Risk assessment step by step is the single most important process in any occupational health and safety management system — and the one most organisations complete once, file away, and never genuinely revisit.
Every ISO 45001 certification, every HSE audit, and every serious workplace safety programme rests on one foundation: a risk assessment that actually reflects what happens in the workplace. Not a template filled in during a rushed afternoon before an audit. A living document that identifies real hazards, evaluates them honestly, and drives real controls.
This guide walks through risk assessment step by step — the exact methodology auditors expect to see, the common mistakes that turn a strong safety programme into an audit finding, and how to build a risk assessment process that actually protects people rather than just satisfying a checklist.
WHY MOST RISK ASSESSMENTS FAIL BEFORE THEY START
The most common risk assessment failure has nothing to do with methodology. It happens before the first hazard is even identified — when the exercise is treated as a paperwork requirement rather than a genuine investigation into how work actually happens.
Signs a risk assessment has failed before it started:
→ It was completed entirely at a desk, without observing the actual work → The same generic hazards appear on every risk assessment regardless of the activity → Workers who do the job were never consulted → It has not been updated since the last audit — regardless of what has changed → Risk scores consistently land in the “low” category regardless of the actual hazard
A risk assessment step by step process that genuinely reduces harm requires none of these shortcuts. It requires structured method, applied honestly, by people who understand both the methodology and the actual work.
RISK ASSESSMENT STEP BY STEP — THE 6-STAGE METHODOLOGY
Step 1 — Identify the Hazards
Hazard identification is the foundation every subsequent step depends on. Miss a hazard here, and no amount of careful scoring or control selection downstream will protect against it.
Sources for identifying hazards:
→ Direct observation — physically walk the work area and watch the task being performed, not just reviewed on paper → Worker consultation — the people doing the job every day know hazards that never make it into a desk-based assessment → Incident and near-miss history — past incidents and near-misses reveal hazards that are real, not theoretical → Manufacturer documentation — equipment manuals, safety data sheets, and technical specifications identify hazards inherent to tools and substances → Regulatory and industry guidance — sector-specific hazard guidance often identifies risks not obvious to an internal team
Hazard categories to cover systematically:
→ Physical — noise, vibration, temperature extremes, radiation, manual handling → Chemical — exposure to hazardous substances, dust, fumes, vapours → Biological — pathogens, bloodborne hazards, biological agents → Ergonomic — repetitive strain, posture, workstation design → Psychosocial — work-related stress, fatigue, violence and harassment risk → Environmental — for GCC organisations specifically, heat stress is a critical category during summer months — see our [LINK #2] “heat stress management GCC” guide for detailed guidance on this specific hazard
A risk assessment step by step process that only identifies obvious physical hazards while ignoring psychosocial and environmental categories will not satisfy a competent auditor — and more importantly, will not protect your workforce comprehensively.
Step 2 — Determine Who Might Be Harmed and How
For each identified hazard, determine specifically who is exposed and what harm could result. This step is frequently rushed — but it drives everything that follows.
Consider:
→ Employees performing the task directly → Employees working nearby who are not directly involved → Contractors and visitors who may be unfamiliar with site-specific hazards → Members of the public who may be affected, particularly for site-adjacent hazards → Vulnerable groups — new or young workers, pregnant workers, workers with existing health conditions
Document specifically how harm could occur — not just “injury” but the actual mechanism: crush injury from moving machinery, respiratory harm from inhalation exposure, musculoskeletal injury from repetitive manual handling. Specificity here makes the subsequent risk scoring meaningful rather than arbitrary.
Step 3 — Evaluate the Risk — Likelihood and Severity
This is where risk assessment step by step methodology becomes quantifiable. Most risk matrices use a simple formula:
Risk Score = Likelihood × Severity
Likelihood scale (typical 1–5):
- Rare — could happen but only in exceptional circumstances
- Unlikely — could happen but not expected
- Possible — might happen occasionally
- Likely — will probably happen in most circumstances
- Almost certain — expected to happen frequently
Severity scale (typical 1–5):
- Negligible — no injury or minor first aid only
- Minor — injury requiring first aid, no lost time
- Moderate — injury requiring medical treatment, some lost time
- Major — serious injury, significant lost time, possible permanent effect
- Catastrophic — fatality or permanent disabling injury
Risk level interpretation: → 1–4: Low risk — monitor and maintain existing controls → 5–9: Medium risk — additional controls should be considered → 10–15: High risk — additional controls required before work proceeds → 16–25: Critical risk — work must not proceed until risk is reduced
The honesty of this scoring determines whether the entire risk assessment step by step process has value. Scoring inflated to make every risk appear “low” defeats the purpose — and auditors are specifically trained to challenge risk scores that do not match the severity of hazards described.
Step 4 — Select and Implement Controls Using the Hierarchy of Controls
Once risk is evaluated, controls must be selected — and not all controls are equal. The hierarchy of controls ranks control types from most to least effective:
1. Elimination — remove the hazard entirely. The most effective control, and the most commonly skipped in favour of easier options.
2. Substitution — replace the hazard with something less dangerous. A less hazardous chemical, a quieter machine, a safer process.
3. Engineering controls — isolate people from the hazard through physical means. Machine guarding, ventilation systems, noise enclosures.
4. Administrative controls — change how people work around the hazard. Safe work procedures, permit-to-work systems, training, signage, rotation schedules.
5. Personal Protective Equipment (PPE) — the last line of defence, protecting the individual after all other controls have been applied. PPE alone, without higher-level controls, is rarely adequate and is frequently challenged at audit.
A risk assessment step by step process should always ask: can this hazard be eliminated or substituted before defaulting to administrative controls and PPE? Auditors specifically look for evidence that higher-order controls were genuinely considered — not just PPE issued as the sole response.
Step 5 — Record Findings and Communicate to Affected Workers
Documentation is not paperwork for its own sake — it is the evidence that the risk assessment step by step process actually happened, and the mechanism by which findings reach the people who need to act on them.
Risk assessment records should include:
→ The specific activity, location, and date assessed → Hazards identified, with sufficient specificity to be actionable → Who is exposed and the potential harm → Risk score before and after controls → Specific controls implemented, with responsible owner and target date → Sign-off from someone with appropriate competence and authority → Date of next review
Communication matters as much as documentation. A risk assessment that sits in a file, unseen by the workers actually exposed to the hazard, provides no protective value regardless of how well it was completed. Toolbox talks, safety briefings, and visible posting of key controls ensure the assessment translates into changed behaviour.
Add significant risks identified through this process to your legal compliance register where they relate to specific regulatory requirements — this creates a direct link between your risk assessment and your compliance evidence.
Step 6 — Review and Update
A risk assessment is not a one-time exercise. It requires review at defined intervals and whenever circumstances change.
Triggers for review:
→ Scheduled interval — typically annually as a minimum → After any incident or near-miss related to the assessed activity → When new equipment, substances, or processes are introduced → When work location or environment changes → Following any change in legal or regulatory requirements → When corrective action (CAPA) findings reveal a control has failed
Organisations that treat risk assessment as a static document completed once for certification purposes consistently struggle at surveillance audits — because the document no longer reflects the current reality of the workplace. A risk assessment step by step process that includes genuine, triggered review remains defensible and, more importantly, remains protective.
RISK ASSESSMENT STEP BY STEP — COMMON AUDIT FINDINGS
Based on common certification and surveillance audit patterns, these are the risk assessment gaps auditors identify most frequently:
→ Risk assessments that have not been reviewed despite significant operational changes → Generic risk assessments that do not reflect the specific activity or location → Risk scores that do not match the described severity of the hazard → No evidence that workers performing the task were consulted → Controls that jump straight to PPE without evidence that elimination or substitution was considered → No clear link between identified risks and the ISO 45001 compliance programme’s broader hazard register
For organisations running an integrated management system, see our QHSE integration guide for how risk assessment can serve quality, environmental, and OH&S requirements simultaneously rather than requiring three separate assessment processes.
RISK ASSESSMENT METHODOLOGY — ALIGNING WITH ISO 31000
For organisations seeking a more formal enterprise risk management framework beyond operational HSE risk assessment, ISO 31000 provides internationally recognised risk management principles and guidelines applicable across all types of organisational risk — not just occupational health and safety.
The core risk assessment step by step methodology described in this guide aligns directly with ISO 31000 principles: establish context, identify risk, analyse risk, evaluate risk, treat risk, monitor and review — with communication and consultation running throughout the entire process.
THE BOTTOM LINE
Risk assessment step by step is not complex methodology — it is disciplined, honest application of a straightforward process: identify hazards genuinely, evaluate them honestly, control them using the hierarchy of controls properly, document the findings clearly, and review them when circumstances change.
The organisations that get the most protective value from risk assessment are not those with the most sophisticated risk matrices. They are the ones where risk assessment is a living process — informed by real observation, real worker input, and genuine commitment to reducing risk rather than simply documenting it.
Build your risk assessment process around genuine hazard identification and honest scoring. The audit compliance follows naturally from a process that is actually protecting people.
Use our audit ready checklist to confirm your risk assessment documentation meets the standard auditors expect before your next audit.
👉 Visit the Standards Unlimited shop for risk assessment templates, hazard registers, and ISO 45001 compliance tools built for GCC organisations.
#RiskAssessment #HSE #OccupationalSafety #HazardIdentification #ISO45001 #WorkplaceSafety #RiskManagement #SafetyManagement #HierarchyOfControls #GCCSafety #RiskAssessmentMethodology