To me the who can be harmed is employees, their families, visitors etc with specific mention of those who are vulnerable.

For me it made sense to break down the how into bringing the disease into the workplace, airborne spread within the workplace, spread by surface contamination within the workplace, spread by direct physical contact within the workplace, taking the disease back home and business travel.  That's because there are somewhat different control measures for each.

I've also included effects on mental health, potential consequences of operating at a low staffing level and in changed conditions, and the effects of the control measures themselves (such as dermatitis from all the hand washing).

That's just how I've done it, I'm sure there are other equally valid ways of breaking it down and some ways may be more relevant in some workplaces depending on the nature of the work activities and working environment.  So do what works for you.

It doesn't matter where you put the details of your training and communication, as long as you are able to show what they are.  HSE are not prescriptive about how your risk assessment looks, they just want to see that you have considered and controlled the risks.  It's usual for a risk assessment on any topic to say training is needed and then to have separate training schedules and records to back this up.

Hey Andy that is one beautiful Bowtie. I have been following thinkreliability.com who use cause mapping as the analysis tool - they have a few examples on Covid here's one. https://cdn2.hubspot.net/hubfs/2164270/Virus%20Surface%20Contact%20-%20BB.pdf

However, the 8 page HSE guidance https://www.hse.gov.uk/news/assets/docs/working-safely-guide.pdf emphasises giving INFORMATION over any deep analysis. I sense that some may be trying to force-fit CV into some kind of standard risk assessment form. I don't find that helpful as there is already so much guidance - what you need is an action list. 

The GOV industry guidance https://www.gov.uk/government/publications/guidance-to-employers-and-businesses-about-covid-19 and https://www.gov.uk/guidance/working-safely-during-coronavirus-covid-19 gives 99% of the expected control measures with some options where these can't be met. I see there is also now a useful reminder poster there I've not seen before - things get added almost every day. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876212/COVID19_Guidance_Employers_and_businesses_.pdf 

Why not just use these as your framework almost as checklists and then it's either 'yes done' or 'no - we will have to do this or this instead'. That means you have assessed the risk in your workplace for your staff. You don't have to fill in a form with 'risk assessment' written on it to have done what is required. It's not a safety person task, it's a business task. Bow-tie diagrams may persuade managers to get involved!

Most actions will be management / procurement based (fixing screens , installing hygiene stations, for example). some will be mangement / supervisor led (briefngs, monitoring, replenishing, adjusting, etc) and some will be instructions / reminders to workers - keep 2m apart, sanitise in these circumstances, wash hands, take breaks in this way. Allow for regular communication and be prepared to adjust as required. 

The other element is to identify individuals who may be at particular risk. My company director has spoken (confidentially) to everyone (90 people) to establish whether they should even be there, or whether they require extra consideration whilst at work, for childcare or other reasons. This has also givcn people the chance to suggest problems or other ideas. The 'open door' continues with daily contacts (obviously not actual contact) and more visibility of management than usual to offer support.

The outcome should be clear list of: we are going to do these things, including adapt as needed, and we expect you (workers) to do these things too. Now you can display your poster with pride.