Risk Assessment Services | UK and Global Businesses

Risk assessment is the cornerstone of all health and safety management. It is not an optional exercise that businesses choose to undertake when they feel ready — it is a legal requirement under Regulation 3 of the Management of Health and Safety at Work Regulations 1999 that applies to every UK employer from the moment they take on staff. For businesses operating internationally, equivalent obligations apply in every jurisdiction where employees work. Inadequate risk assessments are consistently among the most frequently identified findings in HSE enforcement action, with the HSE securing over £33 million in fines in 2024/25 alone. Professional risk assessment services provide the expertise, methodology, and documentation that transforms a legal obligation into genuine worker protection and organisational resilience. This guide covers 12 essential things every business needs to know.

Why Professional Risk Assessment Services Deliver More Than Compliance

Many businesses approach risk assessment as a documentation exercise — producing the required paperwork while treating the actual process as a box-ticking formality. This misunderstands both what risk assessment is and what it achieves when done well.

A risk assessment conducted by a qualified professional provides far more than a compliant document. It provides a systematic, evidence-based understanding of where harm can occur in a business's operations, what controls genuinely reduce that risk, and whether those controls are working in practice. The gap between these two approaches — documentation compliance versus genuine risk identification — is precisely where workplace injuries and enforcement action occur.

The Health and Safety at Work Act 1974 requires employers to ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees. Risk assessment is the mechanism through which employers identify what "reasonably practicable" means for their specific operations. Generic templates that could apply equally to any business in any sector cannot satisfy this standard.

Professional risk assessment services — provided by CMIOSH-qualified Health and Safety Consultants — produce assessments that are specific to the actual workplace, reflect the real hazards of the business's activities, and withstand the scrutiny of HSE inspection, civil litigation, and procurement pre-qualification.

1. The Legal Basis: What UK Law Requires

Risk assessment in the UK is anchored in specific legislation that every employer must understand.

Regulation 3 of the Management of Health and Safety at Work Regulations 1999:

Every employer must conduct a suitable and sufficient assessment of the risks to the health and safety of employees and others affected by the undertaking. Where there are five or more employees, the significant findings must be recorded in writing. The risk assessment must be reviewed — it is a living document, not a one-off exercise.

The assessment must be suitable in scope — covering all relevant hazards — and sufficient in depth — providing enough detail to enable appropriate control measures to be identified and implemented.

The specific regulations that create assessment obligations beyond the general duty:

Several specific regulations impose their own assessment requirements, each extending the employer's obligations in targeted directions:

Manual Handling Operations Regulations 1992: Risk assessment of manual handling operations that cannot be avoided
Health and Safety (Display Screen Equipment) Regulations 1992: Workstation assessment for all habitual screen users, including home and hybrid workers
Control of Substances Hazardous to Health Regulations 2002: COSHH assessment for all hazardous substances used or arising from work activities
Regulatory Reform (Fire Safety) Order 2005: Fire risk assessment for all non-domestic premises
Work at Height Regulations 2005: Risk assessment for all work at height activities
Personal Protective Equipment at Work Regulations 1992: Assessment to determine appropriate PPE
Noise at Work Regulations 2005: Noise assessment where exposures may exceed action levels
Control of Vibration at Work Regulations 2005: Vibration assessment for relevant exposures

Professional risk assessment services address all of these regulatory requirements within a coordinated, systematic programme — not as fragmented, disconnected documents produced at different times by different people.

2. What "Suitable and Sufficient" Actually Means

The legal standard for risk assessments in the UK is that they must be "suitable and sufficient." This phrase is not defined in legislation — its meaning has been established through guidance, enforcement action, and case law.

What makes a risk assessment suitable:

A suitable risk assessment is appropriate to the nature of the work and the severity of the risks. It must actually address the significant hazards present in the workplace rather than cataloguing minor issues while missing the hazards that matter most. It must reflect the actual conditions of the specific workplace — not conditions that might apply to an average business in the same broad sector.

What makes a risk assessment sufficient:

A sufficient risk assessment identifies who might be harmed and in what way, evaluates the adequacy of existing controls, identifies what further action is needed, and records enough detail to enable that action to be taken. It does not need to be encyclopaedic — but it must be substantive. A two-line risk assessment for a complex industrial activity is unlikely to be sufficient regardless of how many boxes it ticks.

What makes a risk assessment insufficient — the common failures:

Generic templates applied without adaptation: A risk assessment copied from an internet template, with the company name substituted but the content unchanged, is unlikely to be suitable for any specific workplace. The controls it specifies may be irrelevant to the actual hazards present, and the hazards that matter most may not be mentioned.

Hazard identification that misses the significant risks: A risk assessment that identifies slip hazards but misses the asbestos in the ceiling tiles, or that addresses manual handling but ignores the stress risk in a high-pressure call centre, is not sufficient.

Controls identified but not implemented: A risk assessment specifying controls that are not in place is worse than useless — it documents that the employer knew about the risk and failed to address it.

Not reviewed when required: An assessment that was suitable and sufficient three years ago may no longer be so if the workplace, activities, or workforce have changed.

Professional risk assessment services from Health and Safety Consultants produce assessments that genuinely meet the suitable and sufficient standard — because they are conducted by practitioners with the sector knowledge, regulatory understanding, and professional accountability to identify what actually matters.

3. Types of Risk Assessment: What Professional Services Cover

Professional risk assessment services address multiple categories of assessment, each meeting specific legislative requirements and covering distinct aspects of workplace health and safety.

General Workplace Risk Assessment

The foundational assessment covering all significant workplace hazards not addressed by more specific assessments. Covers physical conditions, working practices, equipment, access and egress, lone working, violence and aggression, and the general working environment. Serves as the basis for identifying priorities and directing more detailed sector-specific or activity-specific assessments.

Manual Handling Risk Assessment

Required where manual handling operations cannot be avoided, using the TILEO (Task, Individual, Load, Environment, Other) framework. Covers lifting, carrying, pushing, pulling, and repetitive handling — identifying where the risk of musculoskeletal injury is greatest and specifying controls including mechanical aids, weight limits, training, and task redesign.

Display Screen Equipment (DSE) Workstation Assessment

Required for all habitual screen users — those using screens for one hour or more per day as a significant part of their normal work. The HSE confirmed in 2025 that DSE obligations extend to all home and hybrid workers, making this one of the most widely applicable and most commonly incomplete assessment categories. Covers screen position, keyboard, mouse, chair, desk, lighting, and working practices.

COSHH Assessment

Required under the Control of Substances Hazardous to Health Regulations 2002 for any workplace where hazardous substances are used, produced, or arise from work activities. Covers chemical hazards, biological agents, and substances produced in work processes. Must include exposure assessment, control specification, health surveillance requirements where applicable, and emergency procedures.

Fire Risk Assessment

Required under the Regulatory Reform (Fire Safety) Order 2005 for all non-domestic premises. Follows a five-step methodology: identifying ignition and fuel sources, identifying people at risk, evaluating and reducing risk, recording findings and emergency plans, and reviewing regularly. Must be building-specific and reflect actual conditions.

Stress and Psychosocial Risk Assessment

Required under the Management of Health and Safety at Work Regulations 1999 as part of the general duty to assess all significant risks — including psychological ones. Uses the HSE Management Standards framework covering Demands, Control, Support, Relationships, Role, and Change. Now a primary HSE enforcement priority following record-high stress and mental ill health statistics in 2024/25.

Noise Assessment

Required under the Noise at Work Regulations 2005 where exposures may reach or exceed the Lower Exposure Action Value (80 dB(A) daily average). Identifies areas and activities generating significant noise, measures worker exposure, and specifies engineering controls, administrative controls, and hearing protection requirements.

Work at Height Risk Assessment

Required under the Work at Height Regulations 2005 before any work at height is undertaken. Covers planning, supervision, and use of appropriate equipment. Must address the specific heights, activities, and surfaces involved — not simply specify that workers should take care.

4. The Risk Assessment Process: How Professional Services Work

Understanding how professional risk assessment services actually work helps businesses know what to expect and how to prepare for maximum value.

Step 1: Scope agreement The professional assessor agrees with the client which premises, activities, and personnel are within scope, what specific assessment types are required, and what information or access will be needed. Clear scoping prevents gaps and duplication.

Step 2: Pre-visit document review Before the site visit, the assessor reviews any existing assessments, accident records, near-miss data, and relevant documentation. This identifies existing controls, previous findings, and areas where existing documentation can be built upon rather than replaced.

Step 3: Site survey and observation The assessor visits the workplace, observes work activities in practice — not only as described in procedures — and identifies hazards through systematic examination of all areas within scope. This is where professional service adds the most value over self-assessment: qualified assessors identify hazards that have become invisible to people immersed in the working environment.

Step 4: Employee interviews Speaking with employees at all levels — not only managers — reveals how work is actually done rather than how it is documented. Employee interviews identify hazards that management may not be aware of, and verify that controls described in existing documentation are genuinely implemented.

Step 5: Hazard identification and risk evaluation The assessor systematically identifies all significant hazards in scope, evaluates the likelihood and severity of harm from each, assesses the adequacy of existing controls, and determines the residual risk.

Step 6: Control specification For hazards where existing controls are inadequate, the assessor specifies additional controls following the hierarchy of controls: elimination, substitution, engineering controls, administrative controls, and personal protective equipment — in that order of preference.

Step 7: Documentation The assessment is recorded in a format appropriate to the workplace and its risk profile. Professional assessments are specific, clear, and actionable — naming actual hazards, actual controls, actual responsible persons, and actual review dates.

Step 8: Review scheduling and action tracking Each assessment includes a specified review date and, where actions are required, an action plan with named ownership and deadlines. Health and Safety Consultants and Software solutions automate review reminders and action tracking — ensuring assessments are reviewed when required and actions are completed and verified.

5. Sector-Specific Risk Assessment: Why One Size Does Not Fit All

Professional risk assessment services are most valuable when the assessor has genuine sector-specific knowledge. Different industries carry different hazard profiles, different regulatory requirements, and different enforcement environments — and generic approaches miss the hazards that matter most in specific sectors.

Construction: Construction risk assessment must address CDM 2015 obligations, work at height, excavation, scaffold and access equipment, workplace transport, COSHH for construction chemicals and dusts, asbestos management in refurbishment, and the specific risks of the construction phase plan.

Manufacturing: Manufacturing assessments cover machinery guarding under PUWER, COSHH for process chemicals and dusts, noise and hearing conservation, confined space entry, LEV (Local Exhaust Ventilation) effectiveness, and workplace transport for fork-lift truck operations.

Healthcare and social care: Healthcare risk assessments address manual handling of patients and residents (using TILE assessment adapted for patient handling), violence and aggression from patients, COSHH for biological agents and clinical chemicals, lone working for community care staff, and stress and burnout in high-demand clinical roles.

Retail: Retail assessments address slips, trips, and falls in customer areas (the most common injury cause in retail), manual handling in stockrooms, violence and aggression in customer-facing roles, and — for businesses operating across multiple sites — consistency of assessment across the estate.

Technology and professional services: Professional services assessments focus on DSE — covering both office and home workstations — stress and psychosocial risk under the HSE Management Standards, fire safety for commercial office premises, and lone and remote working arrangements.

Hospitality: Hospitality assessments cover kitchen safety (burns, gas, fire), Legionella in water systems, manual handling, violence in licensed premises, fire safety for sleeping guests, and food safety alongside general health and safety.

6. Risk Assessment and Health and Safety Audits: A Complementary Relationship

Risk assessment and health and safety audit are complementary activities that together provide the most comprehensive assurance of effective safety management.

Risk assessment identifies hazards, evaluates risk, and specifies controls. It answers: "What could go wrong and what are we doing about it?"

Health and Safety Audit assesses whether the risk assessment programme is working effectively — whether assessments are suitable and sufficient, whether controls are implemented, whether reviews happen when required, and whether the overall management system is achieving its objectives. It answers: "Is our approach to risk management actually working?"

Neither is sufficient without the other. A business with excellent risk assessments that are never reviewed and whose controls have deteriorated since the assessment was produced has good documentation and poor safety management. A business with active safety management and engaged workers but without systematic documented risk assessment lacks the legal foundation and the evidence that regulatory bodies, insurers, and procurement teams require.

Professional risk assessment services integrate with audit programmes — each annual audit cycle reviewing the quality and currency of the risk assessment programme as a specific audit dimension. Findings from audits drive improvements to assessments; revised assessments drive improvements to management practice.

7. Technology and Risk Assessment Services

Health and Safety Consultants and Software solutions have fundamentally changed what professional risk assessment services can deliver — making assessments more accurate, more accessible, more easily reviewed, and more integrated with the management actions they generate.

What technology adds to professional risk assessment services:

Digital assessment completion: Assessors complete assessments on mobile devices during the site visit — with photographs attached directly to specific hazard findings, observations recorded in structured fields, and completed documents stored immediately without transcription delay.

Template libraries: Pre-built assessment frameworks for common activities across key sectors — manual handling, DSE, COSHH, fire, lone working, stress — customisable to specific workplace conditions. Templates accelerate assessment completion while maintaining consistency across multiple sites or assessment cycles.

Version control and review scheduling: Every assessment stored with version history, review dates tracked automatically, and alerts generated when assessments approach their review date. Assessments never silently become outdated.

Action tracking: Each control identified as requiring implementation generates an action record assigned to a named owner with a deadline. Overdue actions escalate to management automatically — eliminating the most common failure mode: controls identified in assessments but never verified as implemented.

Multi-site consistency: For businesses with multiple locations, digital platforms ensure the same assessment criteria are applied across all sites — enabling meaningful comparison and identification of systemic issues that a site-by-site approach would miss.

Management dashboards: Real-time visibility of assessment currency across the organisation — which assessments are current, which are approaching review, which have outstanding actions — providing management with the oversight that paper-based approaches cannot deliver.

8. How Risk Assessment Services Support Tenders and Procurement

One of the most commercially significant values of professional risk assessment services is the role they play in enabling businesses to qualify for tenders, contracts, and commercial relationships that require evidence of systematic safety management.

What procurement processes examine:

Many public sector and major private sector contracts require pre-qualification evidence of health and safety management quality, typically including:

Current, suitable, and sufficient risk assessments for all significant activities
Evidence that assessments are reviewed and maintained — not produced once and filed
Training records demonstrating that identified controls have been communicated to relevant workers
A named, qualified competent person — which risk assessment services typically include
Recent independent Health and Safety Audit evidence

SSIP accreditation: Safety Schemes in Procurement (SSIP) accreditation — through CHAS, SafeContractor, Constructionline, or other member schemes — requires documented risk assessments as a core component of assessment. Businesses with professionally produced, current risk assessments navigate SSIP pre-qualification more efficiently and reliably than those with generic or outdated documentation.

Common Assessment Standard: The Common Assessment Standard (CAS) used by major UK contractors requires health and safety documentation evidence that includes risk assessment quality. Professional risk assessment services produce the documentation that CAS assessments require.

ISO 45001: ISO 45001 certification requires documented risk assessment processes as a fundamental management system component. Professional risk assessment services provide the foundation for organisations pursuing or maintaining ISO 45001 certification — the internationally recognised management system standard increasingly required by enterprise clients and major supply chains.

9. Dynamic and Ongoing Risk Assessment: Beyond the Annual Review

The most common misunderstanding about risk assessment is that it is an annual exercise — produce the document, file it, and repeat in twelve months. This misunderstands both the legal requirement and the practical value of effective risk management.

When risk assessments must be reviewed:

The MHSWR requires review "regularly" and "if there is reason to suspect it is no longer valid or there has been a significant change in the matters to which it relates." Specific triggers for review include:

Changes to work activities, processes, or methods
Introduction of new equipment, substances, or chemicals
Changes to the physical environment — building modifications, new areas
Changes in workforce composition — new vulnerable groups, high turnover affecting trained worker proportions
Following any workplace accident, near miss, or dangerous occurrence
Receipt of new information about a hazard — new research, updated HSE guidance, enforcement activity in the sector
Regulatory change — new legislation or updated approved codes of practice

Dynamic risk assessment:

In some contexts — construction, lone working, maintenance activities, emergency response — formal pre-written risk assessments must be supplemented by dynamic assessment at the point of activity. A trained worker who encounters conditions different from those anticipated in the pre-written assessment must be competent to assess the changed risk in real time and make safe decisions. Risk assessment training for relevant workers, covering the hierarchy of controls and the principles of dynamic assessment, is part of a comprehensive risk assessment service.

Review as a systematic programme:

Professional risk assessment services build review into the assessment programme from the outset — specifying review dates, assigning review responsibility, and using Health and Safety Consultants and Software to alert the responsible person when reviews are due. This transforms review from a reactive response to events into a proactive management discipline.

10. International Risk Assessment: Meeting Multiple Jurisdictions

For businesses operating internationally, risk assessment obligations extend across every country where employees work — and the format, content, and process requirements differ materially between jurisdictions.

Netherlands — RI&E: The RI&E (Risico-inventarisatie en -evaluatie) is the Dutch equivalent of the UK risk assessment, but with specific format and process requirements that UK assessments do not satisfy. For companies with 25 or more employees, the RI&E must be reviewed by a certified external expert — a requirement with no direct UK equivalent.

France — DUERP: The DUERP (Document Unique d'Évaluation des Risques Professionnels) must be produced from the first employee, updated at least annually, and retained for 40 years. It has specific content requirements and must address psychosocial risks as a primary category. French labour inspectors can request the DUERP during unannounced inspections — producing a UK risk assessment in response would not satisfy the requirement.

Germany — Gefährdungsbeurteilung: The German risk assessment under DGUV regulations must explicitly cover psychosocial hazards alongside physical risks — a requirement in force since 2013. Sector-specific Berufsgenossenschaften (professional associations) provide additional guidance that shapes assessment content and methodology.

Italy — DVR: The RSPP arrangement requires a Documento di Valutazione dei Rischi (DVR) with specific signatures from the responsible safety officer, the works council representative, and the employer. The DVR format is prescribed by law, and a UK-format assessment submitted as a DVR would fail compliance immediately.

International Health and Safety Consultants who provide risk assessment services across multiple jurisdictions develop genuinely compliant assessments for each country — using the correct format, meeting local content requirements, and producing documents in the required language.

11. Choosing a Risk Assessment Service Provider

The UK risk assessment services market includes large national consultancies, regional specialists, and sole practitioners at widely varying levels of qualification and competence. Selecting the right provider requires evaluating specific quality indicators.

CMIOSH qualification and OSHCR registration: The individual assessor conducting the risk assessment — not only the firm's partner — should hold Chartered Member of IOSH (CMIOSH) status. The Occupational Safety and Health Consultants Register (OSHCR), supported by the HSE, provides independent verification of professional competence and professional indemnity insurance.

Sector-specific experience: An assessor who has conducted risk assessments in your specific industry — construction, manufacturing, healthcare, technology, retail — will identify hazards that a generalist misses and produce controls that reflect what is genuinely achievable in your sector. Request evidence of experience in comparable businesses.

Suitable and sufficient output — not template documents: Ask to see anonymised examples of assessments produced for comparable clients. Assess whether they are specific and operational or generic and theoretical. An assessment that could apply to any business in the country is not suitable and sufficient for yours.

Review programme inclusion: Confirm that the service includes review scheduling and notification — not just initial production. An assessment that is produced and filed without a structured review programme will drift out of currency and out of compliance.

Technology integration: Modern risk assessment services use Health and Safety Consultants and Software platforms that provide clients with digital access to their assessments, automated review alerts, action tracking, and management dashboards. A service relying entirely on paper or email-delivered Word documents is not providing contemporary best practice.

International capability: For businesses with international operations, confirm that the provider can produce locally compliant assessments in each relevant jurisdiction — not simply translate UK documents.

12. How Arinite Provides Risk Assessment Services

Arinite provides comprehensive professional risk assessment services to UK and international businesses across all sectors — combining CMIOSH-qualified expertise, sector-specific knowledge, and integrated digital platforms.

Arinite's risk assessment services:

General workplace risk assessment: Systematic site survey, hazard identification, risk evaluation, and control specification — specific to the actual workplace, its activities, its workforce, and its risk profile.

Specialist assessments: DSE assessments for office and home workers. COSHH assessments for all hazardous substances. Manual handling TILEO assessments. Stress risk assessments using the HSE Management Standards. Noise assessments. Work at height assessments. Fire risk assessments under the RRO 2005.

Competent person service: Named, CMIOSH-qualified competent person appointment under Regulation 7 — providing the professional accountability and documented appointment that legal compliance requires.

Independent Health and Safety Audits: Annual independent audits verifying that the risk assessment programme is working effectively — assessments are current, controls are implemented, and management systems are achieving their objectives.

Health and safety policy: Policies that integrate with and reference the risk assessment programme — ensuring that documented arrangements reflect assessed risks.

Health and Safety Consultants and Software: Digital platforms managing assessment completion, version control, review scheduling, action tracking, and management dashboards across single and multi-site operations.

International risk assessment services: International Health and Safety Consultants producing locally compliant assessments across 50+ countries — RI&E in the Netherlands, DUERP in France, Gefährdungsbeurteilung in Germany, DVR in Italy, and equivalent documentation in each operating jurisdiction.

ISO 45001: Management system development incorporating risk assessment as a core documented process — providing the internationally recognised certification framework that enterprise clients and supply chains increasingly require.

Supporting over 1,500 global businesses across the UK and 50+ countries with a 95%+ client retention rate, Arinite's CMIOSH-qualified consultants produce risk assessments that are genuinely suitable and sufficient — not generic documents, but specific, actionable, and professionally accountable assessments that protect workers and organisations.

Frequently Asked Questions

Is risk assessment a legal requirement in the UK?

Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to conduct a suitable and sufficient risk assessment. Where five or more people are employed, the significant findings must be recorded in writing. Specific regulations — including COSHH, Manual Handling, DSE, Fire, and Work at Height — impose their own additional assessment requirements.

What does "suitable and sufficient" mean for a risk assessment?

Suitable means the assessment is appropriate to the nature and severity of the risks — specific to the actual workplace and its activities, not a generic template. Sufficient means it provides enough detail to identify who might be harmed, evaluate existing controls, and determine what further action is required. The standard is not perfection — but assessments that are generic, incomplete, or produce controls that are never implemented fall below the legal standard.

How often should a risk assessment be reviewed?

The MHSWR requires review "regularly" and when there is reason to suspect the assessment is no longer valid. As a minimum, annual review is standard practice. Review is also triggered by changes to activities, equipment, or workforce; following any accident, near miss, or dangerous occurrence; and when new information about a hazard becomes available.

Can I write my own risk assessments?

Yes, if you have sufficient competence — the right training, experience, and knowledge to identify hazards, evaluate risks, and specify appropriate controls for your specific workplace. Many employers delegate this to qualified staff or external professionals, because the consequences of an inadequate assessment — regulatory enforcement, civil liability, and worker harm — far exceed the cost of professional risk assessment services.

What is the difference between a risk assessment and a method statement?

A risk assessment identifies hazards, evaluates risk, and specifies controls. A method statement (or Safe System of Work) describes, step by step, how a specific task will be carried out safely — incorporating the controls identified in the risk assessment into a practical operational procedure. For construction work, the two are often combined into a single document known as an RAMS (Risk Assessment and Method Statement).

Do risk assessment obligations differ internationally?

Yes, significantly. Dutch employers must produce a RI&E with certified external review for companies over 25 employees. French employers must produce a DUERP from the first employee with 40-year retention. German assessments must cover psychosocial hazards. Italian assessments follow a prescribed DVR format. International Health and Safety Consultants produce locally compliant assessments in each jurisdiction.

Taking the Next Step

Risk assessment is the foundation of all health and safety management — the point from which every other management activity flows. Whether you need general workplace risk assessments, specialist COSHH or DSE assessments, sector-specific evaluations, or coordinated international risk assessment services across multiple countries, professional support produces assessments that are genuinely suitable, sufficient, and systematically maintained.

Find your assessment gaps: Take our Health and Safety Quiz to evaluate the currency and completeness of your risk assessment programme.

Discuss your requirements: Book a free Gap Analysis Call with an Arinite consultant to identify which assessments you need, what they should cover, and how they should be maintained.

Commission professional risk assessment: Contact Arinite to engage our Health and Safety Consultants for risk assessment services across the UK and internationally.

Arinite provides professional risk assessment services and Health and Safety Consultants advisory to over 1,500 global businesses across the UK and 50+ countries. Key external resources: HSE risk assessment guidance | Management of Health and Safety at Work Regulations 1999 | Health and Safety at Work Act 1974 | HSE enforcement statistics | OSHCR consultant register

Risk Assessment Services: What UK and Global Businesses Need to Know