Risk Assessment Reviews: How Managers Can Tell When an Assessment Is Out of Date

The useful management test is whether the assessment still describes the risks and controls that exist in practice. Review becomes necessary when there is reason to suspect that the assessment is no longer valid or when a significant change affects what it covers, with separate but closely comparable legal provisions applying in Great Britain and Northern Ireland.

Review Should Follow Evidence, Not Document Age Alone

A review date can support administration, but the age of an assessment does not by itself establish whether it remains suitable.

Under the Management of Health and Safety at Work Regulations 1999 in Great Britain, an employer must review an assessment where there is reason to suspect that it is no longer valid or where a significant change has occurred in the matters to which it relates. Required changes identified by that review must then be made.

For managers, the assurance question is therefore whether the assumptions recorded in the assessment still match the workplace.

Operational Change Should Feed Into Risk Assessment

HSE guidance identifies changes in staff, processes, substances and equipment as matters that can create new risks. This makes change management an important route into risk assessment review.

Before revised arrangements become routine, managers should know whether they affect existing hazards, introduce different exposure or alter the controls already relied upon. Where they do, the relevant assessment should be reconsidered.

The same principle applies when work develops gradually. A process may change through a series of smaller operational decisions even though no single project has been labelled as a major change. The assessment still needs to describe the work that is actually being done.

Performance of Controls Provides a Review Signal

An assessment can also become unreliable because a control that looked adequate on paper does not work as expected.

HSE says employers must review controls to make sure they are working. It also advises considering a review where workers report problems or where accidents or near misses occur.

For senior managers, these are useful sources of assurance evidence. Reports from workers, incident information and observation of work can reveal differences between the documented control arrangements and everyday practice. Where those differences affect the assessment, the record needs to be revised.

A Review Can Be Proportionate

Review does not necessarily mean recreating every risk assessment from the beginning. The purpose is to determine whether the existing assessment remains suitable and sufficient and to make changes where required.

This matters in larger organisations with extensive assessment registers. A change to one process or item of equipment may affect a defined group of assessments without invalidating unrelated material. Review arrangements should make it possible to identify the affected assessments and revise the relevant content.

Records Should Show the Current Position

Where an employer has five or more employees, HSE guidance states that significant findings must be recorded. HSE also instructs employers to update the risk assessment record with changes made through the review process.

A useful record should therefore show the current hazards and controls, rather than preserving an outdated assessment simply because the original document has been formally approved.

Northern Ireland has its own Management of Health and Safety at Work Regulations (Northern Ireland) 2000. Its Regulation 3 uses the same two central triggers for review: reason to suspect that an assessment is no longer valid and significant change in the matters covered. HSENI also describes review and updating as part of the risk assessment process.

Common Compliance Gaps

A weak review process may separate risk assessments from operational decision-making. Equipment or processes are changed first and the assessment register is considered later.

Further gaps arise where reviews confirm existing paperwork without checking controls in practice, or where information from workers, accidents and near misses does not reach the person responsible for maintaining the assessment.

Manager Checklist

1. Map operational change procedures to the assessments they may affect.
2. Test whether assessment assumptions still match current work.
3. Use incident and near-miss information as possible review triggers.
4. Include worker-reported control problems in the review process.
5. Check that controls described in assessments are still operating as intended.
6. Amend the assessment record promptly when a review identifies a changed position.
7. Keep responsibility for review initiation and completion clearly assigned.

Frequently Asked Questions

Can a risk assessment remain valid for several years?

Its validity depends on whether the risks, circumstances and controls it covers remain current. The general Great Britain regulations do not set a universal expiry period.

Should a risk assessment be reviewed before introducing new equipment?

Changes to equipment can introduce new risks. HSE guidance identifies equipment changes as a reason to review controls and the associated assessment where the change affects the risks.

Is signing a review date enough?

A review needs to establish whether the assessment remains valid and whether controls are working. Changing a date without examining the current circumstances does not address those questions.

Do the same regulations apply in Northern Ireland?

No. Northern Ireland has separate management regulations, although its Regulation 3 contains the same central review triggers of possible invalidity and significant change.