Many small businesses know they need to manage health and safety risks.

But the word risk assessment can feel heavy.

It can sound like a big formal document.
It can sound like legal language.
It can feel like something only large companies do.

But a risk assessment does not need to be complicated.

At its core, a risk assessment is simply this:

Look at what could hurt people, decide how serious it is, and put controls in place before something goes wrong.

Under the Health and Safety at Work Act 2015 (HSWA) in New Zealand, businesses must manage work health and safety risks. WorkSafe explains that different businesses have different risks, and the risks you need to identify, assess, and manage depend on the type of work you do.

So let’s break this down in plain English.

What Is a Risk Assessment?

A risk assessment is a simple way to ask:

• What could go wrong?
• Who could be harmed?
• How bad could it be?
• How likely is it?
• What can we do to control it?
• Is the control actually working?

That’s it.

It is not about creating paperwork for the sake of it.

It is about making better decisions before work starts.

For small businesses, rural contractors, orchard operators, and trades, this can be one of the most useful health and safety tools you have.

Step 1: Identify the Hazard

A hazard is anything that could cause harm.

Examples include:

• Moving vehicles
• Machinery
• Chemicals
• Working at height
• Uneven ground
• Manual handling
• Fatigue
• Public access
• Weather conditions

Start by looking at the actual work.

Do not sit in an office and guess.

Walk the site.
Talk to workers.
Look at what really happens.

WorkSafe says businesses should focus on critical risks first before managing less serious risks, and should review work activities on an ongoing basis to identify new risks.

That means you do not need to list every tiny thing first.

Start with what could seriously hurt someone.

Step 2: Decide Who Could Be Harmed

Once you know the hazard, ask who could be affected.

It may be:

• Workers
• Contractors
• Subcontractors
• Visitors
• Clients
• Members of the public
• Delivery drivers
• Seasonal staff

This matters because health and safety duties are not only about your direct workers.

If your work could affect others, that risk needs to be managed too.

For example, if a contractor is operating machinery near a public entrance, the public are part of the risk picture.

If a spray contractor is working near another crew, that other crew may also be exposed.

Step 3: Rate the Risk Simply

You do not need a complicated scoring system.

Ask two basic questions:

How likely is it to happen?
How serious could the harm be?

For example:

A paper cut may be likely, but not serious.

A vehicle strike may be less common, but the harm could be fatal.

That second risk needs more attention.

WorkSafe explains that risk has two parts: the likelihood it will happen and the consequence, or degree of harm, if it does.

This is why not all risks are equal.

A good risk assessment helps you focus on the risks that matter most.

Step 4: Choose the Right Controls

A control is what you put in place to reduce the risk.

For example:

• Barriers
• Guarding
• Traffic management
• Training
• Exclusion zones
• Safe work procedures
• Maintenance
• Supervision
• PPE

The key is to choose controls that match the level of risk.

WorkSafe guidance says PCBUs must minimise risks using control measures described in the hierarchy of controls, and that the most effective control measures should be used first so far as is reasonably practicable.

In plain English:

Do not jump straight to PPE if a stronger control is available.

Try to:

1. Remove the hazard if you can.
2. Replace it with something safer if possible.
3. Isolate people from the hazard.
4. Use engineering controls.
5. Use admin controls like procedures and training.
6. Use PPE as a final layer.

PPE matters.

But it should not be your only control for serious risks.

Step 5: Check If the Control Works

This is where many small businesses fall down.

They identify the risk.
They choose a control.
Then they never check it again.

But work changes.

Weather changes.
Workers change.
Equipment wears out.
Contractors come and go.
New hazards appear.

A risk assessment should not sit in a folder forever.

Ask:

• Is the control being used?
• Do workers understand it?
• Is it practical?
• Has anything changed?
• Has there been a near miss?

If the control is not working, change it.

A simple review can prevent a serious incident.

Step 6: Write It Down

You do not need a novel.

But you do need useful records.

A simple risk assessment should show:

• The task or activity
• The hazard
• Who could be harmed
• The risk level
• The controls chosen
• Who is responsible
• When it was reviewed

Good records help prove that risks were considered and managed.

They also help workers understand what is expected.

What Businesses Get Wrong Most

Here are the common mistakes:

1. Listing hazards but not controlling them

A hazard register is not enough.

If the risk is listed but no one acts on it, the system is weak.

2. Treating all risks the same

Focus on serious risks first.

Do not spend all your energy on low-risk issues while major risks sit unmanaged.

3. Not involving workers

Workers often know where the real risk is.

WorkSafe says businesses must engage with workers and enable them to participate in improving health and safety.

Ask workers what is actually happening.

4. Using PPE as the first answer

PPE is useful, but it is usually the last line of defence.

For serious risks, look for stronger controls first.

5. Not reviewing the assessment

A risk assessment is only useful if it stays current.

Review it when work changes, after incidents, or when workers raise concerns.

A Simple Risk Assessment Checklist

Before work starts, ask:

• What task are we doing?
• What could hurt someone?
• Who could be harmed?
• How serious could it be?
• How likely is it?
• What control will reduce the risk?
• Is there a stronger control available?
• Who will check it?
• When will we review it?

If you can answer these clearly, you are already building a stronger system.

A Note for Businesses Outside New Zealand

This article refers to HSWA and WorkSafe New Zealand, but the same core risk assessment method applies in many countries.

Australia, the UK, Canada, and other regions also use risk-based health and safety systems.

The law names may change.
The regulator may change.
The forms may look different.

But the core idea remains the same:

Identify the hazard.
Assess the risk.
Choose proportionate controls.
Involve workers.
Review what is working.

If you operate outside New Zealand, use this structure and align it with your local legislation.

Final Thought

Risk assessment does not need to be scary.

It does not need to be long.

It just needs to be useful.

The goal is simple:

Know the risk.
Control the risk.
Check the control.
Keep improving.

If you would like editable templates to help with risk assessments, contractor coordination, incident follow-up, and health and safety records, our Way Safe Biz DIY Compliance Bundle is currently being developed.

You can register your expression of interest below.

Clear risks.
Clear controls.
Safer businesses.

– Esther, Way Safe Biz