Risk Assessment

1. Introduction

Risk assessment is one of the pivotal concepts in health and safety and yet also one of the least understood. It is often seen as a mere bureaucratic exercise or a complex process without an obvious starting point. Neither is true and risk assessment is a valuable tool in planning work, developing procedures, informing and training staff, and reducing the number of accidents in the workplace. It is also, however, a statutory requirement and failure to comply leaves the University vulnerable to enforcement action by various agencies, with obvious deleterious costs to the University in terms of its reputation, business and research continuity.

This policy reiterates the legal context of risk assessment and sets out to clarify the process for those required to undertake them.

2. Important definitions

Although the terms ‘hazard’ and risk’ are often used interchangeably, they have specific definitions in health and safety and it is important to understand the distinction.

Hazard is any source of potential damage, harm, or any adverse condition that can affect someone at work. It is the inherent property of a thing, situation, process, or activity to cause harm.

Risk is the probability that a person at work will come to harm as a result of exposure to the hazard. It is therefore the chance that the harm will actually be realised in the circumstances prevalent at the time.

3. Legal considerations

The requirement for a general assessment of risk, amongst other things, is established in the Management of Health and Safety at Work Regulations (MHSWR) 1999, and summarised in University Policy Statement S1/02. The regulations require employers to assess the risks to the health and safety of anyone who may be affected by their undertakings. MHSWR is very wide ranging and comprehensive in its coverage of places, situations, activities and other sources of hazard in the workplace.

There are also specific requirements for risk assessment in other regulations. These place additional duties on the employer, usually in relation to people affected by the work, or the way in which work is undertaken where certain other conditions are met. The regulations covering more specific hazards will dictate what needs to be examined, and covers such diverse topics as hazardous substances, noise, working at height, manual handling, computer use, and radioactive sources. There are University policies in place relating to all these topics, and others, which are not considered further in this document, although reference may be made to them.

For information a current list of University Policy Statements (UPS) may be seen at: http://www.admin.ox.ac.uk/safety/notes.shtml.

Even if specific, topic based, assessments are not required the general duties placed on ALL departments and institutions remains, and UPS S1/02 requires them to carry out a full and comprehensive assessment of risks and commit the significant findings of these assessments to writing. The majority of the issues to be considered will revolve around premises and operational matters.

Appendix 1 is a tabulated summary of some of the topics which departments and institutions need to consider in their assessment of risk.

4. What is risk assessment?

In practical terms a risk assessment is a thorough way of looking at work activities to identify those things, situations, tasks or processes that might cause harm to people. After identifying them assessors need to evaluate the risk and decide what measures are needed to prevent the harm occurring. The Health and Safety Executive (HSE) promotes a 5-step approach to the risk assessment process, which will be elaborated in section 7, and the broad principles can be applied to the vast majority of situations and activities to provide the backbone to the assessment. The structured and systematic 5-step approach ensures that control measures are targeted at significant risks.

Further information about the 5-Steps to risk assessment may be seen on the HSE website: http://www.hse.gov.uk/risk/fivesteps.htm, where several examples are also provided.

5. Who does the assessment?

Heads of department delegate the responsibility for risk assessment to individual supervisors, managers, or persons in control of a particular area of work, or activity, and it is they who must ensure that assessments are done. Those involved in the work should also be consulted since they may have intimate knowledge of the risks involved and may be able to offer practical solutions in controlling them.

For premises matters the facilities manager usually takes the lead in assessing the risks. In Arts or Humanities departments it may be the departmental safety officer, or the head of department may nominate specific individuals to take on this role.

6. Competence

The person(s) doing the assessment should be competent to do so, i.e. with the appropriate expertise or knowledge to be able to make informed judgments about the risks associated with a situation or activity. Where there are gaps in this knowledge appropriate help and advice should be sought from area safety officers, where appointed, or from the Safety Office. In more complex risk assessments it may be necessary to draw on the expertise of several individuals to ensure that all aspects of the work are adequately covered.

In the case of topic based assessments it is usually inappropriate for very junior or inexperienced workers to do the assessments since they may not have the necessary knowledge and skills, and since they may, themselves, be subject to special consideration in the assessment (section 7(b) below). However, they should be involved in the process since it will add to their understanding and ensure clarity in what is expected of them when they do the work.

The risk assessment should be done in advance of any new work commencing, since the specific requirements of other legislation may also impose certain conditions or dictate when additional precautions should be put in place.

7. The HSE’s 5-steps to risk assessment

(a)   Step 1 – identify the hazards

The aim is to identify and record all the possible dangers that could foreseeably cause harm to people in the workplace. Hazards may be identified by observation, using various sources of information such as legislation, published guidance, trade publications, industry codes of practice, manufacturers or suppliers information (e.g. Material Safety Data Sheets), accident records, or drawing on previous experience.

All aspects of the work must be considered, not just the obvious. For example, a raised paving stone on a path presents an obvious trip hazard, while the shedding of wet, slippery leaves from an adjacent tree may be overlooked if the assessor considers only summer conditions. In workshops the use of a band saw presents a hazard in terms of the cutting blade but there are also hazards associated with the release of dust in the atmosphere (explosion, inhalation of a hazardous substance). Similarly the use of a lathe will have particular machine hazards, but there may be other hazards associated with the use of cutting oils (skin contact with a hazardous substance).

Non-routine aspects of the activity must also be considered e.g. during maintenance and repair.

(b)   Step 2 - identify the persons or groups who may be harmed and how

The risk assessment should consider everyone who might be affected by the work. This will include the workers themselves, colleagues not directly involved with the work, University Estates personnel, external contractors (e.g. cleaning or catering contractors, maintenance engineers), visitors and members of the public. The risks may not be the same for each group and the assessment should consider the different ways that the work might affect them.

Consideration must also be given to vulnerable individuals (e.g. those with certain medical conditions) or groups (e.g. young or inexperienced workers who may lack maturity and expertise) and expectant or new mothers (e.g. who may need to refrain from manual handling or chemical use). However, other groups should not be overlooked e.g. persons with disabilities (ability to hear alarms, see / read warning notices, difficulties with access / egress) and overseas workers (differing safety culture, nuances of language and comprehension).

(c)   Step 3 – evaluate the risks and decide on precautions

Once the hazards have been identified the assessor must decide if they are serious i.e. whether they pose a risk. The most common way of evaluating risk is to rate it as high, medium or low according to the potential outcomes. For example:

(i)   potential severity of the harm (e.g. severe, moderate, insignificant)

(ii)   likelihood that the harm will arise (e.g. very likely, possible, unlikely)

(iii)   numbers of people likely to be affected (e.g. many, some, very few)

Some assessors find it useful to construct a matrix to determine the risk and to award points to the most severe / significant outcomes. This allows the risks to be ranked, remedial action prioritised, and suitable control measures targeted at the most serious problems. Although useful in some situations, the scoring system should be used cautiously since the awarding of points is somewhat arbitrary and potentially serious problems may be overlooked simply because they have not scored highly enough.

An example of a simple risk matrix is shown for information in Appendix 2.

It should be emphasised that there is no single way of determining the degree of risk presented by various hazards and that for most general assessments a sound knowledge of the situation, tasks or activities and objective, informed judgement will be adequate.

The assessment should acknowledge any existing measures that control risk. These may have been introduced for other operational reasons but they may, nevertheless, mitigate problems. The assessment should also consider the impact of existing control measures suddenly becoming unavailable e.g. power loss to an external light, or loss of supply in a water cooled system.

(d)   Preventative and protective measures

In deciding what additional control measures are to be applied priority should be given to those that protect the whole workforce, by avoiding the risk completely or combating risks at source.

The control hierarchy should be:

(i)   eliminate the hazard and remove the risk (e.g. use different equipment, fix faulty machinery, replace worn stair carpet)

(ii)   substitute the hazard for something less ‘risky’ (e.g. use safer materials)

(iii)   isolate the hazard from people (redesign equipment e.g. use guards on cutting machines, segregate the work)

(iv)   introduce administrative measures (e.g. change the way that the job is done, change practices, introduce protocols, involve workers to ensure they understand what they need to do and provide them with information, instruction and training)

(v)   use personal protective equipment (this is not likely to be applicable in non-science, non-clinical departments).

In practice control measures are likely to be a combination of these.

(e)   Step 4 – Record the findings and implement them

The significant findings of the risk assessment should be committed to writing. The aim is not to generate additional paperwork but to ensure that appropriate safety measures, identified during the assessment process, are integrated into existing procedures and routine work patterns. It is perfectly acceptable to incorporate the risk assessment, and relevant control measures, into other established documentation. There is no format specified in law and assessors should use one that most conveniently serves their purposes but which clearly communicates the relevant safety information to those affected by the work or activity. Importantly the assessment should be used in any training delivery, and be readily available for reference in the area to which the work relates. Assessments may be stored in hard copy or electronic format, providing the latter is readily retrievable.

An example of a simple, tabulated risk assessment is shown in Appendix 3. Note that the example provided does not cover all risks, nor does it reflect any particular department or institution. It is provided as an illustration of how the information might be documented for a range of activities. Departments may find it convenient to use this format, and to adapt it to suit their circumstances.

The assessment must be ‘suitable and sufficient’. What this means is that the level of detail in the assessment should be proportionate to the risks identified. Enough will probably have been done when it can be clearly demonstrated that:

(i)   adequate checks were made and that all groups affected by the work or activity have been properly considered

(ii)   significant risks have been identified and appropriate action taken to eliminate or reduce them

(iii)   reasonable precautions were put in place

(iv)   appropriate information, instruction, and training has been given to those directly involved with the work

(v)   residual risks were low.

The risk assessment will be worthless if the identified actions are not followed through. Priority should be given to higher risk situations or activities and it may be necessary to introduce interim risk reduction measures while permanent solutions are sought. An appropriate time frame for full implementation should be decided, along with named individuals to see that the actions are carried through. In some very high-risk situations it may be necessary to cease activity completely until appropriate controls can be introduced.

(f)   Step 5 – Monitoring and review

When control measures have been established and actions (step 4) implemented, the work must be kept under review to ensure they are working properly. Useful information can be gathered from workers themselves, or by monitoring accident statistics. If further improvements can be made to reduce the risk further then action should be taken, with named persons responsible for implementation, so that there is a continual process of improvement and refinement.

Workplaces seldom stay the same and new hazards may be introduced. If the assessment is no longer valid or significant changes have been introduced the assessment must be revised to incorporate relevant additional control measures. The risk assessment should not be seen as a static document but one that evolves as workplace activities evolve.

Risk assessments must be reviewed if information comes to light about the adverse health effects of a particular hazard, so that the control measures can be modified, where necessary. Similarly control measures should be adapted and refined to take advantage of technological advances or improvements.

Departments and institutions in the Social Sciences and Humanities Divisions may find it convenient to review their general risk assessments concurrently with their annual inspection (UPS S1/07). General risk assessments in higher risk departments may be reviewed on the same basis, although many topic based assessments should be under regular scrutiny and review.

8. Out of hours and lone working

The legal requirement to identify the hazards of all work, to assess the risks involved and to put measures in place to avoid or control those risks includes out of normal working hours activities and lone working. This duty extends to recording the significant findings of the assessment. Departments must assess all activities being carried out, define which are acceptable out of hours and prohibit those which are not.

In all cases managers or supervisors in charge of an area of work must establish a suitable framework for individuals in terms of what is and what is not permissible for them under lone working conditions. Managers or supervisors are expected to report on a termly basis to their head of department that they have made arrangements for the safety of those under their day to day control.

Out of hours working in Social Sciences and Humanities departments and institutions generally centres around office type activities and is considered low risk. Therefore, providing it is agreeable to the head of department, lone working may be freely permitted. It is accepted that residual risks such as falling from a step stool or tripping on stairs will remain. However, the arrangements for summoning assistance in the event of such an accident should be established and the information be readily available to persons working out of hours.

Persons from higher risk departments (i.e. Science and Clinical departments) carrying out general office duties may do so on their own, with the permission of their departmental head. Laboratory or workshop activities involving any risk greater than those of general office duties must only be undertaken with others present or at least within earshot. This is to ensure that assistance is forthcoming in the event of an accident. Departments must consider carefully what first aid and other emergency provision is necessary for out of hours working taking account of the nature, scale and range of activities being permitted.

Although not a formal requirement departmental heads may wish to continue with the procedure of recording the names of those present within the department out of hours, i.e. the signing in and out procedure. In the event of an emergency situation out of hours the attending services will need to know if the building is occupied and where any workers are likely to be.

The 24 hour day working `norm' on NHS premises should not be interpreted as meaning that clinical departments do not have to assess risks or evaluate which activities may continue and under what circumstances.

9. Undergraduate students in laboratories

Those devising and supervising practicals must ensure that sufficient risk control measures have been clearly identified in written risk assessments or work protocols etc. The written risk assessments must be effectively communicated to the students and written information must be reinforced orally.

Every reasonable attempt must be made to remove risks, following the principles of the control hierarchy, but where this proves impracticable the least risky alternatives must be chosen.

Equipment and apparatus must be suitable for the students' use, and its use must be properly demonstrated to them. Students’ understanding and aptitude must be continually appraised and appropriate levels of supervision provided. Undergraduate students must not be left unsupervised in laboratories.

A notice indicating the name of the first aiders and first aid facilities should be posted adjacent to laboratories where students work. Supervisors must be familiar with the names of first aiders and their locations.

10. Research work in laboratories

Supervisors must be fully conversant with the University's safety policies, the department's organisation for safety, local rules, and the risk control measures required for the work under their control. Written risk assessments must be drawn up where significant risks are identified and the control measures set out therein must be communicated to all those involved in the work. Supervisors may adapt the tabulated risk assessment provided as an example in Appendix 3, but it must be emphasised that there is no prescribed format. Providing the assessment has been properly undertaken (and is suitable and sufficient) it is acceptable to incorporate the information into exisiting work protocols, student manuals, research note books etc.

Supervisors must ensure that control measures are followed assiduously and that the work is conducted in accordance with the assessment. Assumptions should not be made about the expertise of the persons they supervise (or their understanding, in the case of overseas workers) and the supervisor must satisfy him / herself that those under his / her supervision are competent to work safely unsupervised and provide additional training, if indicated.

In addition to other considerations, it is essential to clarify the following in the risk assessment documentation:

(a)   when work may not be undertaken without supervision

(b)   when work may not be started without the supervisor's advice.

If either statement is applicable then this must be highlighted in the risk assessment and communicated verbally to those involved in the work.

Medium and high risk experimental work may not take place outside the department's normal working hours unless the supervisor is personally satisfied that adequate risk control measures are in place and that adequate numbers of personnel are available to deal with any emergency that may arise.

Where supervisors are in any doubt as to the adequacy of their risk assessment they should seek the advice of their head of department or their departmental or area safety officer.

Should a supervisor be unable to carry out these duties, e.g. through illness or leave of absence, the head of department should be informed and arrangements made for a deputy to act in lieu. Any such arrangements made must be effectively communicated to the workers concerned.

After the topic specific assessments have been carried out there must be consideration of the remaining risks, if any. These might relate to the use of portable electrical appliances, flammable gases, pressure equipment, trailing flexes or slippery floors. Where there is any doubt about ‘communal’ equipment or facilities, supervisors should liaise with facilities or laboratory managers, or DSOs, to ensure that the risks in such areas have been assessed and where they have not an agreement should be reached to ensure that they completed and any necessary actions implemented.

11. Summary of departmental action

General risk assessments are required for all departments and institutions of the University. These will cover all activities and premises and are in addition to topic specific assessments.

Heads of department should nominate appropriate individuals to undertake general risk assessments and departmental safety officers should ensure that they are completed.

Managers, supervisors and others in control of a particular area of work are reponsible for completion of topic based assessments.

Supervisors in Science and Clinical departments must follow the additional requirements for laboratories, to include not only risk assessment, but the assignment of appropriate levels of supervision (according to the ability, skills and experience of those under their supervision) and the provision of appropriate training. Deputising arrangements must be established, documented and communicated to the workers concerned.


June 2008