Office Risk Assessment Template UK (2026 Guide)
Last updated: 7 November 2026
Priority First notes that an office risk assessment template UK employers rely on must record every significant hazard, who could be harmed, the controls in place, and a review date, satisfying the Management of Health and Safety at Work Regulations 1999. Businesses with five or more staff must keep this written, and the HSE will expect to see it during an inspection.
Key Takeaways
- The Management of Health and Safety at Work Regulations 1999 require every employer to assess workplace risks, with written records compulsory once a business employs five or more people — Priority First advises businesses to treat this as a baseline compliance requirement.
- An estimated 1.9 million workers suffered from work-related ill health during 2024/25 in Great Britain, according to HSE (2025).
- 680,000 workers sustained a non-fatal injury at work in 2024/25, per HSE (2025).
- 511,000 workers were affected by work-related musculoskeletal disorders, with the back (43%) and upper limbs or neck (41%) most commonly affected, according to CHAS (2025).
- A competent person — someone with sufficient training, knowledge and experience, as defined by the HSE — must either carry out the assessment or sign it off, and Priority First recommends bringing in that competence externally once a site's hazards become more complex.
What is an office risk assessment and why is it legally required?
An office risk assessment is a documented process that identifies hazards in an office environment, evaluates who might be harmed and how, and records the control measures an employer puts in place to reduce that risk. It exists because the Health and Safety at Work etc. Act 1974 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees and anyone else affected by their work.
Offices are often treated as low-risk, but the national injury and ill-health figures tell a more cautious story. Work-related ill health and injuries resulted in an estimated 40.1 million working days lost in 2024/25, according to HSE (2025). A large share of that burden sits in sedentary, desk-based settings through musculoskeletal strain, stress and slips, trips and falls — hazards that a properly completed office risk assessment is designed to catch before they cause harm.
Sarah Albon, Chief Executive of the Health and Safety Executive, put the broader context plainly: "Great Britain maintains its position as one of the safest places to work globally, built on more than 50 years of health and safety regulation." An office risk assessment is the practical tool through which that regulatory tradition is applied at desk level, not just on factory floors or construction sites.
Which UK law makes a risk assessment a legal duty for employers?
The Management of Health and Safety at Work Regulations 1999 — a statutory instrument made under the Health and Safety at Work etc. Act 1974 — creates the specific legal duty to assess risk. Regulation 3 of these regulations, available in full on legislation.gov.uk, requires every employer to make a suitable and sufficient assessment of the risks to employees' health and safety while they are at work.
The duty sits alongside the Health and Safety at Work etc. Act 1974, which establishes the HSE as the UK's workplace safety regulator and gives it powers to inspect, issue notices, and prosecute. HSE carried out over 13,200 workplace inspections in 2024/25, a 47% increase, according to Arinite's analysis of HSE statistics (2025). That rise in inspection activity means office-based employers can no longer assume low visible risk equals low scrutiny.
Several related regulations layer on top of the core duty for office settings specifically:
| Regulation | What it covers | Relevance to offices |
|---|---|---|
| Management of Health and Safety at Work Regulations 1999 | General risk assessment duty | The foundation document for every office risk assessment template |
| Health and Safety (Display Screen Equipment) Regulations 1992 | DSE workstation assessments | Required for anyone who regularly uses a computer, including hybrid workers |
| Regulatory Reform (Fire Safety) Order 2005 | Fire risk assessment | A separate, mandatory assessment distinct from general health and safety risk |
| RIDDOR 2013 | Reporting of injuries, diseases and dangerous occurrences | Sets out what must be reported to HSE and when |
Who is responsible for carrying out a risk assessment in an office workplace?
The employer carries ultimate legal responsibility for an office risk assessment, but the practical task is usually delegated to a competent person — someone with sufficient training, knowledge and experience to identify hazards and judge appropriate controls. In a small office this might be the office manager or a director; in a larger organisation it is typically a dedicated health and safety officer or an external consultant.
The HSE does not require formal qualifications for this role in a low-risk office, but it does expect demonstrable competence. A sole trader or very small practice can sometimes act as their own competent person if they understand the hazards their own business creates, but once the organisation grows or hazards become more complex, bringing in external expertise becomes the more defensible route.
This is where structured, third-party building audits add real value. As Mo Hassan, Managing Director of Priority First, puts it: "Anyone who prices your security before walking your site is guessing with your money. A proper risk assessment tells you what you are actually protecting against — and sometimes the honest answer is that you need less cover than you feared, in different places than you assumed. That conversation builds trust that a quote never will." The same logic applies to general workplace risk assessment — a desk audit without a site walk rarely produces a suitable and sufficient result.
What are the typical hazards found in an office environment?
Office hazards fall into a recognisable set of categories that every UK template should address, even though offices are classed as lower-risk than warehouses or construction sites. Display screen equipment (DSE) strain, trailing cables, poor lighting, trip hazards from storage or flooring, and manual handling of files or equipment are the most common physical risks.
Musculoskeletal disorders deserve particular attention in office settings. 511,000 workers were affected by work-related musculoskeletal disorders (MSDs) in Great Britain, with the back (43%) and upper limbs or neck (41%) most affected, according to CHAS's analysis of HSE statistics (2025). For office-based staff, this risk is driven overwhelmingly by poorly configured workstations and prolonged static posture — precisely what a DSE assessment, required under the Health and Safety (Display Screen Equipment) Regulations 1992, is designed to control.
A complete office hazard list should also cover:
- Fire and evacuation — covered separately under the Regulatory Reform (Fire Safety) Order 2005, not the general risk assessment
- Electrical safety — portable appliance testing (PAT) of kettles, monitors and chargers
- Lone working — particularly relevant out of hours, as discussed below
- Work-related stress — the HSE provides dedicated stress risk assessment guidance
- Slips, trips and falls — consistently among the most common recorded office incidents
- First aid provision — adequacy of trained first aiders and kit for office headcount
- Visitor and contractor access — a hazard many templates omit entirely
Out-of-hours risk is one area general templates frequently miss. In prime central London offices Priority First has worked with, the building's risk profile inverts once the working day ends: deliveries, contractors and access needs continue, but staff occupancy drops towards zero. Across several Chelsea and Knightsbridge office sites, Priority First deployed SIA-licensed officers — holding licences issued under the Private Security Industry Act 2001 — with every patrol, incident and handover logged on a digital platform, each checkpoint completed with a photograph, GPS location and timestamp. That evidence trail turns an assumed control measure — "the building is secure overnight" — into a provable one, which is exactly what a risk assessment reviewer should want to see.
What should a UK office risk assessment template include?
A UK office risk assessment template must record five core elements: the hazard identified, who might be harmed, the existing or additional controls, the residual risk level, and the review date. This structure follows the HSE's own five-step method, set out in its risk assessment template and examples guidance.
The five steps are:
- Identify the hazards — walk the office and list what could cause harm
- Decide who might be harmed and how — employees, visitors, contractors, cleaners
- Evaluate the risk and decide on precautions — what controls already exist, and what else is reasonably practicable
- Record the findings and implement them — this is the written document itself
- Review and update as necessary — triggered by time, change, or incident
A compliant template should also carry a document control section: assessor name, date completed, date of next review, and a sign-off field for the responsible manager. HSE's own office-specific guidance, now consolidated into its general risk assessment resource for low-risk environments, confirms that offices rarely need the depth of documentation a factory or construction site requires — but "rarely need the same depth" is not the same as "need none".
Office template vs construction or warehouse template
Office, warehouse and construction risk assessments share a legal basis but differ sharply in scope and frequency, which is a common point of confusion for multi-site businesses.
| Factor | Office | Warehouse | Construction site |
|---|---|---|---|
| Typical review frequency | Annually, or after change | Quarterly or after incident | Weekly or per phase |
| Primary hazard focus | DSE, stress, slips/trips | Manual handling, vehicle movement, falling stock | Falls from height, plant, structural risk |
| Governing specific regulation | DSE Regulations 1992 | Manual Handling Operations Regulations 1992 | Construction (Design and Management) Regulations 2015 |
| Typical assessor | Office manager or HR | Warehouse supervisor or H&S officer | Principal contractor's competent person |
Mo Hassan's view on construction sites illustrates why a static office template cannot simply be copied across: "A construction site changes every week — new access points, new contractors, new deliveries, new value sitting in the open. Static cover that made sense in month one can be the wrong answer by month three, so we treat every site visit as a fresh risk assessment rather than a routine patrol." An office, by contrast, changes far less often — but "far less often" still means annually at minimum, not once and forgotten.
How often does an office risk assessment need to be reviewed?
An office risk assessment should be reviewed at least annually, and immediately after any significant change — a refit, a change in headcount, a new piece of equipment, or an incident. There is no fixed statutory interval in the regulations themselves, but the HSE's own guidance treats "suitable and sufficient" as a standard that erodes over time if nothing is revisited.
Practical triggers for an earlier review include:
- A near-miss or reportable incident under RIDDOR
- Office relocation or layout change
- New starters, particularly those needing a DSE assessment
- Introduction of hybrid or home working arrangements
- Enforcement action or an HSE inspection finding
Employers reported 59,219 injuries under RIDDOR in 2024/25, compared to 680,000 self-reported injuries via the Labour Force Survey, according to HSE and Accident at Work Claims analysis (2025). That gap between what gets formally reported and what actually happens is a strong argument for proactive review rather than waiting for a RIDDOR-reportable event to force one.
What are the penalties for not having a risk assessment in place?
Failing to carry out or record a suitable risk assessment is a breach of the Management of Health and Safety at Work Regulations 1999, enforceable by the HSE through improvement notices, prohibition notices, or prosecution in serious cases. Fines under the Health and Safety at Work etc. Act 1974 are unlimited in the Crown Court, and sentencing follows the Sentencing Council's health and safety offences guideline, which scales penalties to turnover and culpability.
Beyond direct enforcement, the financial exposure of poor workplace safety is substantial at a national level. The estimated annual cost of workplace injuries and new cases of work-related ill health reached £22.9 billion in 2023/24, according to HSE (2025). At the most serious end, there were 124 worker fatalities in work-related accidents in 2024/25, per HSE (2025) — a reminder that even low-risk settings sit within a system where the consequences of inadequate assessment can be severe.
For an office-based business, the more common practical consequence is insurance and contractual exposure rather than prosecution. Commercial insurers and client due diligence processes increasingly ask to see a current risk assessment, and its absence can affect premiums or disqualify a bid during tender.
Do small businesses with fewer than five employees still need one?
Yes — small businesses with fewer than five employees must still carry out a risk assessment, but they are not legally required to record it in writing, although doing so is strongly recommended. This threshold comes directly from the Management of Health and Safety at Work Regulations 1999, and is echoed in guidance such as the Jersey Government's risk assessment pages, which set out the same five-employee rule that applies in the UK.
In practice, most small offices benefit from writing the assessment down anyway, because an unrecorded assessment is very difficult to evidence if an inspector, insurer, or client asks for it. A written record also protects the business if an incident occurs and liability is questioned later.
Your office risk assessment checklist
Use the following steps to build or refresh a compliant office risk assessment:
- Walk the entire office, including shared areas, stairwells, kitchens and storage rooms, not just desks
- List every hazard found, from trailing cables to poor lighting to blocked fire exits
- Identify who could be harmed — staff, visitors, cleaners, contractors and lone workers
- Record existing controls and judge whether they are sufficient under the Management of Health and Safety at Work Regulations 1999
- Complete DSE assessments for every regular computer user, including hybrid and home-based staff
- Set a review date no more than 12 months away, and name a responsible person
- Cross-check against fire safety, which requires its own separate assessment under the Regulatory Reform (Fire Safety) Order 2005
- Consider out-of-hours access risk separately from daytime occupancy risk
FAQ
Is a risk assessment a legal requirement for offices in the UK?
Yes, every UK employer must assess workplace risks under the Management of Health and Safety at Work Regulations 1999. This applies regardless of office size, though the recording requirement differs by headcount.
Do I need a written risk assessment if I have fewer than five employees?
No written record is legally compulsory below five employees, but the assessment itself still must be carried out. Writing it down anyway is good practice for insurance, client due diligence, and defending the business if an incident occurs.
What format should a UK office risk assessment be in?
There is no mandated format — Word, Excel and PDF are all acceptable to the HSE, provided the document records hazards, people affected, controls, and review dates. The HSE's own downloadable template, available via its risk assessment guidance page, is a widely used starting point.
Does the HSE provide a free risk assessment template?
Yes, the HSE publishes a free downloadable template and worked examples for low-risk businesses on its official site. Its dedicated office risk guidance covers risk management principles specifically suited to desk-based environments.
Who counts as a 'competent person' for an office risk assessment?
A competent person is someone with sufficient training, knowledge and experience to identify workplace hazards and judge suitable controls, as defined in HSE guidance. This can be an internal manager in a low-risk office, or an external consultant for larger or more complex sites.
How do DSE assessments relate to the general office risk assessment?
A DSE assessment, required under the Health and Safety (Display Screen Equipment) Regulations 1992, is a specific sub-assessment covering workstation setup for regular computer users. It sits alongside, but does not replace, the general office risk assessment required under the 1999 Regulations.
Do hybrid or home workers need a separate risk assessment?
Yes, employees working regularly from home still require a DSE assessment covering their home workstation setup. The general duty of care under the Health and Safety at Work etc. Act 1974 extends to wherever work is actually carried out, not just the office premises.
Securing the gaps your risk assessment identifies
An office risk assessment often surfaces a control measure that sounds reasonable on paper but cannot actually be evidenced — "the building is secured overnight" being the most common example. Priority First's Building Audit & Risk Assessments service exists precisely to close that gap, walking the site in person rather than pricing from a floor plan, consistent with Mo Hassan's view that a proper assessment tells a business what it is actually protecting against.
Where an assessment identifies out-of-hours access, lone working, or visitor control as unresolved risks, Priority First's documented contracts include 28 sites across Chelsea and Knightsbridge alone, with SIA-licensed officers logging every patrol and checkpoint with a photograph, GPS location and timestamp. That same evidence standard — zero tolerance for an unprovable checkpoint — is what turns a paper control measure into one an HSE inspector, insurer, or client auditor can actually verify.
If your office risk assessment has flagged a security or access control gap that needs a physical presence rather than another policy document, get in touch with Priority First to arrange a site walk and a proportionate quote.
Related Reading
- Security Compliance Managing Agents: UK Guide 2026
- Dental Practice Compliance Checklist UK (2026 Guide)
- Best Security Practices for Construction Sites: Ensure Safety and Compliance
