They are closely related but not the same thing...

Risk Assessment (RA)

• What it is: A formal process to identify hazards, evaluate risks, and determine control measures.
• Focus: It’s about understanding the risks and deciding what controls are necessary.
• Output: A documented assessment (often with a risk matrix) listing hazards, who may be harmed, existing controls, and any additional controls required.
• Legal basis: Required under the Management of Health and Safety at Work Regulations 1999 in the UK.

Safe System of Work (SSoW)

• What it is: A documented method of carrying out a task safely, using the controls identified in the RA.
• Focus: It’s about doing the work safely in practice.
• Output: Usually a procedure, method statement, or set of instructions (sometimes linked to training).
• Legal basis: Required under the Health and Safety at Work Act 1974 and regs like PUWER, LOLER, COSHH etc., which require safe working methods.

How they fit together

• The RA comes first: you assess the hazards and risks.
• The SSoW comes second: you describe how the work must actually be done safely, based on the RA’s findings.

Think of it like this:

• RA = What could go wrong and how to control it.
• SSoW = Step-by-step instructions to make sure the controls are actually applied.

Could you be caught out without SSoWs?

Yes, potentially. If you only have RAs, you may not be demonstrating that workers have clear, practical instructions for carrying out the job safely. Inspectors (HSE, auditors, etc.) often expect to see both:

• The RA to show you’ve considered the risks.
• The SSoW (or method statement, SOP, permit-to-work, etc.) to show how the job is actually done safely.

Hi LaserSafetyGuy

If the regulator is HSE and they decide to prosecute the odds are that somewhere in the case there will be an accusation that the risk assessment was inadequate in some way even if they may not use the correct words "suitable and sufficient".

There may be a specific charge under Regulation 3 of the Management Regulations but even if there is at the start it might be dropped in a plea bargaining exercise and just form part of the prosecution case under e.g. Sections 2 and/or 3 of HSWA.

....and if the bone of contention between prosecution and defence is about what was or what wasn't "reaonably practicable" and the onus is on the defence to prove on the balance of the evidence that the defendant HAD done all that was reasonably practicable - see Section 40 of HSWA which sets out a "reverse burden of proof" - then the exact words used in the risk assessment documentation are unlikely to take centre stage.

One problem is that if the defendant elects to plead Guilty (even if they think they are only just guilty) it leaves space for HSE to then make pronouncements about the inadequacy of the risk assessment which may be entirely unfounded. [Been there on two occasions as an Expert Witness where in each "Joint Experts' Statement, i.e. one Prosecution and one Defence Expert, we had agreed that the risk assessment had been substantially sound]. 

Morning LaserSafetyGuy

I agree with AK entirely that the risk assessment (under whatever name or names people choose to give the documentation that results) has turned into a circus and has become an "end in itself".

That said I do think that it is an implicit requirement that a duty holder who does things that involve risk and who is required to manage those risks, usually to the extent that is "reasonably practicable" has to make an assessment - if not how could they demonstrate that they HAVE done what is appropriate to mitigate the risks to an adequate degree?

I NEVER thought we needed specific legislation such as that in Reg 3 of the Regs, let alone the multitude of similar specific requirements to assess different types of risk. 

This happened mostly as successive UK Governments were so terrified of introducing so called Red Tape that their solution to "transposing" various European Commision H&S Directives was to take each one and do a "copy out" of the words.

So, if the Directive on e.g. noise says "Assess the risk of harm from noise", then instead of some guidance from HSE to say "remember to consider noise in your risk assessment" we got a specific requirement in the Code of Regulations that transposed the relevant Directive to risk assess whatever risk that Directive related to.

Result - far too many people look at each task and conclude that they need to do perhaps five or six risk assessments, when ONE would often be much better and be much more likely to adequately address ALL the risks (and MITIGATIONS) as a package.

There are occasions when it IS sensible to look at e.g. the noise on its own, but not if the end result is some assessment that is done in splendid isolation from the broader view.