Is risk assessment training a legal requirement in the UK?

Yes. Risk assessment training is a firm legal requirement in the UK for anyone appointed to identify hazards, evaluate risks and put controls in place at work. The duty is built from the Health and Safety at Work etc. Act 1974 and, most directly, the Management of Health and Safety at Work Regulations 1999. Regulation 3 requires every employer to carry out a "suitable and sufficient" risk assessment, and Regulation 7 requires them to appoint one or more "competent persons" to do it. Competence, in HSE language, is "sufficient training and experience or knowledge and other qualities" to do the job properly. A recognised risk assessment course is the standard way to prove that competence at inspection, in insurance renewals, and in civil proceedings after an incident.

The legal framework in plain English

There is no single "Risk Assessment Regulations". Three instruments operate together and each one bites at inspection.

Health and Safety at Work etc. Act 1974

Section 2 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. Section 3 extends that duty to anyone else who may be affected by the undertaking, including contractors, visitors, patients, pupils and the public. Where a hazard is foreseeable, and almost every workplace hazard is foreseeable once you look, risk assessment is one of the "reasonably practicable" steps an employer must take. The Health and Safety Executive or the local authority enforces the Act, and the maximum penalty on indictment is an unlimited fine and up to two years in prison.

Management of Health and Safety at Work Regulations 1999

This is the risk assessment regulation. Regulation 3 requires a suitable and sufficient assessment of the risks to employees at work and to anyone else affected by the work. Regulation 4 requires the employer to apply the principles of prevention set out in Schedule 1 (avoid the risk, evaluate what cannot be avoided, combat at source, adapt the work to the worker, and so on). Regulation 5 requires effective arrangements for planning, organising, controlling, monitoring and reviewing. Regulation 7 is the one that catches most enforcement notices: the employer must appoint one or more competent persons to help apply the measures needed to comply with the law. Regulation 13 requires adequate health and safety training on recruitment and whenever a new or increased risk is introduced. Together, Regulations 3, 7 and 13 close the "we did not know" defence.

Task-specific and sector-specific rules

Above the general duty, most workplace hazards come with a specific set of regulations that each require their own risk assessment. Manual handling operations need an assessment under the Manual Handling Operations Regulations 1992. Hazardous substances need one under the Control of Substances Hazardous to Health Regulations 2002. Display screen equipment needs one under the DSE Regulations 1992. Fire safety needs a Fire Safety Order 2005 assessment. Work at height, noise, vibration, asbestos, lead, biological agents and pregnant workers each have their own regime. A generalist risk assessment course teaches the transferable method; the sector-specific courses layer the specialist duties on top.

Why the numbers still matter

The latest HSE headline statistics for Great Britain (2024/25) record 124 workers killed in work-related accidents, 680,000 workers reporting a non-fatal workplace injury under the Labour Force Survey, 59,219 employee non-fatal injuries formally reported to HSE under RIDDOR, and 1.9 million workers suffering from a work-related illness, new or long-standing. Between them, work-related ill health and injury cost 40.1 million working days lost across the year. Every one of those cases started with a hazard that either was not assessed, was assessed badly, or was assessed but not controlled. Regulator prosecutions almost always trace back to the same three failings: no risk assessment on file, an assessment that missed the hazard that actually caused the harm, or an assessment that identified controls but never checked they were used.

What "suitable and sufficient" actually means

HSE and the courts have interpreted the "suitable and sufficient" test consistently. A risk assessment must:

• Identify all the significant hazards arising from or connected with the work.
• Identify who might be harmed and how, including groups of workers with particular needs (young workers, new and expectant mothers, lone workers, disabled workers, temporary staff and contractors).
• Evaluate the risk from each hazard, taking into account existing precautions.
• Record the significant findings in writing where the employer has five or more employees.
• Identify further action needed to reduce the risk to an acceptable level, following the hierarchy of controls.
• Be proportionate to the risk, not exhaustive for its own sake.
• Be reviewed when circumstances change, when the work changes materially, after an incident or near miss, and at reasonable intervals in any case.

The HSE five-step method (identify hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record and implement findings, review and update) is the plain-English version of the same test.

The hierarchy of controls

Selecting controls in the right order is what separates a competent assessment from a paper exercise. The Schedule 1 principles of prevention, reproduced in every HSE and HSG document, run:

1. Eliminate the hazard entirely. If the work can be done without the hazard, do it that way.
2. Substitute the hazard with something less harmful. A less volatile solvent, a lower-voltage tool, a lighter component.
3. Engineering controls. Guards, extraction, interlocks, physical separation. These protect everyone in the area without depending on behaviour.
4. Administrative controls. Safe systems of work, permits, rotas that limit exposure time, signage, training.
5. Personal protective equipment. The last line, used to control residual risk after the higher levels have been applied.

PPE-first is a hallmark of a weak assessment. Inspectors look for it. Insurers look for it. Coroners look for it.

Who must be trained

Risk assessment training is aimed at the people who are appointed to create, approve or review assessments, not the whole workforce. In HSE terms, that normally means:

• The dutyholder, usually the employer or the most senior person in control of the premises.
• Appointed competent persons under Regulation 7.
• Health and safety managers and advisers.
• Line managers, supervisors and team leaders with authority over how work is planned.
• Facilities and estates managers responsible for buildings and shared spaces.
• Site managers and project managers in construction, manufacturing and engineering.
• Care home, school and nursery managers responsible for staff, residents, pupils and visitors.
• Hotel, restaurant and leisure operators responsible for guests as well as staff.
• Union and non-union safety representatives who consult on assessments on behalf of colleagues.
• Anyone newly promoted into any of the above roles.

The general workforce needs awareness of the risks and controls that affect them, delivered through the specific safety training that follows an assessment (manual handling, COSHH, fire, and so on). They do not, in most cases, need to complete the risk assessment training itself.

What good risk assessment training covers

A competent generalist course, delivered online and CPD accredited, works through the same syllabus a good in-person course would:

• The legal framework: HSWA 1974, Management Regs 1999, and how sector rules layer on top.
• The difference between a hazard and a risk, with worked examples across office, care, warehouse and construction settings.
• Who might be harmed, including workers, contractors, visitors and vulnerable groups.
• Hazard identification methods: walk-throughs, worker consultation, incident and near-miss review, health surveillance data, manufacturer information.
• Risk evaluation using a simple likelihood x severity matrix.
• The hierarchy of controls, with a working understanding of why PPE is the last line rather than the first.
• Recording the significant findings in writing where the employer has five or more employees, with a template and worked examples.
• Communicating the assessment to the people it affects, including toolbox talks and safety briefings.
• Reviewing and updating: what triggers a review, and how to evidence it.
• The interface with specific regulations (manual handling, COSHH, DSE, work at height, fire) and when a specialist assessment is required in addition.
• A short final assessment leading to a downloadable certificate.

How often to refresh

Neither the 1974 Act nor the 1999 Regulations set a fixed refresh interval. HSE and industry practice converge on the same triggers: retrain when the role changes, when new equipment or processes are introduced, when regulations or Approved Codes of Practice are updated, after a significant incident or near miss, when performance monitoring suggests knowledge has drifted, and on a routine every two years as a default. Any inspector who asks "when was this person last trained?" expects a dated certificate on file, not a verbal assurance.

Enforcement and cost

An inadequate risk assessment is one of the most common findings in HSE improvement and prohibition notices, and it is almost always cited in fatal-accident prosecutions. Fines under the sentencing guideline for health and safety offences are unlimited in the Crown Court and are calibrated to turnover: a large organisation convicted of a high-culpability, high-harm offence can face a starting point in the millions. Directors and senior managers can be prosecuted personally under Section 37 of the 1974 Act where an offence is proven to have been committed with their consent, connivance or neglect, and the maximum penalty is imprisonment. Insurance policies routinely require documented risk assessments as a condition of cover; a claim can be reduced or refused where none exists.

The learndirect Risk Management Training course

learndirect's Risk Management Training covers exactly this ground. It is a self-paced online course of about 60 minutes, CPD accredited, worth one CPD hour, priced at GBP 25 for a single seat with volume discounts starting at ten seats (GBP 212.50 for ten, GBP 468.75 for twenty-five, GBP 812.50 for fifty, GBP 1,375 for one hundred). Learners work through the five steps of risk assessment, the hierarchy of controls, employer and employee duties, and the recording and review cycle, and download an instant personalised certificate on completion. The certificate is recognised by UK employers and by HSE inspectors as evidence of the training required by Regulations 7 and 13 of the Management Regulations 1999.

For teams that also need task-specific assessments, learndirect publishes companion courses at the same price point: Manual Handling Training Risk Assessment for lifting, carrying and load handling, and Playground Inspection Risk Assessment for schools, nurseries and local authorities responsible for play equipment. Complete the generalist course first, then layer the specialists on top for the hazards that matter most in your setting.