Risk Assessments · Mandatory · Pre-Construction
Generic Site Risk Assessment
The Generic Site Risk Assessment identifies common hazards present on all construction sites and establishes baseline control measures. It covers access, welfare, general housekeeping, plant movement, and environmental conditions. This assessment forms the foundation upon which task-specific risk assessments are built.
Last reviewed: 29 March 2026 — This guide reflects UK law as of this date. MHSWR 1999 remains current with no amendments enacted as of 29 March 2026. Next scheduled review: 29 March 2027.
| Legal basis | Management of Health and Safety at Work Regulations 1999 Regulation 3(1) — every employer must make a suitable and sufficient assessment of risks |
| Recording duty | MHSWR 1999 Reg 3(6) — employers with 5 or more employees must record significant findings in writing. In construction, this is effectively universal. |
| Who produces it | Principal Contractor — as employer and person in control of the construction phase. Every employer on site also has their own duty under Reg 3. |
| When | Before construction begins and updated throughout the project. Must be in place before any worker starts on site. |
| ‘Suitable and sufficient’ | HSE’s term for the standard a risk assessment must meet. Defined by six criteria — see Section 3. Not a defined term in the regulation itself. |
| Generic vs task-specific | This guide covers the site-wide generic risk assessment. Task-specific RAMS (Guides B2–B25) address individual activities. |
| Enforcing authority | Health and Safety Executive (HSE) |
1. What Is a Generic Site Risk Assessment?
A Generic Site Risk Assessment is the foundational health and safety document that identifies the principal hazards present across a construction site as a whole — not associated with any specific trade activity, but with the general conditions and operations that affect everyone on site.
It is the Principal Contractor's primary discharge of the duty under Management of Health and Safety at Work Regulations 1999 Regulation 3(1), which requires every employer to make a ‘suitable and sufficient’ assessment of risks to their employees and to other persons — including subcontractors, visitors, and members of the public near the site boundary.
“3(1) Every employer shall make a suitable and sufficient assessment of the risks to the health and safety of his employees to which they are exposed whilst they are at work; and the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking.”— Management of Health and Safety at Work Regulations 1999, Regulation 3(1)
Generic site RA and task-specific RAMS — how they fit together
The generic site risk assessment covers the baseline hazards on site — plant movements, access and egress, general housekeeping, welfare, site security, falls from height at general locations. It does not cover the specific risks of individual construction activities. Those are addressed by task-specific RAMS (see Guides B2–B25) produced by the contractor carrying out each activity. Both are required — the generic site RA does not substitute for task-specific RAMS, and task-specific RAMS do not substitute for the generic site RA.
2. The HSE Five-Step Framework
The HSE sets out a five-step process for risk assessment in its guidance publication INDG163. This framework applies to every risk assessment including the generic site risk assessment. HSE inspectors use these five steps as the benchmark when assessing whether an assessment is suitable and sufficient.
Identify the hazards
Walk the site physically — do not complete this as a desktop exercise. Observe tasks, equipment, materials, and the environment. Talk to workers and supervisors. Review the Pre-Construction Information Pack. Consider both routine activities and non-routine ones (deliveries, maintenance, end-of-day site security). Include physical hazards (falls, struck-by, plant), chemical hazards (dust, solvents, COSHH substances), biological, ergonomic, and psychosocial hazards.
Decide who might be harmed and how
Go beyond your own directly employed workers. On a construction site this means: employees of subcontractors, self-employed workers, agency workers, delivery drivers, visitors, neighbouring occupants, members of the public near the site boundary. For each hazard, be specific about the harm mechanism — not just ‘injury’ but fall from height causing fractures, struck by vehicle causing fatality, silica dust inhalation causing silicosis.
Evaluate the risks and decide on precautions
For each identified hazard, assess likelihood of harm and severity of consequences to determine risk rating. Then apply the hierarchy of control in order — Eliminate, Substitute, Engineering controls, Administrative controls, PPE. PPE is always the last resort, not the first response. The remaining risk after controls must be as low as reasonably practicable (ALARP).
Record your findings and implement them
If you employ 5 or more people, you must record significant findings in writing (MHSWR Reg 3(6)). In construction this is effectively always required. The record must identify the hazards, state who is at risk, describe the controls in place, and assign responsibility for implementation. It must be accessible to workers and relevant parties.
Review and update
The risk assessment is a live document, not a one-off exercise. Review it when: the scope of work changes; new plant or materials are introduced; an accident or near miss occurs; working conditions change significantly; at regular intervals throughout the project. An out-of-date risk assessment that no longer reflects site conditions is legally worthless and operationally dangerous.
3. What Does ‘Suitable and Sufficient’ Mean?
The term ‘suitable and sufficient’ is not defined in the MHSWR 1999. The HSE has provided a practical definition through its guidance and approved codes of practice. An assessment meets the standard if it satisfies all six of the following criteria:
| HSE criterion | What this means in practice |
|---|---|
| A proper check was made | The assessment is based on a physical inspection of the site and the specific activities planned — not a generic template completed at a desk without site-specific knowledge. |
| It states who might be affected | The assessment identifies all persons at risk — including employees, subcontractors, visitors, the public near the site boundary — not just ‘site workers’. |
| All obvious significant risks are dealt with | Every hazard that a competent person would reasonably expect to be present has been identified and has a control measure assigned. Trivial risks can be disregarded; significant ones cannot. |
| It considers the number of people who could be harmed | Where many people could be affected by a single hazard (e.g. a road adjacent to the site, a scaffold over a public footpath), this is reflected in the risk rating and the controls applied. |
| The remaining risk is low | After all controls are applied, the residual risk is as low as reasonably practicable. The assessment does not sign off a high-risk activity as ‘acceptable’ simply because PPE has been specified. |
| Workers or representatives were involved | Workers who will carry out the tasks have been consulted in the assessment process. Their practical knowledge of hazards and workable controls improves the quality of the assessment and satisfies the worker consultation duty under MHSWR Reg 3. |
Generic templates fail this standard
A risk assessment downloaded from the internet and submitted with only the company name changed does not meet the ‘suitable and sufficient’ standard. HSE inspectors look for evidence that the assessment reflects the actual site, actual activities, and actual people at risk. A generic template referencing hazards that don't exist on your site, or failing to reference hazards that do, is worse than useless — it is evidence that a genuine assessment was not carried out. The TradeRAMS guidance (February 2026) is explicit: the assessment must match the actual job, location, equipment, and people.
4. The Hierarchy of Control
For every hazard identified, control measures must be selected in order of effectiveness — from most effective (eliminate the hazard entirely) to least effective (protect the individual with PPE). This hierarchy is embedded in MHSWR 1999 Schedule 1 (Principles of Prevention) and is the standard against which HSE assesses whether controls are adequate.
| Level | What it means | Construction examples |
|---|---|---|
| ELIMINATE | Remove the hazard entirely. Change the design, process, or method so the risk does not exist. Most effective — preferred above all other options. | Design out the need to work at height by prefabricating elements at ground level. Use pre-cast concrete units instead of in-situ pours to remove working with wet concrete. Schedule delivery of heavy materials directly to point of use to eliminate manual handling. |
| SUBSTITUTE | Replace something hazardous with something less hazardous. Reduces but does not eliminate the risk. | Use water-based instead of solvent-based paint to reduce VOC exposure. Specify lightweight blocks (max 20kg) instead of standard dense concrete blocks. Use dust-suppressed cutting methods instead of dry cutting silica-bearing materials. |
| ENGINEERING CONTROLS | Isolate people from the hazard using physical means. Does not rely on worker behaviour — more reliable than administrative controls. | Install edge protection, scaffolding and barriers before work at height begins. Fit local exhaust ventilation to dust-generating tools (grinders, cut-off saws). Use plant with ROPS/FOPS cab protection. Fit proximity alarms to excavators. |
| ADMINISTRATIVE CONTROLS | Change the way people work through procedures, permits, training, supervision. Relies on worker behaviour — less reliable than physical controls. | Implement permit to work for high-risk activities (hot works, confined space, excavation). Ensure site inductions cover all relevant hazards and controls. Rotate workers on tasks with vibration/noise/repetitive strain exposure. Restrict site access during certain operations (crane lifts, concrete pours). |
| PPE | Protect the individual from residual risk after all other controls are applied. Always the last resort — if PPE is the primary control, the assessment has failed. | Hard hats, hi-vis, safety footwear as minimum standard. RPE (dust masks) where engineering controls do not reduce dust exposure below WEL. Eye protection for grinding, cutting, chemical handling. Hearing protection where noise exposure exceeds action values (80 dB(A)). |
PPE is always the last resort — not the first response
The most common control measure listed on inadequate risk assessments is PPE. ‘Wear hard hat and hi-vis’ appears on almost every hazard entry regardless of whether higher-level controls have been considered. PPE protects only the individual wearing it; it does nothing if it is not worn, worn incorrectly, or damaged. Engineering controls protect everyone in the area regardless of individual behaviour. Always exhaust higher-level options before relying on PPE. If PPE is the primary control for a significant hazard, the assessment has not genuinely applied the hierarchy.
5. Generic Site RA vs Task-Specific RAMS
Understanding the distinction between the generic site risk assessment and task-specific RAMS is essential for both the Principal Contractor and for subcontractors who produce their own RAMS before starting work.
| Generic Site Risk Assessment | Task-Specific RAMS | |
|---|---|---|
| What it covers | Site-wide general hazards present throughout the project — access/egress, general site conditions, security, welfare, general plant movements, housekeeping, slips/trips, weather | A specific construction activity — excavation, working at height, hot works, concrete pour, electrical installation — with step-by-step method |
| Who produces it | Principal Contractor — produced before construction begins, reviewed and updated throughout | Individual contractor or subcontractor responsible for that activity, submitted to PC before works start |
| When required | On every construction project, before any workers begin on site | For every significant activity — each distinct trade and task type |
| Does it replace the other? | No — the generic site RA is the baseline but does not cover activity-specific risks | No — task-specific RAMS build on the generic site RA; they do not substitute for it |
| CDM relationship | Forms part of the Construction Phase Plan and reflects the site’s general arrangements | References the CPP and generic site RA; reviewed by PC before works commence |
A note on overlapping hazards:
Some hazards appear in both the generic site RA and in task-specific RAMS — for example, falls from height appears in the generic site RA (general site edge protection, scaffold access) and in a roofing contractor's RAMS (specific method for working at the eaves on a particular roof pitch). This duplication is correct and expected. The generic site RA sets the baseline arrangements; the task-specific RAMS add the activity-specific controls that the generic assessment cannot anticipate.
6. Common Hazards in a Generic Site Risk Assessment
The following table covers the hazards that should appear in almost every generic site risk assessment for a UK construction project. This is not an exhaustive list — site-specific conditions will add further hazards. Each entry must be populated with controls specific to your site, not copied verbatim from this table.
| Hazard | Who is at risk | Risk factors | Control measures |
|---|---|---|---|
| Slips, trips and falls on the same level | All site personnel, visitors | Uneven terrain, wet surfaces, materials stored in walkways, poor lighting, cable routes | Keep walkways clear, adequate lighting, mark uneven surfaces, provide matting in wet areas, regular housekeeping inspections |
| Falls from height | All site personnel working above ground level | Open floor edges, excavations, scaffolding, ladders, roof work | Edge protection to all open edges, inspected scaffolding, prohibition of work at height during high winds, PPE — harnesses where collective protection not practicable |
| Moving plant and vehicles | All site personnel, delivery drivers, pedestrians near site boundary | Plant reversing, blind spots, pedestrians in plant exclusion zones | Separate pedestrian and vehicle routes, banksman for reversing operations, site speed limit, hi-vis mandatory, delivery management plan |
| Manual handling | All site personnel handling materials and equipment | Heavy loads, awkward shapes, repetitive movements, overhead handling | Eliminate by using mechanical aids (forklift, pallet trucks) where practicable; limit maximum individual lift to 25kg; train workers in safe manual handling technique |
| Electricity — general site supply | All workers on site | Overhead lines, underground services, temporary site supply, damaged cables | Service strike prevention plan, overhead line exclusion zones, 110V reduced voltage tools for portable equipment, RCD protection on all supplies |
| Structural collapse / falling objects | All site personnel and public near site | Unstable structures, unsupported excavations, materials falling from scaffold, inadequate propping during demolition or refurbishment | Structural engineer approval for demolition sequence, scaffold toe boards and debris nets, exclusion zones beneath lifting operations, propping to excavations >1.2m deep |
| Welfare and welfare facility access | All site workers | Inadequate sanitary facilities, no hot water or rest facilities, exposure to heat/cold, dehydration | Welfare facilities per CDM 2015 Schedule 2 from day one of construction; water supply, toilets (min 1 per 25 workers), washing facilities, rest area with heating/seating |
| Site access and security | All site personnel, unauthorised persons especially children | Unauthorised access, site boundary breaches, theft and vandalism | Secure perimeter hoarding, secure access control, out-of-hours security arrangements, site boundary lighting |
7. What the Document Must Contain
MHSWR 1999 does not prescribe a specific format for the risk assessment record. The following fields are required or strongly recommended for a document that meets the ‘suitable and sufficient’ standard and would satisfy HSE inspection.
| Field | Detail | Status |
|---|---|---|
| Project / site details | Site name, address, project reference, PC name, date of assessment | Essential |
| Assessment author | Name, role, and competence of the person who carried out the assessment | Essential |
| Date and review date | Date assessment was completed and scheduled review date or review trigger | Essential |
| Hazard description | Clear description of each identified hazard — specific enough to be meaningful, not just ‘working at height’ | Essential |
| Who is at risk | Categories of persons who could be harmed by each hazard — own workers, subcontractors, visitors, public | Essential |
| Risk rating — before controls | Likelihood and severity rating for each hazard before controls are applied — demonstrates the assessment was carried out, not assumed | Strongly recommended |
| Control measures | Specific, actionable controls for each hazard — following the hierarchy. Not generic statements like ‘wear PPE’ without specifying what PPE and when. | Essential |
| Risk rating — after controls | Residual risk rating after controls are applied — demonstrates the controls reduce risk to ALARP | Strongly recommended |
| Person responsible | Who is responsible for implementing and maintaining each control measure | Recommended |
| Worker involvement note | Confirmation that workers were consulted in the preparation of the assessment (satisfies MHSWR worker involvement requirement) | Recommended |
| Signature / approval | Signature of the PC’s responsible person confirming the assessment is approved and in force | Essential |
8. Common Mistakes
Using a downloaded generic template without site-specific adaptation
The most common failure mode. A risk assessment that references hazards not present on your site, or omits hazards that are present, is not suitable and sufficient. Every entry in the assessment must reflect the actual site conditions, actual plant and equipment, and the actual activities planned. A logo swap on a downloaded template does not constitute a risk assessment — it is evidence that one was not carried out.
Listing PPE as the primary or only control measure
Specifying ‘wear PPE’ as the control for every hazard without demonstrating that higher-level controls were considered and either applied or ruled out with reasons is not a compliant risk assessment. HSE inspectors look for evidence that the hierarchy of control was applied. If PPE appears as the sole control for a significant hazard, expect enforcement action.
Completing the assessment as a desktop exercise without site inspection
The ‘proper check was made’ criterion for suitable and sufficient explicitly requires physical site inspection. A risk assessment completed without visiting the site cannot identify site-specific hazards — ground conditions, adjacent properties, overhead lines, underground services, site access constraints. The assessor must walk the site before completing the document.
Failing to review after significant changes
A risk assessment produced at the start of the project that is never updated becomes invalid as the project progresses. Phase changes, new subcontractors, changes to working methods, weather events, and near misses all trigger a review obligation. Keep the assessment as a live document, not a filed record.
Not involving workers in the assessment process
MHSWR Reg 3 and the HSE’s definition of ‘suitable and sufficient’ both require worker involvement. Workers who carry out the tasks have practical knowledge of hazards that management may not identify. Not involving them produces a weaker assessment — and fails the legal standard. Record that workers were consulted and note any contributions they made.
Treating it as a separate document from the Construction Phase Plan
The generic site risk assessment feeds directly into the CPP. The CPP must describe how health and safety will be managed, and the risk assessment is the evidential basis for the control arrangements the CPP describes. The two documents should be consistent with each other and updated together when either changes.
10. Frequently Asked Questions
Is a risk assessment required on every construction project?▾
Yes — MHSWR 1999 Regulation 3 applies to every employer on every construction project. There is no size threshold. The depth and formality of the assessment is proportionate to the risk — a small domestic project has fewer hazards and less complex controls than a major commercial development — but the duty exists regardless of project size. The requirement to record findings in writing applies whenever an employer has five or more employees, which in construction is almost always.
Does the generic site risk assessment need to be updated throughout the project?▾
Yes. MHSWR 1999 requires review when there is reason to suspect the assessment is no longer valid or when there has been a significant change. In construction, this happens frequently — new trades start, methods change, site conditions evolve. The assessment should be reviewed at each significant project phase, after any accident or near miss, and whenever new information emerges about site hazards. Record the date and reason for each review.
Who is responsible for the generic site risk assessment — the client or the PC?▾
The Principal Contractor is responsible for producing and maintaining the generic site risk assessment. The client has no direct duty to produce it. However, the client must provide the Pre-Construction Information Pack, which feeds into the RA, and must not allow construction work to start unless a Construction Phase Plan (which references the RA) is in place. Every other employer on site — each subcontractor — has their own MHSWR Reg 3 duty for their own workers’ risks.
Does the generic site RA replace the need for COSHH assessments?▾
No. COSHH assessments are separate legal requirements under the Control of Substances Hazardous to Health Regulations 2002 for activities involving hazardous substances — cement, paint, solvents, silica dust, welding fumes, etc. The generic site RA may reference that COSHH-regulated activities are present on site, but each substance requires its own COSHH assessment. See Category C guides for COSHH document requirements.
What is a ‘dynamic risk assessment’ and does it replace the formal assessment?▾
A dynamic risk assessment is the real-time judgement a competent worker makes when site conditions change unexpectedly — a worker spotting unstable ground, noticing unexpected weather, or identifying a hazard not covered in the formal assessment. It does not replace the formal written assessment — it supplements it. Workers should be trained to recognise when conditions deviate from the formal assessment and empowered to stop work or adapt safely.
Generate your Generic Site Risk Assessment on Construction Suite
Construction Suite walks you through every required section with a guided Q&A — built to MHSWR 1999 — and generates a professionally formatted document in minutes.
Get started freeThis guide is for general informational purposes only and does not constitute legal advice. While every effort is made to ensure accuracy, regulations change and individual project circumstances vary. Construction Suite is a trading name of Xzist Digital Ltd, registered in England and Wales.