Risk Assessment Templates | UK-Compliant, Legally Mapped

A template downloaded from the internet is only as useful as the legal framework it reflects. This page gives you a risk assessment template built field-by-field around regulation 3 of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999) — the specific provision that creates the duty — together with a completed worked example, a suitable and sufficient checklist, and a review trigger table. Review and adapt every output to your specific site, task, and workforce before use.

---

What the Law Actually Requires from a Risk Assessment Template (Reg 3, MHSWR 1999)

The duty is precise. Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of:

• the risks to the health and safety of employees while at work; and
• the risks to persons not in their employment arising from the conduct of the undertaking.

Regulation 3(2) extends the same duty to relevant self-employed persons — both for their own safety and for others affected by their work.

The purpose of both provisions is identical: to identify the measures needed to comply with the relevant statutory provisions. The assessment is a means to an end, not a paperwork exercise.

Regulation 3(6) adds a recording obligation: where an employer has five or more employees, they must record the significant findings of the assessment and identify any group of employees especially at risk.

What this means for your template: Every field in a compliant template must serve reg 3 directly — capturing hazards, who is at risk, existing controls, and what further action is required. Fields that do not serve those purposes are decoration.

---

The Five Steps Every Compliant Template Must Capture

The statutory standard is suitable and sufficient (reg 3 MHSWR 1999). HSE's five-step framework — identify hazards, assess the risks, control the risks, record your findings, review the controls — is operational guidance that describes how to reach that standard in practice. It is not itself a statutory requirement, but structuring your template around these steps is the most reliable way to ensure nothing is missed. (HSE — Steps needed to manage risk)

Step	Template field it creates	What to capture
1 — Identify hazards	Hazard description	Source of harm; consider work methods, equipment, substances, work practices, premises condition
2 — Assess the risks	Who is harmed and how; likelihood; severity; risk score	All persons exposed, including contractors and visitors; rated before additional controls
3 — Control the risks	Existing controls; additional controls required	Current measures already in place; further action needed to reduce residual risk
4 — Record your findings	Assessor; date; responsible person	Who carried out the assessment; when; who owns each action
5 — Review the controls	Review date; review trigger	Scheduled date and events that bring the review forward

---

Worked Example: A Completed Template Row for a UK Office DSE Hazard

The table below shows one completed row of the Ramsdocs template, using a hybrid-worker DSE scenario. The right-hand column maps each field to the element of reg 3 MHSWR 1999 it satisfies.

How to read this: The left section is the template as a user completes it. The right column is the legal mapping — it does not appear on the document the worker sees.

---

Ramsdocs Risk Assessment Template — Worked Example Row

Template Field	Completed Entry	Reg 3 mapping
Reference	RA-2024-017	— (version control, not a reg 3 requirement but supports audit trail)
Task / activity	DSE use — hybrid worker using laptop at home desk 3 days/week	Reg 3(1) — scope: the work activity being assessed
Hazard identified	Prolonged laptop use without secondary screen or separate keyboard; inadequate seating height adjustment at home workstation	Reg 3(1)(a) — identification of risks to employees
Who might be harmed and how	Employee: upper limb disorder, neck and back musculoskeletal pain from sustained awkward posture; particularly relevant for any employee with a disclosed disability or health condition	Reg 3(1)(a) & 3(6)(b) — employees at risk; groups especially at risk
Existing controls	DSE self-assessment completed by employee; company DSE policy issued; laptop stand available on request; guidance on home workstation setup provided during induction	Reg 3(1) — identifying measures already in place
Likelihood (1–5)	3 — Possible	Reg 3(1) — assessing level of risk
Severity (1–5)	3 — Moderate	Reg 3(1) — assessing level of risk
Risk score (L × S)	9 — Medium	Reg 3(1) — overall risk level informs whether further measures are needed
Additional controls required	(1) Manager to arrange formal DSE workstation assessment for home setup within 4 weeks. (2) Provide external keyboard and mouse on request — no cost barrier. (3) Review seating adequacy; fund adjustable chair where self-assessment flags a shortfall	Reg 3(1) — identifying measures needed; reasonably practicable control
Responsible person	Line manager (named) / H&S lead	Reg 3(1) — ensuring controls are implemented
Target completion date	30 days from assessment date	Reg 3(1) — timely implementation
Assessor name	J. Smith	HSE guidance: assessment carried out by employer or competent person appointed to help
Assessment date	[auto-dated in Ramsdocs]	Reg 3(6) — recorded findings
Review date	12 months or earlier if trigger event occurs (see review table below)	Reg 3(3) — review obligation

---

How to Score Risk: Likelihood × Severity Explained

A numerical risk matrix is a practical aid — it is not a statutory requirement under reg 3 MHSWR 1999. It helps assessors articulate and compare risk levels consistently. The Ramsdocs template uses a 1–5 scale for both dimensions:

Score	Likelihood	Severity
1	Rare — highly unlikely to occur	Negligible — minor discomfort, no absence
2	Unlikely — could happen but not expected	Minor — first aid, short-term effect
3	Possible — may happen occasionally	Moderate — over-3-day injury, medical treatment
4	Likely — will probably occur	Major — serious injury, significant ill health
5	Almost certain — expected to occur regularly	Catastrophic — fatality or permanent disability

Risk score = Likelihood × Severity

Score range	Risk level	Indicative action
1–4	Low	Monitor; review at scheduled date
5–9	Medium	Apply additional controls; assign responsible person with deadline
10–16	High	Urgent action; consider stopping activity until controls in place
17–25	Very high	Do not proceed; immediate intervention required

Score the risk after accounting for existing controls to establish residual risk, and note whether additional controls reduce the score further.

---

The 'Suitable and Sufficient' Test — Five Questions Your Completed Template Must Pass

Suitable and sufficient is the statutory standard under reg 3(1) MHSWR 1999. It is not a best-practice aspiration — it is the threshold the completed template output must meet. Before filing, run through these five questions:

• 1. Are all significant hazards identified? Does the assessment cover the work methods, equipment, substances, work practices, and premises relevant to this activity? (Drawn from the hazard prompts in HSE's risk-management guidance.)
• 2. Is every group at risk named? Are employees, contractors, visitors, members of the public, and any especially vulnerable groups (e.g. young workers, new/expectant mothers, workers with disabilities) addressed where relevant to this task?
• 3. Are existing controls evaluated, not just listed? Does the template show why current measures are or are not sufficient — not just what they are?
• 4. Are additional controls specific and owned? Is each further action assigned to a named responsible person with a completion date?
• 5. Is the assessment current? Does it reflect the work as it is actually carried out today, and has it been reviewed following any trigger event under reg 3(3)?

A completed template that passes all five is in a strong position to satisfy reg 3. One that fails any of them is not a suitable and sufficient assessment regardless of how neatly it is formatted.

---

When to Review: A Trigger Table for Keeping Your Assessment Current

Regulation 3(3) MHSWR 1999 requires the assessment to be reviewed if there is reason to suspect it is no longer valid, or if there has been a significant change in the matters to which it relates. The following table operationalises that duty:

Trigger event	Review required?	Notes
Introduction of new equipment or machinery	Yes — significant change	Re-assess before the equipment enters use
Change in work process or procedure	Yes — significant change	Includes hybrid or remote working arrangements
New substance or chemical introduced	Yes — significant change	Check against existing COSHH assessment too
Incident, injury, or near miss	Yes — reason to suspect assessment no longer valid	Review even if injury was minor
Significant period of staff absence or high turnover	Consider	New workers may face risks the existing assessment assumed away
Regulatory or guidance change	Consider	Where the legal control standard changes, the assessment may need updating
Scheduled review date reached	Yes — routine	Annual review is common practice; set date at assessment stage
Young person about to be employed	Yes — reg 3(4) creates a specific obligation	Assessment must address the particular requirements of reg 3(5)

Update the assessment record with any changes made following a review, as required by reg 3(3).

---

Common Mistakes That Make a Completed Template Legally Insufficient

1. Hazards listed, risks not assessed. Writing "manual handling" as a hazard without assessing the likelihood and severity for the specific task and the specific workforce means the template has not completed step 2.
2. Controls described but not evaluated. Stating "PPE provided" without confirming whether it is adequate, worn consistently, and maintained confuses listing with assessing.
3. Generic population, not actual workforce. Reg 3(6)(b) requires identifying groups especially at risk. A template that does not address vulnerable workers where they are present is incomplete.
4. No responsible person or deadline. Additional controls without ownership are intentions, not measures. The template must record who does what by when.
5. Filed and forgotten. An assessment that has not been reviewed following a trigger event under reg 3(3) may no longer be suitable and sufficient even if it was when first completed.
6. Template mistaken for the assessment. A blank template is a starting point. The suitable and sufficient assessment is the completed, site-specific document — a downloaded form that has not been adapted to the actual task and workforce does not satisfy reg 3.

---

How Ramsdocs Risk Assessment Templates Work

Ramsdocs provides a pre-structured risk assessment template built around the field mapping above. Key features:

• Version control and auto-dating — every saved assessment is timestamped; previous versions are retained for audit purposes
• Team access — assessments can be assigned to named responsible persons and reviewed collaboratively
• Review reminders — set a review date at creation; Ramsdocs flags assessments approaching their review date or where a trigger event has been logged
• Linked document trail — connect the risk assessment to the associated method statement, COSHH assessment, or toolbox talk record within the same project

The template is PC review-ready and designed to reduce RAMS rework, but every completed assessment must be reviewed and adapted to the specific site, task, and workforce by a competent person before it is used or filed.

---

Download: Free UK Risk Assessment Template

The blank Ramsdocs risk assessment template — structured around the field mapping in this page — is available to registered users of the Ramsdocs platform. It includes:

• Blank template (all fields, with prompt text)
• Worked example row (DSE hybrid worker scenario)
• Suitable and sufficient checklist
• Review trigger reference card

Browse the 51 free task-specific RAMS templates →

---

Frequently Asked Questions

What must a risk assessment template legally contain in the UK? Under reg 3(1) MHSWR 1999, it must support identification of: the hazards, the persons at risk and how they might be harmed, the controls already in place, and the further measures needed. Where an employer has five or more employees, reg 3(6) requires the significant findings and any especially at-risk groups to be recorded.

Who is required by law to carry out and record a risk assessment? Every employer (reg 3(1)) and relevant self-employed person (reg 3(2)) under MHSWR 1999. The assessment can be carried out by the employer or by a competent person appointed to help — the template must record who did it.

What are the five steps of risk assessment? HSE identifies: identify hazards, assess the risks, control the risks, record your findings, and review the controls. These are operational guidance steps, not statutory requirements in themselves — the legal duty is to produce a suitable and sufficient assessment under reg 3.

How do you score risk inside a template? Likelihood (1–5) × Severity (1–5) = Risk score (1–25). This is an industry-standard practical tool, not a statutory requirement. It helps assessors document and justify their judgements consistently.

How often should a completed risk assessment be reviewed? Regulation 3(3) MHSWR 1999 requires review when there is reason to suspect the assessment is no longer valid, or when there has been a significant change. In practice, an annual review is common; the trigger table above lists specific events that require earlier review.

Can a template downloaded online satisfy MHSWR 1999 reg 3? Only if it is completed — not left blank — and genuinely adapted to the specific task, workplace, and workforce. A downloaded blank form is a structural aid; the suitable and sufficient assessment is the completed document that reflects real hazards, real controls, and real people.

What is the difference between a generic template and a suitable and sufficient assessment? A generic template provides structure. A suitable and sufficient assessment (the reg 3 standard) is a completed, site-specific document that identifies the actual hazards of the actual work, evaluates the actual controls in place, and assigns real actions to named people. One without the other has no legal standing.

---

Disclaimer: This page and the templates available through Ramsdocs are provided to support the production of risk assessments and are designed to reduce rework. They do not constitute legal advice and do not guarantee compliance with any regulatory requirement. Every completed risk assessment must be reviewed and adapted to the specific site, task, workforce, and circumstances by a competent person before it is used or filed. Ramsdocs accepts no liability for assessments that have not been appropriately adapted. When should I use a full RAMS template rather than a standalone risk assessment template? For low-risk, office-based activities a standalone risk assessment template is generally sufficient. For construction, maintenance, and engineering tasks — particularly higher-risk, complex, or unusual work such as steel erection, demolition, or work involving hazardous substances — a method statement alongside the risk assessment is the expected industry standard and, as HSE construction guidance notes, is a proven and practical way to plan, manage, and monitor the work. Many principal contractors and clients will also require a completed RAMS before granting site access, so producing one early is sound practice regardless of project scale.