Health risk assessment for employees explained: it is a documented, step-by-step look at what in your workplace could hurt people, how likely that harm is, and what you will do to stop it. Employers use one to prevent injury and ill health, to meet a legal duty, and to show they acted on what they already knew.
One warning before we go further. The phrase means two different things in the workplace, and mixing them up causes real trouble. In one sense it is a safety assessment about tasks, equipment and hazards. In the other it is a health questionnaire about an individual person’s health and lifestyle, often sold as part of a wellness program.
This guide covers the safety meaning first, because that is where the legal duty sits, and then explains the wellness version and how to tell them apart. Nothing here is legal or medical advice. Rules differ by country and change, so check with the regulator that covers you: the Health and Safety Executive in the UK, OSHA in the United States, your national authority under EU Framework Directive 89/391/EEC, or Safe Work Australia and your state regulator in Australia.
Table of Contents
- What Is a Health Risk Assessment for Employees?
- Why Employers Conduct Workplace Health Risk Assessments
- What Risks Does an Employee Health Risk Assessment Cover?
- How to Conduct a Health Risk Assessment for Employees
- How Are Workplace Risks Prioritized?
- What Controls Can Reduce Employee Health Risks?
- How Should Employee Feedback Be Included?
- What Should the Final Risk Assessment Report Include?
- When and How Often Should Assessments Be Reviewed?
- Frequently Asked Questions
- Is a health risk assessment for employees a medical test?
- Do employers have to do a health risk assessment for every employee?
- Can my employer see my individual health risk assessment results?
- Do I legally need a written risk assessment, and how detailed must it be?
- What is the difference between a hazard and a risk?
- How often should a risk assessment be reviewed?
- Conclusion
What Is a Health Risk Assessment for Employees?
A health risk assessment for employees is a systematic, documented process in which an employer identifies what in the workplace could cause harm to staff and others, works out how serious and how likely that harm is, and decides on controls that reduce each risk to a level it can justify. It is reviewed whenever the work, the equipment or the people change.
Two words in that sentence get mixed up more than any others. A hazard is anything with the potential to cause harm: a wet floor, an unguarded blade, a solvent, a deadline nobody can meet. A risk is what you get when that hazard meets a real task: how likely the harm is, and how bad it would be. Coffee in a kitchen is a hazard. A scalding splash on someone carrying a full mug up a stairwell is a risk, because the likelihood and the severity are both higher.
So a proper assessment covers jobs, not buildings. It applies to employees, contractors, agency staff, young workers and visitors, and it should exist for a warehouse night shift, a hospital ward and a home desk in the same way. It is not a medical exam. Nobody is being tested, and nobody is being asked to declare a diagnosis. If someone needs fitness-to-work advice or health monitoring for a specific exposure, that is occupational health work sitting alongside the assessment, not part of it.
| What it is | Occupational safety risk assessment | Wellness health risk assessment (HRA) |
|---|---|---|
| Purpose | Find workplace hazards and reduce harm to staff and others | Estimate an individual health profile and guide wellness support |
| Who runs it | Duty holder, safety lead, or a trained manager with worker input | HR or a wellness vendor, usually voluntary |
| What it collects | Tasks, equipment, substances, exposure, incidents | Self-reported lifestyle and health questionnaire, sometimes biometrics |
| Legal basis | Usually a general duty to assess and control risk | Generally none; runs on consent and data-protection rules |
| Output | Written findings, controls, owners, review dates | Risk stratification, aggregate reporting, program design |
If a document tells you how many points to lose on a blood pressure chart, it is the second kind. If it lists what could injure someone, who is exposed and what you changed as a result, it is the first.
Why Employers Conduct Workplace Health Risk Assessments
Most employers start for a blunt reason: something went wrong. A near miss on a forklift, a sprain on a wet stair, a cluster of absence in a warehouse team. After that, the reasons broaden out, and it helps to separate them because they justify different spending.
The safety case is the strongest and the least negotiable. People get hurt at work, and the harm shows up in the person first and the organisation second: a shoulder that never recovers, a hand tremor from vibration, hearing loss after years on a machine. A good assessment catches those exposures before they become chronic conditions.
The legal case is what regulators rely on. In the UK the duty holder must make a suitable and sufficient assessment, which means the record has to match the actual work and the actual risks, not a generic site template. In the United States, OSHA’s general duty clause sits alongside specific standards for noise, hazard communication, machine guarding and respiratory protection. In Australia, sections 19 and 27 of the Work Health and Safety Act 2011 place duties on primary duty holders to provide safe work and consult workers. A defensible assessment is also the document an employer reaches for after an incident, and the one a regulator or insurer will ask to see.
The business case is about time and money. Lost-time injuries, replacement and retraining, insurance premiums, and disruption when a key person cannot do their job. This is where workforce planning meets the safety file, and where a risk register is often a better fit than a full assessment.
The wellbeing case covers psychosocial risks that physical checks miss: work-related stress, burnout, bullying, workload that has crept up over a year. Mercer, in its employee wellbeing guidance, recommends that an annual health risk assessment include a mental health section covering anxiety, depression and burnout. Ignoring that is why psychosocial hazards keep ending up as a footnote.
None of this licenses an employer to profile or diagnose staff. The assessment looks at work, not at people’s bodies, and it feeds prevention rather than performance management.
What Risks Does an Employee Health Risk Assessment Cover?
Most assessments end up covering seven families of risk. The list matters less than the grouping, because a hazard that does not fit neatly into a box still has to be recorded and rated.
| Category | Examples | Typical controls |
|---|---|---|
| Physical | Noise above safe levels, vibration, heat, cold, radiation, electricity, slips and trips | Enclosure, isolation, guard rails, non-slip flooring, exposure limits |
| Chemical | Cleaning products, solvents, dust, welding fume, lead, asbestos, legionella in water systems | Substitution, local exhaust ventilation, closed delivery, monitoring |
| Biological | Blood and body fluids in healthcare, mould, sewage, infection in care homes and labs | Sharps safety, hygiene rules, vaccination, decontamination |
| Ergonomic | Manual handling, awkward postures, screen height, repetitive keyboard or mouse work | Trolleys and hoists, adjustable desks, workstation assessment, rotation |
| Psychosocial | Workload, work-related stress, bullying, harassment, aggression from the public, lone working | Workload planning, trained conflict de-escalation, check-ins, escalation routes |
| Organizational | Unclear shift patterns, no handover, fatigued workers, communication gaps between sites | Handover protocols, staffing review, supervision, near-miss reporting culture |
| Environmental | Temperature swings, poor ventilation, building moves, remote and hybrid work setups | Ventilation checks, room air and light monitoring, home-working guidance |
Physical, chemical and biological hazards
These get the most attention because they are measurable. Noise readings, air sampling, lifting weights, exposure durations. A manufacturing site will usually have hard data, and the assessment is largely a matter of comparing it against exposure limits and documenting what happens when limits are exceeded.
Healthcare settings carry a different mix. Sharps injuries, needlestick protocol breaches, exposure to respiratory viruses, and the physical load of turning and repositioning patients are the recurring items, and a great many of them are treated as ergonomic or biological rather than as accidents waiting to happen.
Ergonomic and organizational hazards
Desk-based work produces fewer injuries and more lost days than people expect, and they accumulate quietly. A monitor at the wrong height, a chair that does not fit, a laptop used as a monitor for nine hours a day, and the same call every morning for four years. The controls are cheap and the assessment is often a conversation rather than a survey.
Organizational risks are the ones that get skipped because nobody owns them. A double shift, no relief break, a team that never hands over properly, or a lone worker on a rural site with no check-in. These belong in the assessment because they are choices someone made, and choices can be changed.
Psychosocial risks: the part of a health risk assessment for employees that gets skipped
Psychosocial hazards are the ones most likely to be treated as an afterthought. Staff surveys surface them constantly, then nothing happens, and the next quarter looks identical.
The evidence base is not thin here. A systematic review by Brownson and colleagues in 2018 looked at work-related stress and found a clear link between psychosocial working conditions and mental health outcomes. Wells and colleagues, writing in 2005, set out the workload, control and support factors that predict common mental disorders at work. The practical version is plain: ask about workload, control, support, role clarity and change, and treat the answers as hazards with ratings and owners, not as feelings to be acknowledged and filed.
Remote work added its own list, and a good assessment treats a home setup the way it would treat a hot workshop: check the chair, the screen, the lighting, the hours, the isolation, and whether the person can actually take a break when the kitchen is also the office.
How to Conduct a Health Risk Assessment for Employees
Five steps, in order, and you can run a first pass on a single site in an afternoon. The order matters. Rating risks before identifying them, or writing findings before consulting the people doing the work, is the most common way these documents end up useless.
1. Define the scope and collect what you already know. Write down the tasks, locations, equipment, substances, shift patterns and people you are covering. Then gather incidents, near misses, maintenance faults, existing inspection records, complaints and any previous assessments. If a process only exists in one person’s head, write that down first. You are setting the boundary for everything that follows.
2. Identify hazards with the people doing the work. Walk the task, not the site, and take someone who performs it. Workers routinely notice hazards during the task that a manager walking through misses, and an assessment built without them will miss the same ones. Ask open questions: what slows you down, what makes you change your method, what do you stop doing so you can finish. Done when every task in scope has been walked and every hazard is written down in plain words.
3. Decide who could be harmed, and rate likelihood and severity. Include contractors, agency staff, visitors, young workers and anyone in the vicinity, not just employees on the payroll. For each hazard, score how likely the harm is and how serious it would be, then multiply or band the two. Flag where exposure is frequent, where the work is routine and repetitive, and where a vulnerable group is involved. Done when every hazard has a score, a named group exposed and a note on frequency.
4. Choose controls, strongest first, and put them in place. Work down the hierarchy of controls rather than jumping to personal protective equipment. Then stop at the point where further reduction is not reasonably practicable, and write down why. That sentence is what an inspector or an insurer will look for.
5. Record the findings, assign owners, set review dates, and consult workers. Each action needs a name and a date against it, or it does not happen. Share the outcome with the people who contributed, record their comments including the disagreements, and store the document where everyone working there can find it. Done when a new starter or an agency worker could read the file and know exactly what to do safely.
If a hazard appears mid-task, pause and reassess rather than pushing through. That is a dynamic risk assessment, and it is a real part of the method, not a substitute for the written one.
How Are Workplace Risks Prioritized?
You cannot control everything at once, so the rating decides the order of work. Most employers use a simple scale: likelihood from rare to frequent, and severity from negligible to catastrophic. A five by five grid is a common choice. There is no universal regulatory matrix, so pick one, write it on the form, apply it the same way every time, and set a threshold for what counts as unacceptable.
Beyond the two numbers, three things move a risk up the list. Exposure frequency beats intensity more often than people expect: a low-grade noise exposure every hour for five years is a bigger problem than a loud one for ten minutes. Vulnerable groups push things up, because young workers, pregnant workers, new starters, lone workers and people with a medical condition or return-to-work adjustment have less capacity to absorb the same exposure. And control availability matters in both directions, since a risk you can engineer out tomorrow is worth doing tomorrow.
| Hazard | Who could be harmed | Initial rating | Controls in place | Further controls needed | Residual rating | Owner and review date |
|---|---|---|---|---|---|---|
| Unguarded blade on the cutting station | Machine operator, nearby packers | Likelihood 3 x severity 5 = High | PPE, training, one operator trained | Fixed interlocked guard with hold-to-run isolation | Likelihood 1 x severity 5 = Low | Production manager, 14 days |
| Manual turning of residents | Care staff, shoulders and backs | Likelihood 4 x severity 3 = High | Two-person lift, manual handling training | Ceiling hoists in the two highest-dependency rooms, rota review | Likelihood 2 x severity 3 = Medium | Ward manager, 30 days |
| Cleaning chemicals decanted by hand | Domestic staff, cleaning staff | Likelihood 2 x severity 4 = High | Gloves, safety data sheets on the trolley | Pre-dosed system, no decanting of concentrated product | Likelihood 1 x severity 4 = Low | Facilities lead, 60 days |
| Sustained overtime on night shift | Drivers and lone night staff | Likelihood 3 x severity 3 = Medium | Break schedule, check-in calls | Shift length cap, fatigue reporting route, staffing review | Likelihood 2 x severity 2 = Low | Operations manager, 90 days |
| Deteriorating laptop dock in a home office | Remote workers, neck and wrist | Likelihood 2 x severity 1 = Low | Self-assessment checklist | Equipment refresh cycle, home-working allowance review | Likelihood 1 x severity 1 = Low | HR, 12 months |
| Aggression from the public at a counter | Front-line staff | Likelihood 3 x severity 3 = Medium | Reporting, no lone opening shifts | De-escalation training, screen or barrier at the counter, incident follow-up | Likelihood 1 x severity 3 = Low | Branch manager, 45 days |
Residual risk is what is left once the controls are in, and it is the number that tells you whether the work is acceptable at all. Record it honestly. A residual rating that never moves from the initial one usually means the controls were never actually installed, and an action with no owner and no date is a wish, not a control.
Watch the psychosocial line too. Work-related stress scores badly on likelihood and moderately on severity, so it can slip below mechanical risks on a numeric grid while causing more harm in total. Weight it deliberately, and say in the document that you did.
What Controls Can Reduce Employee Health Risks?
The hierarchy of controls is the ordering that keeps you honest. Each step down removes more risk for the person doing the work, and each step relies more heavily on people behaving perfectly every time.
Elimination. Remove the hazard entirely. Take the solvent-based product out of the process rather than ventilation-ing it. Stop the double shift. This is the only control that reduces risk to zero, and it is often dismissed as unrealistic because nobody asks what problem the hazard was solving in the first place.
Substitution. Swap in something less dangerous. Water-based paint for solvent-based, a manual trolley for a hand lift, a quieter machine for a loud one.
Isolation. Separate people from the hazard: interlocked guards on machines, a restricted area, a separate room, negative pressure where relevant.
Engineering controls. Change the physical setup: machine guarding, local exhaust ventilation, tool balancers, fixed hoists, interlocked doors, ventilation rates checked, water temperature set to avoid scalding. These work whether or not anyone remembers them.
Administrative controls. Change how the work is done: rotation, training, permits, checklists, rest breaks, workload limits, signage, lone-worker check-ins, refresher training. Real and necessary, but they depend on human behaviour every time.
Personal protective equipment. Gloves, eye protection, hearing protection, high-visibility clothing, footwear. It is the last line, not the first, and a control that leans on PPE usually means the engineering option was never costed properly. Employers have a duty to provide PPE free of charge and to train people in using it, and to be honest, most sites over-rely on gloves and under-invest in the machine guard that would have removed the need.
Work down the list in order and record why you stopped. That record is the evidence that the assessment was reasonable, not a formality.
How Should Employee Feedback Be Included?
Consultation is not a courtesy and it is not a signature box. The people doing the work see hazards the paperwork misses, and an assessment built around a manager’s two-hour site walk will be worse than one built around an hour of listening to the people who run the line.
Useful methods, roughly in order of reach: a short walk-round with the team doing the task; a five-question survey at shift change rather than a 40-question form nobody finishes; one-to-one interviews with the people you most need to hear from; a focus group on a specific issue; the safety committee or a representative nominated by the workforce, where one exists; and an anonymous reporting route for anything you would rather not raise in front of your supervisor. Consultation duties with unions, works councils or employee representatives apply in many jurisdictions, so check what your setup requires.
One practical warning: assessment fatigue is real. Staff who have filled in the same questionnaire five years running click through it, and the resulting data looks fine while being worthless. Keep it short, keep it about the work, and tell people what changed because of the last one. Feedback that visibly does nothing gets ignored the next time.
Now the part that decides whether staff trust the process. Individual health information is special-category data in the UK under UK GDPR, and US state privacy rules treat medical information similarly, with HIPAA and the ADA adding their own layers where they apply. The workable pattern is straightforward: consent first and in writing, medical staff only, individual results seen only by the occupational health provider, and the employer receiving aggregate, de-identified reporting. Say plainly, and in writing, that individual results do not go into performance reviews, promotion decisions, hiring or redundancy selection. Employees worry about exactly that, and staff who suspect it will opt out or answer honestly less often. If you intend to act on individual results, say so up front and get proper advice first.
Keep reported symptoms separate from verified hazards. Someone reporting headaches is a signal worth investigating, not a confirmed finding, and it is not evidence of a workplace cause until someone competent has looked. Log it, investigate it, and record the conclusion either way.
What Should the Final Risk Assessment Report Include?
The report is the deliverable. A long one will not be read, a short one will not survive an investigation, so aim for something that fits on a few pages per area and contains these things.
Scope and method. What was assessed, which tasks and locations, who did it, what evidence was reviewed and when. Name the standard you rated against.
Hazards identified, with who could be harmed and how. Plain descriptions, no jargon codes.
Risk ratings before and after controls, with the scale you used printed on the form so a reader can follow the arithmetic.
Controls, at the level of the hierarchy you reached, plus the reason you stopped there.
Action plan: each action with a named owner, a target date and a status. “Awareness campaign” is not an action. “Replace the guard on the cutting station, production manager, 14 October” is.
Employee concerns raised during the work, and how each was resolved or why it was not.
Review date and triggers, plus who owns keeping it current.
Then turn it into the operational document: a risk register that tracks status, a briefing pack for new starters, and a copy available to anyone who works in the area. An assessment filed in a drawer that no one can find is not evidence that you identified anything.
When and How Often Should Assessments Be Reviewed?
A reasonable baseline for most workplaces is a full review every 12 months, and anything higher-risk needs more often than that. What matters more is the trigger list, because the real failure pattern is doing a good assessment once and then letting the work change underneath it.
Review after new equipment or a new process, after a refurbishment, move or change of layout, after a change in staffing or shift patterns, after an incident or near miss, after a new control turns out not to work, after a worker raises a concern, when a regulator or law changes, when someone returns to work after a long absence, and when the workforce changes shape through recruitment, redundancies or a new contract. Reviews triggered by something specific should happen straight away, not at the next annual date.
Two distinctions keep this clear. Dynamic assessment is what a competent person does in the moment when conditions change: a spillage, a different route, an unfamiliar load, a missing guard. It is a real part of risk management, and relying on it is not a substitute for the written assessment. Health monitoring is a separate, ongoing check on an individual’s health where a specific exposure demands it, such as noise, respiratory sensitizers, vibration or lead. An annual risk assessment does not replace it, and neither replaces a fitness-to-work conversation after illness.
On records and access: keep the assessment for as long as the work continues, since it is evidence of what you knew and when. Keep incident records longer, as many jurisdictions set statutory minimums, some measured in decades for occupational disease cases. Employees should be able to see the assessment for their own area and ask for a copy, and a well-run system has a published retention period rather than a quiet one.
Finally, measure whether any of it worked. Track near misses, recordable incidents, absence in the assessed areas, control completion rates on the action plan, and the rate at which the same hazard keeps reappearing. If a hazard recurs three times, the problem is rarely the hazard.
Frequently Asked Questions
Is a health risk assessment for employees a medical test?
No. A safety risk assessment examines the work: tasks, equipment, substances, exposure and the harm that could result. It produces controls, owners and review dates, not diagnoses and not fitness certificates. Where a specific exposure calls for health monitoring or a fitness-to-work conversation, that is separate occupational health work arranged by a qualified professional.
Do employers have to do a health risk assessment for every employee?
Most jurisdictions place the duty on the employer or duty holder, and it applies to everyone who works there: employees, contractors, agency staff, young workers and visitors, in every area where your people work. What varies by country is the detail required and how far the written record must go. A wellness questionnaire, by contrast, is normally voluntary and has no such duty attached.
Can my employer see my individual health risk assessment results?
It depends which kind of assessment you completed. For a workplace safety assessment, the findings describe the task, not your body, and you can ask to see it. For a wellness health risk assessment, good practice is that individual results go only to the occupational health provider, with the employer receiving aggregate, de-identified reporting. Health information is treated as special-category data in the UK and similarly protected in the US, so consent must be explicit and documented.
Do I legally need a written risk assessment, and how detailed must it be?
In most countries, yes, in writing, and the standard is proportionate to the risk. UK law requires it to be suitable and sufficient, which means matching the actual work rather than reusing a site-wide template. Low-risk office work needs a short document; a quarry, a hospital ward or a chemical plant needs something far longer. Check the specific requirements of your regulator rather than copying a generic form.
What is the difference between a hazard and a risk?
A hazard is anything with the potential to cause harm, such as a wet floor, an unguarded blade or a solvent. A risk is what happens when that hazard meets a real task, expressed as likelihood times severity. Two workplaces can share the same hazard and face very different risk levels because the task, the frequency, the controls and the people exposed are different. Ratings only make sense once you separate the two.
How often should a risk assessment be reviewed?
A twelve-month cycle is a reasonable baseline, but triggers matter more than the calendar. Review after new equipment, a process change, a building move, an incident or near miss, a worker concern, a regulatory update, or when a control fails. Higher-risk work should be looked at more often than that. Any action with a named owner and a target date is easier to chase than a file with a review date and nothing in between.
Conclusion
Start with the scope. List the tasks and locations you are covering, pull together the incidents and near misses you already have, and then walk the work with the people who do it. From that, identify hazards, rate likelihood and severity, choose controls from the top of the hierarchy, and write up an action plan with a named owner and a review date for every item.
Do the privacy bit properly on day one rather than after the first complaint. Tell staff what the assessment covers, what it does not cover, who reads individual results and who never will, and get consent in writing for anything touching personal health. If you take one habit from this, take that one.
Finally, check which law applies to you before you rely on any of this. If you want a second pair of eyes, talk to a safety professional or an occupational health provider, and give your regulator’s guidance a read before the first audit rather than after it.