Office Risk Assessment: The Complete UK Guide for 2026

he office is the workplace most UK businesses underestimate. Construction sites, manufacturing plants, and warehouses look obviously hazardous, so they get serious risk assessment attention. Offices look benign, so they often do not. The result is that office-based businesses are some of the worst served by their own health and safety arrangements. Generic risk assessment templates downloaded from the internet sit unchanged for years. Display screen equipment assessments cover the people who were in the office in 2019. Mental health, hybrid working, and new and expectant mothers receive no specific assessment at all.

This guide explains what a proper office risk assessment actually covers, what UK law requires, the ten hazard areas every office assessment should include, and where most office assessments fall short. It is written for office managers, HR managers, facilities managers, and anyone responsible for health and safety in a UK office environment.

The starting point is the law. Under the Management of Health and Safety at Work Regulations 1999, every UK employer is required to carry out a suitable and sufficient risk assessment. Where five or more people are employed, the significant findings must be recorded in writing. This duty applies to offices in exactly the same way as it applies to any other workplace. There is no office exemption.

What an office risk assessment actually is

A risk assessment is a structured examination of what could harm people at work, who might be harmed, and what controls are in place or required to prevent that harm. For an office, the assessment must reflect the actual office, the actual work being done, and the actual people doing it. A generic template that could have been written about any office is not compliant with the regulations because it does not reflect the workplace.

The risk assessment is the foundation document for everything else in office health and safety. The fire risk assessment sits alongside it. The DSE assessments build on it. The mental health and wellbeing arrangements draw on it. Training programmes, policies, and audits all reference back to the risk assessment as the underlying picture of what could go wrong in the workplace and what is being done about it.

Most office risk assessments fail at the first hurdle: they are generic. They identify "slips, trips and falls" and "fire" without explaining what the specific slips, trips, falls, or fire risks are in this office. The HSE's published guidance on risk assessment is explicit that the assessment must be specific to the workplace, not a template tick-box.

Who needs an office risk assessment

If you employ anyone in an office environment, you need an office risk assessment. The legal duty is absolute. There is no minimum business size exemption from the duty itself, although the requirement to write down significant findings only applies to employers with five or more employees.

The duty extends to:

Office-based employees, including hybrid and home-working employees for work activities under your control
Self-employed people working in your office
Agency staff, contractors, and temporary workers in your office
Visitors to the office
Cleaners, maintenance staff, and out-of-hours workers
New and expectant mothers, where additional duties apply under Regulation 16 of the 1999 Regulations
Young workers under 18, where additional duties apply

The responsible person is the employer. In practice the duty is usually delegated to a manager or to an external competent person, but the legal duty stays with the employer regardless of who actually does the work.

The 5 steps of an office risk assessment

The HSE describes risk assessment as a five-step process. Every office risk assessment should follow this structure.

Step 1: Identify the hazards. Walk the office. Talk to the people who work there. Look at accident and near-miss records. Check what manufacturers and suppliers say about equipment. List everything that could realistically cause harm.

Step 2: Decide who might be harmed and how. For each hazard, identify the groups exposed (employees, visitors, cleaners, contractors, pregnant workers, young workers, lone workers) and how they could be harmed. The "how" is what generic assessments leave out.

Step 3: Evaluate the risks and decide on control measures. For each hazard, assess the likelihood and severity, identify the controls already in place, and decide whether further controls are needed. Apply the hierarchy of control: eliminate where possible, substitute, engineer out, administrative controls (procedures, training), and personal protective equipment only as a last resort.

Step 4: Record findings and implement them. Document the assessment. Assign each action to a named person with a deadline. Communicate the findings to the workforce. Verify that controls are actually in place, not just written down.

Step 5: Review the assessment and update if necessary. A risk assessment is not a one-off exercise. It must be reviewed when no longer valid, after a significant change, after an incident or near-miss, or when new equipment, processes, or people are introduced. Most offices adopt an annual review cycle as good practice.

The 10 hazard areas every office risk assessment must cover

A proper office risk assessment addresses ten distinct hazard areas. Some are obvious. Several are routinely missed.

1. Display screen equipment (DSE)

DSE is the most common office hazard and the most frequently mismanaged. The Health and Safety (Display Screen Equipment) Regulations 1992 require employers to assess DSE workstations, provide eye and eyesight tests on request, and ensure workstations meet specified minimum requirements. The assessment must consider the screen, keyboard, mouse, chair, desk, lighting, posture, and the duration and pattern of use. Individual workstation DSE assessments are needed for each user, not a single office-wide assessment. Hybrid and home workers require home workstation assessments separately. This is the single most common gap in UK office risk assessment arrangements.

2. Slips, trips and falls

The most common cause of office injury reported under RIDDOR. Specific hazards in an office context include trailing cables, uneven flooring, wet floors after cleaning, items left in walkways, poor lighting in stairwells, inappropriate footwear at social events held in the office, and inadequate maintenance of mats and floor finishes. A proper assessment identifies the specific risks in this office rather than just naming the category.

3. Fire safety

Fire requires a separate fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005. The office risk assessment should cross-reference the fire risk assessment, confirm the responsible person, summarise the evacuation procedure, and identify any office-specific fire hazards (cooking facilities, storage of paper and packaging, fire door propping, the absence or presence of sprinklers). The two assessments work together; neither replaces the other. For a deeper look at what a proper fire risk assessment includes, see our guide on how much a fire risk assessment costs in the UK.

4. Electrical safety

Office electrical hazards include damaged or overloaded socket strips, daisy-chained extension leads, unsafe modifications to fixed wiring, portable appliances (kettles, microwaves, heaters, fans, monitors, laptops) without testing, and the use of personal devices on office sockets. The Electricity at Work Regulations 1989 require electrical systems to be maintained so as to prevent danger. Portable Appliance Testing (PAT) is the most common evidence of this, although the HSE position is that PAT frequency should be risk-based rather than annual by default.

5. Manual handling

Often dismissed as irrelevant in offices. Wrong. Office manual handling risks include moving boxes of paper, lifting laptops and monitors, moving furniture, unpacking deliveries, moving promotional materials, and setting up events. The Manual Handling Operations Regulations 1992 apply to any manual handling that could cause injury, regardless of how mundane the activity looks. The assessment should identify the manual handling activities that actually happen in the office and decide what controls (training, equipment, procedures) apply.

6. Stress and mental health

Stress, depression and anxiety are now the single largest cause of UK work-related ill health, according to HSE statistics. The duty to assess work-related stress as part of the general risk assessment is well established. The HSE Management Standards for work-related stress identify six areas: demands, control, support, relationships, role, and change. A proper office risk assessment includes a stress and mental health section that addresses these six areas, not just a one-line mention.

7. Lone working

Office lone working risks include early arrivers, late leavers, weekend workers, evening cleaners, security staff, and home workers. The HSE guidance on lone working sets out the employer duties. The office risk assessment should identify who works alone, when, what risks they face, and what arrangements are in place (sign-in/out, communication, emergency procedures, welfare checks).

8. Hybrid and home working

Since 2020, hybrid working has become standard in most UK offices. The risk assessment duty applies to home and hybrid arrangements in exactly the same way as it applies to the office. Many office risk assessments have not been updated to reflect this, which is one of the largest compliance gaps in UK office health and safety today. The assessment must cover home DSE, home electrical safety, home lone working, home mental health and isolation, and the boundary between work and personal life. Templates designed for office-only arrangements are no longer compliant for businesses operating hybrid policies.

9. New and expectant mothers, and young workers

Where new and expectant mothers are employed, the 1999 Regulations require a specific assessment of any risks to them or to the unborn child. This is a separate assessment, not a generic clause in the main risk assessment. Common office hazards for new and expectant mothers include prolonged sitting, manual handling, stress, exposure to certain chemicals (cleaning products, photocopier toner), and standing for long periods at events or in meetings. Where young workers under 18 are employed, including interns and apprentices, additional duties apply under Regulation 19 of the 1999 Regulations.

10. Workplace welfare and environment

The Workplace (Health, Safety and Welfare) Regulations 1992 cover temperature, ventilation, lighting, cleanliness, room dimensions, workstations, floors and traffic routes, washing facilities, drinking water, rest facilities, and the workplace itself. Modern issues that the assessment should also address include indoor air quality (particularly relevant since 2020), workplace temperature during heatwaves (no maximum is set in law but a meaningful approach is expected), and the welfare provision for hybrid teams. These are not glamorous, but they are part of the legal duty.

Areas adjacent to the risk assessment that office employers commonly miss

Beyond the ten hazard areas, a proper office health and safety programme also covers areas that sit alongside the risk assessment rather than inside it:

Workplace sexual harassment. Under the Worker Protection (Amendment of Equality Act 2010) Act 2023, in force from October 2024, employers have a preventative duty to take reasonable steps to prevent sexual harassment in the workplace. This is enforced by the Equality and Human Rights Commission. The duty is distinct from the risk assessment but the two should reference each other.
First aid provision. The Health and Safety (First-Aid) Regulations 1981 require employers to provide adequate first aid arrangements. The number of qualified first aiders, the equipment, and the procedures should be set following a first aid needs assessment.
Asbestos. Where the office occupies a building constructed before 2000, the Control of Asbestos Regulations 2012 require a register of any asbestos-containing materials and arrangements to manage them. The duty often sits with the landlord, but the office occupier must understand the arrangements and any restrictions.
Legionella. Buildings with water systems including showers, hot tubs, or cooling towers need a legionella risk assessment. Most offices fall outside this requirement, but those with showers do not.

Common gaps in UK office risk assessments

Across thousands of office assessments, the same gaps repeat:

A generic template downloaded from the internet with the company name pasted in and no actual walk-through. These do not meet the legal test of being "suitable and sufficient".

DSE assessments not done individually by user, or only done at induction and never refreshed. Hybrid arrangements have made this worse, not better.

Stress and mental health treated as a one-line mention rather than a structured assessment against the HSE Management Standards.

Hybrid and home working ignored entirely because the risk assessment was written when the office was the only place work happened.

No new and expectant mothers assessment in place until someone announces a pregnancy, at which point arrangements are scrambled together.

No review schedule, so the document gradually drifts out of date and no one knows when it was last refreshed.

No record of training or communication, so even where good controls exist, there is no evidence that the workforce knows about them.

The most efficient way to identify which of these gaps your office has is a health and safety audit that includes a risk assessment review against the actual workplace and the current legal framework.

How often an office risk assessment should be reviewed

The 1999 Regulations require the assessment to be reviewed if no longer valid or where there has been a significant change. Most offices benefit from a structured annual review as good practice, plus an immediate review whenever any of the following happens:

Office move, refurbishment, or significant layout change
Material change in the workforce, including the introduction of hybrid working
New equipment or technology introduced
Incident, accident, or near-miss
Pregnancy notification or new young worker starting
Change in the law (such as the introduction of the Worker Protection Act 2023)
HSE visit or insurance audit raising any concerns
Change in occupancy of the building or in neighbouring tenants

The annual cycle is good practice; the trigger-based review is the legal requirement. Both are needed.

When to bring in a Chartered consultant

Plenty of UK offices manage their risk assessment in house with a competent manager and good supporting templates. Others find that the complexity outgrows internal capacity. Arinite's Chartered consultants typically add value to office clients in four situations:

The business has grown beyond a single office or a single country, and the same standard of risk assessment needs to be evidenced consistently across every site.

The business has just moved office or restructured, and a fresh assessment from someone external is more efficient than rebuilding internal capability from scratch.

The business is pursuing an accreditation such as ISO 45001 or a tender requirement that demands documented health and safety management, and the existing risk assessment will not pass scrutiny.

The business has received an HSE improvement notice or insurance challenge, and needs the position evidenced quickly and to a defendable standard.

Arinite works with 1,500+ businesses across 50+ countries, with a heavy weighting towards London-based and international office-based professional services firms. 100,000+ Employees Protected. ISO 45001:2018 certified. 15+ years of practice.

The fastest way to understand your position is a 30-minute Free Gap Analysis Call. A structured review of your current arrangements, the gaps that matter most, and what to do about them. No commitment.

Book My Free Gap Analysis Call or call +44 (0)20 7947 9581.

Frequently asked questions

Is an office risk assessment a legal requirement? Yes. Every UK employer must carry out a suitable and sufficient risk assessment under the Management of Health and Safety at Work Regulations 1999. Where five or more people are employed, the significant findings must be recorded in writing. The duty applies to offices in exactly the same way as it applies to any other workplace.

Who is responsible for the office risk assessment? The employer. In practice the work is usually delegated to a manager or to an external competent person, but the legal duty stays with the employer. For multi-tenant office buildings, common parts are the responsibility of the landlord and the demised office areas are the responsibility of the occupier.

How often should an office risk assessment be reviewed? The Regulations require review when the assessment is no longer valid or where there has been a significant change. Most offices adopt an annual review cycle plus trigger-based reviews after specific events (office moves, new equipment, incidents, pregnancy notifications, legal changes). Both routines are important.

What is the difference between an office risk assessment and a fire risk assessment? The office risk assessment is a general assessment of all workplace risks under the 1999 Regulations. The fire risk assessment is a specific assessment of fire risks under the Regulatory Reform (Fire Safety) Order 2005. They are separate legal duties and require separate documents, although they should reference each other.

Do hybrid and home workers need a separate risk assessment? The same risk assessment duty applies, but the home environment introduces specific risks (home DSE, home electrical, home lone working) that need to be addressed. Most offices that adopted hybrid working since 2020 have not updated their risk assessments to reflect the new arrangements, which is one of the largest compliance gaps in UK office health and safety today.

What is a suitable and sufficient risk assessment? The legal test is that the assessment must be appropriate to the nature of the work, identify all significant risks, and reflect the actual workplace. A generic template downloaded from the internet with the company name pasted in does not meet this test. The assessment must be specific to your office, your workforce, and your work activities.

Can I do my own office risk assessment? Yes, provided you are competent to do so. For most office environments, an in-house manager with appropriate training can produce a compliant assessment with the right framework. Competence is the legal test: training, experience, and knowledge of the workplace. Where the in-house position cannot reach that standard, an external Chartered consultant is the most efficient route.

What happens if I do not have an office risk assessment? Failure to comply with the 1999 Regulations is a criminal offence. Penalties depend on severity, harm caused, and the size of the organisation. HSE prosecutions for risk assessment failures can result in unlimited fines and, in serious cases involving death or serious injury, imprisonment of duty holders. Insurance cover may also be voided if a current risk assessment is not in place.