Step three is evaluate the risks and decide on precautions — not record. That one word catches people out every year.
The short answer
A hazard is anything with the potential to cause harm. Risk is the chance that somebody is actually harmed by it, and how serious that harm would be. A risk assessment works through five steps in a fixed order, scores what is left, applies controls from the top of the hierarchy downwards, records the result and gets reviewed. Everything below is detail on those six ideas.
Hazard, risk and who gets hurt
A blowtorch on the bench is a hazard while it is switched off. The same blowtorch in a 1960s loft full of dry insulation is one hazard and a completely different risk. The hazard is the thing; the risk is the judgement about this job, in this place, with these people.
When a question asks for the most significant risk it wants the harm that is most likely and most serious — and naming it correctly is what tells you which control to reach for.
| Situation | Hazard | Most significant risk |
|---|---|---|
| Water lying on a floor | The wet surface | Slipping and falling |
| Disturbing old pipe insulation | Asbestos in the lagging | Inhaling asbestos dust |
| Working in an excavation | Unsupported sides | Collapse and burial |
| Soldering in a loft | Naked flame near combustibles | Fire |
| Chlorinating a cistern | The chemical | Burns and inhalation of vapour |
Asbestos harms by inhalation of the dust, not by burns or splashes. You cannot control asbestos dust with gloves, and you cannot control a wet floor with a dust mask.
The third part of the picture is the persons affected, and it is never just you: your own gang including any apprentice, other trades above and below, the client, occupants and the public, whoever comes later (cleaners, maintenance, the next contractor), and anyone especially at risk — young workers, new starters, expectant mothers, lone workers. A wet corridor is a ten-minute slip risk to your gang and an all-day one to an elderly patient. That is why the control is a wet floor sign and a mop, not boots with good grip.
The five steps, in order
The HSE approach to controlling risks sets out five steps, and the order is examinable:
- Identify the hazards.
- Decide who might be harmed and how.
- Evaluate the risks and decide on precautions.
- Record your findings and implement them.
- Review your assessment and update it if necessary.
Step three is evaluate and decide on precautions. People guess that recording comes third; it comes fourth.
Steps one and two are a deliberate look at a job everybody normally walks past. In a loft job that means the ladder and the unboarded joists, the naked flame near old insulation, the weight and sharp edges of the cistern, the power tool, the dust, the possible asbestos and the poor light — then the apprentice, the plumber and the family in the rooms below, who are underneath a ceiling somebody could put a foot through. Talking to other trades in the area, looking at what went wrong last time, and reading what the manufacturer says about the equipment and substances all add hazards you would not have seen.
At step three the law asks for everything reasonably practicable — not for every risk to be eliminated. At step four the legal duty to record applies where five or more people are employed, though most firms record everything, because the record is the only evidence the thinking happened. Then implement it: each control is somebody's job, by a date, checked off when done.
Scoring the risk
Ranking a risk means putting a number on it, which turns an argument into a figure everybody can see:
Risk factor = likelihood × consequence
This is the quantitative approach. A common scale runs 0 to 5 on each side:
| Value | Likelihood | Consequence |
|---|---|---|
| 0 | No likelihood | No injury or loss |
| 1 | Very unlikely | Treated by first aid |
| 2 | Unlikely | Up to 3 days off work |
| 3 | Likely | More than 3 days off |
| 4 | Very likely | Specified major injury |
| 5 | Certainty | Fatality |
The product falls into a band, and each band carries an action: 1 to 6 minor, monitor closely; 8 to 15 significant, take immediate control action; 16 to 25 critical, all activities must stop until the risk is reduced.
Take the loft. Access by portable ladder to an unboarded loft: likelihood 3, consequence 4, so 3 × 4 = 12 — significant, immediate control action. Add basic training, a ladder inspected for condition and grade, secured top and bottom, extending far enough into the loft for a safe descent, a boarded area to stand on, lighting and the right PPE, and it reassesses at likelihood 1 and consequence 0. That before-and-after pair is the whole point of scoring: it is evidence the controls do something.
The qualitative method does the same job with priority categories. Likelihood and severity each score 1 to 3 — probable 3, possible 2, remote 1; death or hospitalisation 3, over-3-day injury 2, under-3-day injury 1 — and the bands are low 1 to 2 (leave until last), medium 3 to 4 (set a completion date) and high 6 to 9 (act now). Purging a gas pipe shows both ends on one form: tested system, supervised apprentices and a sectioned-off area score 1 × 1, but the moment gas is released to air the step is high and gets no naked flames, no switching and intrinsically safe equipment only.
The hierarchy of control
A control measure removes a hazard or reduces the risk from it, and controls are not equal. They are chosen in a set order, because the top of the list changes the job while the bottom only protects the person if they use it correctly every time.
| Order | Control | Plumbing example |
|---|---|---|
| 1 | Eliminate | Prefabricate at the bench so nobody solders in the loft |
| 2 | Substitute | Press fittings instead of a naked flame; propylene glycol instead of ethylene |
| 3 | Engineering | Guards, trench supports, a tower instead of a ladder, extraction |
| 4 | Administrative | Safe systems of work, permits, training, sequencing, signs, barriers, supervision |
| 5 | PPE | Goggles, gloves, respirator, harness |
PPE is the last resort, used where the risk cannot be adequately controlled another way — it protects only the wearer, only while worn, and it fails silently. Controls that protect everybody beat controls that protect one person: a barrier round an opening protects the joiner who never read the assessment.
The same shape appears throughout the regulations in different words: manual handling is avoid, assess, reduce; work at height is avoid, prevent, reduce; substances are prevent exposure or, where prevention is not reasonably practicable, adequately control it. They all say the same thing — change the job before you change the person.
Whatever you do, something is left over. The residual risk is what remains once the controls are in place, and it must be small enough to accept and clearly communicated. Controls also have to be maintained: a barrier moved for a delivery and not replaced, a guard removed because it slows the job, a harness left in a van with a paint tin — each is a control that exists on paper and not in fact.
Writing it down and signing it
The duty to assess sits with the employer, under the Management Regulations, which require a suitable and sufficient assessment of all work activities. Whoever actually carries it out must be competent. The construction regulations cover domestic jobs too, and a domestic client's duties pass to the contractor. An apprentice does not write the assessment — but must know how to follow it and say so when the job on the ground is not the job on the paper.
Formats vary, but the same headings appear: the job (company, location, a description such as installing a WC pan and cistern, the date, the equipment); the hazards, one plain line each; the harm, as "leading to a risk of"; who is at risk; existing measures; the risk rating; further action required with action by whom and by when and a date completed; and the sign-off — work completed by, checked by supervisor, approved by, each with a name, signature and date. Many forms carry a young persons section asking whether the person needs supervision, lacks experience or is new to work: that is the Management Regulations duty on paper.
Three habits separate a working assessment from a filed one. Keep it simple, because the people doing the job have to understand it. Keep it specific — "portable ladder to unboarded loft, hatch above stair void" tells you something, "working at height" does not. And share it: everyone doing the work including the apprentice, the supervisor who approves it, anyone else affected, and the client or principal contractor, who will normally ask before you set foot on site. Keep a copy on site with the job.
Reviewing and reassessing
Review is step five, and it is the step that keeps the other four honest. Review at a planned interval (many firms annually as a minimum, with review dates diaried on a maintenance plan); before returning to a job you have not seen for a while; when the work changes; when the place changes; when the people change; after an accident, near miss or dangerous occurrence; and whenever a control fails.
An accident is proof the assessment was wrong, incomplete or not being followed, so it triggers a sequence: make it safe and deal with the injured person, stop work in that area; record it in the accident book and preserve a serious scene; report it where the law requires (deaths, specified injuries, over-seven-day injuries, certain diseases and dangerous occurrences); investigate which control was missing, defeated or inadequate; revise the assessment and set who does what by when; re-brief everybody, and check later that the change stuck. A near miss gets the same treatment — it is the cheapest warning you will ever get.
Dynamic risk assessment is the continuous check a competent worker makes on the job in front of them: does what I am looking at still match what was assessed? A hidden cellar under a floor you were told was solid, a live cable in a chased wall, an unexpected board that could be asbestos, rain arriving while you are on a roof. When the answer is no the rule is short: stop, make the area safe, and tell the supervisor. Work restarts once the assessment and method have been amended and the gang told. If asbestos is encountered, work in that area stops immediately and an alternative phase of the job is started — which is exactly why a supervisor keeps the work programme in mind.
🔢 The numbers worth memorising
- Five steps
- Identify hazards; who might be harmed; evaluate risks and decide precautions; record and implement; review
- Risk factor
- Likelihood × consequence
- Quantitative bands
- 1–6 minor, monitor; 8–15 significant, act immediately; 16–25 critical, stop work
- Qualitative bands
- Low 1–2, medium 3–4, high 6–9
- Duty to record
- Legal requirement where five or more people are employed
- Hierarchy of control
- Eliminate, substitute, engineering, administrative, PPE
- Loft example
- 3 × 4 = 12 before controls, 1 × 0 after
⚠️ Where people go wrong
- Saying recording is step three,Step three is evaluate the risks and decide on precautions. Recording is step four.
- Naming the wrong harm,Asbestos harms by inhaling the dust, not by contact. The harm you name decides the control.
- Reaching for PPE first,PPE is the last resort in the hierarchy — it protects only the wearer, only while worn.
- Thinking the law demands zero risk,The duty is everything reasonably practicable, not the elimination of every risk.
- Assessing only your own gang,Persons affected includes other trades, occupants, the public and whoever comes next.
- Carrying on when the job does not match the paper,Stop, make it safe and tell the supervisor. With suspected asbestos, stop that area immediately.
📝 10-Question Self-Test
Straight from the Level 3 course question bank. Click an option to see whether you got it right — the explanation appears instantly, and there is nothing to submit.
Excavations combine collapse, buried live services and oxygen-deficient or gassy air, and any one of those can kill, so the risk is the highest of the four. Risk is likelihood multiplied by severity, and burial has an extreme severity. Working in a cold environment needs managing too, but it rarely kills anyone.
The harm from asbestos comes from breathing the fibres, which lodge in the lungs and cause disease decades later, so inhaling the dust is the significant hazard and every control is aimed at keeping fibres out of the air. Splashes damaging the eyes is a genuine hazard of other materials, but asbestos does its damage once airborne and inhaled.
Water on a floor makes the surface slippery, so the harm is a slip and the fall that follows — still one of the commonest causes of injury on site. Risk of a fall from height is tempting because a fall is involved, but this is a fall on the level; there is no height in the hazard described.
A battery drill runs at extra-low voltage with no mains connection to the tool at all, so wet conditions cannot give a mains shock. A 230 V Class II drill is double insulated and safer than an earthed metal one, but its flex still carries 230 V into the wet area, and a damaged lead there is exactly the risk you are trying to remove.
This is a two-pole voltage indicator: permanently attached fused leads, finger guards and shrouded probes with no more than 4 mm of metal exposed. That is the pattern HSE guidance note GS38 asks for; the lamps marked in steps from 24 to 690 volts are a feature of the common two-pole detector rather than a GS38 requirement. A clamp-on ammeter reads current through a jaw clipped round a single conductor and has no probes at all.
Cast iron is heavy, is fitted at height and the work depends on the weather; those are the safety considerations. The bolt type is a fitting detail.
Prove, test, prove. The voltage indicator is proved on a known live source or a proving unit, then used to show the circuit is dead, then proved again on that same known source. The second proving is the one people drop, and it is the one that matters: an indicator that failed at some point during the test would read dead on a live circuit, and without proving it afterwards there is no way of knowing.
Teaching lifting technique instead of removing the lift is the common error.
Avoid, assess, reduce — technique and equipment are controls that follow the assessment.
Contain first — once it reaches a drain it is somebody else's problem and your offence.
Going further: the lessons behind this article
This article is the public answer. Unit 336 of the Level 3 course takes the same ground to the depth the exam and the synoptic assignment ask for, in 6 lessons:
- Hazard and risk: telling the two apart
- The five steps of a risk assessment
- Ranking the risk: likelihood times severity
- Control measures and the hierarchy of control
- Writing it down: forms, formats and who signs
- Reviewing and reassessing: keeping it true
- Site procedures: the Unit 336 guide — every article on this unit in one place
- All PlumbMate articles — Level 1, 2 and 3
- The Level 3 course — the whole 8202-35 Diploma