing it down is the only way to prove you did. A fire risk assessment is different. That must be recorded in full whatever your size.
Can I do a risk assessment myself?: Only if you are competent, which means trained. HSE allows the person who runs a low risk business to do it and provides the template. Trained means a short course or a recognised certificate or real experience of managing safety in this kind of work. If nobody on the staff has that, pay a consultant once and review it yourself every year. Higher risk or specialist work needs a consultant regardless.
What are the different types of risk assessment?: The general health and safety risk assessment is the starting point. Specific assessments then cover particular hazards such as fire and legionella and asbestos. COSHH for chemicals. DSE for screen work. Manual handling. Noise and vibration. Most workplaces need the general one plus two or three specific ones.
How often should a risk assessment be reviewed?: The law says review it when there is reason to think it is no longer valid or when there has been a significant change. There is no statutory interval. An annual review is sensible practice and costs you an hour. A paid annual reassessment is not required.
How much does a risk assessment cost?: Where someone competent on your team does it, it costs their time. Bought in it is £300 for a small low risk premises and £420 for an office or shop with 5 to 19 people. Higher risk or larger sites run above that. If you are being quoted for a general risk assessment of a low risk office, ask whether anyone on your team is competent to do it first.
Do I need a health and safety policy as well?: If you have five or more employees you must have a written health and safety policy. Below five you must still have a policy but it does not have to be written. The risk assessment and the policy are different documents that reference each other.
What happens if I do not do a risk assessment?: It is a breach of the Regulations. If someone is hurt it is the first thing an HSE inspector or an insurer or a claimant solicitor will ask for. Fines are unlimited. Not having one also makes any other compliance you have bought much harder to defend.
What is a competent person and do I have to appoint one?: The law requires you to have access to competent help with health and safety. For a low risk business that can be you or a manager with training. Without the training it is not competent help and you need to buy some. You do not have to buy a retained consultancy service to satisfy it, whatever the sales call says.
Do landlords need risk assessments?: If a landlord employs people or controls premises where others work, yes. A landlord of commercial premises typically holds the assessments for common parts and the building fabric. Tenants hold them for their own activities.

Find and check

Who can I use for this?

We do not recommend suppliers. Here is the official register and what to check before you book.

The register

OSHCR Register Consultants who meet a recognised competence standard.
IOSH membership check Chartered status is CMIOSH.

Check

OSHCR registration or IOSH chartered status for anything beyond a low risk workplace.
Experience in your sector. Ask for two businesses like yours.
Insurance in date.

Ask

For a workplace like mine, do I need you at all? HSE says most low risk businesses can do this themselves.
Will the report describe my workplace or is it a template?
What will you charge for the document and what will you charge for a retainer? Keep them separate.

Insist on

A report that names your premises and your actual activities.
No retained advice line unless you have decided you want one and priced it per call.
Annual terms at most if you take any ongoing service.

How do I find and check a health and safety consultant near me?

General information about UK compliance, written for the person paying the bill. Not legal advice. If your situation is unusual, get a professional to look at it. See our editorial standards.