Risk Assessment and Method Statement (RAMS): Legal Guide + Free Template

If you have been asked to produce a RAMS pack before starting work, you are dealing with one legal duty (the risk assessment) and one operationally essential document (the method statement) that together tell a principal contractor exactly how you will keep people safe. This guide explains what each document is, which regulations apply, how to produce both from first principles, and how they connect to a CDM 2015 construction phase plan — illustrated with a complete worked example you can map onto your own project.

---

What a Risk Assessment and Method Statement Actually Is — and Why the Two Documents Are Distinct

A risk assessment is a structured examination of what could cause harm in your work activities and what measures you will put in place to reduce the likelihood or severity of that harm to an acceptable level. It answers the question: what could go wrong, and how likely is it?

A method statement (sometimes called a safe system of work) translates the conclusions of the risk assessment into a step-by-step sequence of operations. It answers the question: in what order will the work be done, and which specific controls will be in place at each step?

Feature	Risk Assessment	Method Statement
Primary purpose	Identify hazards; evaluate and rank risks	Describe how work is performed safely
Statutory driver	MHaSWR 1999, reg 3	No standalone statutory instrument; fulfils control duties under MHaSWR 1999 reg 3 and CDM 2015 reg 13; commonly a contractual requirement imposed by the PC
Core output	Risk register with residual ratings	Numbered sequence of operations with controls mapped
Who produces it	Employer or competent person they appoint	Employer or competent person they appoint
When reviewed	Whenever no longer valid or after significant change	Whenever scope, method or site conditions change

The key point: neither document is sufficient alone. A risk assessment without a method statement lists problems without solutions. A method statement without a risk assessment is a work instruction without evidence that the hazards have been properly evaluated.

---

The Legal Framework: Which Regulations Require a Risk Assessment, and When Does CDM 2015 Add Method Statement Duties?

Management of Health and Safety at Work Regulations 1999 — the foundational duty

Every employer must make a suitable and sufficient assessment of the risks to their employees and to persons not in their employment arising from their work activities, for the purpose of identifying the measures needed to comply with relevant statutory requirements (MHaSWR 1999, reg 3(1)).

The same duty applies to every relevant self-employed person in relation to risks to their own health and safety and to others (MHaSWR 1999, reg 3(2)).

Where an employer employs five or more employees, they must record the significant findings of the assessment and any group of employees identified as being especially at risk (MHaSWR 1999, reg 3(6)). Note: this recording threshold is drawn directly from reg 3(6) — it does not mean smaller employers are exempt from the duty to assess; it means they are not separately obligated by that regulation to record findings. Best practice is always to record.

An assessment must be reviewed if there is reason to suspect it is no longer valid or if there has been a significant change in the matters to which it relates (MHaSWR 1999, reg 3(3)).

CDM 2015 — construction phase plan and principal contractor duties

On projects where CDM 2015 applies and a principal contractor is appointed, risk documentation becomes a prerequisite of lawful site commencement. The principal contractor — who, on projects involving more than one contractor, is appointed by the client to control the construction phase (HSE, CDM 2015: principal contractors) — must draw up a construction phase plan before setting up the construction site (CDM 2015, reg 12(1)).

That plan must set out the health and safety arrangements and site rules, taking account of the industrial activities on site (CDM 2015, reg 12(2)), and must be kept under review throughout the project (CDM 2015, reg 12(4)).

To fulfil the plan, the principal contractor must plan, manage and monitor the construction phase, coordinate health and safety matters, organise cooperation between contractors, and ensure that employers and self-employed persons apply the general principles of prevention consistently (CDM 2015, reg 13(1) and 13(3)). In practice, this means the PC needs each subcontractor's risk assessment and method statement to demonstrate that control measures align with the construction phase plan. The method statement is not expressly required by a single named statutory instrument — it is the practical mechanism by which reg 3 control duties and CDM 2015 reg 13 coordination duties are evidenced and discharged, and it is routinely a contractual condition of appointment by the PC.

---

Risk Assessment Step by Step: The HSE Five-Step Process Applied

The HSE presents risk management as a five-step process that you can complete yourself or with the help of a competent person you appoint (HSE, steps needed to manage risk).

Step 1 — Identify hazards. Walk the workplace and think about what may cause harm. Consider how people work and how plant and equipment are used, what chemicals and substances are used, what safe or unsafe work practices exist, and the general state of the premises (HSE, ibid.). Also review accident and ill-health records, and think about non-routine operations such as maintenance or changes in production cycles.

Step 2 — Assess the risks. For each hazard, decide who might be harmed and how, what you are already doing to control the risk, and what further action is needed.

Step 3 — Control the risks. Eliminate the hazard if possible; if not, apply the hierarchy of control — redesign, substitution, engineering controls, administrative controls, PPE as a last resort. You are not expected to eliminate all risk but must do everything reasonably practicable to protect people.

Step 4 — Record your findings. Document hazards, who might be harmed and how, and what controls are in place. Where an employer has five or more employees, this recording is required by reg 3(6) of MHaSWR 1999.

Step 5 — Review the controls. Revisit the assessment if there is reason to suspect it is no longer valid, or after significant change (MHaSWR 1999, reg 3(3)).

---

Method Statement Step by Step: Turning Your Risk Findings into a Safe Sequence of Work

Once the risk assessment is complete, use the hazard-control mapping to build the method statement. The structure should follow the actual sequence of operations on site, with each step annotated to show which controls from the risk assessment are active at that point.

1. Project details — site address, client, PC name, contract reference, document version and date.
2. Scope of work — describe precisely what task is covered and what is excluded.
3. Sequence of operations — numbered steps reflecting the order work actually happens; each step names the hazards present and the specific controls that apply.
4. Plant, equipment and materials — list everything to be used, with inspection/test certificates referenced where relevant.
5. PPE requirements — specify by task stage rather than issuing a blanket list.
6. Emergency procedures — nearest first-aid point, fire assembly point, emergency contacts, nearest A&E.
7. Competency and training evidence — NVQ cards, CSCS, IPAF/PASMA, COSHH awareness, relevant trade qualifications.
8. Sign-off and review — document author, competent person review, version control, workforce briefing record.

---

How RAMS Feeds into a CDM 2015 Construction Phase Plan

The construction phase plan is not a document the PC writes in isolation. It draws on the risk assessments and method statements submitted by every contractor and subcontractor on the project. The PC must ensure the plan sets out health and safety arrangements and site rules (CDM 2015, reg 12(2)) and must take account of health and safety risks to everyone affected, including members of the public, in planning and managing the measures needed to control them (HSE, CDM 2015: principal contractors).

In practical terms: your RAMS pack feeds directly into the PC's plan at two levels. First, the residual risk ratings from your risk assessment tell the PC what residual risks are present during your activity and what controls are in place. Second, your method statement sequence of operations confirms the programme interdependencies — what must be complete before you start, what trades cannot work simultaneously in your zone. If your RAMS is vague, the PC cannot accurately reflect your work in the plan, which is the most common reason documents are returned for revision.

---

Worked Example: Flat-Roof Waterproofing Subcontract — From Blank Page to Compliant RAMS Pack

Scenario: A two-person roofing subcontractor has been awarded the felt-laying (torch-on waterproofing) element of a notifiable CDM project — a new commercial unit with a flat roof at 5.2 m above finished floor level. The PC has requested a RAMS pack before the subcontractor can commence. The project involves multiple contractors, so a principal contractor has been appointed.

Part A — Risk Assessment (extract)

Ref	Task/Activity	Hazard	Who is at risk	Likelihood (1–5)	Severity (1–5)	Risk Rating (L×S)	Existing controls	Additional controls required	Residual risk	Responsible person	Review date
RA-01	Access to roof via fixed ladder	Falls from height	Operative A, Operative B	3	5	15	Fixed ladder present, ladder inspected by PC	Operative to maintain 3 points of contact; tool bag used — no materials carried by hand up ladder; ladder footed or tied	6 (L:2, S:3)	Site supervisor	Before start and after any change in method
RA-02	Torch-on felt application	Fire / burn injury from LPG torch	Operatives, adjacent trades	3	4	12	LPG cylinder secured upright in trolley; flashback arrestor fitted	Hot-work permit obtained from PC; fire extinguisher (CO₂, 2 kg) within 3 m; 30-min fire watch after work; felt roll not stored within 1 m of naked flame	4 (L:1, S:4)	Operative A	Daily and after permit expiry
RA-03	Handling felt rolls (up to 45 kg)	Manual handling injury — back/shoulder	Operatives	4	3	12	Rolls delivered to base of building	Two-person lift for all rolls above 25 kg; rolls hoisted to roof level using rope and bucket hook, not carried up ladder; operatives briefed on posture	4 (L:2, S:2)	Site supervisor	If operative reports discomfort
RA-04	Working at roof edge	Falls from height — unguarded perimeter	Operatives, persons below	4	5	20	PC has installed edge protection on three sides	Check fourth side edge protection before starting; do not work within 2 m of unguarded edge; report any defect to PC immediately; exclusion zone below maintained by PC	5 (L:1, S:5)	Site supervisor	Every morning before work begins
RA-05	LPG storage and cylinder change	Fire / explosion from gas leak	Operatives, site personnel	2	5	10	LPG supplier MSDS on site	Cylinders stored in designated external cage; no more than one spare cylinder on roof at any time; cylinder exchange by trained operative only; leak test before first use each day	4 (L:1, S:4)	Operative A	Daily

Risk rating matrix: Likelihood 1 (very unlikely) – 5 (almost certain) × Severity 1 (minor) – 5 (fatal/catastrophic). This matrix is industry best practice, not a statutory formula.

Part B — Method Statement (mapped to risk assessment)

Project details: Commercial unit, [Site address], Client: [Client name], PC: [PC name], Contract ref: [Ref], Document version: 1.0, Date: [Date]

Scope: Torch-on felt waterproofing to flat roof, two layers — vapour control and cap sheet. Excludes structural deck preparation (PC responsibility).

Sequence of operations:

1. Pre-start: Obtain hot-work permit from PC site manager. Inspect edge protection on all four sides (ref RA-04). Confirm exclusion zone below is in place.
2. Materials delivery: Two-person carry of felt rolls to base of ladder. Hoist rolls to roof level using rope and hook — no materials carried up fixed ladder (ref RA-01, RA-03).
3. LPG setup: Position cylinder trolley with flashback arrestor. Leak test. Locate CO₂ extinguisher within 3 m of working area (ref RA-02, RA-05).
4. Primer application: Brush-apply bitumen primer to deck. Allow to tack dry per manufacturer data sheet.
5. Vapour control layer: Torch-on application working away from roof edge. Maintain minimum 2 m from unguarded edges. Overlap joints per specification.
6. Cap sheet: Torch-on application, same controls as step 5. Two-person operation — one torch operative, one roll guide.
7. End of work: Extinguish torch, close cylinder valve, carry out 30-minute fire watch (ref RA-02). Secure LPG cylinder in external cage. Remove all waste felt to skip.
8. Completion: Sign off hot-work permit with PC. Record any edge-protection defects observed.

Plant, equipment and materials: LPG torch and cylinder, flashback arrestor, CO₂ extinguisher (2 kg), rope and hook, felt rolls (vapour control and cap sheet, brand/product ref), bitumen primer, roller, hand tools.

PPE: Leather gauntlets and face shield (torch work); safety footwear (steel toecap, heat-resistant sole); hard hat; hi-vis vest; knee pads. Standard PPE for all other operations.

Emergency procedures: First aid kit — Operative B (first-aider). Fire assembly point — [location per PC induction]. Nearest A&E — [hospital name and address]. PC site manager emergency number — [number].

Competency/training: CSCS cards held by both operatives; hot-works training certificate (Operative A); manual handling awareness (both). Copies attached.

Sign-off: Prepared by: [Name, position]. Reviewed by: [Competent person name]. Workforce briefing: operatives to sign below confirming they have read and understood this document before work commences.

---

RAMS Template Skeleton (Annotated, Ready to Complete)

Risk Assessment Section

Ref	Task/Activity	Hazard	Who is at risk	Likelihood (1–5)	Severity (1–5)	Risk Rating (L×S)	Existing controls	Additional controls required	Residual risk	Responsible person	Review date
e.g. RA-01	Describe the specific operation	State the hazard clearly — not the consequence	Name the groups: operatives, visitors, public	1 = very unlikely, 5 = almost certain	1 = minor injury, 5 = fatal	L × S	Controls already in place before you arrive on site	Additional controls you will implement	Revised L × S after controls	Named person accountable	Date or trigger for review

Method Statement Section

Section	What to include	Guidance note
Project details	Site address, client, PC, contract ref, document version, date	Version control is checked by PC on every submission
Scope of work	Precise description of task; explicit exclusions	Avoids scope creep disputes
Sequence of operations	Numbered steps in actual site order	Cross-reference each step to its RA ref number
Plant, equipment and materials	Full list; inspection/test cert refs	PC may ask for evidence of inspection
PPE requirements	By task stage, not a generic list	Generic lists are a common rejection reason
Emergency procedures	First-aid, fire, emergency contacts, nearest A&E	Must reflect actual site layout, not head-office defaults
Competency/training evidence	Qualifications, cards, certificates	Attach copies; don't just list
Sign-off and review	Author, competent person, workforce briefing record	Unsigned toolbox talk records are a common gap

---

10 Checks Before Submitting Your RAMS to a Principal Contractor

Use this list before every submission. A document that fails these checks is likely to be returned.

1. Version control is visible — document number, version number (e.g. v1.0), date, and author name appear on the first page.
2. A named competent person is identified — not just a company name; an individual who can be contacted to discuss the assessment.
3. Hazards are site-specific — the document references the actual site address, roof height, adjacent trades, and site-specific conditions. Generic hazard lists not tailored to the site are a common rejection reason.
4. Risk ratings are applied consistently — likelihood and severity scores are explained, and residual risk ratings reflect the controls described (not just copied from a master template without adjustment).
5. Each method statement step cross-references its RA entry — so the PC can trace every operational step back to the hazard evaluation that justifies it.
6. PPE is specified by task stage — not as a single blanket list at the end of the document.
7. The construction phase plan reference is present — confirm that site rules from the PC's plan (e.g. permit-to-work requirements, welfare locations, emergency procedures) are incorporated into your method statement.
8. Emergency procedures reflect the actual site — first-aid provision, assembly point, and nearest A&E match the site-specific details provided at induction, not your company's head-office address.
9. Competency evidence is attached or cited — training cards, qualifications, or certificates referenced in the method statement are included with the submission.
10. Workforce briefing is planned and recordable — the method statement includes a sign-off section for operatives to confirm they have read and understood the document before work starts. The PC may request evidence that briefing took place.

---

Common RAMS Mistakes That Get Documents Rejected — and How to Fix Them

Generic content not adapted to the site. The most frequent rejection reason. Fix: replace every placeholder with site-specific data before submission — site address, roof height, adjacent trades, PC contact names.

Residual risk not recalculated after controls. A risk assessment that shows a rating of 20 before controls but makes no adjustment after controls have been applied tells the PC nothing about whether the work is safe to proceed. Fix: always record a revised likelihood and severity score after additional controls have been applied.

Method statement sequence does not match actual operations. A method statement written in abstract order (e.g. "carry out work safely") rather than reflecting the actual numbered steps on this specific site is not useful for coordination under CDM 2015 reg 13. Fix: walk through the task mentally before writing; write steps in the order they will actually happen.

PPE list is not task-specific. Listing "hard hat, hi-vis, safety boots" for every step regardless of the hazard signals that the document was not written for this task. Fix: assign PPE requirements to the specific operations that require them.

No review date or trigger. An undated or unreviewed RAMS cannot demonstrate compliance with the review duty under MHaSWR 1999 reg 3(3). Fix: include a review date and a list of triggers (change of method, near-miss, change in site conditions).

Missing briefing record. Producing the document is not the same as briefing the workforce. A PC coordinating multiple contractors under CDM 2015 reg 13(3) needs to know that operatives have been told what the controls are. Fix: include a toolbox-talk sign-off sheet as the final page of every RAMS pack.

---

Frequently Asked Questions

What is the difference between a risk assessment and a method statement? A risk assessment identifies hazards, evaluates likelihood and severity, and determines what controls are needed — it is a legal duty under MHaSWR 1999 reg 3. A method statement describes the sequence of operations and embeds those controls into each work step. The method statement is not a standalone statutory requirement but is the practical mechanism for demonstrating that control duties have been discharged, and it is routinely required contractually by principal contractors.

Are risk assessments and method statements a legal requirement in the UK? The risk assessment is a statutory duty for every employer and relevant self-employed person under MHaSWR 1999 reg 3. The method statement has no single statutory instrument that mandates it by name, but it is the recognised practical tool for meeting control duties under that regulation and under CDM 2015 reg 13, and is almost universally required by principal contractors as a condition of appointment.

What regulations require a risk assessment? The foundational requirement is Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Additional task-specific regulations (for example, covering work at height, manual handling, or hazardous substances) may impose further specific assessment requirements for those activities.

When must a method statement be produced under CDM 2015? CDM 2015 does not name "method statement" as a document type. However, on any CDM project where a principal contractor is appointed, the PC's duties under reg 13 to coordinate health and safety and ensure contractors apply the general principles of prevention consistently means the PC will require evidence of how each contractor controls risk during their operations. In practice, that evidence is the method statement. On projects where the construction phase plan must be in place before work starts (reg 12(1)), the PC will typically need RAMS from subcontractors before they can authorise work to commence.

What must a risk assessment contain to be legally sufficient? MHaSWR 1999 reg 3 requires it to be "suitable and sufficient." The HSE's five-step guidance indicates it must identify hazards, assess who might be harmed and how, record existing and additional controls, note the significant findings, and include a review mechanism. Where five or more employees are employed, the significant findings and any especially at-risk groups must be recorded (reg 3(6)).

Who is responsible for producing RAMS on a construction project? Each employer is responsible for producing a risk assessment for their own work activities under MHaSWR 1999 reg 3. The principal contractor coordinates the overall construction phase plan under CDM 2015 regs 12 and 13 and takes account of health and safety risks to everyone affected by the work. Individual subcontractors produce their own RAMS covering their scope, and the PC incorporates these into the construction phase plan and ensures they are consistent with the site's general principles of prevention.

How do you complete a risk assessment step by step? Follow the HSE's five steps: identify hazards (considering how people work, equipment used, substances present, and site conditions); assess who might be harmed and how; control the risks, eliminating hazards where possible and applying the hierarchy of controls where not; record your findings; and review them when circumstances change or validity is in doubt.

How does a RAMS pack feed into a CDM 2015 construction phase plan? The construction phase plan must set out health and safety arrangements and site rules (CDM 2015 reg 12(2)) and must be kept under review (reg 12(4)). Your RAMS pack provides the PC with the specific hazard controls and operational sequence for your scope of work. The PC uses this to populate and update the plan, verify that contractors are applying consistent prevention measures (reg 13(3)), and demonstrate to the client that the construction phase is being properly managed.

Does a RAMS pack need to include a COSHH assessment as well as the risk assessment and method statement? Where your work involves substances hazardous to health — such as solvents, cement, silica dust, or process-generated fumes — a COSHH assessment is a distinct and additional requirement under the Control of Substances Hazardous to Health Regulations 2002. In practice, principal contractors routinely expect COSHH assessments to be submitted as part of the wider RAMS pack, sitting alongside rather than embedded within the task-level risk assessment. The HSE's COSHH guidance is clear that a COSHH assessment concentrates specifically on the hazards and risks from hazardous substances in your workplace, covering how workers may be exposed, how often, and what controls are needed — scope that a general task risk assessment does not fully discharge on its own.

How should COSHH assessments be structured within a RAMS pack when multiple hazardous substances are involved? A COSHH assessment is written around an individual substance or product rather than a task, so a project using several hazardous substances will require a separate assessment for each one; these are then referenced collectively within the method statement at the relevant work stages. Each assessment should identify the substance, draw on the product label and safety data sheet (SDS) to establish the hazard, and set out exposure controls — the HSE guidance notes that substances with workplace exposure limits (WELs) are hazardous to health and that exposure routes include inhalation, skin contact, and ingestion. Appending the relevant SDS documents to the RAMS pack gives site managers and operatives a single consolidated reference covering both method and chemical hazard data.

---

How RamsDocs Generates Site-Specific RAMS in Minutes

This section describes RamsDocs product capability — it is not regulatory guidance.

RamsDocs is designed specifically for UK contractors who need PC review-ready RAMS documents without starting from a blank page each time. The platform guides you through the HSE five-step process using trade-specific hazard libraries, prompts you to enter site-specific details that replace generic placeholders, and produces a two-part output — risk assessment register and method statement — in the format principal contractors expect to receive.

Documents are generated as editable outputs so that you can review and adapt them to your specific site, task, and contractor requirements before submission. RamsDocs does not remove the need for review by a competent person familiar with the actual site conditions — no software can do that. What it does is reduce the time spent on document production so that more of your time can be spent on the site-specific review that makes RAMS genuinely useful.

Start from one of the 51 free task-specific RAMS templates, or go deeper on the distinction with risk assessment vs method statement and how to write a method statement.

---

Disclaimer: This page provides general legal and practical information about risk assessments and method statements in the UK construction context. It does not constitute legal advice. All RAMS documents must be reviewed and adapted to the specific site, task, and contractor requirements by a competent person before submission or use. RamsDocs documents are designed to reduce RAMS rework and support PC review-readiness — they are not guaranteed compliant with any specific project requirement and should not be used without site-specific review.