Most risk assessments fail an audit for the same reason. Not because the hazards were missed, but because the document cannot show that anyone actually looked. An auditor is not grading your imagination. They are grading your evidence.

Here is what separates a document that survives from one that gets marked as a paperwork exercise.

Name the activity, not the area

“Warehouse” is not an activity. “Manual unloading of palletised goods from a container at the loading bay, two operatives, no mechanical aid” is.

The reason is practical. Hazards attach to activities, not to rooms. The moment you write the area instead of the task, your hazard list becomes generic, and generic is the word an auditor writes in the margin. Break the work into the tasks people actually perform, and assess each.

Who might be harmed is a longer list than you think

Almost every weak assessment lists “employees” and stops. The people who get hurt in practice are often the ones nobody assessed:

• Contractors and maintenance staff who do not know the site routine
• Delivery drivers who are on the premises for eleven minutes
• New starters and agency workers in their first week
• Cleaners working outside normal hours, often alone
• Anyone whose first language is not the language of the signage

Listing them is not box-ticking. Each of these groups changes what a reasonable control looks like. A verbal briefing is a control for a permanent employee and close to worthless for a driver you will never see again.

Rate the risk twice

The most common structural mistake is a single risk score. It hides the entire point of the document.

Score the risk as it would be with no controls at all, then score it again with your controls in place. The gap between the two numbers is the argument for why your controls exist. Without it, an auditor cannot tell whether the score is low because the work is safe or because someone was optimistic.

Keep the scale simple. Likelihood one to five, severity one to five, multiply. The precision of the number matters far less than the consistency of how you apply it, which is why the same person should score a whole set.

Controls in the right order

The hierarchy exists because it reflects what actually works, and auditors check whether you applied it or skipped to the bottom:

1. Eliminate. Stop doing the task, or design it out.
2. Substitute. Use a less hazardous substance, material or method.
3. Engineering controls. Guards, extraction, barriers, mechanical handling.
4. Administrative controls. Procedures, training, signage, rotation.
5. PPE. Last, always.

An assessment where every control is training and PPE is a red flag, because those two are the cheapest to write and the hardest to sustain. If you have gone straight to PPE, the document should say why the levels above were not reasonably practicable. One sentence is enough. Its absence is what gets challenged.

Date it, name it, and record the review

An undated assessment is not evidence of anything. The document needs the assessor’s name, the date it was carried out, and a review date. It also needs a record of what triggered the last review.

Reviews are triggered by more than the calendar. A near miss, a change of equipment, a new substance, a change in staffing, an injury, or a change in the law all require the assessment to be revisited. An auditor who sees an annual review cycle and a significant process change six months ago will ask why the two do not line up.

The part everyone forgets

A risk assessment that has not been communicated to the people doing the work is not a control. It is a file.

Record how the findings were shared: the briefing, the toolbox talk, the sign-off sheet. This is the single most common gap. The assessment is thorough, the controls are sensible, and there is no evidence that any operative was ever told. From an auditor’s point of view, an unread control does not exist.

A quick self-check

Read your assessment and ask three questions. Could a new supervisor run this task safely using only this document? Can I point to the evidence for every control I claim is in place? Would I be comfortable reading this out at an inquiry?

If the answer to any of them is no, you have found your next edit.