What Is a Risk Assessment — and Why the Format Matters
A risk assessment is the structured process of identifying what could cause harm in a workplace, evaluating how serious that harm could be and how likely it is, and deciding what to do about it. It is the foundation of every occupational health and safety management system — and in most jurisdictions, a legal requirement.
The core of every risk assessment is a simple calculation: Risk = Likelihood × Severity. A hazard that is almost certain to occur and would be catastrophic scores far higher than one that is rare and trivial. That single number is what lets you prioritise — to act on the forklift-versus-pedestrian risk before the paper-cut risk.
But a number alone isn’t a risk assessment. What matters is what happens next: choosing controls that actually reduce the risk, in the right order of effectiveness, and then re-scoring to prove the residual risk is acceptable. Most free templates stop at the first score. This one is built around the full cycle — identify, score, control, re-score — which is exactly what ISO 45001 and OSHA expect.
📋 Quick definition: A risk assessment identifies hazards, scores each one (Likelihood × Severity), applies controls using the hierarchy of controls, then re-scores the residual risk that remains. The goal isn’t a perfect number — it’s to reduce risk to a level that is acceptable and “reasonably practicable.”
What’s Inside This Risk Assessment Template
Search “risk assessment template” and you’ll find thousands of blank grids. Almost all of them are a table you fill in by hand, with no logic behind the numbers. This template does the scoring, the colour-coding and the prioritisation for you.
Five connected tabs:
| Tab | What it does |
|---|---|
| Risk Assessment | The working register — 100 hazard rows with auto Risk Score, auto risk level, residual-risk scoring, dropdowns and colour-coding |
| Risk Matrix | The visual 5×5 matrix (Likelihood × Severity) with colour bands and the action each level requires |
| Dashboard | Live KPIs — total hazards, Extreme/High counts, open actions, average initial vs residual score, and charts |
| Guidance | The 5 steps of risk assessment, the hierarchy of controls, and the scoring scales |
| Lists | The dropdown values — edit to adapt the template to your organisation |
What separates it from a blank grid:
- Automatic 5×5 risk scoring — Likelihood × Severity calculates the Risk Score and bands it Low / Medium / High / Extreme, colour-coded automatically
- Residual-risk scoring — re-score after controls to prove the risk was actually reduced (the step most templates skip)
- Hierarchy of controls built in — every control is tagged Elimination → Substitution → Engineering → Administrative → PPE
- Live dashboard — see your highest risks and open actions at a glance, with an initial-vs-residual chart
- ISO 45001 & OSHA aligned — structured around the recognised 5-step method
The 5 Steps of Risk Assessment
Every credible risk assessment follows the same five steps — the method set out by the UK HSE (INDG163) and mirrored in ISO 45001 and OSHA hazard-assessment guidance. The template walks you through each.
- Identify the hazards. Walk the activity and list anything with the potential to cause harm — machinery, chemicals, work at height, manual handling, electricity, vehicles, and psychosocial hazards too.
- Decide who might be harmed and how. For each hazard, note who is at risk — workers, contractors, visitors, the public — and include vulnerable groups such as new, young or pregnant workers.
- Evaluate the risk and decide on controls. Score Likelihood × Severity, record existing controls, and decide what more is needed.
- Record your findings. Document the hazards, the risks, the controls, the owners and the dates. The written record is both a management tool and your evidence of compliance.
- Review and revise. Reassess regularly, and whenever the activity changes, after an incident, or when a control proves ineffective.
✅ Tip: Involve the people who do the job. Workers see hazards and near-misses that a desk-based assessment misses entirely — and ISO 45001 explicitly requires worker participation in hazard identification.
The 5×5 Risk Matrix Explained
The 5×5 matrix is the engine of the assessment. It plots Likelihood (1–5) against Severity (1–5); their product is the Risk Score (1–25), which maps to a colour-coded risk level.
| Likelihood ↓ / Severity → | 1 Negligible | 2 Minor | 3 Moderate | 4 Major | 5 Catastrophic |
|---|---|---|---|---|---|
| 5 Almost Certain | 5 | 10 | 15 | 20 | 25 |
| 4 Likely | 4 | 8 | 12 | 16 | 20 |
| 3 Possible | 3 | 6 | 9 | 12 | 15 |
| 2 Unlikely | 2 | 4 | 6 | 8 | 10 |
| 1 Rare | 1 | 2 | 3 | 4 | 5 |
The score bands into four action levels:
| Risk Level | Score | What it means |
|---|---|---|
| Low | 1 – 3 | Acceptable — monitor and review |
| Medium | 4 – 7 | Reduce risk where reasonably practicable |
| High | 8 – 14 | Priority action — additional controls required |
| Extreme | 15 – 25 | Stop work — immediate action, do not proceed |
In the template, you pick Likelihood and Severity from dropdowns and the score, level and colour appear automatically — so a room full of hazards sorts itself into a clear priority order.
The Hierarchy of Controls — Why PPE Comes Last
Once you’ve scored a hazard, you reduce it with controls. But not all controls are equal, and the order matters enormously. The hierarchy of controls ranks them from most to least effective — and it’s a core requirement of both ISO 45001 (§8.1.2) and OSHA.
| Order | Control | What it means |
|---|---|---|
| 1 | Elimination | Physically remove the hazard — the most effective control |
| 2 | Substitution | Replace the hazard with something less dangerous |
| 3 | Engineering | Isolate people from the hazard — guards, LEV, barriers |
| 4 | Administrative | Change the way people work — procedures, training, signage |
| 5 | PPE | Protect the worker with equipment — the last resort |
⚡ The most common control mistake
Reaching for PPE first. Hard hats and gloves protect one worker if everything else fails — they don’t reduce the hazard itself. Always ask whether you can eliminate, substitute or engineer the risk out before defaulting to PPE. The template tags every control by type so an over-reliance on PPE is visible on the dashboard.
Residual Risk — The Step Most Templates Skip
Here is the difference between a genuine risk assessment and a box-ticking exercise: residual risk. After you’ve decided on additional controls, you re-score the hazard — new Likelihood, new Severity — to calculate the risk that remains once those controls are in place.
This matters for two reasons. First, it proves the control actually works: if your scaffold hazard scored 20 (Extreme) and your controls only bring it to 16 (still Extreme), you haven’t done enough — the residual score forces that realisation. Second, it’s your evidence. When an auditor or inspector asks “how do you know this risk is under control?”, the residual score with its controls is the answer.
The template calculates residual risk automatically and shows it beside the initial risk, so the reduction — from Extreme to Medium, say — is visible at a glance. The dashboard even charts your initial-versus-residual profile across every hazard, so you can prove your controls are collectively working.
ISO 45001 & OSHA Alignment
The template is structured around the requirements both frameworks share.
| Requirement | Reference | How the template helps |
|---|---|---|
| Hazard identification & risk assessment | ISO 45001:2018 §6.1.2 | Structured hazard register with Likelihood × Severity scoring |
| Hierarchy of controls | ISO 45001:2018 §8.1.2 | Every control tagged Elimination → Substitution → Engineering → Administrative → PPE |
| Worker participation | ISO 45001:2018 §5.4 | Register designed to capture input from those doing the work |
| Hazard assessment & abatement | OSHA 29 CFR 1910 / General Duty Clause | Documented assessment and control of recognised hazards |
For the wider management system, see our ISO 45001 implementation guide. When a risk assessment identifies a control that needs to be implemented and verified, route it into the CAPA Tracker. And to audit whether your controls are actually in place on the floor, use the EHS Audit Checklist.
Six Common Risk Assessment Mistakes
- Stopping at the score. A Risk Score isn’t the goal — reducing the risk is. An assessment with no controls and no residual score is just a list of things that might hurt someone.
- Reaching for PPE first. PPE is the least effective control. Always try to eliminate, substitute or engineer the hazard out before defaulting to hard hats and gloves.
- Skipping residual risk. Without re-scoring, you can’t prove the control worked — and you can’t tell a “controlled” Extreme hazard from an uncontrolled one.
- Assessing from a desk. Hazards live on the floor. An assessment done without walking the activity and talking to workers misses the risks that actually cause incidents.
- Writing it once and filing it. A risk assessment is a living document. It must be reviewed when the work changes, after an incident, or when a control fails — not left to gather dust.
- Generic, copy-paste assessments. A template is a starting structure, not a finished assessment. The hazards, controls and scores must reflect your actual activity, not a generic example.
💡 The bottom line: A blank risk-assessment grid records hazards. A real risk assessment scores them, controls them in the right order, and proves the residual risk is acceptable. The difference is the logic behind the numbers — and that’s exactly what this free template adds.
Related Resources & Tools
- EHS Audit Checklist (ISO 45001 + OSHA) — verify your risk controls are actually in place on the floor
- CAPA Tracker Excel — turn required controls into tracked, verified corrective actions
- HSE KPI Dashboard — track the leading and lagging indicators your controls influence
- SafetyCulture — run risk assessments and inspections from a mobile device
- Intelex — enterprise risk and EHS management at multi-site scale
- Evotix — connected EHS with embedded AI risk intelligence
- ISO 45001 Implementation Guide — where risk assessment fits in your safety management system
Provided free by AiGreenTools for educational and operational use. It aligns to ISO 45001:2018 and OSHA guidance but does not constitute legal advice, certification, or a guarantee of compliance — always confirm current regulatory requirements and validate against your own management system. Created by AiGreenTools.
