Why UK Workplace Risk Registers Fail an HSE Inspection

A business keeps its risk register on a spreadsheet. Each line names a risk and a rating, such as "manual handling: medium", and nobody has updated it for two years. When an inspector asks to see the assessment behind one line, and how its controls work on the shop floor, nobody can show it.

A workplace risk assessment is the employer's record of what could harm people at work, who could be harmed and how each risk is controlled. Inspectors judge that assessment, not the register. A register fails when its lines have no assessment behind them, or when it describes a workplace that has since changed.

Knowing what inspectors look for, what the law requires and how to keep assessments current means the register can show that risks are under control.

 

Why Do Risk Registers Fail Health and Safety Inspections?

Early in a visit, inspectors ask for the risk assessment, then walk the site to check that work is done the way the assessment says.

Advice from an HSE inspector is free. If the inspector finds a breach serious enough to put in writing, which HSE calls a material breach, the business pays HSE's Fee for Intervention for the inspector's time, at £188 an hour in 2026.

Nobody Owns the Register or Its Review Dates

In many spreadsheet registers, no single person is responsible for each line. Without a named owner, checks fall due unnoticed, and actions agreed after an accident stay open with no name or deadline.

Moving the register into an EHS risk management software gives every risk an owner and a review date, with a reminder before each date and a list of overdue reviews, so a missed review is visible as soon as it happens.

The Register Lists Risks With No Assessment Behind Them

A workplace risk register is a summary list of risks, usually one line each with a rating and an owner. It helps track actions, but what the law asks for is the assessment itself. A line that says "slips and trips: low" does not show who could be hurt, where, or which controls keep the risk low.

Chemicals Are Covered Only by Safety Data Sheets

Some workplaces treat a folder of supplier safety data sheets as their chemical assessment, and the folder goes out of date as suppliers revise their sheets. Workers can also struggle to find the right one. Storing the sheets in safety data sheet software keeps each one up to date and lets staff open it from a phone or a QR code poster where the chemical is used.

Even an up-to-date folder is not an assessment. HSE's guidance on COSHH (the Control of Substances Hazardous to Health Regulations) states that "a safety data sheet is not a risk assessment". Where the sheet describes what a substance can do, the assessment records how it is used on site, by whom and with which controls.

The Assessment Was Copied From a Template

HSE publishes its own free template, a sensible place to start. The trouble comes when a template is filled in with general hazards and the company name, without anyone walking the site. HSE warns that copying an example and putting your company name to it "would not satisfy the law".

The Paperwork Does Not Match the Workplace

An assessment can be detailed and still fail if the controls it lists are not in place. On paper, a machine guard may be checked every week, while the records show no check at all. Once a work process, the equipment or the layout changes, an assessment written before the change no longer describes the real risks. HSE's guidance tells employers not to rely purely on paperwork, because the aim is to control risks in practice.

Some Workers Are Left Out of the Assessment

HSE asks employers to consider young workers, new and expectant mothers and disabled workers. According to Acas, the public body that advises on workplace rights, assessments should also cover people working from home and agency workers, and a worker who tells their employer in writing that they are pregnant, breastfeeding or have given birth in the last six months needs an individual assessment.

 

Legal Requirements of Workplace Risk Assessment in the UK

Every employer must assess the risks of its work, whatever the size of the business. The duty comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999. It requires a "suitable and sufficient" assessment of the risks to employees and to anyone else affected by the work, such as visitors and contractors.

In practice, the assessment must cover the real hazards and the people at risk, with controls that match the size of each risk.

Businesses with five or more employees must write down the significant findings. The employer is responsible for the assessment and can carry it out or appoint a competent person, someone with the right training and experience, to help. Council environmental health officers enforce these rules in offices, shops, warehouses and hotels, and HSE inspectors cover factories, building sites and farms.

Some hazards and groups of workers have their own assessment rules. These include hazardous substances under COSHH, manual handling, display screen equipment such as computer screens, fire safety, young workers, and new and expectant mothers. For work-related stress, HSE's Management Standards set out what a good assessment looks at. The general health and safety risk assessment should include these or point to the separate assessments.

 

How to Do a Workplace Risk Assessment in 5 Steps (With an Example)

HSE's guidance on managing risk splits a risk assessment into five steps, and its free template is a simple way to record the findings.

1. Identify hazards. Walk around the workplace, look at each task, check accident records, read the safety data sheets for substances on site and ask workers what they find unsafe.
2. Assess the risks. Decide who could be harmed, how likely harm is and how serious it would be. Many businesses use a simple risk matrix that scores likelihood against severity to decide what to deal with first.
3. Control the risks. Remove the hazard if you can. If not, replace it with something less harmful, change the equipment or the way the work is organised, and use personal protective equipment (PPE) only after those options.
4. Record your findings. Write down the hazards, who could be harmed, the controls in place, any further action with a named person and a date, and the review date.
5. Review the controls. Check that the controls work and update the assessment when the work, equipment or staff change.

A completed line for a small warehouse could look like this:

Hazard	Who could be harmed and how	Controls in place	Further action	Who and when
Lifting boxes from delivery pallets	Warehouse staff: back injuries from heavy or awkward lifts	Trolleys available; lifting training at induction	Store heavy items at waist height; refresher training	Site manager, within one month

 

How Often Should a Workplace Risk Assessment Be Reviewed?

The law does not set a fixed review date. An assessment must be reviewed when there is reason to think it is no longer valid, or after a significant change. HSE's manual handling guidance recommends a yearly review, as a guide rather than a rule.

An assessment needs an earlier review when:

• new equipment, substances or processes are introduced
• staff change, especially when young or inexperienced workers join
• an accident, near miss or case of work-related ill health happens
• workers report that a control is not working

Each review is easier to prove to an inspector when incident reports are linked to the assessment they relate to, earlier versions are kept and workers are told when a control changes.

 

Getting Your Risk Register Ready for an Inspection

Every line in the register should point to a current assessment, and its controls should be in place on site.

The quickest check is to walk the site with the register. Look for hazards that are missing from it, controls it lists that you cannot see, and lines with no owner or with a review date that has already passed. Found this way, each gap can be fixed now, while it costs only time.