How to Write a Construction Risk Assessment: Step-by-Step UK Guide (2025)

A construction risk assessment is a legal document. Get it wrong and you are not just failing a PC's paperwork check — you are leaving workers exposed to hazards that UK law requires you to have anticipated and controlled. This guide anchors every step to its governing regulation, provides a regulation-mapped reference table, and works through a complete high-risk scenario: a roofing contractor accessing a pitched roof with suspected fragile roof lights.

---

What a Construction Risk Assessment Is — and Why the Law Requires One

A risk assessment is a structured record of the hazards present in a task, who could be harmed, and what you are doing about it. It is not the same as a method statement. A method statement sets out the sequence of work; a risk assessment evaluates the dangers within that sequence. When the two documents are combined into a single package they are called a RAMS (Risk Assessment and Method Statement).

The Construction (Design and Management) Regulations 2015 (CDM 2015) govern health and safety duties across UK construction projects. (CDM 2015) Under CDM 2015, clients, principal designers, principal contractors, and contractors each carry defined duties. For contractors — including self-employed tradespeople — that means assessing and controlling the risks created by their own work and co-operating with the principal contractor's site-wide health and safety arrangements.

CDM 2015 is the overarching framework, but it sits alongside a suite of task-specific regulations. Each hazard category you encounter on a construction site has its own governing instrument. Knowing which regulation applies to which hazard is the foundation of a legally grounded risk assessment.

---

The Regulation Lookup Table — Seven Hazard Categories Mapped to Their Governing Law

Most guidance lists hazards. This table tells you why each control is legally required, not just best practice.

Hazard category	Governing UK regulation	What the regulation requires you to address
Falls from height	Work at Height Regulations 2005	Plan, supervise and carry out work at height safely; apply the hierarchy of controls (avoid, then collective protection, then personal fall protection)
Hazardous substances	Control of Substances Hazardous to Health Regulations 2002 (COSHH)	Assess health risk from substances; prevent or adequately control exposure
Asbestos	Control of Asbestos Regulations 2012	Identify presence; assess exposure risk; apply control measures; licence where required
Manual handling	Manual Handling Operations Regulations 1992	Avoid hazardous manual handling where reasonably practicable; assess remaining tasks
Lifting equipment	Lifting Operations and Lifting Equipment Regulations 1998 (LOLER)	Ensure lifting operations are properly planned, supervised and carried out safely
Work equipment	Provision and Use of Work Equipment Regulations 1998 (PUWER)	Ensure equipment is suitable, maintained and used safely
Confined spaces	Confined Spaces Regulations 1997	Avoid entry where possible; implement safe system of work and emergency arrangements
Noise	Control of Noise at Work Regulations 2005	Assess noise exposure; eliminate or control exposure; provide hearing protection
Fire / dangerous substances	Regulatory Reform (Fire Safety) Order 2005 and DSEAR 2002	Assess fire risk and risks from dangerous substances or explosive atmospheres
Electricity	Electricity at Work Regulations 1989	Ensure electrical systems and work activities involving electricity are safe

Use this table as your opening checklist: for each hazard you identify in Steps 2–3, locate its row and make sure the controls you record satisfy that instrument.

---

Step 1 — Define the Scope: Task, Location, and Who Is Affected

Before you write a single hazard row, state precisely:

• The task: not "roofing work" but "stripping and replacing plain tiles on a 35° pitched roof, including ridge work, using a scaffold platform and ladders for access."
• The location: site address, specific area of the site, proximity to other trades and the public.
• The duration: start date, planned completion, and any phasing.
• Who is affected: your own workers, subcontractors, other trades working in the same zone, visitors, and members of the public (including children near the site boundary).

Scope definition determines which regulations apply. A task that involves a substance on the COSHH radar but takes place in a confined space triggers both COSHH 2002 and the Confined Spaces Regulations 1997. Narrow the scope too far and you miss overlapping duties.

---

Step 2 — Identify the Hazards: Construction-Specific Prompt List

Work through the following categories systematically. Do not rely on memory — use this prompt list on site.

• Falls from height — unprotected edges, fragile roof lights, asbestos cement sheets, leading edges, openings in floors
• Falling objects — materials dislodged from height, tools dropped from scaffolding, overloaded working platforms
• Hazardous substances — cement, solvents, bitumen fumes, silica dust from cutting — governed by COSHH 2002
• Asbestos — any pre-2000 building may contain asbestos-containing materials; the Control of Asbestos Regulations 2012 require identification before disturbance
• Manual handling — lifting roof tiles, sheet materials, scaffold components
• Lifting equipment — cranes, hoists, telehandlers, gin wheels — all governed by LOLER 1998
• Work equipment — angle grinders, circular saws, disc cutters — governed by PUWER 1998
• Confined spaces — roof voids, inspection chambers, drainage runs — governed by the Confined Spaces Regulations 1997
• Noise — disc cutting, breaking out, power tools — governed by the Control of Noise at Work Regulations 2005
• Electricity — overhead lines near the working area, buried services, temporary site supplies — governed by the Electricity at Work Regulations 1989
• Fire and explosion — LPG for hot-works, fuel storage — governed by the Regulatory Reform (Fire Safety) Order 2005 and DSEAR 2002

HSG33 trigger point: According to HSG33 — Health and safety in roof work, roof work accounts for a quarter of all deaths in the construction industry, and falls through fragile materials such as roof lights and asbestos cement roofing sheets account for more of those deaths than any other single cause. Importantly, not all the people killed while working on roofs are trained roofers — many are maintenance workers accessing roofs. (HSG33) This means your hazard identification must capture fragile surfaces even if the person ascending the roof is not a specialist roofer.

---

Step 3 — Decide Who Might Be Harmed and How

For each hazard, name the categories of person at risk:

• Direct workers: operatives physically doing the task
• Nearby workers: other trades working below, alongside or above
• Supervisors and visitors: people entering the work zone
• Members of the public: pedestrians, residents adjacent to the site
• Vulnerable persons: young workers, new starters, workers with relevant health conditions, members of the public who cannot read site signage

Be specific about the mechanism of harm. "Fall from height" is a hazard; "operative falls through fragile roof light, striking the internal floor" is the mechanism — and the mechanism determines the severity rating you apply in Step 4.

---

Step 4 — Evaluate Risk and Record Existing Controls

Risk scoring

Use a likelihood × severity matrix. Both axes typically run 1–5:

• Likelihood: 1 = very unlikely / 5 = almost certain
• Severity: 1 = minor first aid / 5 = fatality or permanent disability
• Inherent risk score = likelihood × severity before controls are applied
• Residual risk score = likelihood × severity after controls are applied

There is no statutory scoring matrix prescribed by UK regulation — but whatever system you use, it must be consistent across all rows of the document, and the residual score must be demonstrably lower than the inherent score as a result of the controls you record.

Existing controls

Record controls that are already in place before you write the assessment — not controls you intend to introduce. Existing controls reduce the inherent score to the residual score. Controls you still need to implement are captured in Step 6.

---

Step 5 — Record Your Findings: The Annotated Template Fields

A legally sufficient written record contains the following fields. The guidance note alongside each field states what standard it is designed to satisfy.

Field	What to write	Guidance note
Task / activity	Specific work activity, not a trade label	Satisfies the scope requirement — assessments must be task-specific
Hazard description	The agent or condition that can cause harm	Triggers the regulation lookup — determines which instrument governs the control
Persons at risk	Named categories (operatives, public, etc.)	Required to identify all those who might be harmed
Inherent likelihood (1–5)	Score before any controls	Establishes the baseline risk level
Inherent severity (1–5)	Score before any controls	Combined with likelihood to produce the inherent risk rating
Inherent risk rating	L × S	Prioritises which hazards need the most robust controls
Control measures	Specific, named controls citing the governing regulation	The legal substance of the document — vague controls are unenforceable
Residual likelihood (1–5)	Score after controls	Demonstrates controls are effective
Residual severity (1–5)	Score after controls (usually unchanged — controls reduce likelihood, not the severity of the worst-case outcome)
Residual risk rating	L × S	Must be lower than inherent rating
Responsible person	Named individual, not a job title alone	Fixes accountability for implementing and monitoring each control
Review trigger / date	Named circumstance or scheduled date	Satisfies the requirement to keep the assessment up to date

---

Step 6 — Implement Further Control Measures Mapped to Their Governing Regulation

Where your residual risk remains unacceptably high, you must introduce additional controls. Record them here, with the responsible person and implementation date. Map each control to its governing regulation using the table in the opening section.

Key principle for work at height: The Work at Height Regulations 2005 establish a hierarchy that must be followed in order — you must first consider whether the work at height can be avoided altogether; if it cannot be avoided, you must use collective protective measures (such as edge protection, scaffolding, or safety nets) before resorting to personal fall protection equipment such as harnesses and lanyards. Personal fall protection is the last resort, not the first response. (Work at Height Regulations 2005)

Asbestos: The Control of Asbestos Regulations 2012 require the presence of asbestos to be identified before work that might disturb it begins, and to assess the exposure risk before proceeding. (Control of Asbestos Regulations 2012) If your risk assessment identifies suspected asbestos-containing materials, the control measure is to stop, commission a survey, and not proceed until the result is known.

Ladders: According to the HSE's construction ladders guidance, the user must carry out a pre-use check before using a ladder for a work task, and again after something has changed — for example, if the ladder has been dropped or moved from a dirty area to a clean area — so that any immediate or serious defects are caught before they cause an accident. (HSE — Safe use of ladders and stepladders (construction)) This is not optional best practice; record it as a named control and state who is responsible for conducting and recording the check.

---

Step 7 — Review and Update: Five Triggers That Require Reassessment

A risk assessment is not a one-time document. Use the following checklist to determine when yours must be revisited.

Review Trigger Checklist

• Significant change in scope — the task, method, location or equipment changes materially from what was originally assessed
• New hazard identified on site — a hazard emerges during the work that was not present or foreseeable at the time of the original assessment (e.g. discovery of suspected asbestos-containing material during stripping)
• Near-miss or accident — any incident that reveals a control measure was insufficient or was not being followed
• Change in workforce composition — a new subcontractor, a young worker, or an operative with a relevant health condition joins the task
• Scheduled review date reached — the review date set in the original document has elapsed, regardless of whether anything else has changed

When any trigger is met, the responsible person named in the document must review, update, re-sign, and re-issue the assessment before work continues.

---

Worked Example: Roofing Contractor on a Pitched Roof with Suspected Fragile Roof Lights

Why this scenario? HSG33 records that falls through fragile materials are the single largest cause of roof work deaths in the UK construction industry. (HSG33) The Work at Height Regulations 2005 define "work at height" as work in any place where, if there were no precautions in place, a person could fall a distance liable to cause personal injury — there is no minimum height threshold in the definition. (HSE INDG401) The scenario below is therefore high-risk from the moment a foot leaves the ground.

---

Project: Re-tiling of a residential extension — 35° pitched roof, approximately 7 m ridge height
Task: Access and tile-stripping across the full roof slope, including the ridge; two suspected translucent roof lights in the lower slope identified during pre-start survey
Assessor: [Name, qualification]
Date: [Date]
Review date: [Insert — or earlier if any trigger above is met]

---

Field	Content
Hazard description	Fall through fragile roof lights (translucent panels, suspected polycarbonate or GRP) during tile stripping; fall from unprotected roof edge; fall from access ladder
Persons at risk	Roofers (2 operatives); ground workers below; members of the public if site boundary is adjacent to a public footpath
Inherent likelihood	4 (fragile surface not yet clearly marked or protected; access ladder in use)
Inherent severity	5 (fall from 7 m through fragile surface onto hard substrate — high probability of fatality or life-changing injury)
Inherent risk rating	20 — HIGH
Control measures	1. Avoid (hierarchy step 1): Assess whether tile stripping can be carried out from inside the roof space to eliminate external access over the fragile panels. If not possible, proceed to step 2. 2. Collective protection (hierarchy step 2): Erect a fully boarded independent scaffold with double guard-rails and toe-boards to the eaves before any operative accesses the roof, in accordance with the Work at Height Regulations 2005 (Schedule 3 — requirements for working platforms) and the requirements for guard-rails and similar collective means of protection (Schedule 2). Do not substitute collective protection with personal fall protection unless it is not reasonably practicable to provide it. Lay crawling boards across the full slope including over the fragile roof light zones before work begins; mark the location of roof lights with high-visibility warning tape visible from the ridge. 3. Fragile surface controls: Treat the roof lights as fragile surfaces — Regulation 9 of the Work at Height Regulations 2005 governs work on or near fragile surfaces. Boards must span the roof lights and extend beyond them; no operative to step directly onto any translucent panel. 4. Personal fall protection (hierarchy step 3 — last resort only): Where any work cannot be completed from the scaffold platform or crawling boards, operatives to wear a correctly fitted and inspected fall arrest harness with a lanyard anchored to a suitable anchor point rated for the load; harness and lanyard must be inspected before use and records retained. 5. Asbestos: Translucent sheets could be asbestos cement — do not disturb until surveyed. Operate under Control of Asbestos Regulations 2012: commission a refurbishment/demolition survey of the roof lights before any stripping. If asbestos-containing materials confirmed, stop and engage a licensed contractor. 6. Ladder pre-use check: Access ladder to be checked by the user before each period of use and again after any change in condition (e.g. if moved across the site or knocked over), per HSE construction ladders guidance. Record of check to be made in the site inspection log. 7. Exclusion zone: Establish a clearly signed ground-level exclusion zone directly below the working area, sized to capture the potential fall radius; maintain throughout the work. 8. Competence: All operatives must have demonstrated competence for the task — only workers with appropriate training and experience in roofing and work at height to be permitted on the roof. HSE guidance explains that work at height must be properly planned, supervised and carried out by competent people with the skills, knowledge and experience to do the job.
Residual likelihood	1
Residual severity	5 (the severity of a fall through a fragile roof at height does not change; controls reduce the likelihood of the fall occurring)
Residual risk rating	5 — LOW
Responsible person	[Named site supervisor / working foreman]
Review trigger	Discovery of additional fragile materials; near-miss; change in operatives; survey result confirming asbestos; scheduled review date

---

How a Risk Assessment Fits Into a RAMS Document and CDM 2015 Obligations

A risk assessment and a method statement are distinct documents. The risk assessment answers: what could go wrong and what will stop it? The method statement answers: in what order will the work be done, and how? Bundling them into a RAMS does not make them interchangeable — a PC reviewing your RAMS expects to see both components, each complete in its own right.

Under CDM 2015, contractors have defined duties in relation to health and safety at the construction phase. (CDM 2015) The principal contractor is responsible for coordinating health and safety across the site; individual contractors are responsible for managing the risks created by their own work. A task-specific risk assessment is the primary evidence that a contractor has discharged that responsibility. Without it, the contractor cannot demonstrate compliance — and in the event of an incident, cannot show that the risk was identified and controlled.

---

Who Can Write a Construction Risk Assessment: Competence Requirements

There is no prescribed qualification that makes a person competent to write a construction risk assessment, but competence has a practical meaning: the person must have sufficient knowledge of the task, the hazards it generates, and the controls available to eliminate or reduce them.

For higher-risk activities — work at height, asbestos, confined spaces, lifting operations — the assessor must understand the specific regulations that apply. An assessor who does not know that the Work at Height Regulations 2005 establish a hierarchy of controls, or that the Control of Asbestos Regulations 2012 require a survey before disturbance, cannot produce a legally grounded document.

In practice, competent authors include: experienced site managers, competent trade supervisors, health and safety advisers with relevant construction knowledge, and self-employed tradespeople who have undergone trade-specific training covering the relevant risks. The document must be signed by the author and countersigned by the responsible person who will implement the controls on site.

---

How ramsdocs Helps You Produce PC Review-Ready Construction Risk Assessments

ramsdocs is purpose-built for UK contractors who need to produce risk assessments and method statements that satisfy principal contractor and client requirements. The platform structures your document around the seven-step process set out in this guide, prompts you for task-specific hazards using the regulation-mapped categories above, and stores completed RAMS with version control so that your review trigger dates are tracked automatically.

Every document produced using ramsdocs must still be reviewed and adapted to your specific site, task, and workforce by a competent person before issue. ramsdocs structures the process — the competent judgement is yours.

---

Frequently Asked Questions

Q: Is a construction risk assessment legally required?
A: Yes. CDM 2015 imposes health and safety duties on contractors, including the obligation to manage the risks created by their work. Task-specific risk assessments are the primary mechanism for discharging that duty and for demonstrating compliance to a principal contractor or the HSE.

Q: Does "work at height" only apply above a certain height?
A: No. The Work at Height Regulations 2005 define "work at height" as work in any place where, if there were no precautions in place, a person could fall a distance liable to cause personal injury. (HSE INDG401) There is no minimum height threshold in the definition.

Q: What is the difference between a risk assessment and a method statement?
A: A risk assessment identifies hazards, evaluates who might be harmed, and records the controls that reduce the risk. A method statement sets out the sequence and method of work. Together they form a RAMS. They must not be treated as interchangeable — each component must be complete in its own right.

Q: When must a risk assessment be reviewed?
A: At any of the five trigger points listed in Step 7: significant change in scope, new hazard identified, near-miss or accident, change in workforce composition, or the scheduled review date being reached.

Q: Who is responsible for producing a risk assessment on a CDM project?
A: Each contractor is responsible for assessing and controlling the risks arising from their own work. The principal contractor coordinates across all contractors and may require each to submit task-specific risk assessments before work begins.

Q: Can a self-employed tradesperson write their own risk assessment?
A: Yes, provided they are competent — meaning they have sufficient knowledge of the task, the hazards it generates, and the applicable regulations. For high-risk activities such as roof work or work involving asbestos, the assessment must reflect the specific controls required by the relevant regulations.

Q: What controls are required for fragile roofs?
A: The Work at Height Regulations 2005 require you to follow the hierarchy: first avoid the work at height if possible; then use collective protective measures such as scaffolding, crawling boards, and covers over fragile surfaces; personal fall protection equipment is the last resort, not the first response. Regulation 9 of the Work at Height Regulations 2005 specifically addresses work on or near fragile surfaces. (Work at Height Regulations 2005)

Do I have to write my construction risk assessment down, or is a verbal briefing enough? Where you employ five or more people, writing it down is a legal requirement, not simply good practice: the HSE's guidance on MHSWR 1999 confirms that employers must record the significant findings of the assessment. Even if your workforce falls below that threshold, a written record is strongly advisable on construction sites — a verbal briefing leaves no audit trail if a task changes, a worker is injured, or a principal contractor requests sight of your risk documentation. In practice, most principal contractors will require a written assessment before permitting work to start on site regardless of your headcount.

---

Disclaimer: This guide and any documents produced using it must be reviewed and adapted to the specific site, task, workforce, and conditions by a competent person before use. Nothing in this page constitutes legal advice or guarantees regulatory compliance. ramsdocs documents are designed to reduce RAMS rework and support PC-review-ready submissions — they do not remove the requirement for site-specific competent review.