Think you’ve got risk assessment nailed?


Human beings like to have things nailed down, and consequently some become very attached to their risk assessment scoring systems – just like the nail gun they recently bought from B&Q.

Consider how opinion polls have got things wrong with their percentages time and again, yet they’re still frequently used and quoted as though they’re Gospel.

Similarly, judging risk in Health and Safety using numbers isn’t easy and should be used with caution.

A clue to whether scoring risk is a good idea can be found on the HSE’s risk assessment website where their risk assessment form contains no scoring at all, just the question ‘Do you need to do anything else to control this risk?’

Another clue as to the lack of scientific backing to scoring can be seen in the myriad of scoring systems out there – normally a colourful grid of 3×3 or 5×5 scores of ‘Hazard’ times ‘Likelihood’.

The numbers are generally clear enough, but the division between the resulting risk levels vary enormously, as does the advice on what to do next.

The very worst have no logic at all e.g. with the centre of a spread of ‘Likelihood’ scores having the word ‘Likely’ attached – already a skewed system: surely the central ground of ‘Likelihood’ is a 50:50 chance aka ‘Possible’.  

Before and After Systems

More complicated scoring systems have a ‘before’ and ‘after’ – so two lots for the price of one!
With these systems, you have to ask ‘before’ what?

When I do ask those people using them, they say ‘before the controls are in place’ – to which the follow-up question is: ‘a lot of the controls you have are standard practice, so which one’s are you taking away’?

For example, wearing protective boots – let’s pretend that we’re ‘scoring’ risk without the person wearing protective boots (even though they’re not allowed on site without them).

So they’re wearing flip-flops: what are we scoring here? Yes! In simple terms it’s the ‘Hazard’ part of a single scoring system.

The other problem with ‘before and after’ scores is that it naturally leads to game-playing. We know that it looks bad to have a high-risk score ‘before’ that remains unchanged, so let’s throw in some Personal Protective Equipment (that our staff are going to wear anyway), and miraculously the score is changed to ‘Low’.

Phew! There’s that risk assessment finished……and the point of it all was….?

Risk assessment should be a system of honest analysis, not of playing games with numbers. We should be asking ourselves – as the basic HSE form prompts – ‘Are we doing enough?’


By the way, who makes these scoring systems up?

Good question. Unfortunately the answer is – it could be anyone, and ‘Very Likely’ to be someone without training and lacking in insight into risk scoring.

The hazard of scoring risk

Where’s the harm?

Well, using a poorly constructed system can make you feel that you’re on solid ground when you’re not.

We’ve seen people who have scored risk as ‘High’ or ‘Medium’ who have then not considered whether they need to do more to lower the risk.

One, when questioned about this said: ‘well, it’s useful to tell the guys which areas are high risk’.

That is an aberration of the purpose of risk assessment – it’s a management technique to determine whether risks are being controlled ‘so far as is reasonably practicable’. It is NOT a signalling technique designed to leave high risks high so that when someone gets hurt we can say ‘Well, we told them it was high risk’.

In this example, an ‘Amber’ score led to the advice ‘Implement control measures’. Well, yes! What were you going to do with the control measures you’d written down?!

Qualify, don’t Quantify

A modern analogy might be the 2016 EU Referendum. I’m taking a risk here!

No matter which side of the debate, most people would agree that the simple binary question and the simple numerical majority didn’t quite give the country a clear idea of how to proceed.

Recent suggestions to rectify this and ‘bring the country together’ have been to have ‘Citizens Assemblies’.

What are these? They’re a representative qualitative approach to finding an answer to a complex issue – if you like, large ‘Focus Groups’.

The analogy I’m making here is that risk control is complex. So we can’t rely on quickly put together scoring systems to point the way forward on whether we need to qualitatively need to do more to lower risk.

Instead, consult with your own ‘Citizen Assembly’ i.e. your workforce and record their thoughts on whether the risk could reasonably be lowered.

Concluding Advice

  • There has to be some kind of conclusion. No, we don’t mean to this blog (!), we mean to risk assessments.

‘Do we need to do more?’:       Answer:  ‘No’         is one such conclusion.
[By the way, we’d say a better way to phrase this would be to ask: ‘Are the risks adequately controlled?’]
So the final answer can’t be ‘Residual Risk’ = ‘High’ without considerable effort made to lower the risk (and it’s questionable to leave it at ‘Medium’ without some explanation)

  • Ditch the scoring as much as possible – it isn’t scientific and never will be
  • For most risk assessment, follow the HSE advice and use the power of words ‘Are we doing enough?’ – and keep asking your workforce and searching for improvements
  • If you must use scoring systems, then only use them at the topmost level to compare different risks, so that you know which one to work on first…by doing a non-scoring risk assessment.
  • Lastly, don’t get too wedded to any scores you end up with such that you think you’ve ‘got it nailed’.