How Often Should a Risk Assessment Be Reviewed? 4 Answers
The expected answer is annually, and a great many organisations run on exactly that: a date in the calendar, a document reopened, a signature, a new date twelve months out.
The law does not say annually. It says something more demanding and more useful, which is that review is triggered by events rather than by the passage of time.
An organisation reviewing on a calendar and nothing else will be up to date on paper and out of date in fact for most of the year, because the things that invalidate an assessment do not wait for the anniversary.
Four answers.
1. There is no prescribed interval, and here is what there is instead
Start with the provision, because it is short and specific.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires an assessment to be reviewed where there is reason to suspect that it is no longer valid, or where there has been a significant change in the matters to which it relates, and where the review shows changes are required, to make them.
Two triggers. Neither is a date.
Other instruments follow the same pattern. Article 9 of the Regulatory Reform (Fire Safety) Order 2005 requires review where the assessment is no longer valid or there has been a significant change. Regulation 6 of the COSHH Regulations requires the assessment to be reviewed regularly and forthwith where there is reason to suspect it is no longer valid, where there has been a significant change, or where monitoring results indicate it is necessary.
COSHH is the one that mentions regularity, and even there it sits alongside the event triggers rather than replacing them. HSE's guidance on risk assessment reflects the same approach.
2. What actually counts as a significant change
The practical question, and for an office-based organisation the list is knowable.
The building. A move, a fit-out, new partitions, a change of floor, giving up or taking additional space, or works happening around occupied areas.
The people. A material change in headcount, a restructure, a new team doing something the organisation has not done before, or the departure of people holding named safety roles.
The work. New equipment, a new process, a laboratory or hardware environment, a new service line, or a change in the hours or pattern people work.
The occupancy. An attendance mandate, a shift to or from hot desking, or a change in peak-day density, all of which affect welfare, ventilation and evacuation arithmetic.
The evidence. An incident, a near miss, a pattern of concerns raised, or something found during an inspection or drill. This is the trigger organisations most often miss, because it arrives as an operational matter rather than as a document control matter.
The law. A change in requirements, which in the last two years has included the removal of the five-employee threshold for recording fire risk assessments and the strengthening of the harassment duty.
Any one of those is a review trigger. Most organisations experience several a year and review on none of them.
3. Why annual is a sensible default and not the duty
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The nuance that matters, because the answer is not to abandon the calendar.
A periodic review has real value. It catches the accumulation of small changes that individually cleared no threshold, it gives the assessment an owner and a date, and it is the mechanism most organisations use to evidence the monitoring and review arrangements required under the Management Regulations.
What it cannot do is substitute for the event triggers. An organisation that moved office in March and reviews in November has spent eight months with an assessment describing a building it no longer occupies, and the fact that the review was scheduled does not help.
The workable arrangement is both: a standing periodic review, plus a short list of events that prompt an earlier one, held by somebody who would actually hear about them. In practice that means the person doing safety being told about property, headcount and equipment decisions, which is an organisational arrangement rather than a document one.
Different assessments also justify different rhythms. A display screen assessment under regulation 2 of the Display Screen Equipment Regulations follows the individual and their setup. A fire risk assessment follows the building. A psychosocial assessment follows the way work is organised. Treating them as one annual exercise is why some of them go stale.
4. What a review is, and what to record
The final answer, and it is lighter than people fear.
A review is not a rewrite. It is a deliberate question: is this still accurate, are the controls still in place and still working, and has anything changed that it does not reflect.
Three things make it worthwhile.
Go and look. The most common finding in any review is that the document describes the work as it was designed rather than as it is done. That is established by walking round and asking people, not by reading.
Check the actions. An assessment that identified measures which were never implemented is not an assessment that needs reviewing, it is an action list that needs closing.
Record the outcome, including no change. Date it, note what was considered, and state the conclusion. A review that concluded nothing needed changing is a legitimate and useful record. A review that left no trace is indistinguishable from one that never happened.
HSE's framework for managing health and safety describes the check and act stages this sits inside.
The four, in short
| Question | Common answer | Actual position |
|---|---|---|
| How often | Annually | On the triggers; no interval prescribed |
| What triggers it | A date | Building, people, work, occupancy, evidence, law |
| Is annual wrong | It is the rule | A sensible default that cannot replace triggers |
| What a review is | A rewrite | A question, a walk round, and a dated record |
The second row is where the value is. An organisation that knows its trigger list and has somebody who hears about those events will keep its assessments current with far less effort than one running an annual project.
For international groups
Two considerations, and here the British position is the outlier.
Several jurisdictions do prescribe intervals. Peru requires risk assessment at least annually. Kenya requires an annual audit by a state-approved advisor and a separate annual fire safety audit. Morocco requires an annual prevention programme and report. Colombia requires an annual self-evaluation. Bulgaria requires an annual declaration. Slovakia requires an annual joint assessment by two services.
Some also prescribe who reviews. Where the assessment is reserved to a qualified specialist, as in Hungary, or must be authored by appointed professionals, as in Greece, the review carries the same constraint.
So a group standard saying "review annually" is, unusually, closer to correct abroad than at home, and still insufficient because it addresses the interval and not the triggers. Holding review dates, triggers and outcomes for every entity in one register is where health and safety consultants and software are worth more together than either alone, and periodic health and safety audits are how organisations discover which assessments describe a previous version of themselves.
Where Arinite fits
Arinite keeps assessments describing the organisation as it currently is, which is a different service from producing one and dating it. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with legal, finance and banking and IT and software organisations, where the building, the headcount and the way work is done all change faster than an annual cycle can track.
Where entities sit in several countries, our global health and safety consultants establish which jurisdictions prescribe an interval and who may carry out the review, and our international health and safety consultants keep that current.
If your organisation moved, reorganised or changed its working pattern in the last year and the assessment date predates it, a free gap analysis is the right place to start.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
