Risk assessments for hospitality: the document the HSE looks at first

A customer slipped on the front step at Welsh Back one wet October morning. Nothing dramatic, she caught herself on the railing, was fine, walked off with a flat white on the house. Three weeks later our insurer wrote asking for our risk assessments. I went to the folder above the prep bench. The slips and trips assessment in there had been downloaded from a free template site in 2016. It still had "Insert company name here" in two of the fields. The signature at the bottom was from a manager who had left eighteen months earlier.

The insurer didn't refuse the claim, but the letter they sent made it very clear that next time they might. And if it had been the HSE instead of the insurer, the conversation would have been a lot less polite.

Risk assessments are the document the HSE looks at first when they walk in. Not your training records, not your cleaning schedule. The risk assessment. Because everything else flows from it. Here is what one actually needs to contain, which ones you need for a café or restaurant, and how to keep them alive instead of dead paper in a folder nobody opens.

Why this matters

The Management of Health and Safety at Work Regulations 1999 require every employer in the UK to assess the risks to employees and anyone else affected by the business. That is not guidance, it is law. If you have five or more employees, regulation 3 says the significant findings must be recorded in writing. Most cafés and restaurants tip over that threshold the moment they have a couple of full-timers and a few part-time weekend staff.

The bit operators miss is what happens when something goes wrong. After an accident, the HSE and your insurer both want to see the same thing: did you identify the hazard before it bit someone, and did you do something sensible about it. A current, specific, signed risk assessment is the difference between "lessons learned" and a Section 33 prosecution under the Health and Safety at Work Act 1974. Fines for serious breaches start in the tens of thousands and go up quickly.

The other thing worth saying out loud: risk assessments are also how you protect your team. Burns, slips, bad backs from carrying crates up cellar steps, these are the injuries that actually happen in cafés. Writing them down forces you to look at them properly.

What a risk assessment actually is

The HSE's definition is simpler than people make it. A risk assessment is a careful look at what could cause harm in your workplace, so you can decide whether you have done enough to prevent it or whether you need to do more. That is the whole job.

There are five steps, straight from the HSE's INDG163 guidance:

• Identify the hazards. Walk the building. What could realistically hurt someone? Wet floors, hot oil, the steam wand, the cellar trapdoor, the chemical store under the sink.
• Decide who might be harmed and how. Staff, customers, contractors, delivery drivers, the window cleaner. Be specific. "Kitchen staff could suffer burns from contact with the oven door" is useful. "People might get hurt" is not.
• Evaluate the risk and decide on precautions. What are you already doing? Is it enough? What else is reasonably practicable?
• Record your findings and implement them. Write it down. Sign it. Date it. Tell your team.
• Review and update. When work changes, when staff change, after an incident, and annually as a sanity check.

That is the whole framework. Every assessment you ever do, whether it is for a deep fat fryer or a pop-up event, follows the same five steps.

The assessments most hospitality operators actually need

You do not need one giant document, you need a small stack of focused ones. Each covers a specific type of risk. For a typical café or small restaurant, the working set looks like this:

• Slips, trips and falls. Front of house floors, the bit behind the bar where the ice machine drips, the back steps to the bins. Where do people actually slip? At Harbourside it was always the same patch by the dishwasher.
• Fire. Required separately under the Regulatory Reform (Fire Safety) Order 2005. More on this below.
• Manual handling. Crates of milk up from the cellar, kegs, sacks of flour, dishwasher racks. Manual handling risk assessment hospitality work is mostly about the cellar stairs and the delivery in.
• Hot surfaces and burns. Coffee machines, ovens, fryers, hot water taps, steam wands, anything coming out of a salamander. Plus the boiler room if you have one.
• Chemicals (COSHH). Sanitiser, oven cleaner, descaler, dishwasher rinse aid. You need the safety data sheets and an assessment for each substance.
• Working at height. Changing bulbs, getting boxes off the top shelf of dry storage, cleaning the canopy. Even a kick stool counts.
• Lone working. Anyone opening up, closing down, or doing a cash drop on their own.

There are others depending on your set-up. Display screen equipment if you have office-based staff. Young workers if you have anyone under 18. Pregnant workers when relevant. New and expectant mothers gets its own legal trigger under regulation 16.

The one operators most often miss is lone working. A barista doing a 5am open on their own, no other staff in the building, dealing with deliveries in a dark service yard. That is a specific hazard pattern and it deserves its own document.

Fire risk assessment is its own thing

A restaurant fire risk assessment is not a section of your general risk assessment, it is a separate legal duty. The Regulatory Reform (Fire Safety) Order 2005 makes the "responsible person" (usually the owner or operator) carry out and maintain a fire risk assessment for the premises. If you have five or more employees, it must be written.

It covers things your general assessment does not: means of escape, fire detection and warning, emergency lighting, signage, the spread of fire and smoke, what staff do if the alarm goes off at 2pm with a full dining room. After the changes brought in by the Fire Safety (England) Regulations 2022 and the Building Safety Act, expectations have tightened, particularly around documenting the assessment properly and reviewing it.

For most independent cafés and restaurants you can do this yourself if your premises are simple. If you are in a listed building, a basement, a multi-occupancy unit, or you have sleeping accommodation above, get a competent fire risk assessor in. It costs a few hundred pounds and it is money very well spent.

The five-or-more rule, and what "writing it down" actually means

If you employ fewer than five people you still have to do risk assessments, you just do not legally have to write them down. In practice, write them down anyway. Memory is not a defence, and the second anything goes wrong you will wish you had paper.

"Writing it down" does not mean a forty-page document. The HSE explicitly says risk assessments should be proportionate. For a small café, each assessment can be a single page covering: the hazard, who could be harmed, existing controls, additional controls needed, who is responsible, by when, and the review date. That is it. Signed by whoever did the assessment, with the date.

The trap people fall into is treating it as a one-off form-filling exercise. Risk assessments are working documents. They should look slightly tatty. They should have notes in the margin. If yours is pristine and laminated, nobody is using it.

When to review them

The HSE is clear on the triggers for review. You do not just dust them off once a year and call it done. Review when:

• The work changes. New equipment, new menu items that need different prep, a new layout, a refit.
• Staff change significantly. New manager, high turnover, a lot of new starters who have not been through your induction.
• After an incident or near miss. Even if nobody was hurt. A near miss is a free lesson.
• After any enforcement action or insurer query.
• Annually as a sanity check, even if nothing has changed. Because something has changed, you just have not noticed.

At Welsh Back we had a habit of reviewing the slips and trips assessment every September, because that was when the weather turned and the front step became a problem again. Linking the review to a real trigger in your year (seasonality, lease renewal, insurance renewal) makes it more likely to actually happen.

Common mistakes

• Downloading a generic template and changing the company name. A template is a starting point. If your assessment does not mention the actual hazards in your actual building, it is not a risk assessment, it is a piece of paper.
• Letting the signatures go stale. An assessment signed by a manager who left two years ago tells the HSE you stopped paying attention. Re-sign when ownership of the document changes.
• Treating fire as a sub-section. Fire risk assessment is a separate legal duty under different legislation. It needs its own document.
• Skipping near misses. If someone almost slipped, that is a review trigger. Waiting until someone actually falls is how you end up with a claim and a stale assessment in the same week.
• Writing controls you do not actually do. "Floor mopped every hour during service" only helps you if the floor is actually mopped every hour during service. The HSE will ask your staff what happens, not just read the document.
• Hiding the assessments in a folder nobody opens. The team needs to know what is in them. That is the whole point of identifying who could be harmed and how.