STATUTORY SAFETY MANAGEMENT

Contractor Risk Assessment GuidePrinciples, Matrices & Control Hierarchies for Commercial FM

Learn how to conduct robust, audit-ready risk assessments that comply with HSE guidelines, protect operatives on site, and satisfy commercial client compliance audits.

7 min read•Updated 2026• UK Commercial FM Standard

View Risk Assessment Template Explore Compliance in Portal

Executive Summary

A suitable and sufficient risk assessment identifies genuine hazards, applies the statutory hierarchy of controls, and calculates residual risk using standard 5x5 severity/likelihood scoring.

Authoritative UK facilities management guidance. Non-legal operational standard.

01 // THE HSE 5-STEP MODEL

The Five Steps to Contractor Risk Assessment

Identify the Hazards

Inspect the physical working area, equipment, materials, and processes. Look beyond obvious risks to identify invisible hazards such as asbestos, toxic gases, buried cables, or structural weaknesses.

Decide Who Might Be Harmed & How

Identify all affected groups: your engineers, client building occupants, cleaning staff, delivery drivers, and members of the public (especially children or vulnerable persons if near public boundaries).

Evaluate Risks & Apply Controls

Determine the likelihood and severity of harm. Apply the Hierarchy of Controls (Elimination -> Substitution -> Engineering -> Admin -> PPE) to reduce risk As Low As Reasonably Practicable (ALARP).

Record Your Significant Findings

Document the hazards, identified risks, control measures, responsible persons, and residual risk scores in an audit-ready format. (Mandatory for employers with 5 or more staff, and required by all FM clients regardless of business size).

Review & Update When Conditions Change

Regularly audit the assessment. Immediately revise controls if new equipment is deployed, building operations alter, or an incident occurs on site.

IN-DEPTH GUIDES

What Is a Risk Assessment? & How to Write One

Explore our deep guides covering hazard identification, 5x5 scoring, and plantroom case studies.

Overview →How-To →

02 // QUANTITATIVE EVALUATION

Understanding the 5x5 Risk Matrix

Risk is mathematically defined as: Risk = Severity (1-5) × Likelihood (1-5).

SCORE 1 – 6 // LOW RISK

Acceptable / Manageable

Standard site precautions and basic PPE are sufficient. Work may proceed under normal supervision.

SCORE 8 – 12 // MEDIUM RISK

Tolerable with Specific Controls

Formal engineering isolations, permits to work, or physical barriers required. Specific briefing before starting.

SCORE 15 – 25 // HIGH RISK

Unacceptable / Immediate Stop

Work must not commence. The process must be completely re-engineered or eliminated until residual score drops.

03 // HAZARD CHECKLIST

Common Commercial FM Contractor Hazards

Working at Height

Ladders, roofs, plant decks, MEWPs. Falls from height remain the leading cause of fatal injury in UK construction.

Electricity & Live Conductors

Electric shock, burns, arc flash explosions, and power interruption to critical building services.

Hazardous Substances (COSHH)

Refrigerant gases (R410A/R32/R717), solvents, acidic coil cleaners, water treatment biocides.

Hot Works & Fire Inception

Oxy-acetylene brazing, soldering, grinding, roofing torch-on membranes. Strict permit & fire watch required.

Asbestos Containing Materials (ACMs)

Disturbance of insulation boards, pipe lagging, floor tiles in pre-2000 commercial properties.

Lone Working & Confined Spaces

Working isolated in plantrooms, basements, ceiling voids without immediate alarm communication.

QUESTIONS & ANSWERS

Frequently Asked Questions: Contractor Risk Assessments

Key guidance on statutory thresholds, matrices, and commercial review requirements.

What is the legal basis for contractor risk assessments in the UK?↓

The statutory duty to conduct risk assessments is set out in Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Employers and self-employed persons must make a 'suitable and sufficient' assessment of risks to employees and non-employees arising out of their work undertakings.

What is the 5-step HSE risk assessment model?↓

The Health and Safety Executive (HSE) defines 5 steps: 1) Identify hazards; 2) Assess who might be harmed and how; 3) Evaluate the risks and decide on control measures (using the Hierarchy of Controls); 4) Record your significant findings; and 5) Review your assessment regularly or when circumstances change.

How does the 5x5 Risk Matrix work?↓

A 5x5 matrix multiplies Severity (1: Negligible to 5: Catastrophic/Fatality) by Likelihood (1: Improbable to 5: Almost Certain). This produces a risk score from 1 to 25. Scores of 1-6 are generally Low/Acceptable; 8-12 are Medium (tolerable only with strict controls); and 15-25 are High (work must not proceed until re-engineered).

What is the Hierarchy of Controls?↓

The statutory hierarchy prioritises risk elimination over personal protection: 1. Elimination (remove hazard completely); 2. Substitution (replace with safer alternative); 3. Engineering Controls (physical barriers, extraction, isolations); 4. Administrative Controls (procedures, training, signage, permits); 5. PPE (Personal Protective Equipment as the last line of defence).

Does every minor job require a brand-new risk assessment?↓

Contractors can maintain standard task risk assessments for routine, repetitive activities, provided they perform a dynamic site check upon arrival to confirm that no unique or unrecorded site hazards exist (e.g. nearby public, live cables, poor lighting, or fragile roof lights).

KNOWLEDGE ECOSYSTEM