Risk Assessment in Health and Social Care

Risk assessments are not just a paperwork exercise. When they are missing, out of date or poorly completed, people can and do come to harm.

In 2017, a care provider in Croydon was fined £45,000 and ordered to pay over £14,000 in costs when a 72‑year‑old resident of their care home was severely burned after sitting on a portable heater. Investigations showed that risks around heaters and burns had not been properly assessed and controlled.

In 2018, the Care Quality Commission (CQC) prosecuted a nursing home and its registered manager after a resident died following a fall from a second floor window. The provider was fined £16,500 for failing to take adequate measures to prevent falls from windows. The registered manager was fined £1,000 for failing to have an up to date risk assessment. A suitable assessment could have identified that the window did not have restrictors fitted and prompted action to install them, preventing the death and the distress caused to the person’s family and staff.

In these and many other cases, the courts, CQC and the Health and Safety Executive (HSE) were able to show that risk assessments were missing, out of date or not completed properly. As a result, avoidable risks were not identified or managed, and people were harmed.

This article covers the fundamentals of risk assessment in health and social care so that you can avoid similar mistakes and protect the people who use your services, as well as your staff and organisation.

A risk assessment in health and social care is a structured process used to identify potential sources of harm and decide what needs to be done to reduce those risks to an acceptable level. The aim is to protect service users, staff and others who may be affected by the service, such as visitors or contractors. Risk assessments should be completed:

• For each person you provide care for, whether in a residential setting like a care home or in a person’s own home
• For the environment in which care is delivered, for example the care home building or an individual’s home
• For specific activities or tasks, such as moving and handling, medication administration or use of equipment

Risk assessments in health and social care must be carried out by staff who are competent to do so. This usually means they have had appropriate training, understand the service and the people who use it, and know how to apply relevant legislation and guidance.

A person’s individual risk assessments should be completed before their care package begins and updated whenever circumstances change or new risks are identified. Environmental and activity-based assessments also need regular review, especially after incidents, near misses or changes to equipment, staffing or layout.

Many providers now use electronic care planning systems that include pre-built risk assessment templates, such as general risk assessments and specific tools like falls risk assessments. Depending on the system, these templates can often be customised to reflect your own policies and processes, helping to standardise practice and reduce the chance of important risks being overlooked.

Although risk assessments can vary in format, the core process is usually the same. The following six steps provide a useful framework.

Step 1: Gather information and identify hazards

Step 2: Determine who might be harmed and how

Record who is at risk and how they might be harmed. This includes:

• Care recipients 
• Staff
• Visitors, including family and friends
• Contractors or other professionals

It is important to consider how different groups may be affected in different ways. For example, moving and handling activities present one type of risk for staff and another for the person being moved.

Step 3: Evaluate the risks and identify controls

Next, assess:

• How likely it is that harm will occur
• How serious the harm could be
• What is already in place to control the risk
• What further action is needed

Some organisations use a numerical rating system or traffic light approach to score the likelihood and severity of each risk, such as multiplying a likelihood score by a severity score to generate an overall rating. There is no single compulsory method, so you can use whatever approach best supports your service to prioritise and address risks effectively.

Step 4: Decide on control measures

Where possible, risks should be eliminated rather than simply reduced. For example:

• Removing a trip hazard
• Repairing or replacing faulty equipment
• Installing window restrictors
• Changing how a task is carried out

Where risks cannot be eliminated, you should introduce control measures to reduce the likelihood of harm or minimise its impact. This might include training, supervision, use of equipment, revising procedures or making environmental changes.

Any control measures should be checked against relevant legal requirements and best practice guidance, including advice from the HSE.

It is also important to consider the person’s rights and preferences. In health and social care, risk management must be balanced with person centred care and respect for choice. Providers are required to do what is “reasonably practicable”, meaning that the level of risk should be balanced against the cost, time or difficulty of further controls.

Step 5: Record your findings and implement controls

Risk assessments should be recorded in a clear and accessible way. At a minimum, the record should usually include:

• Name of the person who carried out the assessment
• Location of the assessment
• Date of the assessment
• Details of the risks identified
• Control measures already in place
• Actions to be taken, with responsible persons and timescales
• Date of next review

For individual service users, the risk assessment should feed directly into their care plan so that staff understand how to support the person safely.

Step 6: Review and update the risk assessment

Risk assessments are not a one‑off document. They should be reviewed regularly and whenever there is reason to suspect they are no longer valid. Triggers for review include:

• An incident or near miss
• A change in the person’s health, mobility or behaviour
• Introduction of new equipment or medication
• Changes to the environment or staffing levels

Risks that are rated as higher or more severe should usually be reviewed more frequently. New assessments may be needed when existing hazards change or new risks emerge.

In health and social care, risk assessments should support people to live as fully and independently as possible, not restrict their lives unnecessarily. The HSE refers to this as “sensible risk management” in care settings. Good risk assessments:

• Recognise that some level of risk is unavoidable in everyday life.
• Consider what matters most to the person and what they want to achieve.
• Explore how support and equipment can reduce risk while still enabling choice.
• Avoid blanket restrictions, instead focusing on individual circumstances.

For example, rather than banning a person from going out alone after a fall, a risk assessment might identify that they can go out safely with appropriate footwear, a walking aid and a mobile phone, or with short supervised walks at first.

Risk assessments can be recorded in many different ways, from simple tables to more detailed forms. A basic format might look like this:

• Column 1: What is the risk and who might be harmed?
• Column 2: How likely is harm to occur and what is the potential severity?
• Column 3: What control measures or actions are required? Who will do them and by when?
• Column 4: Any further or ongoing actions needed and review notes

Whatever format you use, the key is that information is clear, up to date and actually used to guide day to day practice. Electronic systems can help by keeping records in one place, prompting reviews and ensuring actions are tracked to completion.

While every service and individual is different, some risk areas appear frequently in health and social care settings. Common examples include:

• Moving and handling, which is responsible for a significant proportion of accidents and injuries
• Medication handling and administration
• Slips, trips and falls
• Behaviours that challenge, including aggression or violence
• Food and nutrition risks, such as allergies, choking or burns
• Infection prevention and control, for example managing COVID‑19 or other infectious diseases

In care homes and other residential services, additional environmental risks include:

• Scalding and burns from hot water, bathing or heating equipment
• Electrical safety, fire safety, asbestos and other premises based hazards
• Bedrail entrapment and positioning injuries
• Legionella and water system management
• Safe staffing levels and skill mix

For more detailed guidance on specific risk areas, providers can refer to HSE resources and relevant sector guidance.

Effective risk assessment in health and social care is essential for keeping people safe, meeting legal requirements and providing high quality, person-centred support. When risk assessments are carried out well, they help staff understand where harm might occur, what needs to be done to reduce that risk and how to balance safety with independence and choice.

When they are done poorly, or not done at all, the consequences can be serious, leading to avoidable incidents, regulatory action and lasting harm to people who use services. By following a clear process, keeping assessments up to date and making sure they feed into day to day practice, providers can build a strong foundation for safe care.

Risk assessments can be difficult to manage using paper forms or spreadsheets, especially when multiple teams need access or assessments must be reviewed regularly. Using technology to manage risk assessments helps maintain accuracy, reduce duplicated effort and ensure that crucial information is always up to date.

Access Risk Management software is designed to help care providers complete, review and evidence risk assessments with confidence. The system includes structured templates for common risk areas and allows you to tailor assessments to your service, environment or the needs of an individual. Real‑time updates ensure that all team members can see changes as soon as they are made, helping to keep people safe and maintain continuity of support.

Automated reminders prompt staff when reviews are due, and clear audit trails show exactly when assessments were completed, what actions were taken and who was responsible. This makes it easier to stay compliant, reduce errors and demonstrate good practice during inspections.

Contact us today to see how Access Risk Management can help your service manage risk more effectively and maintain safer, more consistent care.