Five Steps to a Suitable and Sufficient Risk Assessment Under Irish Law
Irish law requires employers to carry out a suitable and sufficient risk assessment.
# Five Steps to a Suitable and Sufficient Risk Assessment Under Irish Law **Slug:** five-steps-suitable-sufficient-risk-assessment-ireland **Category:** Risk Assessments **Meta description:** Irish law requires employers to carry out a suitable and sufficient risk assessment. This guide explains the five-step process, what makes a risk assessment legally adequate, and the common mistakes to avoid. **Focus keyword:** suitable and sufficient risk assessment Ireland five steps --- The phrase "suitable and sufficient" appears in the Safety, Health and Welfare at Work Act 2005 and is the legal standard that every risk assessment in Ireland must meet. But what does "suitable and sufficient" actually mean in practice? What does a risk assessment need to contain to satisfy this standard, and what are the most common ways in which risk assessments fall short? This article explains the five-step process for carrying out a risk assessment that meets the legal standard, the key elements that must be present, and the mistakes that most commonly lead to risk assessments being found inadequate by the HSA or by a court. --- ## The Legal Requirement Section 19 of the Safety, Health and Welfare at Work Act 2005 requires every employer to identify the hazards in the workplace, assess the risks arising from those hazards, and put in place the control measures necessary to eliminate or reduce those risks. The risk assessment must be in writing where there are three or more employees. The Act does not use the phrase "suitable and sufficient" explicitly, but the concept is well established in Irish health and safety law through the influence of UK legislation and EU Directives, and it is the standard applied by the HSA and by the courts when assessing whether an employer has complied with their duty to carry out a risk assessment. A risk assessment is suitable and sufficient if it: - Identifies all significant hazards - Evaluates the risks arising from those hazards - Identifies the control measures required to eliminate or reduce the risks - Is appropriate to the nature of the work and remains valid for the duration of the work - Is reviewed and updated whenever there is a reason to believe it is no longer valid --- ## Step 1: Identify the Hazards The first step in a risk assessment is to identify the hazards in the workplace or in the work activity being assessed. A hazard is anything that has the potential to cause harm. The most effective way to identify hazards is to walk through the workplace or work activity and observe what is happening. This should be done by someone who is familiar with the work, ideally in consultation with the workers who carry it out. Workers often have the best knowledge of the hazards in their work, because they encounter them every day. Sources of information that can help with hazard identification include: - Accident and near miss records - Manufacturers' instructions and safety data sheets for materials and equipment - HSA guidance documents and codes of practice - Industry guidance from bodies such as the Construction Industry Federation (CIF) - Previous risk assessments for similar work activities The hazard identification should be systematic and should cover all aspects of the work activity, including the physical environment, the work equipment, the materials used, and the work methods. --- ## Step 2: Assess Who Might Be Harmed and How The second step is to identify who might be harmed by each hazard and how. This is not simply a matter of listing "workers" as the persons at risk. The assessment should consider: - Which specific workers are at risk (for example, workers carrying out a specific task, workers in a specific area, or workers with specific characteristics such as young persons, pregnant workers, or workers with health conditions) - Whether any other persons might be at risk, such as subcontractors, visitors, members of the public, or occupants of adjacent buildings - How each person might be harmed (for example, by a fall, by contact with a hazardous substance, by manual handling, or by noise) Identifying who might be harmed and how is important because it influences the control measures required. The control measures needed to protect a young worker with limited experience may be different from those needed to protect an experienced worker. --- ## Step 3: Evaluate the Risks and Decide on Control Measures The third step is to evaluate the level of risk associated with each hazard and to decide on the control measures required to eliminate or reduce the risk to an acceptable level. Risk is typically evaluated by considering two factors: the likelihood of harm occurring and the severity of the harm if it does occur. A hazard that is likely to cause serious injury or death requires more stringent control measures than a hazard that is unlikely to cause harm or that would cause only minor injury. The control measures should be selected using the hierarchy of control, which is set out in the Safety, Health and Welfare at Work Act 2005: 1. **Elimination:** Remove the hazard entirely (for example, by redesigning the work method to avoid the need for working at height) 2. **Substitution:** Replace the hazardous material or process with a less hazardous one (for example, by using a water-based paint instead of a solvent-based one) 3. **Engineering controls:** Use physical controls to reduce the risk (for example, by installing edge protection to prevent falls from height) 4. **Administrative controls:** Change the way the work is organised to reduce the risk (for example, by restricting access to a hazardous area or by implementing a permit-to-work system) 5. **Personal protective equipment (PPE):** Provide PPE to protect workers from the residual risk after other controls have been applied PPE should always be the last resort, not the first. A risk assessment that relies primarily on PPE as the control measure is unlikely to be considered suitable and sufficient. --- ## Step 4: Record the Findings The fourth step is to record the findings of the risk assessment in writing. The written record must include: - The hazards identified - The persons at risk - The control measures in place or required - The residual risk after the control measures have been applied The written record does not need to be lengthy or complex. A simple table or form is sufficient for most risk assessments. What matters is that the record is clear, accurate, and complete, and that it reflects what actually happens in the workplace. The risk assessment must be brought to the attention of the workers who are affected by it. It is not sufficient to file the risk assessment in a folder in the site office: the workers must know what the hazards are and what control measures are in place. --- ## Step 5: Review and Update the Risk Assessment The fifth step is to review and update the risk assessment regularly. A risk assessment is not a one-off exercise: it must be kept up to date to remain valid. The risk assessment should be reviewed: - At regular intervals (at least annually for most workplaces) - Whenever there is a significant change in the work activity, the work environment, or the work equipment - Whenever an accident or near miss occurs that suggests the existing control measures are inadequate - Whenever new information becomes available about the hazards or the risks When the risk assessment is reviewed, the review should be recorded in writing, including the date of the review, the name of the person who carried it out, and any changes made to the assessment. --- ## Common Mistakes That Make Risk Assessments Inadequate The following mistakes are the most common reasons why risk assessments are found to be inadequate: **Generic risk assessments that do not reflect the specific workplace or work activity:** A risk assessment that is copied from a template without being adapted to the specific conditions of the workplace is unlikely to be suitable and sufficient. The HSA expects risk assessments to reflect the actual hazards and risks of the specific work being carried out. **Failure to identify all significant hazards:** A risk assessment that misses a significant hazard is not suitable and sufficient, even if it is thorough in relation to the hazards it does identify. **Reliance on PPE as the primary control measure:** As noted above, PPE should be the last resort. A risk assessment that specifies PPE as the main control measure without considering higher-order controls is likely to be found inadequate. **Failure to review and update the risk assessment:** A risk assessment that was accurate when it was prepared but has not been reviewed following a change in the work activity is no longer suitable and sufficient. **Failure to communicate the risk assessment to workers:** A risk assessment that workers have never seen or been told about cannot protect them. --- If you need help preparing or reviewing risk assessments for your construction business, Safety Check can assist. [Contact us](/contact) for practical guidance from a consultant with over 24 years of construction safety experience.