Risk Assessments That Actually Work: A Practical Method for Busy Businesses

Most risk assessments don’t fail because people don’t care. They fail because they’re:

• too complicated
• too generic
• done once and forgotten

A risk assessment should be a working tool — something that helps you prevent problems, prove control to clients and auditors, and make better decisions.

Here’s a practical method that works for busy SMEs.

What a risk assessment is, in plain English

It’s a simple way to answer:

• what could go wrong?
• how bad would it be?
• how likely is it?
• what are we doing to control it?
• what else do we need to do?

The five-step method

Step 1: Define the scope

Be specific. Write one sentence covering:

• risk assessment for: [process, site or activity]
• applies to: [team or locations]
• reviewed: [date]

Step 2: Identify real risks, not generic fluff

Use three prompts:

• People: competence, fatigue, supervision, contractors
• Process: steps that fail, handovers, approvals, changes
• Proof: evidence, records, traceability, version control

Keep it real. If it’s never happened and can’t happen, don’t include it.

Step 3: Score it simply

Don’t overthink it. Use a simple 1–5 scale for:

• likelihood, from 1 rare to 5 frequent
• impact, from 1 minor to 5 severe

Then calculate: likelihood × impact = risk score. For example, likelihood 4 × impact 3 = 12, which needs action.

Step 4: List your current controls

This is where you show you’re in control. Controls might include:

• training and competence checks
• supervision
• maintenance and calibration
• document control
• inspections
• supplier approval

Step 5: Add actions that actually reduce risk

If the score is high, add an action that changes the reality — not just a note. Every action needs an owner, a due date and the evidence required.

Examples of good actions:

• introduce a pre-start checklist and store completed records in one folder
• train the team on procedure v3 and record sign-offs
• add a monthly inspection log and review it at management review

The bit most businesses miss: keep it live

A risk assessment isn’t a one-off. Update it when:

• you win a new contract
• you add a new site
• you change suppliers or subcontractors
• you introduce new equipment
• you have an incident or complaint

Quick rule: if the business changes, the risk register changes.

Common mistakes that get flagged in audits

• generic risks copied from the internet
• no owners or dates on actions
• actions listed but not completed
• no review dates
• a risk assessment that exists but doesn’t match reality

A simple risk register structure

Use columns for: activity or process, hazard or risk, who it affects, likelihood, impact, score, current controls, further actions, owner, due date, status and review date.

How CAW Consultancy helps

We build practical, audit-ready systems — including risk registers that are simple, live and actually used. If you want a formal framework behind it, ISO 31000 is the risk management standard, and the same discipline sits at the heart of ISO 9001 and ISO 45001.

Need help with this?

CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost. Ask and we’ll send over the risk assessment template we use with clients.