How to Write a Risk Assessment in Ireland

What a risk assessment actually is

A risk assessment is a careful, written look at what in your workplace could cause harm to people, so you can decide whether you have done enough to prevent it. It is not a one-off form to be filed and forgotten. It is a living record that shows you have identified the hazards, judged how serious the risks are, and put sensible controls in place.

In Ireland, the term has a precise legal meaning. The Health and Safety Authority (HSA) defines a hazard as anything with the potential to cause harm, and a risk as the likelihood that the hazard will actually cause harm, combined with how severe that harm could be. Writing it down forces you to think clearly about both.

The legal duty: section 19 of the 2005 Act

The obligation to assess risk comes directly from the Safety, Health and Welfare at Work Act 2005. Section 19 of the Act requires every employer to identify the hazards in their place of work and to assess the risks presented by those hazards. This duty is not optional and it is not limited to large companies — it applies to a sole trader with one employee just as it applies to a multinational.

The risk assessment then feeds directly into your Safety Statement, the separate document required under section 20 of the same Act. Think of section 19 as the analysis and section 20 as the written declaration that captures it. The two are inseparable: you cannot write a credible Safety Statement without first carrying out the section 19 assessment.

A risk assessment that exists only in your head is worth nothing to an inspector, and nothing to the employee who gets hurt. Write it down, date it, and act on it.

The format the HSA expects

There is no single mandatory template, but a good risk assessment in Ireland almost always records the same core information. The General Application Regulations 2007 set out the detailed requirements that sit beneath the Act, and a clear table satisfies them comfortably. Each row should cover:

• The hazard — what could cause harm (for example, a wet floor, a manual lifting task, or exposed electrical wiring).
• Who might be harmed and how — employees, visitors, contractors, members of the public.
• Existing controls — what you already do to reduce the risk.
• The risk rating — usually a simple low/medium/high judgement combining likelihood and severity.
• Further action needed — additional controls, who is responsible, and a target date.

For a deeper walk-through of the method itself, our guide to the five steps to risk assessment breaks the process into manageable stages.

A worked example

Imagine a small café in Galway. One obvious hazard is hot liquids being carried across a busy floor. Here is how a single line of the assessment might read:

• Hazard: Scalding from hot drinks and spillages.
• Who and how: Staff and customers — burns, and slips from spilled liquid.
• Existing controls: Spill-proof lids on takeaway cups; non-slip flooring; staff carry no more than two hot items at once.
• Risk rating: Medium.
• Further action: Add a "Caution: Hot Surfaces" sign at the counter; refresher training for new staff within their first week. Owner responsible; complete within one month.

That single row demonstrates the whole logic of a risk assessment: a real hazard, the people exposed, what is already in place, an honest rating, and a concrete next step with an owner and a date.

Common mistakes to avoid

The most frequent failing is copying a generic template without tailoring it to your actual premises and tasks. An assessment that does not reflect your real work is not a defence — it is evidence that you did not look properly. The second most common error is never reviewing it. The third is writing actions with no name and no deadline beside them, so nothing ever gets done.

Once you can write one good risk assessment, the rest follow the same pattern. Formal training makes the method second nature and gives you a certificate to show you understand the legal requirements.