Suitable and Sufficient: The 3 Tests Your Risk Assessment Must Pass
There is a great deal of guidance on how to write a risk assessment and remarkably little on the standard it has to meet.
That standard is a phrase, and it appears in the regulation itself. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to the health and safety of employees at work, and of persons not in the employer's employment arising out of or in connection with the conduct of the undertaking.
Neither word is defined. Both do real work, and organisations that have never examined them tend to reach for length as a proxy for quality, which is the one thing the phrase does not mean.
Three tests. If an assessment passes all three it is very likely suitable and sufficient. If it fails any one of them, its length will not save it.
Test one: does it address the significant risks, and only those?
The word doing the work here is significant, and it appears explicitly in the regulation.
Regulation 3 requires the employer to record the significant findings of the assessment, together with any group of employees identified as being especially at risk. Not every finding. Not every hazard that could theoretically arise. The significant ones.
That cuts in both directions, and organisations usually fail on one side or the other.
Under-inclusion is the obvious failure. An office assessment covering trips, screens and kettles, in a firm whose real exposure is workload during transaction peaks, people working at client sites, and a hardware laboratory nobody mentioned, has addressed the visible and omitted the significant. Physical hazards are easy to see and organisational ones are not, which is why they are the ones missing.
Over-inclusion is the failure nobody names, and it is more common in well-resourced firms. An assessment listing forty hazards, each scored, each with a control reading "staff to be careful", has buried three genuine issues in thirty-seven that were never in doubt. A document that cannot be read cannot inform anybody, and an assessor who spent the available effort on completeness had less left for the hazards that mattered.
The practical test: could someone reading your assessment identify, in under a minute, what the three biggest risks in your organisation actually are? If not, significance has not been established, whatever the document contains.
HSE's guidance on risk assessment is notably brief, and that brevity is deliberate.
Test two: does it describe the work as it is actually done?
The test an assessment most often fails while looking entirely competent.
A risk assessment describes work. If it describes the work as the process document says it happens, rather than as people actually perform it, then it has assessed something that does not occur and left the real activity unassessed.
The gap appears in predictable places. The procedure says two people; one person does it. The assessment assumes an assigned workstation; the floor is hot desked. It describes an office; a third of the population is at home two days a week and at client sites on others. It was written when the building had two floors and the firm now has four. It assumes work happens between nine and six.
None of those is exotic. All of them are how professional and financial organisations actually operate, and each one makes an assessment describe a fiction.
Regulation 3 also requires review where there is reason to suspect the assessment is no longer valid, or where there has been a significant change in the matters to which it relates. A move, a fit-out, an attendance mandate, a new team, a piece of equipment or a change in working hours all qualify, and an assessment carrying the same date through all of them has not been reviewed, whatever the review box says.
The practical test: ask three people doing the work to describe how they do it, and compare that with the document. The difference is your gap.
Test three: does it identify the measures you need to take?
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The purpose clause, and it is easy to miss because it sits at the end of the sentence.
Regulation 3 requires the assessment to be made for the purpose of identifying the measures the employer needs to take to comply with the requirements and prohibitions imposed by the relevant statutory provisions.
An assessment is not an end in itself. It exists to produce actions. That framing disposes of a great deal of what passes for risk assessment in practice.
A control column reading "staff are trained", "policy in place", "employees to take care" or "signage displayed" does not identify measures the employer needs to take. It describes a state the employer believes already exists, and it does so in terms that cannot be verified or actioned. If nothing in your assessment produces a task with an owner and a date, it has not done what the regulation asks.
The related discipline is the hierarchy: eliminate, substitute, engineer, then administrative controls, with personal protective equipment last. An assessment whose measures are all in the last two categories has usually not asked whether the earlier ones were reasonably practicable. And under British law the burden falls on the employer to show that further measures were not reasonably practicable, which is a case made in writing or not at all.
HSE's templates and examples are structured around what will be done, by whom, and by when, for exactly this reason.
Three tests, applied
| Test | Passes when | Fails when |
|---|---|---|
| Significance | The three biggest risks are identifiable in a minute | Everything listed, or only the visible listed |
| Reality | It matches how the work is actually done today | It matches a process document, or a previous building |
| Purpose | It produces actions with owners and dates | Controls describe an existing state |
Note what is absent from that table. Length, format, scoring, colour and template are all irrelevant to whether an assessment is suitable and sufficient. A two-page assessment that passes all three tests is compliant. A forty-page one that fails any of them is not, and the length may make the failure worse by obscuring it.
One further requirement worth remembering: regulation 16 requires the assessment to include an assessment of risks to new or expectant mothers where women of child-bearing age are employed and the work could involve risk to them or the baby. That is a specific statutory add-on, and its absence is a definite gap rather than a matter of judgement.
For international groups
The phrase itself is British, and the underlying idea is not.
Most jurisdictions in this series require an assessment that is proportionate, current and productive of measures, expressed in their own terms. What differs is the artefact and the author: France requires a DUERP in a prescribed format, Hungary reserves the assessment to a qualified specialist, Greece requires it to be authored by the appointed safety technician and physician, Mexico and Colombia prescribe the psychosocial instrument, and Kenya requires an annual audit by a state-approved advisor with the report going to the regulator.
So a group can hold one methodology and one view of quality, using tests like the three above, while each entity produces the artefact its own law demands. That distinction is where health and safety consultants and software are worth more together than either alone, and periodic health and safety audits are how you find out whether the local documents pass the tests or merely exist.
Where Arinite fits
Arinite writes assessments that identify measures, which is the standard the regulation actually sets. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with legal, finance and banking and IT and software organisations, where the significant risks are frequently organisational and therefore the ones most often absent from the document.
Where a group operates internationally, our global health and safety consultants map one standard of quality onto each national requirement, and our international health and safety consultants confirm what each jurisdiction expects the output to look like.
If your assessments are long and nobody could tell you what your three biggest risks are, a free gap analysis will establish which of the three tests they are failing.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
