Safety guide · Safety management
Risk assessment: what it is, the six steps and a 5x5 worked example
Short answer
A risk assessment is a structured look at a task, machine or area to find what could hurt people, judge how likely and how bad that harm would be, and decide which controls bring the risk down to an acceptable level. The result is a written record of each hazard, its rating, the controls and who acts by when.
A hazard is something that can cause harm: a moving ram, a hot surface, a forklift aisle. Risk is the chance that the harm happens combined with how serious it would be. A risk assessment lists the hazards, decides who could be harmed and how, rates each risk with the controls in place today, usually as severity times likelihood on a risk matrix, and adds further controls in the order of the hierarchy of controls until the risk is acceptable. The findings are recorded with an owner and a date for each action, and the assessment is reviewed whenever the work changes or something goes wrong.
Last reviewed:
What is a risk assessment? Hazard vs risk
The two words get swapped, and the difference is the whole method. A hazard is the source of harm. Risk is how likely that harm is and how bad it would be, given the way the work is done today. A press brake ram is a hazard. The risk depends on who stands at it, how close their hands get, and what stops the ram.
| Hazard | Who could be harmed and how | What sets the risk |
|---|---|---|
| Press brake ram | The operator: fingers crushed between punch and die | How close hands get to the tooling, and whether a guard stops the ram |
| Welding fume | Welders and people at nearby benches: breathing it in over months | How much fume reaches the breathing zone, and for how long |
| Steel sheet on the shear table | The shear operator and helper: back strain lifting it | The weight, how often, and how far from the body it is held |
| Offcuts and air hoses on the floor | Anyone walking through the cell: trips and falls | How often the floor is cleared and where the hoses run |
Illustrative. The same hazard can carry a low risk in one cell and a high one in another, which is why the assessment looks at the work as it is really done.
ISO 31000:2018, the general risk management standard, splits risk assessment into three parts in clause 6.4: identifying risks, analysing them and evaluating them against criteria. Safety practice adds the controls and the record. Methods range from qualitative (words such as low and high), through semi-quantitative (a numbered matrix, the usual choice on a plant floor), to quantitative (probabilities and frequencies, used for process safety and fault trees).
When is a risk assessment required?
In the United States, no single OSHA general industry standard requires one written risk assessment for the whole workplace. Specific standards ask for hazard assessments of their own. 29 CFR 1910.132(d)(1) requires the employer to assess the workplace for hazards that call for personal protective equipment, and 1910.132(d)(2) requires a written certification of that assessment naming the workplace evaluated, the person certifying it and the date. Section 5(a)(1) of the OSH Act, the general duty clause, obliges employers to deal with recognized serious hazards even where no standard applies. OSHA's Recommended Practices for Safety and Health Programs make hazard identification and assessment one of the core elements of a program.
In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees and to others affected by the work, and where five or more people are employed the significant findings have to be written down. Sites certified to ISO 45001 need a documented process for it under clause 6.1.2. Customers and insurers often ask to see one too.
- Before a new task, machine, material or layout goes live.
- When a task, machine, material, shift pattern or crew changes.
- After an injury, a near miss or a failed control, for the task involved.
- When new information arrives: a noise survey, a new safety data sheet, a manufacturer's notice.
- On a fixed review cycle that your own procedure sets, shorter for the higher bands.
How to do a risk assessment in six steps
The order below follows the classic five steps published by HSE, the British regulator, with control split out from evaluation so the hierarchy of controls gets its own step. HSE's current guidance, Managing risks and risk assessment at work, runs the same sequence: identify hazards, assess the risks, control them, record the findings, review the controls.
Risk assessment in six steps
- 1
Identify the hazards
- 2
Decide who could be harmed and how
- 3S x L
Evaluate the risk with today's controls
- 4
Decide further controls by the hierarchy
- 5
Record the findings and assign the actions
- 6
Review and update
- 1
Identify the hazards
Walk the area while the work is running, with the people who do it. Read the near miss and injury records, the maintenance work orders, the safety data sheets and the machine manuals. Include the non-routine jobs: changeovers, cleaning, jam clearing, maintenance. A walk during normal running never shows them.
- 2
Decide who could be harmed and how
Operators first, then maintenance, cleaners, contractors, drivers and visitors. Think about new starters, young workers, pregnant workers, people working alone and the night shift. Write how the harm happens: caught between, struck by, breathed in, lifted, slipped.
- 3
Evaluate the risk with today's controls
Rate the severity of the worst credible outcome and the likelihood of that outcome with the controls already in place. Multiply them on a risk matrix and read off the band. Score as a group, against a written scale.
- 4
Decide further controls by the hierarchy
For every risk above your accept band, choose controls from the top of the hierarchy of controls down: eliminate, substitute, engineer, then administrative controls and PPE. Score the hazard again with the further controls and check it moves down a band.
- 5
Record the findings and assign the actions
Write each hazard, who is at risk, the controls in place, the scores before and after, the further action, its owner and its due date. Share it with the crew that does the work, at the huddle or a toolbox talk.
- 6
Review and update
Check the actions were done and work. Review the assessment when the work changes, after an incident or near miss, and on the cycle your procedure sets. An assessment nobody has opened since it was signed is a record of what the area used to be.
Scoring risk with a 5x5 risk matrix
Most plants score risk as severity times likelihood on a matrix, the consequence and likelihood matrix that IEC 31010:2019 lists among risk assessment techniques. On a 5x5 grid each rating runs from 1 to 5 and the score from 1 to 25. The band the score falls in decides the action. No standard fixes the scales or the bands, so write yours down and use the same ones in every area.
| Band | Scores | Cells of the 25 | What to do |
|---|---|---|---|
| Low | 1 to 4 | 8 | Accept with the controls in place. Review when the task changes. |
| Medium | 5 to 9 | 7 | Reduce where you reasonably can. The supervisor agrees the controls and a date. |
| High | 10 to 16 | 7 | Reduce before the work goes on, or with temporary controls and a manager's approval. |
| Very high | 20 to 25 | 3 | Stop. Do not start or carry on until the risk is reduced. |
The banding the free [risk assessment matrix template](/templates/risk-assessment-matrix) prints. Scores of 17 to 19 cannot occur on a 5x5 grid. Check the cell count both ways: 8 + 7 + 7 + 3 = 25 cells, and 5 x 5 = 25.
Severity is the worst credible outcome, not the worst imaginable: a 5 is a fatality or permanent disability, a 1 is first aid at most. Likelihood is how likely that outcome is with today's controls, from 1, not expected in the life of the task, to 5, happens regularly. The risk matrix calculator does the multiplication on a 3x3, 4x4 or 5x5 grid, shows the band, and lets you change the banding to your own policy.
Read the severity as well as the score. Severity 5 with likelihood 1 scores 5, the same band as a 2 x 3 hand cut. Consider a rule in your risk policy that sends any hazard at the top severity to a manager whatever its score. L. A. Cox Jr. set out the wider limits of risk matrices in What's Wrong with Risk Matrices? (Risk Analysis, 2008): ties between very different hazards, coarse cells, and scale words that people read differently.
Choosing controls: the hierarchy of controls
NIOSH ranks the ways of controlling a hazard from most to least effective: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. ISO 45001:2018 sets the same order in clause 8.1.2. The higher the level, the less the control depends on someone remembering to do the right thing every shift.
| Level (NIOSH order) | What it does | Example on the floor |
|---|---|---|
| 1. Elimination | Removes the hazard | Buy sheet cut to size so the shear job goes; run air hoses overhead so nothing lies on the floor |
| 2. Substitution | Replaces it with something less hazardous | A water-based degreaser in place of a solvent; lower-noise grinding discs |
| 3. Engineering controls | Separates people from the hazard | A light curtain on the press brake; on-torch fume extraction; a vacuum lifter for sheets |
| 4. Administrative controls | Changes the way people work | A written procedure, training, job rotation, a lockout, a permit, signs |
| 5. PPE | Protects the person when the hazard is still there | Cut-resistant gloves, respirators, hearing protection, safety glasses |
Most assessments end with a mix: an engineering control for the main hazard, a procedure to keep it working, and PPE for what is left.
A control lowers the score only by what it really changes. A guard that keeps hands out of the tool lowers the likelihood a lot. A sign lowers it very little. Severity rarely moves, because the hazard is still there if the control fails; it drops only when the control changes the hazard itself, such as less energy, a lower working height or a smaller quantity. For energy during servicing the control is a lockout: see the lockout tagout guide.
Risk assessment example: a fabrication cell scored on a 5x5 matrix
This example is illustrative. A fabrication cell has a press brake, a guillotine shear, a welding bay and a grinding bench, worked by four people on two shifts. The supervisor, two operators and the maintenance technician walk the cell for an hour, read the last year of near misses, and score five hazards on the 5x5 matrix with the banding above.
The fabrication cell on the 5 x 5 matrix
Example numbers- Low (1 to 4)
- Medium (5 to 9)
- High (10 to 16)
- Very high (20 to 25)
- Press brake, fingers at the tooling. Before controls 5 × 3 = 15 (high), after 5 × 1 = 5 (medium).
- Welding fume. Before controls 4 × 4 = 16 (high), after 4 × 2 = 8 (medium).
- Lifting sheet onto the shear. Before controls 3 × 4 = 12 (high), after 3 × 2 = 6 (medium).
- Trips on offcuts and hoses. Before controls 2 × 4 = 8 (medium), after 2 × 2 = 4 (low).
- Noise from the shear and grinding. Before controls 4 × 4 = 16 (high), after 4 × 3 = 12 (high).
| Hazard and who is at risk | Today's controls | Before: S x L | Further controls (hierarchy level) | After: S x L |
|---|---|---|---|---|
| 1. Press brake: operator's fingers crushed at the tooling | Foot pedal, written rule to keep fingers clear | 5 x 3 = 15, high | Light curtain that stops the ram (engineering); check it at the start of each shift (administrative) | 5 x 1 = 5, medium |
| 2. Welding fume: two welders and the fitter at the next bench | General ventilation, disposable masks | 4 x 4 = 16, high | On-torch fume extraction (engineering); fitted respirators with a fit check (PPE) | 4 x 2 = 8, medium |
| 3. Lifting steel sheet onto the shear: operator and helper, back strain | Two-person lift | 3 x 4 = 12, high | Vacuum lifter on the jib crane (engineering) | 3 x 2 = 6, medium |
| 4. Trips on offcuts and air hoses: anyone in the cell | Sweep at the end of the shift | 2 x 4 = 8, medium | Hoses on overhead reels (elimination); offcut bin at each machine emptied at every break (administrative) | 2 x 2 = 4, low |
| 5. Noise from the shear and grinding: everyone in the cell | Earplugs at the cell entrance | 4 x 4 = 16, high | Lower-noise discs (substitution); hearing protection enforced and a noise dose survey (administrative and PPE) | 4 x 3 = 12, high |
S is severity and L is likelihood, both 1 to 5. Hazard 5 stays high because nothing yet separates people from the noise at its source; an acoustic screen around the grinding bench goes on the plan for the next quarter, with the survey from the [noise dose calculator](/tools/noise-dose-calculator) as its input. For hazard 3, the [NIOSH lifting equation calculator](/tools/niosh-lifting-equation-calculator) checks the lift before and after.
Count the bands before: four high (15, 16, 12, 16) and one medium (8), so 4 + 1 = 5 hazards. After: one high (12), three medium (5, 8, 6) and one low (4), so 1 + 3 + 1 = 5. Four of the five moved down at least one band. The highest score fell from 16 to 12, and the only hazard still high is the one where the further controls sit at the bottom of the hierarchy.
Read hazard 1 the way a manager should. It scores 5 after the light curtain, a medium, but its severity is still 5. That is why the daily check of the curtain is written into the start-up routine and the press brake stays on the review list. Each action goes on the plan with an owner and a due date, and the assessment is reviewed once the actions are in.
Risk assessment vs JHA, FMEA and a risk register
A risk assessment looks at an area, a machine or an activity as a whole. A job hazard analysis takes one task and breaks it into steps, finding the hazards at each. The two work together: the area assessment tells you which tasks carry the highest risk, and those tasks get a JHA.
| Method | Looks at | Output | Use it when |
|---|---|---|---|
| Risk assessment | An area, machine or activity | Hazards rated before and after, controls, owners and dates | Setting up or reviewing the safety of a cell, line or job family |
| Job hazard analysis (JHA or JSA) | One task, step by step | Hazards and controls for each step, often rated | A task that has hurt or nearly hurt someone, or is new or non-routine |
| FMEA | How a process or design can fail | Failure modes ranked by severity, occurrence and detection | Quality and reliability risk in a process or product |
| Preliminary hazard analysis | A design or change before it is built | Hazards to design out early | New equipment, a new line or a layout change |
| Risk register | Every open risk in one list | Owner, rating, next review date | Tracking all assessments and actions across the site |
The [FMEA guide](/learn/fmea) covers severity, occurrence and detection for failure modes. The [risk register template](/templates/risk-register-template) holds the risks from every assessment in one list.
What ISO 45001 clause 6.1 asks for
ISO 45001:2018 is the international standard for occupational health and safety management systems. Clause 6.1, actions to address risks and opportunities, is where risk assessment sits. The summary below is in our own words; read the standard itself for the exact requirements.
| Clause | Topic | In practice on a plant |
|---|---|---|
| 6.1.1 | General | Plan for the risks and opportunities that affect the safety system and its results |
| 6.1.2.1 | Hazard identification | An ongoing, proactive process covering routine and non-routine work, past incidents, everyone in the workplace including contractors and visitors, and changes |
| 6.1.2.2 | Assessment of risks | Defined methods and criteria for rating risk, applied before harm happens rather than after, with records kept |
| 6.1.2.3 | Assessment of opportunities | Ways to improve safety performance, such as adapting work to people |
| 6.1.3 | Legal and other requirements | Know which laws and customer requirements apply and how they affect the assessment |
| 6.1.4 | Planning action | Plan the actions from the assessment, fit them into the system and check they work, using the hierarchy of controls |
Clause 8.1.2 sets the hierarchy of controls, and clause 5.4 asks for workers to take part in identifying hazards and assessing risks. An auditor will ask to see your method, your criteria and a sample of assessments with their actions closed.
Common risk assessment mistakes
- Writing it at a desk. The hazards that hurt people are in the non-routine work you only see on the floor: changeovers, cleaning, jam clearing.
- Scoring with the new control already counted. Score today's controls first, then the further control, or there is no before.
- Every control is PPE or a sign. They sit at the bottom of the hierarchy and barely move the likelihood.
- Everything is a 5. Score the worst credible outcome, or nothing stands out and the list cannot be ranked.
- Lowering the severity because a guard is fitted. If the guard fails, the harm is the same.
- Different scales in every area. A 12 must mean the same thing on every line.
- Actions with no owner or date. A rating without an action is only a description.
- Never reviewing it. A new machine, a new material or a near miss makes the old scores wrong.
Safety Improvement
Report and control hazards in LeanSuite
Workplace safety in manufacturing, run from one platform: report hazards in seconds, fix them with tracked actions, train people and see safety KPIs on your tier boards.
Go deeper
This page is the short version. These guides cover each part in full.
- Top Five Common Manufacturing HazardsThe five hazards most plants find first when they walk the floor: electrical, chemical, slips and trips, machine guarding and ergonomics.
- 7 Preventable Shop Floor Incidents Most Plants MissSeven incident types that a risk assessment should catch, and the gaps that let them through.
- Near Miss Reporting That Actually Prevents Future IncidentsHow near misses feed the hazard list and the review of an assessment.
- FMEA Workshop: Risk Assessment and Prioritization GuideRunning a team session to rate and rank failure modes, the quality side of risk assessment.
- Top Ergonomic Practices for Manufacturing TeamsControls for the lifting and posture hazards that a risk assessment often scores high.
All our articles on this subject are in the safety management topic.
Free templates and tools
- Stop, think, act posterA short pre-task check for the floor, for the hazards a written assessment cannot foresee.
- Risk assessment matrix template (5×5)A color-coded 5 × 5 severity and likelihood matrix, a scoring guide and a risk register.
- Risk register templateOne scored list of operational risks with owners, actions and dates, a heat map and a review log.
- Job safety analysis (JSA) templateJob steps, hazards, risk scored before and after the controls, the hierarchy of controls, PPE and sign-off.
- Preliminary hazard analysis (PHA) worksheetFind and score the hazards of a new line, machine or process before design is fixed, then choose controls and re-score.
- Ergonomic risk assessment checklistScreen a task for 21 ergonomic risk factors, score how long each lasts, and rank tasks so the worst get controls first.
- Chemical inventory and SDS register templateA register of every chemical on site with its hazard class, safety data sheet and label, and a check that incompatible products are kept apart.
- Risk matrix calculatorSeverity times likelihood on a 3 x 3, 4 x 4 or 5 x 5 risk matrix, the band and its action, editable banding, and the score after further controls.
- Noise dose and TWA calculatorDose and 8-hour TWA for a shift of noise levels under OSHA and NIOSH, which limits are reached and how much loud time to cut.
- NIOSH lifting equation calculatorRecommended weight limit and lifting index for a two-handed lift, with every multiplier shown so you can see what to redesign.
Doing this in LeanSuite
Safety Improvement
Risk assessments start from the marketplace safety templates, every action on a hazard has an owner and a due date with delays flagged, and a floor-plan heat map shows where hazards cluster.
See Safety ImprovementSafety tags
Anyone on the floor reports a hazard, near miss or unsafe condition in seconds, it is routed to an owner and tracked until it is fixed.
See Safety tags
See it on your own lines
Bring the problem you are working on to a 45-minute demo. Or look around with sample data first, or pilot LeanSuite on your own lines for 90 days, with the setup done by our team.
FAQ
Questions about risk assessment
A risk assessment is a structured review of a task, machine or area that finds the hazards, decides who could be harmed and how, rates each risk by severity and likelihood, and sets the controls that bring it down to an acceptable level. The findings are recorded with an owner and a date for every action.
The classic five steps published by HSE are: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the findings, and review and update. This guide splits evaluating from choosing controls, which gives six steps with the same content.
A hazard is anything that can cause harm, such as a moving ram, a hot surface or a chemical. Risk is the combination of how likely the harm is and how serious it would be, given the way the work is done now. The same hazard can carry a low risk in one place and a high risk in another.
Rate the severity of the worst credible outcome and its likelihood with today's controls, usually each from 1 to 5, and multiply them. Severity 5 and likelihood 3 give 15 out of 25, which falls in the high band of a common 5x5 banding. Score again after the further controls.
By method: qualitative, which rates risk in words; semi-quantitative, which uses a numbered risk matrix and is usual on a plant floor; and quantitative, which uses probabilities and is used for process safety. By scope: area or activity assessments, task assessments such as a job hazard analysis, and quick pre-task checks done on the spot.
The common ones are a risk matrix for rating, a job hazard analysis for single tasks, checklists for walking an area, FMEA for process and design failure modes, and fault trees, bow ties or HAZOP for process safety. A risk register keeps the results and actions in one list.
In Great Britain, yes: regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires one, written down where there are five or more employees. In the United States, OSHA has no single general requirement, but specific standards do, such as the certified PPE hazard assessment in 29 CFR 1910.132(d).
A risk assessment covers an area, machine or activity as a whole. A job hazard analysis takes one task, breaks it into steps and finds the hazards at each step. The area assessment points to the riskiest tasks, and those get a JHA.
A small group: the supervisor who owns the area, the people who do the work, and someone with safety or maintenance knowledge. The people who do the task know the shortcuts and the non-routine jobs. ISO 45001 clause 5.4 expects workers to take part in identifying hazards and assessing risks.
Whenever the task, equipment, material, layout or crew changes, after an injury or near miss, when a control is found not working, and on a fixed cycle that your own procedure sets, shorter for higher risks. Check any interval your regulator or customer sets.
Clause 6.1 covers it. 6.1.2.1 asks for ongoing hazard identification, including non-routine work, contractors and visitors. 6.1.2.2 asks for defined methods and criteria for assessing risk, with records kept. 6.1.4 asks for planned action, and clause 8.1.2 sets the hierarchy of controls.
Related guides and tools
- Risk matrix calculator: score a hazard on a 3x3, 4x4 or 5x5 grid and set your own bands
- Risk assessment matrix template: the 5x5 grid, scoring guide and a register in Excel and PDF
- Job hazard analysis: break one task into steps and find the hazards at each
- Lockout tagout: the control for hazardous energy during servicing
- Near miss reporting: the reports that tell you where to assess next
- Safety Improvement in LeanSuite: hazard actions with owners, due dates and a floor-plan heat map
More method guides
- The 6 Ms of production
- Poka-yoke
- Model area 90-day plans
- Moving from Excel to one system
- Reducing machine downtime: a worked month
- Andon
- Cycle time vs lead time, worked through
- Root cause analysis
- How many operators a line needs
- Reducing scrap and rework: a worked month
- Unsafe acts and unsafe conditions
- Just culture
- Stop-work authority
- Material review board (MRB)
- Nonconformance and NCRs
- Problem solving methods
- Quad chart
- OEE calculation
- Quality assurance vs quality control
- SOP meaning and format
- Job hazard analysis
- Near miss reporting
- Fishbone diagram
- Pareto chart
- Histogram
- Control chart
- What is a gemba walk
- What is lead time
- What is operational excellence
- How to improve product quality
- Preventive vs predictive maintenance
- Kanban
- FMEA
- PDSA cycle
- Safety moments
- Just-in-time manufacturing
- Kaizen
- 5S
- Total quality management (TQM)
- CAPA (corrective and preventive action)
- Layered process audit (LPA)
- Lean tools
- Lockout tagout (LOTO)
- A3 problem solving
- Preventive maintenance
- APQP
- High reliability organization (HRO)
- Manufacturing KPIs
- Quality metrics
- Practical problem solving
- CMMS
- Production efficiency
- Total productive maintenance (TPM)
- Reliability-centered maintenance (RCM)
Or browse the topics, the full library and the lean glossary.
Rather see it on your own problem?
Bring the problem you are stuck on, and we will show you on a call how LeanSuite handles it.