Martin Hodgson explains the 12 simple steps to risk assessment that adult social care providers should follow to ensure that they comply with the law and with their regulatory requirements.

Step 1: Know the law

Service providers must be aware of their responsibilities under the law in relation to risk assessments.

All employers must comply with Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 (MHSWR) which obliges them to carry out “suitable and sufficient” assessments of the risks to which their employees are exposed while at work. Compliance with the regulations is not only an important part of an organisation’s health and safety management arrangements, ensuring safety is also a key element in the regulatory requirements for adult social care employers.

For instance, in England care providers such as care homes and domiciliary care agencies must ensure that risk assessments are regularly carried out in order to comply with the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and to maintain registration with the Care Quality Commission. For more information, see Regulation 12: Safe Care and Treatment.

Step 2: Have regard to relevant guidance

The Health and Safety Executive (HSE) publishes a range of risk assessment guidance for employers. This can be a great help in getting risk assessment right.

Publications include:

  • HSG65 Managing for Health and Safety

  • INDG275 Plan, Do, Check, Act — An Introduction to Managing for Health and Safety

  • INDG163 Risk Assessment — A Brief Guide to Controlling Risks in the Workplace.

INDG163 replaced the previous HSE guidance, Five Steps to Risk Assessment.

In the context of residential adult social care, the HSE also published HSG220 Health and Safety in Care Homes.

HSG220 includes guidance on:

  • moving and handling

  • slips and trips

  • violence, aggression or challenging behaviour

  • falls from windows and balconies

  • scalding and burning

  • bedrail entrapment

  • Legionella.

The guidance requires that all these areas should be subject to appropriate risk assessment and policy. It provides practical advice for care homes, although much of its contents will also be applicable in domiciliary care.

See our topics on Risk Taking and Assessment for Service Users and Health and Safety Risk Assessment.

Step 3: Assign responsibilities

An organisation’s overall health and safety policy should specify who is responsible for risk assessment. Those responsible should be competent and may require additional training.

A competent person is someone who has a knowledge and understanding of the workplace being assessed. They must also know about the principles of risk assessment and about prevention of risk. It is important that competent persons know their limitations and when to call for others with expertise in specific areas.

Step 4: Involve staff

Care home and domiciliary care employers are advised to involve their staff and health and safety representatives wherever possible in risk assessment, particularly in the identification of hazards. Staff often know their work areas better than anyone else and will appreciate being asked if anything needs improvement. You can train your staff using our Assessing and Managing Risks — Training Presentation.

Step 5: Identify hazards

A hazard is described by the HSE as anything in the workplace with the potential to cause harm. For example: chemicals, electricity, equipment, working from a ladder, a slippery floor, hot water, stress, infection, fire, etc.

Employers should identify general and specific hazards by inspecting work processes, premises and equipment. In adult social care, risk assessment will also be an integral part of the care planning process for each service user.

Accident statistics and incident reports are helpful in identifying hazards and risks. They should be analysed for trends and any common patterns should be noted.

In residential social care, the identification of hazards will usually involve a thorough inspection of the care premises. In domiciliary care, the service is not responsible for the safety of private homes where care is delivered. However, managers still have a responsibility for the safety of their staff and must assess any risks involved in a care placement.

Trivial hazards can usually be ignored. The focus should be on significant hazards which could result in appreciable or serious harm.

Step 6: Find out who might be harmed

Where a hazard is identified, the person conducting the risk assessment should identify who might be harmed and how. It is not necessary to identify individuals by name. Rather, specific groups of employees and others can be referred to, such as care workers, office staff and maintenance staff.

Particular attention needs to be given to vulnerable people, eg young workers, lone workers, disabled persons or new and expectant mothers. Additional controls may be required to reduce the risk to an acceptable level for such people.

Where risks to service users are concerned providers should liaise closely with the individual, carer and family when carrying out assessments in order to achieve outcomes that matter to them.

Step 7: Evaluate the risks

Risk is defined as the likelihood or chance that harm will occur from a hazard, together with an indication of how serious the harm could be. The extent of a risk is often calculated as a measure of likelihood multiplied by severity and described as high, medium or low, or by using a numerical scale.

Different scales and risk evaluation systems exist. These vary in complexity. Care managers should adopt a system that is appropriate for the risks involved in their workplace. The system should help them to identify and focus on real risks where there is a realistic risk of harm.

Step 8: Decide on suitable control measures

Where a hazard is identified which raises a significant risk, the employer must decide on suitable precautions to control or reduce the risk.

Employers are required by the law to do everything “reasonably practicable” to reduce the risks identified and to protect people from harm. This means balancing the level of risk against the measures needed to control the risk in terms of money, time or trouble.

Existing precautions must be examined in order to determine whether they are adequate and compliant with any specific legal requirements or standards. The HSE advises employers to compare what they are doing with good practice to see if there is more they should be doing to bring them up to standard. It could be necessary to implement additional or new precautions.

Wherever possible, eliminating a risk at source by removing a hazard is always the safest control method (eg by changing a work process or by redesigning a job, etc).

For risks to service users, providers should always look at how the risks flowing from an individual’s choice can best be reduced, so far as is reasonably practicable, by putting in place sensible controls.

Step 9: Make balanced decisions

Remember that the law does not expect an employer to remove all risks. However, it does expect employers to protect people by putting in place measures to control realistic risks, so far as reasonably practicable.

In relation to service user care, HSE guidance reinforces the need for balance, particularly between the needs, freedom and dignity of individual service users and their safety. The HSE warns that some care providers may find it hard to maintain a reasonable balance and find themselves adopting a “risk adverse” and over-protective approach. Care assessments, the HSE points out, should enable people to live fulfilled lives safely, rather than be a means of restricting their reasonable freedoms.

Step 10: Obtain external advice if you need it

Where necessary, external advice, guidance or expertise should be obtained to help in the identification of hazards and risks. This is most likely in specialist areas such as those relating to infection control risks, legionella, specialist equipment, etc. Large care homes with complex fire safety arrangements may also require specialist input into their fire risk assessments.

Step 11: Record significant findings and inform staff of changes

Any organisation that employs five or more people must by law keep records of its risk assessments. These should include details of people found to be at significant risk and of the precautions taken to reduce the risk of significant harm to the individuals concerned.

No record is legally necessary where the risk is negligible or insignificant.

HSE guidance states that “huge amounts of paperwork” is not a requirement, although adequate records should be kept. The guidance also reminds providers that, in the health and social care sector, many health and safety risks identified for service users are already assessed and recorded as part of their personalised care plan.

The results of the assessment process should be effectively communicated to staff, especially any changes that affect the way people should work. Where necessary, additional training or support should be arranged.

Step 12: Regularly review your risk assessment

All risk assessments should have a built-in review date based upon the level of risk. High-risk activities and those with most potential for harm should be reviewed more frequently than those that are assessed as low risk. In addition, a new assessment should be made whenever existing hazards change.

The risk assessment procedure must show that:

  • a proper check was made

  • the employer asked who might be affected

  • the employer dealt with all the significant hazards, taking into account the number of people who could be involved

  • the precautions are reasonable and the remaining risk is low

  • staff or their representatives were involved in the process.

Where additional controls are introduced as a result of a risk assessment, it is important that a reassessment is done to determine the new level of risk and the effectiveness of the new controls.

Last reviewed 2 April 2019