Who should carry out a risk assessment? Competence, not job titles

The short answer: employer duty and a competent person

I get this question a lot: who should perform a risk assessment? The legal bit is simple, even if sites are not. The employer has to make a suitable and sufficient assessment of risks to employees and others, as required by the Management of Health and Safety at Work Regulations 1999 reg 3. The person who actually does the assessment must be competent, which in plain English means they have the right skills, knowledge and experience of the work, supported as needed under reg 7 of the same regulations.

There is no law that says only a health and safety manager can write it, or that a particular certificate flicks a switch. A working supervisor who knows the task inside out, and who can think through the job on a real site, can absolutely carry out the assessment if they are competent. The self-employed sit in the same boat. If you are a sole trader, you can assess your own work if you are competent, and you must do so where your work could affect others, which follows from MHSWR 1999 reg 3.

On most projects, the assessment becomes part of your RAMS pack, then a principal contractor or client will review it before you start. That review is not them taking responsibility for your risks, it is them checking it works on their site and fits their rules under CDM 2015. Your duty to control your work still sits with you, backed by the Health and Safety at Work etc. Act 1974 which places general duties on employers and those in control of work.

If you want a refresher on the steps, this guide on how to write a risk assessment walks through the process in plain detail.

What competence really looks like on site

When I say competent, I mean someone who understands the job as it is actually done. Not the glossy brochure version. Picture a wet Tuesday in November, a delivery running late, a part-loaded transom, the smell of cut cement board in the air. A competent assessor knows what that looks like and how people really behave when pressure hits. They can spot where controls will hold and where they will be ignored, then set the method up to make the safe way the easy way.

Training helps, but it is not the same as competence. A short course can teach the five steps and the legal labels. Competence comes from knowing the specific task, the plant, the materials and the site context, then being able to apply the five steps without kidding yourself. If the assessment is for drilling soffits over a live walkway, I want the person who has drilled a hundred soffits and has had to clean dust out of their eyebrows in the rain, not someone who has only read about it.

Evidence of competence is simple. A clear description of the task, photos or sketches of the exact area, mention of the actual kit and consumables, and controls that match the site constraints. The last one I rejected claimed dust suppression on a cut that had no water on that level. That tells me the assessor has not walked the route. Competence shows in the details. Vague phrases like use appropriate PPE or as necessary are a flag that the writer is guessing.

If you are new to the paperwork or you keep hearing RAMS in meetings, it helps to read a clear guide on what is a RAMS document and how the risk assessment and method statement tie together.

Sole traders and small crews: do it yourself, bring help for the gaps

If it is your own work and you know it well, do your own assessment. That is normal for small contractors. You stand in the space, walk the route, list the hazards and set the method. You brief the lads and you supervise the first lift or first cut. You are the competent person for that scope. That fits MHSWR 1999 reg 3 and reg 7, which expect you to assess and to get competent help where needed, not to outsource your brain.

Bring in help when the risk profile or the method needs specialist input that you do not have. A crane pick with a tricky radius. A temporary works check for a high back-prop. A ventilation plan for resin work that will stink out a live building. In those cases you stay in charge of your package, and you bring a competent person in to advise, design or check. That is exactly what MHSWR 1999 reg 7 envisages when it talks about appointing one or more competent persons to assist.

Do not confuse help with ownership. A consultant can help you refine the assessment or write a method for a specialist element, but your company name and your signature go on the RAMS. If you change the planned sequence on the day, you need to review the risk assessment because it is no longer valid for the changed conditions, which is required by MHSWR 1999 reg 3. I see this missed most often when access changes and people improvise with different plant.

If acronyms keep tripping you up, the UK construction safety glossary is a handy shortcut when you are writing RAMS late at night.

Templates, borrowed RAMS and signatures do not transfer responsibility

I know the drill. Someone emails a generic assessment, you swap a logo, tweak a couple of lines and send it in. It gets a stamp, then everyone relaxes. Here is the truth from the reject pile. A generic assessment that does not reflect your task and site is not suitable and sufficient, which is what MHSWR 1999 reg 3 demands. If there is a fall, your logo will be on the cover, not the person you borrowed it from.

Signing someone else’s paper does not move legal duties. Duties under the Health and Safety at Work etc. Act 1974 sit with employers and those in control of the work. Duties under CDM 2015 sit with dutyholders like the contractor and principal contractor. If you tell a labourer to sign that they have read and understood a poor assessment, you have not made them safe. You have made yourself a paper trail that proves you knew it was poor and pressed on.

Use templates properly. Start with a framework that covers the five steps, then insert the real method you will use on this site, with this client, with this access, in this weather window. Delete controls that are not available. Add the ones your supervisor insists on because he has done it here before. If you want a refresher on the steps, this guide on how to write a risk assessment walks through the process in plain detail.

Who reviews and signs RAMS before work starts

Inside your company, a manager or supervisor should review the assessment and method before it goes to the client. The reviewer is sanity checking that the sequence is buildable with your people and kit, and that the controls are resourced and booked. On site, the briefing lands with the person in charge of the workface, who signs to confirm they will run it that way and will stop if conditions change. That internal sign-off shows ownership.

On most jobs the principal contractor will review your RAMS before issuing a start date. Some have a formal reviewer, others ask the site manager and the safety advisor to look together. Their job under CDM 2015 is to plan, manage and monitor the construction phase. They check your plan fits their logistics, permits, welfare and other trades. They often ask for tweaks. That review does not make them responsible for your risks, it keeps the site knitted together.

RAMS are not just forms. They are the agreed way the job will be controlled. If you are new to the paperwork or you keep hearing RAMS in meetings, it helps to read a clear guide on what is a RAMS document and how the risk assessment and method statement tie together. That understanding makes the review smoother because you will have anticipated the common asks, like deliveries, waste, isolation points and supervision levels.

A simple way to prove competence in your risk assessments

Here is the approach I look for when I review. One, scope the task in one paragraph, so anyone can picture it. Two, walk the workface, take photos, and name the real kit, materials and access. Three, list the hazards you actually face, not a shopping list for a different trade. Four, set controls that match your people and plant, state who does what, and check they are resourced. Five, brief it, run it, and record any changes.

Put names next to actions. If the labourer is the banksman for the pallet truck, say that. If the supervisor will check the rescue kit before first use, say that. Vague controls die on site. Add your interface points with others, like isolations with the site manager or permits with the principal contractor. If you draw on outside help for a specialist part, say who, say what, and attach their note or design so the chain is clear, which aligns with MHSWR 1999 reg 7.

Common fails I see. Controls that are not available on the floor you are working on. Methods that assume empty areas in a live building. PPE listed as the only control for a high hazard. No thought for supervision when the competent person is also popping out to collect materials. If you avoid those traps and keep your assessment site-specific and honest, you will show competence without waving a certificate around.

Questions we get asked

Can a supervisor do our risk assessments or does it have to be a safety manager?

A competent supervisor can carry out your assessments if they have the skills, knowledge and experience of the work. The law does not reserve the task for a safety manager. The duty is to make a suitable and sufficient assessment under MHSWR 1999 reg 3, and to ensure the person doing it is competent or supported under reg 7.

Do I need a NEBOSH certificate to write a risk assessment?

No specific certificate is legally required to write a risk assessment. The legal test is competence under MHSWR 1999 reg 7, which means the right mix of skills, knowledge and experience for the work. Training helps, but site knowledge and a method that actually controls the risks matter most.

Can the client insist we use an external consultant?

A client or principal contractor can set rules for their site and may require an external review. You still remain responsible for your risk assessment and controls under MHSWR 1999 reg 3 and the Health and Safety at Work etc. Act 1974. If a consultant helps, treat their advice as support under reg 7, not a handover of duty.

Who should sign RAMS before we start work?

Internally, a manager or supervisor should sign to confirm the assessment and method are right for your scope. Externally, the principal contractor often signs to confirm they have reviewed and accepted your RAMS for their site. Their review under CDM 2015 does not transfer your duty to control your own work.

What if the principal contractor rejects our RAMS?

Ask for specific reasons and fix them. It is often site fit issues, missing controls or unclear supervision. Keep the legal basics in mind, your assessment must be suitable and sufficient under MHSWR 1999 reg 3 and the reviewer is checking it works on their site under CDM 2015.

The short version

The law puts the duty on the employer to assess risks, and the person who does it must be competent. That is MHSWR 1999 reg 3 and reg 7. Competence means real skills, knowledge and experience of the job and site, not just a job title or a course certificate.

Sole traders can assess their own work, and anyone can bring in help for specialist parts. A principal contractor will likely review your RAMS before you start, but that review does not move your duty. Avoid generic paperwork, be site specific, and show you have walked the job.

If you run your assessments this way, you will satisfy the reviewer, brief your team properly and, most importantly, set the job up so the safe way is the easy way.