Table of Contents
- What is the difference between an audit and a risk assessment?
- Where do workplace inspections fit?
- What does the law require?
- What do the differences look like in practice?
- How should you act on the findings?
- Frequently Asked Questions
Imagine a manager opening a folder of completed risk assessments before a busy working day. Everything appears up to date. Then a walk through the workplace reveals a blocked pedestrian route and staff using equipment differently from the method described.
The assessments set out the controls, but are those controls working in practice?
Understanding the difference between a health and safety audit and a risk assessment helps you ask the right questions. A risk assessment identifies hazards and suitable precautions. An audit examines how effectively your management arrangements deliver them. Routine inspections check conditions and working practices on the day.
Together, these tools help you identify gaps and turn findings into practical action.
Health and safety audit vs risk assessment: what’s the difference?
Put simply, the difference between an audit and a risk assessment is focus. A risk assessment looks at particular work and the hazards it creates. An audit takes a wider view, checking whether your health and safety management arrangements actually put controls into practice across the organisation. They serve different purposes: a risk assessment identifies the controls needed for the work, while an audit checks how effectively your arrangements operate in practice.
What a risk assessment establishes
A hazard is anything that could cause harm, such as machinery, substances or manual handling. A workplace risk assessment identifies the hazards in an activity, considers who could be harmed and how, and determines suitable controls. The HSE overview of managing risks describes this as one part of controlling workplace risks, not the whole of it.
- Likelihood and severity: the assessor judges how likely harm is and how serious it could be.
- Existing precautions: what is already in place is recorded before deciding on further measures.
- Suitable evidence: observation, worker input and equipment information, matched to the work, according to HSE.
- A usable record: the activity, people exposed, controls, responsible people and target dates.
A numerical risk matrix can help you rank potential hazards, but HSE does not prescribe a universal scoring system. Choose a method your managers understand and apply consistently.
What a health and safety audit examines
A health and safety audit systematically compares your management arrangements and working practice with defined criteria, so that gaps and improvements become visible. Before it starts, agree its scope: which workplaces and activities it covers and where its limits lie.
Depending on that scope, an auditor may examine policies, responsibilities, risk assessments, training, supervision, maintenance, contractor arrangements, incident investigations and earlier actions. An audit can combine records, interviews and observation to test what really happens.
A useful report records its scope, evidence, findings, priorities and recommendations, with action owners, deadlines and follow-up. Because an audit samples evidence, a favourable report cannot show that every hazard was found.
The key differences side by side
The key differences come down to purpose and breadth. A risk assessment sets the precautions for particular work; an audit tests whether wider arrangements reliably deliver those precautions.
Who carries out the work also differs. According to HSE’s competent-person guidance, a knowledgeable owner, manager or employee can handle straightforward assessments, with specialist help for complex hazards. An internal reviewer or external auditor can conduct an audit, provided they are competent and objective enough to challenge arrangements.
| Aspect | Risk assessment | Health and safety audit |
| Purpose | Identify hazards and decide suitable controls | Check arrangements and practice against defined criteria |
| Scope | A particular activity, hazard or group of people | Policies, responsibilities, procedures, records and performance |
| Evidence examined | Observation, worker input, equipment information, incident records | Documents, interviews and observation of working practice |
| Outputs | Significant findings, controls, owners and target dates | Findings, priorities, recommendations, owners, deadlines and follow-up |
| Who carries it out | A competent owner, manager or employee; specialists for complex hazards | A competent internal reviewer or external auditor with sufficient objectivity |
| When useful | Before new work starts and when work or conditions change | When leaders need assurance that controls are applied consistently |
An audit can test whether assessments are suitable, current and implemented, but it cannot replace them. Equally, a completed assessment does not prove that your wider arrangements are effective. Written reports alone do not make work safe; controls do.
Where do workplace inspections fit?
Audits and inspections are often confused, yet they answer different questions. Alongside risk assessment, a routine inspection is the third tool in proactive risk management, catching problems before an accident rather than after one.
Inspections check conditions today
A safety inspection checks physical conditions, equipment and work practices at a particular moment. It might find an obstructed walkway or a missing machine guard that needs prompt correction. The inspection confirms a control is in place now; the assessment decides what controls are needed; the audit examines what keeps them effective. Repeated inspection findings give an audit useful evidence, and an audit may show where checks should be more frequent.
When to revisit an assessment
HSE risk assessment guidance says relevant risks should be assessed before a new activity starts. Changes to equipment, substances, processes, people or working conditions can then require you to review the affected assessment.
An accident, near miss, worker concern or sign that a control is failing may also challenge an assessment’s assumptions before its planned review date. Some assessments stay accurate for long periods while their controls need frequent inspection; changed work, by contrast, may need an update straight away.
When a wider audit helps
A wider audit is valuable when leaders need assurance that responsibilities, procedures and controls are applied consistently. It is especially useful after recurring failures, significant change or a series of incidents. Audit breadth and frequency can reflect your risks, changes and safety performance rather than a fixed interval.
What does the law require?
Health and safety law makes risk assessment a clear duty, while auditing sits largely within recommended practice. The detail depends on where you operate, because Great Britain and Northern Ireland have related but separate frameworks.
Duties in Great Britain
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer in Great Britain to make a suitable and sufficient assessment of risks to employees and others affected by their work.
Employers with five or more employees must record the significant findings. In Northern Ireland, HSENI guidance sets the same five-employee threshold for recording results.
Having fewer than five employees does not remove the duty to assess and control risks. Particular regulations may also add their own recording requirements.
The distinct Northern Ireland framework
Northern Ireland has its own Management of Health and Safety at Work Regulations (Northern Ireland) 2000. Employers there should check Northern Ireland legislation and HSENI guidance rather than assume the Great Britain rules apply unchanged.
Sector rules, contractual terms or certification schemes can add requirements beyond the general position, HSE’s management-system guidance notes. Check what applies to your own work.
Guidance rather than a universal audit rule
Great Britain employers must organise, control, monitor and review their preventive and protective measures, often through a safety management system. However, HSE’s management-system guidance confirms that a separately named, comprehensive audit by an external body is not a general statutory requirement for every employer.
The HSE guide Managing for health and safety (HSG65) presents Plan, Do, Check, Act, recommending periodic audits of arrangements and controls. No universal rule requires an annual external audit or rewriting every assessment every 12 months; health and safety compliance rests on reviews that respond to risks and change.
What do the differences look like in practice?
Two illustrative examples show how a workplace risk assessment and a health and safety audit approach the same setting from different angles. Neither describes a real client; both show how findings should lead to corrective actions.
Illustrative office example
For staff who use display screen equipment daily, for continuous periods of an hour or more, HSE guidance says the workstation assessment should examine equipment, furniture, working conditions, the job being done and individual needs.
Where someone works at both an office and a home workstation, the assessment should cover both.
A wider audit might check whether identified adjustments were made, whether staff can report discomfort, and whether new workstations or working patterns trigger review. A completed questionnaire does not show a reported problem was resolved; HSE says assessment software needs a trained assessor’s review and action.
Illustrative warehouse example
HSE workplace transport guidance directs the assessment to where forklifts and pedestrians could meet, including reversing, loading, visiting drivers and traffic changes through the day. The aim is suitable precautions for the people exposed, not an assumption that a route is safe because it looks separated during a quiet period.
A wider audit might observe movements and examine routes, barriers, operator competence, maintenance records, site rules, supervision and incident history. HSE warehousing guidance advises checking controls when patterns change, such as at shift changes. If deliveries obstruct a pedestrian route, clear it, fix why it recurs, then recheck during a comparable delivery period.
How should you act on the findings?
Findings only improve workplace safety when someone acts on them. Whether they come from an assessment, an inspection or an audit, the same disciplined follow-up applies.
Prioritise, assign and verify actions
Rank findings by the risk they present. Serious or immediate danger needs prompt control, which can mean stopping or restricting work until effective safeguards are in place.
An internal deadline never makes an uncontrolled hazard or an underlying legal breach acceptable while the action stays open. Record each finding in a format your managers will actually use, whether a simple tracker or an audit checklist.
- The problem and action: what is wrong and exactly what needs doing.
- An accountable owner: one named person, so safety responsibilities are clear.
- A realistic deadline: achievable dates that reflect the level of risk.
- Interim safeguards: temporary measures while a permanent fix is arranged.
Before closing an action, check evidence suited to the issue: a site check, repair record, worker briefing or monitoring result. Confirm the control works in practice, not just that the task was done. Escalate repeated findings or overdue high-risk actions.
Choose an assessment, review or both
If the immediate question is whether a particular area or practice is safe today, start with a targeted inspection. For wider questions, this checklist helps.
- Update the risk assessment when a task or hazard changes, someone exposed was overlooked, an incident challenges its assumptions or controls may be inadequate.
- Review wider arrangements when controls are applied inconsistently, actions stay open, inspection findings recur or ownership and supervision are unclear.
- Do both when new hazards need fresh controls and recurring failures point to weaknesses in how controls are implemented and checked.
One warning sign is a health and safety policy that no longer matches day-to-day practice, which can call for a wider review.
Practical support from Salusphere Global
We help UK employers review their arrangements, develop or update assessments that reflect real work, and prioritise proportionate action. Our practical health and safety support examines responsibilities, documentation, risks and priorities, with deeper assessment, action planning and follow-up alongside your leadership, HR and operational teams. Working with a safety consultant never transfers your own responsibilities.
If you would like a starting point, Salusphere Global offers a free Health & Safety Audit to help identify gaps in your current arrangements and recommend practical next steps. There is no obligation to use our services afterwards. The audit’s scope is agreed with you; it is not a certification or a guarantee that every hazard or legal requirement has been addressed.
Frequently Asked Questions
Does a small, lower-risk business need a lengthy risk assessment?
No. According to HSE, a small or lower-risk workplace still needs to assess its applicable risks, but the assessment can be proportionate rather than lengthy. In Great Britain, having fewer than five employees removes the duty to record findings, not the duty to assess and control risks, and particular regulations may add recording requirements.
Should a risk assessment cover non-routine work as well as normal operations?
Yes. HSE guidance says hazard identification covers normal and non-routine work, such as cleaning, maintenance or clearing a machine blockage. Consider everyone who could be harmed, including contractors, visitors and the public, and individual circumstances such as pregnancy, disability or inexperience.
How should a health and safety audit classify its findings?
Findings should separate an identified legal breach from a management weakness or an optional improvement, based on the stated criteria and supporting evidence. Setting the scope, questions, criteria and limits before the audit starts makes this classification clear and defensible.
