Workplace risk assessment: what UK venues need to show
General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.
A practical guide to workplace risk assessment in UK pubs, restaurants and hotels, covering what must be recorded, scoring, reviews and actions.
A workplace risk assessment is the written record showing that an employer has identified the hazards in a venue, judged who could be harmed and how, and put suitable controls in place. The general duty to assess sits with every employer under the Health and Safety at Work etc. Act 1974, and regulation 3(6) of the Management of Health and Safety at Work Regulations 1999 requires an employer with five or more employees to record the significant findings of that assessment, along with any group of employees identified as being especially at risk. Those regulations extend to England, Wales and Scotland; Northern Ireland works to its own equivalent regulations rather than this Great Britain legislation. On a Friday night, with the pass full and someone carrying stock past a wet floor near the ice machine, that document is rarely what anyone is thinking about, and it only earns its keep if it reflects nights like that rather than a tidied-up venue that exists on paper.
Most hospitality businesses already have a folder of risk assessments somewhere, often inherited from a previous manager or a compliance consultant who visited once. The problem is rarely that the document does not exist. It is that nobody has looked at it since, the control measures on the page no longer match what happens on the floor, and the actions it once flagged were never closed out.
What a workplace risk assessment must show
A workplace risk assessment does not need to be complicated, but it does need five things for every significant hazard: a description of the hazard, who might be harmed and how, the controls already in place, a judgement on whether those controls are adequate, and any further action required with an owner and a date. This applies equally to a five-cover cafe and a two-hundred-cover multi-site restaurant group, though the level of detail should match the level of risk, so a hot pass and a fryer station warrant more depth than a dry storeroom.
The common failure is not missing hazards but missing the follow-through. A hazard is noted, a control is described, and the assessment is filed. Nobody comes back to check whether the control is actually being used on a Tuesday lunch service when the kitchen is short-staffed. Software built around COSHH and risk assessment records can hold hazards, scores and review dates in one place, which at least makes it possible to see what has drifted before an inspector or insurer asks.
The five-step method used across most assessments
The five-step structure is widely used across UK workplaces and remains the backbone of most credible assessments: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the significant findings, and review the assessment and update it when something changes. It is a working method rather than a statutory formula. The legal test is the one set out in the 1999 Regulations, that the assessment is suitable and sufficient and that the significant findings are recorded, so a venue using a different layout is not at fault provided the record answers those questions.
A consistent structure makes the reasoning behind each conclusion visible rather than assumed, and it makes it easier to train a new manager to write or update an assessment. Kitchen operations, food safety hazards, manual handling, fire, and customer-facing areas each tend to need their own assessment or a clearly separated section, because the hazards and the people affected differ in each case. Cramming everything into one generic document usually means the detail that matters gets lost.
Scoring likelihood and severity
Many hospitality businesses use a simple matrix to turn a judgement about a hazard into a number that can be prioritised. Likelihood and severity are each scored from one to five, and the two figures are multiplied to give an overall rating. This is not a legal requirement in itself, but it is a practical way of deciding where to spend limited time and budget first.
| Score range | Typical risk level | Usual response |
|---|---|---|
| 1 to 4 | Low | Monitor and review at the normal interval |
| 5 to 12 | Medium | Reduce further within an agreed timeframe |
| 13 to 25 | High | Act immediately, restrict the activity if needed |
The exact bands vary between businesses, and that is fine, as long as the same scale is applied consistently across every assessment in the venue. What an inspector or an insurer wants to see is a rating before controls and a rating after controls, so it is clear the controls are actually reducing risk rather than just being listed.
Where hospitality assessments usually fall down
Slips and trips remain the single most common cause of major injury in UK workplaces, as HSE sets out in its guidance on slips and trips in catering, and the occupations most affected in this sector are kitchen assistants, chefs and waiting staff. Wet floors near ice wells and glasswashers, trailing cables from portable equipment, and boxes left in walkways are all predictable, which means an assessment that does not name them specifically is not doing its job. Lone working at early opening or late cash-up, hot oil and hot surfaces, manual handling of kegs and deliveries, and COSHH risks from cleaning chemicals come up in almost every venue in some form.
A related guide on COSHH and risk assessments for hospitality managers goes into more depth on chemical safety, since COSHH assessments have their own legal basis under separate regulations and are often treated too casually alongside general workplace risks. Fire risk needs its own document rather than a paragraph inside a general assessment. In England and Wales it sits under the Regulatory Reform (Fire Safety) Order 2005, and since 1 October 2023 article 9 of the Fire Safety Order, as substituted by section 156 of the Building Safety Act 2022, has required the responsible person to record the fire risk assessment together with the prescribed information, whatever the headcount. The five-employee threshold that applies to general risk assessments is no help here, so a two-person coffee shop in England or Wales still needs a written fire risk assessment on file. Scotland works to the Fire (Scotland) Act 2005 and Northern Ireland to its own fire safety regulations, so the reference changes with where a venue trades, and the guide to fire risk assessment obligations for hospitality venues sets out what that record needs to cover.
Keeping reviews, actions and versions honest
An assessment that is never reviewed drifts away from reality within months, not years. Equipment gets replaced, layouts change when a new till point goes in, and staff turnover means the control measures that were once second nature are no longer being followed by anyone still on shift. Setting a review period for each assessment, whether that is monthly for high-risk kitchen areas or annually for a quiet back office, and actually tracking when reviews are due, is what turns a static document into something that reflects the business.
The actions that come out of an assessment matter just as much as the assessment itself. An action with no owner and no date is a wish, not a plan. Where an incident does occur despite the controls in place, it is worth checking whether it meets the threshold for formal reporting under the RIDDOR 2013 regulations, which cover fatal and certain non-fatal work-related accidents, specified diseases and specified dangerous occurrences. The free RIDDOR checker gives a quick indicative answer on whether an injury or dangerous occurrence needs reporting, though it does not replace legal advice, and the guide to which accidents must be reported under RIDDOR covers the detail in full.
Consistency across multiple sites
A single-site venue can get away with one manager holding the detail in their head. That does not scale. A business running several venues needs risk assessments that follow a consistent structure and scoring approach across every site, while still reflecting genuine local differences, such as a cellar with a step down or an outdoor terrace with its own hazards. Standard templates for common hospitality scenarios, adapted per site rather than copied blind, work better than either a single generic document or a bespoke one for every location. The guide to managing multiple restaurant sites without losing control of compliance covers the wider challenge of keeping standards consistent across an estate, of which risk assessment is one part.
Where a business is also managing first aid provision, the starting point is the same logic applied specifically to medical emergencies, and the guide on the first aid needs assessment for hospitality venues sets out how that separate assessment fits alongside the general risk assessment.
A short checklist
Five points to run against the assessments currently on file, with anything that fails going straight onto the action list.
- List every genuine hazard specific to your venue, not a generic list copied from elsewhere, and name who is affected.
- Score risk before controls and after controls, and apply the same scale to every assessment in the business.
- Set a review date on each assessment and record the review when it happens, rather than when it was due.
- Give every outstanding action a named owner and a deadline, then check it was actually closed.
- Keep the fire risk assessment as its own recorded document whatever the headcount, with COSHH and first aid assessments separate again.
Risk Assessments is one of the nine modules in Zynthio's Core plan at £59 per site per month, and a system built around COSHH and workplace risk assessments holds substances, hazard scores banded low, medium and high, sign-off, review dates and outstanding actions in one place. Those due and overdue states are shown on the compliance dashboard rather than pushed out by email, so opening it has to be part of someone's routine.
Frequently asked questions
Is a written risk assessment a legal requirement for a small pub or cafe?
Every employer has a general duty to assess risk under the Health and Safety at Work etc. Act 1974, and regulation 3(6) of the Management of Health and Safety at Work Regulations 1999 adds a duty to record the significant findings once five or more employees are employed. Those regulations cover England, Wales and Scotland, and Northern Ireland operates under its own equivalent. Most hospitality venues sit at or above that threshold, and a written assessment is useful evidence of compliance regardless of headcount.
Does a fire risk assessment also have to be written down?
Yes, in England and Wales, whatever the headcount. Since 1 October 2023, article 9 of the Regulatory Reform (Fire Safety) Order 2005, as substituted by section 156 of the Building Safety Act 2022, requires the responsible person to record the fire risk assessment and the prescribed information that goes with it. The five-employee threshold in the 1999 Regulations does not apply to fire. Scotland and Northern Ireland have their own fire safety legislation with their own recording rules.
How often should a risk assessment be reviewed?
There is no fixed legal interval. Review whenever something changes, such as new equipment, a layout change, an incident or a near miss, and otherwise on a schedule the business sets itself, commonly annually for stable areas and more often for higher-risk activities like hot oil handling or cellar work. Record the date the review actually happened rather than the date it was due.
What is the 5x5 risk matrix and is it compulsory?
The 5x5 matrix scores a hazard's likelihood and severity on a scale of one to five and multiplies them to give a risk rating, which helps prioritise action. It is a widely used tool rather than a legal requirement. What matters legally is that the assessment identifies the hazards, who is affected, the existing controls and any further action needed, and that the significant findings are recorded.
Who is competent to carry out a risk assessment in a hospitality venue?
The person does not need a formal qualification but must understand the work being assessed and the hazards involved. For most day-to-day hospitality risks a trained manager is sufficient. Specialist areas such as legionella or complex COSHH assessments may need external competent advice, and the assessment should record the assessor's name either way.