They are closely related but not the same thing...

Risk Assessment (RA)

• What it is: A formal process to identify hazards, evaluate risks, and determine control measures.
• Focus: It’s about understanding the risks and deciding what controls are necessary.
• Output: A documented assessment (often with a risk matrix) listing hazards, who may be harmed, existing controls, and any additional controls required.
• Legal basis: Required under the Management of Health and Safety at Work Regulations 1999 in the UK.

Safe System of Work (SSoW)

• What it is: A documented method of carrying out a task safely, using the controls identified in the RA.
• Focus: It’s about doing the work safely in practice.
• Output: Usually a procedure, method statement, or set of instructions (sometimes linked to training).
• Legal basis: Required under the Health and Safety at Work Act 1974 and regs like PUWER, LOLER, COSHH etc., which require safe working methods.

How they fit together

• The RA comes first: you assess the hazards and risks.
• The SSoW comes second: you describe how the work must actually be done safely, based on the RA’s findings.

Think of it like this:

• RA = What could go wrong and how to control it.
• SSoW = Step-by-step instructions to make sure the controls are actually applied.

Could you be caught out without SSoWs?

Yes, potentially. If you only have RAs, you may not be demonstrating that workers have clear, practical instructions for carrying out the job safely. Inspectors (HSE, auditors, etc.) often expect to see both:

• The RA to show you’ve considered the risks.
• The SSoW (or method statement, SOP, permit-to-work, etc.) to show how the job is actually done safely.

Hi LaserSafetyGuy

If the regulator is HSE and they decide to prosecute the odds are that somewhere in the case there will be an accusation that the risk assessment was inadequate in some way even if they may not use the correct words "suitable and sufficient".

There may be a specific charge under Regulation 3 of the Management Regulations but even if there is at the start it might be dropped in a plea bargaining exercise and just form part of the prosecution case under e.g. Sections 2 and/or 3 of HSWA.

....and if the bone of contention between prosecution and defence is about what was or what wasn't "reaonably practicable" and the onus is on the defence to prove on the balance of the evidence that the defendant HAD done all that was reasonably practicable - see Section 40 of HSWA which sets out a "reverse burden of proof" - then the exact words used in the risk assessment documentation are unlikely to take centre stage.

One problem is that if the defendant elects to plead Guilty (even if they think they are only just guilty) it leaves space for HSE to then make pronouncements about the inadequacy of the risk assessment which may be entirely unfounded. [Been there on two occasions as an Expert Witness where in each "Joint Experts' Statement, i.e. one Prosecution and one Defence Expert, we had agreed that the risk assessment had been substantially sound]. 

Morning LaserSafetyGuy

I agree with AK entirely that the risk assessment (under whatever name or names people choose to give the documentation that results) has turned into a circus and has become an "end in itself".

That said I do think that it is an implicit requirement that a duty holder who does things that involve risk and who is required to manage those risks, usually to the extent that is "reasonably practicable" has to make an assessment - if not how could they demonstrate that they HAVE done what is appropriate to mitigate the risks to an adequate degree?

I NEVER thought we needed specific legislation such as that in Reg 3 of the Regs, let alone the multitude of similar specific requirements to assess different types of risk. 

This happened mostly as successive UK Governments were so terrified of introducing so called Red Tape that their solution to "transposing" various European Commision H&S Directives was to take each one and do a "copy out" of the words.

So, if the Directive on e.g. noise says "Assess the risk of harm from noise", then instead of some guidance from HSE to say "remember to consider noise in your risk assessment" we got a specific requirement in the Code of Regulations that transposed the relevant Directive to risk assess whatever risk that Directive related to.

Result - far too many people look at each task and conclude that they need to do perhaps five or six risk assessments, when ONE would often be much better and be much more likely to adequately address ALL the risks (and MITIGATIONS) as a package.

There are occasions when it IS sensible to look at e.g. the noise on its own, but not if the end result is some assessment that is done in splendid isolation from the broader view.

I would say it's iterative.  You find out how they are doing it, or if you are lucky how they propose to start doing it.  You evaluate the risks of this.  This may lead you to find a better way of doing it.  Then you do it the new way and re-evaluate the risks.  At some point during all this you write down your record of the risks, and at some point you write down the work instructions (if it's helpful to do so) and then you revise the record of the risks and the work instructions as necessary, keeping them aligned.

Originally Posted by: Engr. Jerome Sancho Cruz

 

The RA is the thinking process that must happen first. 

Why does this need to happen first and where does it state this is law?

Originally Posted by: Engr. Jerome Sancho Cruz

 In short, the law requires you to think (RA) before you act (SSoW). The Risk Assessment is the formal proces that demonstrates compliance with the fundamental legal duty to assess risk 

Sorry but your thought process and understanding are wrong - many established businesses had methods of work long before the 12 pack were published (you need the Chicken to lay the egg).

Many of the business philosphies documented how the task should be undertaken to ensure repeatabiliy and in the main avoided incidents through luck rather than thought and planning - this became very prevalent during WW2 when skilled staff were replaced by a work force drawn from the home.

Even today when we bring in a new piece of equipment the first part of an evaluation is how the supplier has documented it is operated - it is only following those steps can we see if our location, environment and operatives have introduced risks the manufacturer was unable to foresee - our Risk Assessment.

Hi Jerome

Welcome to the IOSH Forums but I think you should perhaps be careful to avoid trying to lecture some highly experienced OSH professionals on the DOs and DON'Ts of UK health and safety legislation, particuarly if you probably have no idea of how much they DO know.

As Roundtuit indicates there was plenty of legislation in place in the UK well before the "6 pack" that became a rather larger pack and which included the Management of Health and Safety at Work Regulations 1992, subsequently overttaken by Regulations of the same name but dated 1999.

Section 2(2) of the Health and Safety at Work etc Act 1974 helps to explain the GENERAL principles of the duty on an employer towards their employee(s) in Section 2(1) of HSWA by spelling out specific aspects in five subsections to Section 2(2). One of these mentions a "safe system of work".

However this was NOT new in the 1974 Act. It is a principle enshrined in civil law and mentioned in numerous case law judgments on civil legal actions BEFORE the Act was even being contemplated.

The idea that there needed to be a specific legal requitement for the safe system of work to be possibly informed by a "risk assessment" or sometimes vice versa came later with first the Noise at Work Regulations 1987 as the precursor for what was laid out in the Management Regs 5 years later.

As Roundtuit indicates we now need both a chicken and an egg. Which should come first depends on what scenario you might be considering at any time. 

For what it is worth I think Roundtuit still holds the record for the highest number of contributions to these Forums (I could very quickly check but I am not going to). VERY long in the tooth!!

...and WatsonD who you have tried to educate not that far behind. Long time contributor. 

Originally Posted by: peter gotch

For what it is worth I think Roundtuit still holds the record for the highest number of contributions to these Forums

Your retirement saw a surge in postings which now exceed 6,000