When to Review Risk Assessments at Your Site

Know when to review risk assessments, what changes trigger action and how to keep defensible evidence across every site, team and asset with records.

A risk assessment is only useful while it reflects the work people actually do, the building they work in and the controls available to them. Knowing when to review risk assessments is therefore not an administrative exercise. It is how a facilities or compliance team spots that yesterday’s controls may no longer protect today’s people.

The practical test is simple: if something has changed, failed, or revealed a gap, review the assessment. If nothing obvious has changed, review it on a planned cycle anyway. The aim is not to recreate documents for the sake of it. It is to keep controls current, understood and evidenced.

When to Review Risk Assessments: The Core Triggers

A review is required whenever the original assessment may no longer be valid. For most organisations, this is driven by operational events rather than a single universal timescale.

After an accident, incident or near miss

An injury, property damage event or near miss is evidence that a hazard may have been underestimated or a control has not worked as intended. Review the relevant assessment as part of the investigation, not after it has been closed.

Look beyond the immediate cause. Was the task being done differently? Was equipment unavailable, poorly maintained or used by someone without sufficient instruction? Had supervisors changed, or was the area under pressure because of staffing levels, delivery activity or competing work? The assessment should record what has been learned and who owns each corrective action.

A near miss deserves the same discipline. It is a lower-cost warning that can prevent a more serious event later.

When work, people or equipment changes

Risk assessments are tied to real conditions. A change in any of the following can make an existing assessment outdated:

• a new process, material, machine, tool or substance is introduced
• a task changes in frequency, location, duration or method
• contractors begin work on site or their scope changes
• new starters, young workers, agency workers or people with additional needs are involved
• a building is altered, refurbished, repurposed or partially closed
• maintenance activity, access arrangements or emergency routes change

The key point is proportionality. Replacing a like-for-like hand tool may need only a recorded check. Installing new plant, changing chemicals, moving a team into a different area or introducing lone working demands a more considered review before work starts.

When inspections, audits or monitoring expose a weakness

Routine checks often show that a written control exists but is not operating in practice. A blocked fire exit, repeated failed equipment check, overdue statutory inspection or missing training record should prompt a review of the related assessment.

Do not treat the inspection finding as a separate issue that ends once it is marked complete. Ask whether the control was realistic, clearly assigned and adequately monitored. If several sites report the same failure, the risk may sit in the standard, process or resourcing model rather than at one location.

Learn MoreIssue Reporting & RequestsHow a failed check stays an owned action, so the related assessment is reviewed rather than the finding just being closed.

When legislation, guidance or standards change

Changes to legal duties, approved guidance, industry standards, insurer requirements or client rules can alter what good control looks like. The assessment may still identify the right hazard, but its controls, competence requirements or inspection intervals may need updating.

For multi-site organisations, this is where a controlled central standard matters. Local teams need to know which assessments are affected, what has changed and when the revised controls take effect. A document held in one person’s shared drive cannot provide that assurance.

When the review date arrives

Every assessment should have a planned review date, even where no event has forced an earlier reassessment. There is no single interval that suits every risk. Higher-risk activities, rapidly changing workplaces and complex contractor environments usually need more frequent review than stable, low-risk office tasks.

Set dates according to the level of risk, the likelihood of operational change and the reliability of your existing controls. Then make the date visible, assign an owner and escalate overdue reviews. An annual date can be a sensible baseline for many assessments, but it must not become a reason to wait when a trigger occurs in month two.

Learn MoreDistribution & ReviewsHow assessments come back round on a review schedule, without waiting for someone to notice that the current version has gone stale.

What a Useful Review Looks Like

A review should test the assessment against the site, not merely change the revision number. Start by confirming the task, area, people at risk and equipment or substances involved. Walk the activity where possible and speak to the people carrying it out. They will often identify workarounds and practical constraints that the original author could not see.

Learn MoreRisk Assessments & HazardsHow hazards, scores and controls sit on one assessment so a review updates the live record, not only the revision date.

Next, test each control. Is it present? Is it maintained? Is it understood? Can the organisation prove it? For example, a control requiring trained operators is only dependable if the training matrix shows the right people are in date. A control requiring extraction ventilation depends on inspection and maintenance evidence. A control requiring weekly checks depends on completed, reviewed records - not an unchecked template.

Update the residual risk only after assessing whether the controls are actually effective. Avoid lowering a rating because the assessment has been reviewed. The rating should reflect the work as it is now, including any temporary conditions, open actions or limitations.

Where actions are needed, make them operational. Assign an accountable person, a due date and a clear outcome. “Improve housekeeping” is not a defensible action. “Site manager to install marked storage bays and verify clear access routes during weekly inspection by 14 May” is measurable and can be checked.

Keep the Evidence Connected

The review itself is only part of the record. During an audit, following an incident or when answering a regulator’s question, teams need to show the full chain: what risk was identified, what changed, who approved the revision, how people were informed and whether the controls were completed.

That chain is often broken when assessments live in spreadsheets, training sits in a separate system and inspection records are stored in email or paper folders. The work may have been done, but proving it takes time and introduces doubt.

A connected compliance workflow brings the assessment together with site inspections, planned maintenance, incidents, actions, policies and competency records. In CalmCompliance, a team can manage the review against the relevant site or asset, assign actions to the right owner and retain the audit trail as activity happens. The evidence assembles itself through normal operations rather than a last-minute search for files.

This also improves oversight. A compliance manager can see which assessments are approaching review, which locations have unresolved actions and whether a recurring issue is appearing across the estate. Site managers receive a clearer task, while senior leaders receive a view of control effectiveness rather than a list of document dates.

Avoid the Two Common Failures

The first failure is reviewing too late. Teams wait for the annual review date despite a process change, near miss or failed inspection. That leaves a gap between how work is managed and what the risk assessment says.

The second is reviewing without changing anything meaningful. An assessment is copied forward, given a new date and filed away, while controls remain vague or incomplete. This can create a false sense of assurance and makes scrutiny harder to defend.

A better approach is to build review triggers into everyday workflows. Link incidents to relevant assessments. Make planned maintenance failures visible to the control owner. Use contractor onboarding and change requests to prompt reassessment before activity starts. Set reminders for periodic review, but allow operational events to move the date forward.

A Practical Review Rhythm for Multi-Site Teams

For a portfolio of sites, consistency matters as much as frequency. Establish a central framework that defines who can create, approve and review assessments, how often standard risk types are reviewed, and what events trigger immediate reassessment. Local managers should be able to record site-specific conditions without creating uncontrolled versions of the same document.

Keep a register showing the assessment owner, location, activity, current version, next review date and open actions. Review this at a regular compliance meeting alongside incidents, inspection performance, overdue maintenance and training expiry. These areas affect one another. A missed service can weaken a control. A change in staffing can alter competence. A pattern of inspection failures can reveal that a control is not practical.

The right question is not, “Have we reviewed the document?” It is, “Can we show that the controls still match the work, and that they are working?” If your team can answer that quickly for every site, risk assessment reviews become a source of control rather than another compliance burden.