Risk assessments and CDM 2015: what is actually required?

Does CDM 2015 require a risk assessment?

CDM 2015 does not prescribe a standalone document called a CDM risk assessment.

The general legal duty to carry out a suitable and sufficient assessment of risks to employees and others comes from Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Management Regulations, Regulation 3: risk assessment: every employer must make a suitable and sufficient assessment of the risks to the health and safety of their employees and of people not in their employment, with the same duty applying to relevant self-employed people, and the assessment must be reviewed where there is reason to suspect it is no longer valid or there has been a significant change in the matters to which it relates (opens in a new tab)

CDM then adds construction-specific duties around project management, design, contractor coordination, the construction phase plan, information exchange and control of work. HSE L153 guidance: Managing health and safety in construction: practical interpretation of the CDM 2015 duties, proportionate management arrangements and construction-phase planning, PDF (opens in a new tab)

So what risk assessments are needed on a construction project?

The risk assessments needed depend on the work being carried out and the hazards involved.

Examples may include:

• Working at height.
• Excavation and groundworks.
• Lifting operations.
• Use of plant and machinery.
• Temporary works.
• Manual handling.
• Exposure to hazardous substances.
• Electrical work and live services.
• Demolition.
• Confined spaces.
• Work affecting members of the public.
• Vehicle and pedestrian interface risks.

Some risks are also subject to more specific legislation, such as COSHH, the Work at Height Regulations or lifting-equipment requirements. The risk assessment process should identify the measures needed for the actual work rather than simply creating a generic construction form. HSE risk assessment guidance: HSE’s general approach to risk assessment: identifying hazards, assessing who might be harmed and how, deciding on and putting in place control measures, recording significant findings and reviewing the assessment (opens in a new tab)

Who carries out construction risk assessments?

The employer or self-employed person controlling the work is normally responsible for assessing the risks arising from their work activities. Management Regulations, Regulation 3: risk assessment: every employer must make a suitable and sufficient assessment of the risks to the health and safety of their employees and of people not in their employment, with the same duty applying to relevant self-employed people, and the assessment must be reviewed where there is reason to suspect it is no longer valid or there has been a significant change in the matters to which it relates (opens in a new tab)

On a construction project, this means individual contractors should assess the work under their control. The Principal Contractor coordinates the construction phase on multi-contractor projects, but that does not remove each contractor’s responsibility to plan, manage and monitor its own work. Read Regulation 15 on legislation.gov.uk: duties of contractors: planning, managing and monitoring construction work carried out by the contractor or by workers under the contractor’s control, and providing workers with information on risks identified by the risk assessment under regulation 3 of the Management Regulations and risks arising from another contractor’s undertaking (opens in a new tab)

What happens when risks involve more than one contractor?

Some risks arise from the interaction between different contractors rather than from one contractor’s task in isolation.

In those situations, the Principal Contractor’s coordination role becomes important. Contractors need to cooperate, share relevant information and coordinate controls so that one activity does not create unmanaged risk for another. Read Regulation 13 on legislation.gov.uk: duties of a principal contractor: planning, managing, monitoring and coordinating the construction phase, organising cooperation between contractors and coordinating implementation by contractors of applicable legal requirements for health and safety (opens in a new tab)

A contractor may still hold its own task risk assessment, but the interface risk may also need to be addressed through the construction phase plan, coordination meetings, sequencing, permits, site rules or other project controls. HSE HSG150 construction guidance: construction guidance on assessing and controlling site risks, the use of method statements for higher-risk work and coordinating risks between contractors, PDF (opens in a new tab)

What should a construction risk assessment contain?

The assessment should be suitable and sufficient for the work. It should identify the significant hazards, who may be harmed, the controls required and whether further action is needed. HSE risk assessment guidance: HSE’s general approach to risk assessment: identifying hazards, assessing who might be harmed and how, deciding on and putting in place control measures, recording significant findings and reviewing the assessment (opens in a new tab)

A practical assessment may record:

• The task or activity being assessed.
• The significant hazards.
• Who could be harmed.
• Existing control measures.
• Further controls required.
• Who is responsible for implementing them.
• Any information, equipment, training or supervision needed.
• Review triggers or changes that would require the assessment to be reconsidered.

Does every risk assessment need a scoring matrix?

No. Neither CDM 2015 nor the Management Regulations prescribe one universal numerical matrix.

A scoring system can help prioritise issues, but it should not become more important than identifying sensible controls. A low residual number is not evidence that the work is safe if the control measures are unrealistic or are not being followed.

What is the difference between a risk assessment and RAMS?

RAMS usually means risk assessments and method statements.

The risk assessment identifies the hazards, evaluates the risks and determines the controls needed. The method statement then explains how a particular job will be carried out safely, often in a logical sequence, using the controls identified by the risk assessment.

Method statements are widely used in construction, particularly for higher-risk, complex or unusual work, but there is no general legal requirement for every construction activity to have a document called a method statement. HSE HSG150 construction guidance: construction guidance on assessing and controlling site risks, the use of method statements for higher-risk work and coordinating risks between contractors, PDF (opens in a new tab)

Risk assessment vs construction phase plan

A construction phase plan is not a replacement for task risk assessments.

The construction phase plan sets out the health and safety arrangements for managing the construction phase as a whole. Task risk assessments sit beneath that project-level framework and address the risks arising from particular activities. HSE L153 guidance: Managing health and safety in construction: practical interpretation of the CDM 2015 duties, proportionate management arrangements and construction-phase planning, PDF (opens in a new tab)

The two should be consistent. If task-level controls depend on site-wide arrangements such as traffic routes, lifting coordination, access controls or emergency procedures, those interfaces should be reflected in the project arrangements.

Risk assessment vs design risk assessment

Designer risk management under CDM is different from a contractor assessing how construction work will be carried out.

Designers have duties under Regulation 9 to eliminate foreseeable risks so far as reasonably practicable, reduce or control risks that cannot be eliminated, and provide relevant information. Read Regulation 9 on legislation.gov.uk: duties of designers: eliminating foreseeable risks so far as is reasonably practicable, reducing or controlling risks that cannot be eliminated, and providing information about remaining risks (opens in a new tab)

CDM does not prescribe a document called a design risk assessment. Designers may use design-risk registers or other processes to support their work, but the legal duty is in the design decisions and information, not the form.

Do Principal Designers carry out the contractor’s risk assessments?

No. The Principal Designer coordinates health and safety during the pre-construction phase; they do not take over the contractor’s responsibility for assessing and controlling construction work. Read Regulation 11 on legislation.gov.uk: duties of a principal designer: planning, managing, monitoring and coordinating health and safety in the pre-construction phase, and providing pre-construction information to every designer and contractor appointed or being considered for appointment (opens in a new tab)

The Principal Designer should provide and coordinate relevant design information so that contractors can plan the work properly. The Principal Contractor and contractors then manage construction-phase risks within their respective areas of control.

Does the client approve contractors’ risk assessments?

CDM does not make the client the technical approver of every contractor risk assessment.

The client has duties to make suitable arrangements for managing the project and to take reasonable steps to ensure appointed Principal Designers and Principal Contractors carry out specified duties. That is different from the client taking ownership of task-level risk assessments.

A client or assurance function may sample RAMS or other risk-control evidence as part of proportionate project assurance, but doing so should not blur the contractor’s own responsibility for the work.

When should a risk assessment be reviewed?

Risk assessments should be reviewed when there is reason to suspect they are no longer valid or when there has been a significant change in the matters to which they relate. Management Regulations, Regulation 3: risk assessment: every employer must make a suitable and sufficient assessment of the risks to the health and safety of their employees and of people not in their employment, with the same duty applying to relevant self-employed people, and the assessment must be reviewed where there is reason to suspect it is no longer valid or there has been a significant change in the matters to which it relates (opens in a new tab)

On construction projects, useful review triggers can include changes to design, work method, sequencing, access, plant, workforce, site conditions, adjacent activities or information about hazards.

Can you reuse a risk assessment from another project?

Previous assessments can be useful starting points where the work is genuinely similar, but they should not be copied without checking the new project’s circumstances.

Generic risk assessments often fail where access, interfaces, site constraints, existing services, work sequencing or nearby activities differ. The assessment should reflect the actual work and environment.

What does a poor construction risk assessment look like?

Generic hazards with generic controls

The document could apply to any site and says little about the actual task or environment.

Controls that are not available on site

The assessment lists barriers, plant, supervision or equipment that the team does not actually have.

No connection to the method of work

The controls do not match the sequence or practical way the job will be carried out.

Ignoring contractor interfaces

The assessment considers one task in isolation even though nearby work changes the risk.

Out-of-date information

The work has changed but the assessment still describes the original design, access or site conditions.

A low risk score used as the conclusion

The document focuses on arithmetic rather than whether the controls are sensible and effective.

Workers have not been briefed

A well-written assessment has little value if the people carrying out the work do not understand the relevant controls.

Construction risk assessment example structure

Risk assessment checklist for construction work

• Define the actual task and work area.
• Identify significant hazards rather than listing everything imaginable.
• Consider workers, other contractors, visitors and members of the public who may be affected.
• Use relevant project information, including drawings, surveys, services and site constraints.
• Apply the hierarchy of control and general principles of prevention where relevant.
• Make controls specific and achievable.
• Consider interfaces with other contractors and site-wide arrangements.
• Link the assessment to the actual work method.
• Provide the information, instruction, training and supervision needed to implement the controls.
• Brief the people carrying out the work.
• Review the assessment when the work or circumstances change materially.
• Check that the controls are actually being followed in practice.

Common misconceptions about ‘CDM risk assessments’

‘CDM requires a special risk assessment form’

It does not. The general risk-assessment duty sits in the Management Regulations, with CDM adding construction-specific project duties.

‘The Principal Contractor writes every contractor’s risk assessment’

Contractors remain responsible for the work under their control.

‘The Principal Designer approves contractor RAMS’

The Principal Designer coordinates the pre-construction phase and design information; this is not the same as owning construction task risk assessments.

‘The construction phase plan replaces RAMS’

The CPP covers project-level construction-phase arrangements; task risk assessments and methods may still be required beneath it.

‘A five-by-five score makes the assessment compliant’

A matrix can support prioritisation, but suitable controls and implementation matter more than the arithmetic.

‘Once signed, the risk assessment is finished’

The assessment should be reviewed when significant changes mean it may no longer be valid.