Risk Assessment Methods: How to Choose and Apply the Right One

Sketches framing a risk assessment title

The right risk assessment method depends on the decision you need to make. Use a qualitative method (descriptive ratings from expert judgement) when you need speed and have little data. Use a semi-quantitative method (simple numerical scores) when you must rank many risks consistently. Use a quantitative method (statistics and loss data) when money is at stake and you have the data. Use job hazard analysis or FMEA when the question is about one task or one failure point. Whichever you choose, the people running it need to be trained to apply it the same way every time, and that is where accredited training pays for itself.

This guide is written for HR managers, project managers, safety leads and individual professionals who have to run, commission or sign off risk assessments. It explains each method in plain terms, shows how to follow the process step by step, and ends with how to choose.

Oxfordcentre
Build Consistency in Risk Assessments
Develop shared risk assessment skills with customizable professional training for your team, available in on-site, online, or blended formats.

Visit Training Courses

TL;DR

  • A risk assessment has three core parts in ISO 31000: identify the risk, analyse it, evaluate it. The UK HSE turns this into five practical workplace steps.
  • Qualitative methods are fast and flexible but subjective. Quantitative methods are precise but need good data. Semi-quantitative scoring sits between them.
  • Job hazard analysis looks at one job, task by task. A risk assessment covers the wider activity, site or project, and the two work together.
  • When uncertainty is high, ISO 31000 says combining techniques usually gives more insight than relying on one.
  • Consistent results come from trained assessors who use the same scales, which is why teams often build a shared method through customised training.

Table of Contents

What a risk assessment actually does

A risk assessment is a structured way of deciding which things could go wrong, how bad they would be, and what you will do about them. In workplace safety, the European Agency for Safety and Health at Work describes it as the evaluation of risks to workers’ health and safety arising from workplace hazards, and it follows ISO’s three components: risk identification, risk analysis and risk evaluation.

Two terms matter before you go further:

  • Hazard: anything that may cause harm, such as a wet floor, a chemical or a poorly planned deadline.
  • Risk: the chance that harm actually happens, combined with how severe it would be. The Canadian Centre for Occupational Health and Safety expresses this as risk = probability x severity.

The same logic applies outside safety. A project manager scoring schedule risks and a facilities lead scoring fire risks are doing the same thing with different hazards.

ISO 31000 adds that the process should be systematic, iterative and collaborative, drawing on the knowledge and views of stakeholders. In practice that means one person with a clipboard is rarely enough: the people who do the work need to be in the room.

The five-step process most UK employers follow

If you employ people in Great Britain, the HSE’s five steps are the reference point. They are the same whichever method you use to rate the risk in step two.

  1. Identify hazards. Walk the workplace, talk to staff, and look at accident records. Hazards fall into broad families: the CCOHS lists biological, chemical, ergonomic, physical, psychosocial and safety hazards, a useful prompt list so you do not stop at the obvious ones.
  2. Assess the risks. Decide who could be harmed, how likely it is and how serious. This is the step where your chosen method does its work.
  3. Control the risks. Decide what you will do and in what order. The hierarchy of controls ranks options from most to least effective: elimination, substitution, engineering controls, administrative controls and personal protective equipment.
  4. Record your findings. Write down the hazards, ratings, controls and who owns each action.
  5. Review the controls. Check they work, and revisit the assessment when the task, equipment, people or environment changes.

Where things go wrong is rarely the method. It is usually step one (a hazard nobody thought of), step three (a control that relies on people remembering) or step five (an assessment filed and never revisited). The CCOHS advises starting with jobs or tasks that have higher injury and illness rates or worker concerns, which keeps a large workplace from stalling on a hundred assessments at once.

Other bodies break the process down differently. The American Society of Safety Professionals lists four elements: identification, analysis, evaluation and communication, and the European Commission’s health risk definition uses hazard identification, hazard characterisation, exposure assessment and risk characterisation. The wording changes, the logic does not.

The main risk assessment methods compared

The European Agency notes that methods range from expert to participatory and from simple to complex, and that the right one depends on the workplace, the tasks and the technical complexity. These are the ones you will meet most often.

MethodWhat it usesOutputBest when
QualitativeExpert judgement, workshops, descriptive ratingsRatings such as low, medium, high; a heat mapYou need a quick first view or have little data
Semi-quantitativeJudgement plus numerical scales, often 1 to 5A score for each risk, which lets you rank themYou have many risks to compare consistently
QuantitativeHistorical data, statistical modelsProbabilities and expected loss, often in moneyDecisions are costly and good data exists
FMEA (failure mode and effects analysis)Ratings for severity, occurrence and detectionA risk priority number per failure modeYou are assessing a product, machine or process
Job hazard analysisTask-by-task breakdownHazards and controls for each step of a jobYou are assessing a specific job

Qualitative risk assessment

Qualitative assessment describes risk in words rather than numbers. A team agrees what “likely” and “severe” mean, rates each hazard and plots the result on a grid, usually called a risk matrix or heat map. It is quick, it needs no specialist data and it suits most routine workplace assessments. The weakness is subjectivity: two people can rate the same hazard differently. Shared definitions and a trained facilitator reduce that gap.

Semi-quantitative risk assessment

Semi-quantitative methods add numbers to judgement. You score likelihood and impact on a fixed scale, multiply them and rank the results. This gives you a defensible order of priority without needing a statistical model, which is why many organisations settle here. The scoring is only as consistent as the scale definitions behind it, so write down what a 3 for likelihood means in your business.

Quantitative risk assessment

Quantitative assessment measures risk with data: incident histories, failure rates, loss figures. The output can be an expected annual loss or a probability range, which helps when you must compare a safety investment with its cost. It is common in engineering, finance and process industries. It needs reliable data and someone competent to model it, so it is worth the effort for high-consequence decisions rather than every hazard on a site.

FMEA

Failure mode and effects analysis lists the ways a process or component could fail, then rates each failure for how severe it would be, how often it occurs and how easily it would be detected. Multiplying the three gives a risk priority number that tells you where to act first. It suits manufacturing, maintenance, healthcare processes and project deliverables where failures can be traced step by step.

FMEA ratings combine into a risk priority number

Other techniques you will see

ISO/IEC 31010 is the standard that catalogues techniques. It organises them into ten categories, from eliciting views from stakeholders and identifying risk to analysing controls, measuring risk and recording and reporting. You do not need all of them. The list is useful because it shows that “method” covers more than the scoring step: how you gather views and how you report matter too.

Qualitative or quantitative: how to decide

The question is not which is better. It is which fits the decision, the data and the time you have.

  • Choose qualitative when the risk is routine, data is thin and speed matters. A workplace walk-round, a new office layout or a first screen of project risks are typical.
  • Choose semi-quantitative when you must rank dozens of risks and defend the order to a board, an auditor or a client.
  • Choose quantitative when the consequences are large and measurable, such as capital projects, process plant or insurance decisions, and you have the data to support it.
  • Combine them when uncertainty is high. ISO 31000 states that events that are highly uncertain can be hard to quantify and that a combination of techniques generally provides greater insight.

A common pattern is to screen everything qualitatively, score the shortlist semi-quantitatively and model only the few risks that justify it. That keeps effort proportionate.

New technology is a good example of a risk where data is thin and judgement leads. If your staff are already using AI tools, an AI risk mitigation guide shows how a structured survey of current usage can feed a scored view of risks, which is the same identify, analyse, evaluate logic applied to a fresh problem.

Job hazard analysis versus risk assessment

People often treat these as rivals. They are better seen as zoom levels.

A risk assessment looks at an activity, workplace or project and rates the risks across it. A job hazard analysis (JHA) takes one job and examines it step by step. OSHA’s resource guide describes it as a step-by-step process that looks for current and potential hazards, including selecting and prioritising the jobs to analyse and then selecting, installing and reviewing controls.

North Carolina State University’s safety department sets out eight steps for a JHA:

  1. Define the scope.
  2. Break the job into tasks.
  3. Identify the hazards in each task.
  4. Develop controls, in the order engineering, administrative, then PPE.
  5. Write the training required.
  6. Specify the PPE.
  7. Review the analysis with the employees who do the job.
  8. Update it when new information appears.

In a UK setting, the output of a JHA slots into steps one to three of the HSE process for that task. Use a risk assessment to see the whole picture and decide where to look closely, then use a JHA on the tasks that rate highest. Specialist work such as working at height or confined space entry is where task-level analysis earns its keep, because the controls are specific and the consequences of a missed step are serious.

A worked example: choosing a method for a site

Imagine a facilities team responsible for a mid-sized hospital building. They need to cover fire, manual handling, contractor access and infection-control routines.

  1. Screen qualitatively. A workshop with department leads rates each hazard low, medium or high on a matrix. Fire and contractor access come out high.
  2. Score the shortlist. Using a 1 to 5 scale for likelihood and severity, the team ranks twelve high and medium items. The ranking shows two contractor tasks outrank everything else.
  3. Analyse the tasks. A job hazard analysis of those two tasks identifies where controls are missing, for example no permit check before roof access.
  4. Apply the hierarchy. The team eliminates the roof access need where it can, adds guard rails where it cannot, and backs both with procedure and training.
  5. Record and review. Owners and dates are written down, and the assessment is reopened when a contractor or a ward layout changes.

Nothing here needs statistical modelling. If the same hospital were weighing a major plant replacement, a quantitative comparison of failure costs would join the process at step two.

Why consistent assessors matter more than the method

Most weaknesses in a risk assessment come from the people applying it. One team member treats “medium” as acceptable, another escalates it. One records controls that exist, another records controls that are intended. Over a year those differences add up to a register nobody trusts.

Three habits fix most of this:

  • Shared scales. Define likelihood and severity in writing, with examples from your own operations.
  • Participation. ISO 31000 asks for stakeholder knowledge and views, so involve the workers who do the task, not only the manager who owns it.
  • Competence. Assessors who have practised the method on realistic cases rate more consistently than those who learned it from a template.

The third is a training question. For project managers, HR leads and safety officers who sign off assessments, an accredited course gives a common vocabulary and a method everyone applies the same way. Our physical security risk assessment training course is one example of a course built around applying a risk method to a real site. For wider capability building, our guide to choosing safety and security courses that prove hands-on skills sets out what HR and L&D leads should look for, and our piece on facilities management and risk reduction shows how the discipline fits day-to-day operations.

Where risk assessment methods fit by sector

The method you lean on shifts with the industry, though the five steps stay constant.

Perspective

We are asked often which method is the best one. We think that is the wrong question. A matrix in the hands of a trained, honest team beats a sophisticated model run by people who have never seen the site.

What we build into our courses is practice on realistic problems: the same hazard rated by several people, the disagreement discussed, the scale rewritten until everyone reads it the same way. That is how a team ends up with a register it trusts.

It is also why we offer our programmes on site, online or blended, and why we customise content to an organisation’s own operations. A hospital, a tunnelling contractor and an energy company do not share hazards, and their assessors should not train on generic examples. Our courses are globally accredited and led by industry experts, so the method a team learns holds up with auditors and clients.

If your assessors rate the same hazard differently today, the fix is shared training, not another template.

Sam

Build shared risk assessment skills in your team

If you are an HR manager, L&D lead or project manager who needs a team to assess risk the same way, we run professional training across project management, safety, compliance, healthcare, oil and gas and civil engineering. Programmes are globally accredited, led by industry experts and customisable to your organisation, and they can be delivered on site, online or in a blended format. Individual professionals can enrol themselves too. Start with our project management courses or browse the full course list.

Oxfordcentre

Tell us the sector, the team size and the methods you already use, and we can shape the content around your own sites and projects. You can reach us through our website.

FAQ

What are the three most common risk assessment methods?

Qualitative, semi-quantitative and quantitative are the three most widely used. Qualitative uses descriptive ratings, semi-quantitative adds numerical scores to judgement, and quantitative uses data and statistical models. Techniques such as FMEA and job hazard analysis sit alongside them for specific tasks and processes.

What are the steps in the risk assessment process?

The HSE describes five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. Your chosen method, qualitative or otherwise, is applied in the second step. The review step matters most over time, because workplaces change.

What is the difference between job hazard analysis and risk assessment?

A risk assessment covers a whole activity, workplace or project and rates the risks across it. A job hazard analysis breaks one job into tasks and finds the hazards in each. Use the first to decide priorities and the second to examine the highest-rated jobs in detail.

Do I need a quantitative method?

Only when the consequences are large, they can be measured, and you have reliable data. Many organisations use qualitative screening and semi-quantitative scoring for most hazards and reserve quantitative modelling for a few major decisions. ISO 31000 notes that combining techniques often gives more insight when uncertainty is high.

Sources

Register Now