Training Risk Assessment: Legal Duties, 5 Steps & RAMS Guide

"Training risk assessment" carries two legally distinct meanings: the skill of conducting a risk assessment (which can be taught), and the duty under UK law to provide training that is directly triggered by what a risk assessment finds. Both obligations are live, enforceable, and easily confused. This page resolves that ambiguity, grounds every training duty in the named regulation that creates it, and provides concrete tools for RAMS authors.

---

What "Training Risk Assessment" Actually Means — and Why the Two Meanings Matter Legally

Search for "training risk assessment" and you will find either course advertisements or generic five-step summaries. Neither addresses the core legal point: a risk assessment is not just a document you need training to produce — it is also the document that creates specific statutory obligations to train your workers.

Meaning A — Training to conduct assessments: Workers, supervisors and managers need the competence to produce risk assessments that meet the statutory standard. Regulation 13(1) of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999) requires every employer, when entrusting tasks to employees, to take into account their capabilities as regards health and safety. Producing a legally sound risk assessment is a health and safety capability. Regulation 13(2) then requires adequate health and safety training whenever employees are exposed to new or increased risks — including through the introduction of new systems of work. [(MHSWR 1999, regulation 13 — capabilities and training)]

Meaning B — Training duties triggered by assessment outputs: Multiple pieces of UK legislation require that once a risk assessment has been made, its significant findings must be communicated to workers through information, instruction and training. The assessment is the trigger, not merely the background. See the Training Trigger Checklist below.

Conflating the two meanings produces gaps in both your training programme and your RAMS documentation.

---

The Statutory Duty: What Regulation 3 of MHSWR 1999 Requires and Who It Applies To

The primary source of the risk assessment duty in UK law is Regulation 3 of the Management of Health and Safety at Work Regulations 1999.

Regulation 3(1) requires every employer to make a suitable and sufficient assessment of: (a) risks to employees whilst at work, and (b) risks to persons not in their employment arising from the conduct of the undertaking — for the purpose of identifying the measures needed to comply with relevant statutory provisions. [(MHSWR 1999, regulation 3 — Risk assessment)]

Regulation 3(2) imposes the same duty on every relevant self-employed person in respect of risks to their own health and safety and to persons not in their employment. [(MHSWR 1999, regulation 3 — Risk assessment)]

Regulation 3(3) requires that any assessment be reviewed if there is reason to suspect it is no longer valid, or if there has been a significant change in the matters to which it relates; where review requires changes, those changes must be made. [(MHSWR 1999, regulation 3 — Risk assessment)]

Regulation 3(4) creates an additional specific obligation: an employer must not employ a young person unless they have, in relation to risks to young persons, made or reviewed an assessment. [(MHSWR 1999, regulation 3 — Risk assessment)]

Regulation 3(6) requires employers with five or more employees to record the significant findings of the assessment and any group of employees identified as being especially at risk. [(MHSWR 1999, regulation 3 — Risk assessment)]

Key point: MHSWR Reg 3 requires the output — a suitable and sufficient assessment — not a prescribed methodology. HSE's five-step model (below) is guidance on how to arrive at that output; it is not itself a regulatory requirement.

---

The 5 Stages of Risk Assessment: HSE's Model in Practice

HSE sets out five steps for managing risk. These are guidance, not a statutory prescription, but they represent the structured approach most likely to produce an assessment that satisfies the "suitable and sufficient" standard under Reg 3. [(HSE — Risk assessment: steps needed to manage risk)]

Step	What HSE requires	What this means in practice
1. Identify hazards	Look at how people work, plant and equipment used, chemicals and substances, safe/unsafe practices, premises condition; review accident records; consider non-routine operations	Walk the task physically. For construction, include non-routine phases: delivery, set-up, cleaning, maintenance. Consult workers directly.
2. Assess the risks	Decide likelihood and severity of harm; identify who might be harmed and how; consider what controls already exist and what further action is needed	Score residual risk only after existing controls are factored in, not before. Identify specific groups: employees, contractors, visitors, public.
3. Control the risks	Consider elimination, substitution, redesign, reduced exposure, practical measures, PPE — in that hierarchy	Document the hierarchy of controls applied, not just the PPE selected. Generic "wear PPE" entries will not satisfy a PC review.
4. Record your findings	If you employ 5 or more people, record hazards, who might be harmed and how, and what controls are in place	The record must reflect what actually happens, not what management intends.
5. Review the controls	Review if controls may no longer be effective; review if workplace changes create new risks (staff, process, substances, equipment); update the record	A review trigger creates an immediate obligation to check whether a fresh training duty also arises (see Training Trigger Checklist below).

The "five types of risk assessment" — generic, site-specific, dynamic, qualitative, quantitative — is a convention used in training programmes. UK law does not define or require any taxonomy of types. The distinction with real force in construction is explained in the comparison table further below.

---

What a "Suitable and Sufficient" Assessment Must Contain: The Four-Question Test

"Suitable and sufficient" is the statutory standard under MHSWR Reg 3(1) and Reg 3(2), and it recurs across COSHH Reg 6(1), DSEAR Reg 5(1), the Manual Handling Operations Regulations 1992, and the Fire Safety Order Art 9(1). It is not the same as "adequate" or "appropriate," which are terms used in other instruments with different scopes.

Before signing off any draft risk assessment, apply these four diagnostic questions drawn from the statutory language:

The Four-Question "Suitable and Sufficient" Test

Q1 — Does it cover the right population? Does the assessment address risks to employees whilst at work AND persons not in employment (visitors, public, adjacent workers)? Under MHSWR Reg 3(1), both groups must be covered. A RAMS that only considers the direct workforce will fail this test on any multi-occupied site.

Q2 — Is it grounded in actual conditions? Does the assessment reflect how work actually happens — including non-routine operations (set-up, maintenance, cleaning), work equipment as actually used, and substances actually present? HSE's guidance on hazard identification explicitly includes considering how plant and equipment are used, what chemicals and substances are used, and what safe or unsafe work practices exist. An assessment written from a desk without site observation cannot reliably answer this question.

Q3 — Does it identify the measures needed? Under MHSWR Reg 3(1), the purpose of the assessment is specifically "identifying the measures [the employer] needs to take to comply with relevant statutory provisions." If the assessment lists hazards but does not tie them to specific, implementable control measures, it does not meet the statutory purpose.

Q4 — Does it identify training as a required measure? Wherever the assessment reveals exposure to substances hazardous to health, vibration, manual handling risk, fire risk, or dangerous substances, a training duty is activated under the respective regulations (see Training Trigger Checklist below). If the assessment does not identify the corresponding training obligation, it is incomplete as a compliance tool — even if every other hazard is correctly described.

---

When Your Risk Assessment Creates an Immediate Training Duty: Regulation-by-Regulation Map

This is the connection most RAMS authors miss. The risk assessment is not merely a document you produce after training — it is the document that defines the scope and content of legally required training. Each regulation below creates a training duty contingent on what the assessment finds.

MHSWR 1999, Regulation 13 — Capabilities and Training

Regulation 13(2) requires adequate health and safety training whenever employees are exposed to new or increased risks arising from a change of responsibilities, introduction of new work equipment, new technology, or a new system of work. Regulation 13(3) requires that such training be repeated periodically where appropriate, adapted to new or changed risks, and take place during working hours. [(MHSWR 1999, regulation 13 — capabilities and training)] If your Reg 3 assessment reveals a new or increased risk because of a changed system of work, Reg 13 requires training before that system is deployed.

COSHH 2002, Regulation 12 — Information, Instruction and Training

Where an employer carries out work liable to expose employees to a substance hazardous to health, Regulation 12(1) requires suitable and sufficient information, instruction and training for those employees. Regulation 12(2) specifies that training must include the significant findings of the risk assessment and the appropriate precautions and actions the employee must take to safeguard themselves and others. [(COSHH 2002, regulation 12 — Information, instruction and training)] Regulation 12(3) further requires that training be adapted to significant changes in work type or methods, and provided in a manner appropriate to the level, type and duration of exposure identified by the risk assessment. [(COSHH 2002, regulation 12 — Information, instruction and training)] Note also that under COSHH Reg 6(1), no work liable to expose employees to a substance hazardous to health may proceed at all unless a suitable and sufficient risk assessment has first been made and implemented. [(COSHH 2002, regulation 6 — Assessment of the risk to health)]

Control of Vibration at Work Regulations 2005, Regulation 8 — Information, Instruction and Training

Two separate triggers activate the training duty under CVAR Reg 8(1): (a) the risk assessment indicates a risk to the health of employees exposed to vibration, or (b) employees are likely to be exposed at or above an exposure action value. Both triggers must be considered — a risk assessment that finds no health risk does not automatically remove the duty if the second trigger applies. [(CVAR 2005, regulation 8 — Information, instruction and training)] Training must include the significant findings of the risk assessment (including any measurements taken), exposure limit values and action values, how to detect and report signs of injury, and safe working practices to minimise exposure. [(CVAR 2005, regulation 8 — Information, instruction and training)] Regulation 8(3) requires this training to be updated when there are significant changes in work type or working methods. [(CVAR 2005, regulation 8 — Information, instruction and training)]

Regulatory Reform (Fire Safety) Order 2005, Article 21 — Training

Article 9(1) requires the responsible person to make a suitable and sufficient fire risk assessment to identify the general fire precautions needed. [(RRO 2005, article 9 — Risk assessment)] Article 21(1) then requires adequate fire safety training at first employment and whenever employees are exposed to new or increased risks from a change of responsibilities, new work equipment, new technology, or a new system of work. [(RRO 2005, article 21 — Training)] Critically, Article 21(2)(d) requires that fire safety training be provided in a manner appropriate to the risk identified by the risk assessment — meaning the content and format of training must be calibrated to the assessment's findings, not delivered as a standard induction for every role. [(RRO 2005, article 21 — Training)] Article 9(3) requires the fire risk assessment to be reviewed regularly and whenever there is reason to suspect it is no longer valid or there has been a significant change. [(RRO 2005, article 9 — Risk assessment)]

Manual Handling Operations Regulations 1992, Regulation 4 — Duties of Employers

The manual handling risk assessment duty is conditional: it arises only where manual handling operations involving a risk of injury cannot be avoided. Where that threshold is met, Reg 4(1)(b)(i) requires a suitable and sufficient assessment having regard to the Schedule 1 factors. [(MHOR 1992, regulation 4 — Duties of employers)] Reg 4(1)(b)(iii) additionally requires that employees undertaking those operations be provided with general indications and, where reasonably practicable, precise information on load weights and the heaviest side of any load whose centre of gravity is not centrally positioned. [(MHOR 1992, regulation 4 — Duties of employers)] The knowledge and training of the individual worker is itself a factor the regulation requires to be taken into account.

DSEAR 2002, Regulation 5 — Risk Assessment

Where a dangerous substance is or is liable to be present, DSEAR Reg 5(1) requires a separate suitable and sufficient risk assessment — this is a distinct duty from MHSWR Reg 3 and has its own specific list of considerations under Reg 5(2), including the likelihood that an explosive atmosphere will occur, the scale of anticipated effects of a fire or explosion, and the hazardous properties of the substance. [(DSEAR 2002, regulation 5 — Risk assessment)] DSEAR Reg 5(5) further provides that no new work activity involving a dangerous substance may commence until the assessment has been made and required measures implemented. [(DSEAR 2002, regulation 5 — Risk assessment)]

---

Training Trigger Checklist: Mapping Assessment Outputs to Training Duties

Use this checklist after completing or reviewing any risk assessment. Each "Yes" answer in the left column activates the corresponding duty in the right column.

Risk Assessment Finding	Regulation Triggered	Training Duty Activated
Assessment reveals new or increased risk due to changed system of work, new equipment, new technology, or change of responsibilities	MHSWR 1999, Reg 13(2)	Adequate H&S training before exposure to new/increased risk; must be during working hours (Reg 13(3))
Work is liable to expose employees to a substance hazardous to health	COSHH 2002, Reg 12(1)	Training must include significant findings of the risk assessment and specific precautions (Reg 12(2)); format must match level, type and duration of exposure (Reg 12(3))
Assessment finds a health risk from vibration exposure or employees likely to be exposed at or above the exposure action value	CVAR 2005, Reg 8(1)	Training to include assessment findings (with measurements), exposure values, injury signs, and safe working practices (Reg 8(2))
Significant change in work type or methods where vibration training already given	CVAR 2005, Reg 8(3)	Existing vibration training must be updated
Fire risk assessment completed or reviewed; employees exposed to new/increased fire risk	RRO 2005, Art 21(1) & Art 21(2)(d)	Fire safety training calibrated to the specific risk level identified; not a standard generic induction
Fire risk assessment significantly changed	RRO 2005, Art 9(3)	Assessment review triggers re-evaluation of whether current training remains appropriate to identified risk
Manual handling operations involving injury risk cannot be avoided	MHOR 1992, Reg 4(1)(b)(i) & (iii)	Workers must receive general indications on loads; precise weight information where reasonably practicable; worker's existing training is a Schedule 1 factor
Dangerous substance present or liable to be present	DSEAR 2002, Reg 5(1)	Ensure assessment covers explosive atmosphere likelihood and effects (Reg 5(2)); no new work to commence until assessment complete and measures implemented (Reg 5(5))
Young person to be employed	MHSWR 1999, Reg 3(4)	Assessment (or review) must be made or reviewed before employment; must account for inexperience, immaturity, and extent of training provided or to be provided

How to use this checklist: Run it immediately after completing, revising, or reviewing a risk assessment. Where a duty is triggered, open a training action with a named responsible person and completion date before the work commences or the change takes effect. Attach the completed checklist to the RAMS document as an appendix.

---

Generic vs Site-Specific vs Dynamic: What These Terms Mean in Practice

As stated above, UK law does not define or require any taxonomy of risk assessment types. The following labels are a training-community convention. Their practical significance — particularly in construction — is real, but they derive from industry practice, not statute.

Term	Practical meaning	Where it has force	What law actually requires
Generic	A baseline assessment for a standard task, written without reference to a specific site or set of conditions	Useful as a starting template; routinely rejected by principal contractors as a standalone RAMS submission	MHSWR Reg 3 requires the assessment to identify measures needed for actual risks. A generic assessment rarely satisfies this for variable-condition tasks.
Site-specific	The generic assessment adapted to the actual location, layout, adjacent hazards, weather exposure, specific workforce and equipment on that site	Required in practice by most principal contractors; the standard a PC review will apply	This is the level at which MHSWR Reg 3's "suitable and sufficient" standard is most reliably met for construction tasks
Dynamic	An on-the-spot reassessment by the worker or supervisor when conditions change during work — not pre-planned	Particularly relevant where conditions are unpredictable or workers operate with limited supervision; embedded via toolbox talks and pre-task briefings	No specific statutory form; the review duty under MHSWR Reg 3(3) is the closest legal anchor — conditions changing mid-task can constitute "reason to suspect it is no longer valid"

---

Who Prepares RAMS and How the Risk Assessment Element Must Be Constructed

RAMS — a Risk Assessment and Method Statement combined in a single document — is an industry convention, not a statutory form. No regulation requires the specific format of a "RAMS." What the law requires is a suitable and sufficient risk assessment (MHSWR Reg 3) and, separately, a safe system of work. The industry combines these into a single submission for principal contractor review.

Who prepares it: HSE states that the risk management process can be carried out by the employer themselves or by a competent person appointed to help. [(HSE — Risk assessment: steps needed to manage risk)] In practice on CDM-notifiable projects, the subcontractor's competent person (typically the H&S manager, working supervisor, or appointed safety adviser) prepares the RAMS for submission to the principal contractor. The PC does not write it on the subcontractor's behalf.

Worked Example: Bricklaying at Height

Scenario

A small bricklaying subcontractor holds a generic risk assessment for "bricklaying." Their PC requires a RAMS before two upcoming tasks: (A) bricklaying at height on an exposed chimney stack, and (B) bricklaying a garden boundary wall at ground level on the same development.

Why the generic assessment fails both tasks:

The generic assessment lists "falls from height" as a hazard with "scaffolding/edge protection" as the control. It does not specify:

• Access system type, load capacity, or inspection frequency
• Exposure to wind loading at chimney stack height
• Silica dust controls (COSHH Reg 6 assessment not completed for task A)
• Manual handling of blocks at height vs ground level (MHOR Reg 4 assessment differs by task)
• Scaffold proximity to public footpath for task B

What the site-specific RAMS for Task A (chimney stack) must add:

Element	Generic entry	Site-specific requirement
Access	"Scaffold erected"	Type of scaffold, design load, third-party inspection certificate reference, restricted zones below
Weather	Not addressed	Wind speed exclusion threshold; named supervisor to authorise stop-work decision
Silica dust	Not addressed	COSHH Reg 6 assessment: cutting method, RPE specification, LEV/water suppression requirement; COSHH Reg 12 training evidence for all operatives
Vibration	Not addressed	Assess whether angle grinder/disc cutter use reaches CVAR exposure action value; if so, CVAR Reg 8 training duty activated
Manual handling	"Blocks to be lifted safely"	Block weight stated; Schedule 1 factors assessed; worker training and physical capability checked (MHOR Reg 4(1)(b)(i) and (iii))
Persons not in employment	"Public excluded from site"	Specific exclusion zone dimensions; signage type; responsible person named

What the site-specific RAMS for Task B (boundary wall) changes:

• Falls from height hazard significantly reduced; working platform requirements are different
• Public adjacency risk increases (boundary wall abuts public pavement)
• Silica dust controls still required if cutting is involved — COSHH duty does not disappear at ground level
• Wind loading irrelevant

Training obligations generated by Task A assessment: Using the Training Trigger Checklist above: COSHH Reg 12 training duty (silica dust findings); CVAR Reg 8 duty if exposure action value met or risk indicated; MHOR training indication duty; MHSWR Reg 13 duty if any worker is new to this system of work.

The RAMS author's mental walkthrough: Begin at the point of arrival on site, not at the point of starting work. Delivery and unloading of blocks generates manual handling and vehicle movement hazards. Scaffold erection is a separate risk assessment task. Cutting generates silica. Working at height generates falls risk. Completion and de-scaffolding generates its own risks. Each phase must be assessed; the method statement describes the sequence; the training requirements flow from the combined assessment outputs.

---

When a Risk Assessment Must Be Reviewed and What Triggers a Fresh Training Obligation

Under MHSWR Reg 3(3), a risk assessment must be reviewed if there is reason to suspect it is no longer valid, or if there has been a significant change in the matters to which it relates. [(MHSWR 1999, regulation 3 — Risk assessment)] HSE's guidance identifies specific review triggers: controls may no longer be effective; changes to staff, a process, substances or equipment; workers spotting problems; accidents or near misses. [(HSE — Risk assessment: steps needed to manage risk)]

Each of the task-specific regulations mirrors this: COSHH Reg 6(3) requires review if there is reason to suspect the assessment is no longer valid, if there has been a significant change in the work, or if monitoring results require it. DSEAR Reg 5(3) requires regular review and particularly when work processes or organisation undergo significant changes. The Fire Safety Order Art 9(3) requires review whenever there is reason to suspect invalidity or a significant change in the matters to which it relates.

Critical link: Every review trigger under these regulations is also a potential training trigger. When a review produces changes to an assessment, those changes must flow through to the relevant workers as updated information, instruction and training — under COSHH Reg 12(3), CVAR Reg 8(3), MHSWR Reg 13(3), and the Fire Safety Order Art 21(2)(c) — before the changed activity commences.

---

Generic vs Site-Specific vs Dynamic: Summary Reminder

The three-way comparison table above covers the full distinction. One practical note on dynamic assessment: while no UK regulation defines it as a formal document type, the review duty under MHSWR Reg 3(3) — to reassess when there is reason to suspect the assessment is no longer valid — provides the closest legal anchor. On construction sites, embedding a pre-task verbal reassessment process (confirmed in the method statement) is the practical mechanism for satisfying this duty when conditions change mid-task.

---

Frequently Asked Questions

What is training risk assessment?

"Training risk assessment" has two distinct meanings in UK practice. First, the skill-based training that equips a worker or manager to produce risk assessments meeting the "suitable and sufficient" standard under MHSWR 1999 Reg 3. Second, the legal duty — under COSHH Reg 12, CVAR Reg 8, the Fire Safety Order Art 21, and MHSWR Reg 13 — to provide workers with training whose content is directly defined by what the risk assessment finds. Both obligations are enforceable and must be managed together.

What are the 5 things a risk assessment should include?

HSE identifies five elements of the risk management process: (1) identify hazards, (2) assess the risks, (3) control the risks, (4) record your findings, and (5) review the controls. For employers with five or more employees, MHSWR Reg 3(6) requires written records of the significant findings and any especially at-risk employee groups. Note: these are HSE guidance steps, not a statutory checklist — the legal standard is "suitable and sufficient" under Reg 3.

Who prepares RAMS?

RAMS is an industry convention, not a statutory form. It is prepared by the subcontractor or self-employed person carrying out the work — typically by a competent person within their organisation (health and safety manager, working supervisor, or appointed adviser). HSE confirms that the risk management process can be carried out by the employer themselves or by a competent person appointed to help. The principal contractor reviews but does not produce the subcontractor's RAMS.

What are the 5 stages of risk assessment?

HSE's five stages are: identify hazards, assess the risks, control the risks, record your findings, and review the controls. These stages are guidance on how to reach the statutory standard of a "suitable and sufficient" assessment under MHSWR Reg 3 — they are not themselves a legal requirement. The law requires the outcome, not the methodology.

---

How ramsdocs Supports Compliant Risk Assessment Documentation and Training Record-Keeping

ramsdocs is designed to help subcontractors, H&S managers and site supervisors produce RAMS that are structured to meet the "suitable and sufficient" standard under MHSWR Reg 3 — PC review-ready and built around the site-specific, task-specific detail that generic templates cannot provide.

The platform enables you to:

• Build risk assessments against the five-step HSE framework with task-specific and site-specific fields that cannot be left blank
• Map assessment outputs to the Training Trigger Checklist above, so Reg 12, Reg 8, Art 21 and Reg 13 duties are identified at the point of assessment, not after a PC rejection
• Record and version-control assessment reviews with dated audit trails, supporting the Reg 3(3) review obligation
• Attach training records against specific assessment findings, creating a direct evidential link between the assessment, the training duty, and the training delivered

Review and adapt every document produced to your specific site, task, workforce and contractor requirements. No risk assessment tool or template removes the need for review by a competent person who understands the actual conditions on your site.

---

Disclaimer: This page is provided for information and guidance only. All risk assessments, RAMS documents and training records must be reviewed, adapted and signed off by a competent person with direct knowledge of the specific site, task, workforce and circumstances. Nothing on this page constitutes legal advice or guarantees regulatory compliance. UK legislation is subject to amendment; always check the current version of any regulation before relying on it.