The Five Steps to Risk Assessment
Risk assessment becomes simple once you break it into five clear steps. Here is the proven Irish method — identify hazards, decide who is at risk, evaluate and control, record, and review — explained in plain English.
Why a five-step method works
Risk assessment can feel daunting until you break it into stages. The five-step approach is widely used across Irish workplaces because it turns a vague legal obligation into a clear sequence anyone can follow. Each step builds on the last, so by the time you reach the end you have a record that satisfies the Health and Safety Authority (HSA) and, more importantly, actually keeps people safe.
The duty itself comes from section 19 of the Safety, Health and Welfare at Work Act 2005which requires every employer to identify hazards and assess the risks they create. The five steps below are simply a practical way of meeting that duty.
Step 1: Identify the hazards
Walk through your workplace and look at everything that could realistically cause harm. A hazard is anything with the potential to injure or make someone ill — slippery floors, manual lifting, machinery, chemicals, electricity, noise, or even long hours and stress.
Do not rely on memory alone. Talk to your staff, who often spot hazards a manager misses, and check accident records and near-miss reports for patterns. Manufacturers' instructions and safety data sheets for chemicals are another valuable source, and it helps to think about hazards in categories — physical, chemical, biological, ergonomic and organisational — so nothing is overlooked. A short, structured walk-round with a checklist almost always surfaces risks that have become invisible through familiarity.
Step 2: Decide who might be harmed and how
For each hazard, name the people at risk and describe the harm. This is not about listing everyone individually but identifying groups — and especially those who may be more vulnerable:
- New or young workers and trainees.
- Pregnant employees and new mothers.
- Lone workers and night-shift staff.
- Visitors, contractors and members of the public.
Being specific here — "a chef could suffer a back injury lifting heavy stockpots" — makes the next steps far easier.
The aim is not to eliminate every risk, which is impossible, but to reduce each one so far as is reasonably practicable. That phrase sits at the heart of Irish safety law.
Step 3: Evaluate the risks and decide on controls
Now judge how likely each hazard is to cause harm and how serious that harm could be. A simple low, medium or high rating is enough for most workplaces. Then ask whether your existing controls are adequate, or whether more is needed.
Irish best practice follows the hierarchy of control, working from most to least effective:
- Eliminate the hazard entirely if you can.
- Substitute it for something safer.
- Apply engineering controls such as guards or ventilation.
- Use administrative controls like training, signage and safe procedures.
- Provide personal protective equipment as a last line of defence.
For more detail on turning this into a written document, see our guide on how to write a risk assessment in Ireland.
Risk Assessment training from €35
Self-paced, HSA-aligned, certificate the same day — €35 per person.
Step 4: Record your findings
Write everything down. In Ireland your findings feed directly into the Safety Statement required by section 20 of the 2005 Act, so a clear record is not optional. The General Application Regulations 2007 expect each entry to show the hazard, who is at risk, the controls in place and any further action needed, with a named person and a deadline.
A risk assessment with actions but no owner and no date is the most common way good intentions quietly disappear. Keep the language plain so that the people who actually do the work can read and understand it, and keep older versions on file — being able to show how your controls have improved over time is exactly the kind of evidence the HSA looks for.
Step 5: Review and update
A risk assessment is never finished. Review it regularly and always after a significant change — new equipment, a new process, an accident, or a near miss. If circumstances have changed, the assessment must change too. Set a fixed review date so it never drifts.
Key takeaways
- The five steps are: identify hazards, decide who is harmed, evaluate and control, record, and review.
- They are a practical way to meet the section 19 duty under the 2005 Act.
- Always reduce risk so far as is reasonably practicable using the hierarchy of control.
- Record your findings in your section 20 Safety Statement, with owners and deadlines.
- Review whenever something changes — the assessment is a living document.
Master these five steps and you have the core skill behind every compliant Irish workplace. Formal training reinforces the method and gives you a certificate to prove it.
