Risk assessment is the foundation of every effective safety management system — and it’s also a core practical skill tested in qualifications like the NEBOSH IGC (GIC2 report). This guide walks through the standard 5-step risk assessment process with a worked example so you can see exactly how it’s applied in practice.
The 5 Steps of Risk Assessment
Step 1: Identify the Hazards
A hazard is anything with the potential to cause harm. Walk through the work area and look for physical hazards (machinery, electrical equipment, working at height), chemical hazards (fumes, dust, cleaning agents), biological hazards, ergonomic hazards (repetitive strain, poor posture), and psychosocial hazards (stress, workload).
Step 2: Decide Who Might Be Harmed and How
Consider not just the worker directly doing the task, but also nearby workers, visitors, contractors, and members of the public who might be affected. Note specifically how they could be harmed (e.g., “machine operator could suffer hand injury from unguarded moving parts”).
Step 3: Evaluate the Risk and Decide on Precautions
For each hazard, assess the likelihood of harm occurring and the severity if it does, often using a risk matrix (Likelihood × Severity = Risk Rating). Then apply the Hierarchy of Control to decide precautions, in order of preference:
- Elimination — remove the hazard entirely
- Substitution — replace with something less hazardous
- Engineering controls — machine guards, ventilation systems
- Administrative controls — training, signage, safe work procedures, permits to work
- Personal Protective Equipment (PPE) — the last line of defense, not the first
Step 4: Record Your Findings and Implement Them
Document the hazard, who’s at risk, the current risk rating, the control measures decided upon, who is responsible for implementing them, and the target date. This record becomes your formal risk assessment document.
Step 5: Review the Assessment and Update if Necessary
Risk assessments are not one-time exercises. Review them after an incident, when a new process or equipment is introduced, or on a scheduled periodic basis (commonly annually, or sooner for higher-risk activities).
Worked Example: Manual Material Handling in a Warehouse
| Step | Details |
|---|---|
| Hazard | Manual lifting of heavy boxes (up to 25kg) from floor to shelving |
| Who’s at Risk | Warehouse workers — risk of back injury, musculoskeletal strain |
| Current Risk Rating | High likelihood, moderate severity — Medium-High risk |
| Control Measures | 1) Substitution: introduce trolleys/pallet jacks where possible. 2) Engineering: install adjustable-height shelving. 3) Administrative: manual handling training, team lifting for items over 20kg, job rotation to reduce repetitive strain. 4) PPE: back support belts as a supplementary measure only. |
| Responsible Person | Warehouse Supervisor |
| Review Date | Every 6 months, or after any manual-handling-related incident |
Common Mistakes to Avoid
- Jumping straight to PPE: PPE should be the last control considered, not the first solution reached for.
- Being too generic: “Be careful” is not a control measure. Controls must be specific and actionable.
- Forgetting non-routine tasks: Maintenance, cleaning, and emergency scenarios are often overlooked but carry significant risk.
- Not reviewing after changes: A risk assessment that isn’t updated after a process change quickly becomes inaccurate and unsafe to rely on.
Frequently Asked Questions
Is risk assessment part of the NEBOSH IGC exam?
Yes — GIC2 is a practical risk assessment report where you apply exactly this process to a real workplace, making it one of the most important practical skills to master.
What’s the difference between a hazard and a risk?
A hazard is something with the potential to cause harm (e.g., a wet floor). Risk is the likelihood and severity of that harm actually occurring (e.g., the chance someone slips and the severity of injury if they do).
How often should risk assessments be reviewed?
At minimum annually, but also immediately after any incident, near-miss, process change, or introduction of new equipment.
Want to Master Risk Assessment?
Our NEBOSH IGC course includes dedicated GIC2 risk assessment report guidance and real workplace case studies. Explore all HSE courses or contact us to get started.
