OSH risk assessment in a company: procedure and updates

In most small businesses, the risk assessment takes the form of a table created just once — most often by downloading a generic register, filling in a header with the company name, and filing it away in a binder. The paperwork exists, the obligation is ticked off. The problem arises the moment someone opens the document and compares it with what actually goes on in the company.

During an audit, an inspector may compare the document against the actual operation. It’s not only about whether it exists, but also whether it matches the workplace, connects to training, assigned PPE, and work procedures, and whether the company can document the measures taken. We’ll walk through what the assessment should cover, how to prepare it step by step, when to update it, and what to back it up with during an audit.

What a risk assessment is and why a generic template isn’t enough

A risk assessment is the process by which a company identifies what may endanger employees during work, evaluates the severity of individual risks, and sets specific measures. The result shouldn’t be just a table. The measures feed into work procedures, training, inspections, equipment maintenance, and the selection of personal protective equipment — otherwise it remains merely text that protects no one.

The obligation to identify risks, evaluate them, adopt measures to eliminate them, and keep documentation on this stems from Section 102 of the Labor Code (Act No. 262/2006 Coll.). There, the law speaks of continuous identification, not a one-off action — and it doesn’t prescribe a form or a uniform structure. This is both a freedom and a trap: an empty space is easily filled with another company’s downloaded register.

Such a document is then hard to defend. When an office-based company assesses the risk of working with a welding machine but has no entry for a fall on the stairs, storing boxes in a passageway, or handling heavy shipments, it’s obvious at first glance that the assessment didn’t come from a walk-through of its own operation. The presence of activities the company has never performed may, during an audit, cast doubt on the accuracy of the document’s other parts too.

What a small business should actually assess

Start with what people actually do, not a list of positions from the organizational chart. One position usually involves several different activities with completely different risks. A warehouse worker receives goods, operates a pallet truck, stocks racking, deals with electrolyte and the possible formation of an explosive hydrogen mixture when charging a lead-acid traction battery, and occasionally steps into an aisle where a forklift operates. Five activities, five different sources of hazard, one box labeled “warehouse worker”.

The assessment should cover in particular:

• routine and occasional work activities — including those done once every six months,
• individual workplaces and movement between them — staircases, corridors, and loading ramps are places where injuries occur,
• the machines, tools, chemical substances, and vehicles in use,
• maintenance, cleaning, fault clearing, and other non-standard work — this is precisely where routine procedures get bypassed,
• new, young, pregnant, or health-restricted employees,
• employees working alone or away from the employer’s workplace,
• the movement of contractors, visitors, and employees of other companies,
• foreseeable failures, accidents, and emergency situations.

In an office, the significant risks tend to be falls on stairs, overloading extension cords and multi-socket adapters, load handling, screen work, or business trips by car. In a warehouse, the traffic of handling equipment, material falling from racking, and a pedestrian colliding with a truck are added. In a workshop, there are additionally moving machine parts, noise, dust, flying particles, and safely shutting down equipment before maintenance. The same table for all three operations therefore cannot make sense.

How to prepare the assessment step by step

A workable procedure has seven connected parts.

1. Define the workplaces and activities. Write down where work takes place and what tasks employees actually perform. You’ll get the basis from a walk-through of the operation and conversations with people — you won’t glean it from employment contracts.

2. Identify the sources of hazard. An unguarded moving machine part, a slippery floor, manual load handling, electrical equipment, a chemical substance, a vehicle moving among pedestrians.

3. Determine who may be endangered. Not just the machine operator, but also the maintenance worker, the cleaner, the supplier’s driver, or an employee passing by.

4. Describe the possible consequence. “Mechanical risk” says nothing. Write down clothing being caught by a rotating machine part, a load falling from racking onto a person in the aisle, chemical burns while diluting a concentrated cleaning agent.

5. Assess the level of risk. The method should account for the probability and severity of the consequence. Both a verbal scale and a scoring matrix can work — but no universal table on its own guarantees a correct result.

6. Set the measure, responsibility, and deadline. “Exercise increased caution” is not a measure. Separating the pedestrian route from truck traffic, adding a missing guard, setting a procedure for safely shutting down a machine before maintenance — those are.

7. Verify implementation. For each measure, record who carried it out, when, and by what document it can be proven.

It’s precisely steps 6 and 7 that decide whether the assessment doesn’t remain just a formal list. Among the recurring shortcomings, the State Labor Inspection Office (SÚIP) summary report for 2023 describes generic, outdated assessments with no link to the actual operation, as well as missing or outdated PPE lists. That’s why it’s important to document not only the identified hazard, but also the implementation of the measure.

What specific measures should look like

Priority goes to measures that eliminate or reduce the hazard directly at the source. Personal protective equipment comes into play where the risk cannot be sufficiently addressed technically or through work organization — its assignment is governed by Government Regulation No. 390/2021 Coll. and stems precisely from the assessed risks.

A measure must match the specific conditions, otherwise it only looks good on paper. Gloves are not a universal answer: with chemicals, the material and breakthrough time according to the safety data sheet are decisive — nitrile, latex, and PVC hold up for different lengths of time against different substances — and around rotating machines, gloves may instead increase the risk, because they get caught more easily than a bare hand.

What the resulting document should contain

There is no uniform statutory form for a risk assessment. The document should, however, make it possible to trace how the company arrived at the result and what it did based on it.

A workable assessment contains at least:

• identification of the company, the workplace, and the activity being assessed,
• the date of preparation and the names of the people involved,
• the source of hazard and the possible consequence,
• the groups of people at risk,
• the protective measures already in place,
• the resulting level of risk according to the described method,
• further required measures,
• the responsible person and the deadline,
• a record of completion and the follow-up check,
• the date of the document’s review and a description of the changes.

Attachments tend to be photographs of defects, the local operational safety regulation, manufacturers’ instructions, safety data sheets, records of inspections and revisions, or a workplace plan with marked routes. There’s no need to copy their content into a single table — but it must be clear how the documents relate to one another. We describe a similar logic of interconnection in OSH documentation for a company: the individual papers should make sense together, not each on its own.

Which assessment method to choose

For a small business, a simple and consistently applied method is better than a complex calculation that no one in the operation understands.

It’s enough to distinguish low, medium, and high risk according to the probability and severity of the consequence. But the company must describe what the individual levels mean and how it responds to them: a high risk may require stopping the activity until a measure is adopted, a medium risk a measure with a set deadline, a low risk ongoing monitoring. Without this part, the scores are mere decoration.

A common mistake is lowering the score without any real change in the operation. If the document claims that the risk of falling material was resolved by “instructing employees”, but the racking remains damaged and unchecked, the number in the table says nothing. A reduced risk must have a corresponding cause in the operation — a new guard, a different route, a different product.

When to update the assessment

There is no universal deadline of the “once a year” type for all companies. The assessment should match current conditions, and under Section 102 of the Labor Code the employer should identify risks continuously and adopt measures to reduce them.

Carry out a review in particular upon:

• the introduction of a new machine, technology, or chemical product,
• a change in the workplace layout or traffic organization,
• the emergence of a new work activity,
• a change in the work procedure, shift pattern, or number of workers,
• a workplace accident, near-miss, or recurring dangerous situation,
• the discovery of a defect during an inspection, a revision, or an audit,
• a change in regulations or the manufacturer’s instructions,
• the arrival of a worker with special needs,
• the start of joint work by several employers at one workplace.

Near-misses are a valuable and often overlooked source of information — a fallen pallet with no one injured points to the same hazard as a fallen pallet with an injury, just this time without the consequence. Similarly, after a workplace accident the assessment isn’t finished with the thought “it happened for the first time”: the first steps after an accident and the entry in the accident log should have their continuation precisely in a review of the risk assessment.

Alongside this, a company may set a regular internal check. Its frequency should stem from the level of risk and the speed of changes in the operation, not from a date picked on the calendar.

How to involve employees so the document matches the operation

Neither a manager nor an external expert has a chance of knowing all the improvised procedures. The machine operator usually knows which guard gets in the way, where the material jams, and why the set procedure gets bypassed when in a hurry. This information makes it into the document only if someone asks about it.

During the walk-through, ask:

• Which activity is the most physically demanding?
• Where has an injury or equipment damage almost happened?
• What is done differently during a breakdown or under time pressure?
• Which protective equipment do people not use, and why?
• When is it necessary to enter the machine’s space?
• What has changed since the last assessment?

The answer to the fourth question tends to be the most useful. “They don’t wear the goggles because they fog up” isn’t laziness, but technical information that the assigned equipment is unsuitable for the given work.

Then familiarize employees with the risks and measures that concern their work. A signature under a generic table doesn’t in itself prove that a person received comprehensible instructions for their specific activity — which is why the risk assessment should connect directly to the content of OSH training for employees.

How to defend the assessment during an audit or after an accident

An inspector need not be satisfied with the existence of the document. They may compare its content with the actual workplace, with training, with assigned PPE, with equipment instructions, and with established work procedures. A discrepancy between the table and reality is then traceable during a single walk-through.

A defensible chain looks like this:

Hazard → risk assessment → specific measure → responsible person → implementation → effectiveness check.

So prepare not only the risk table but, above all, evidence of implementation: an order for the guard repair, a record of the racking inspection, an attendance sheet with the specific training content, a photograph of the adjusted pedestrian route, a record of handing over suitable PPE. It’s precisely the missing link between the assessment, the measure, and the document of implementation that an audit may focus on. We summarize what else an audit examines in the article on a labor inspectorate audit.

After an accident, it’s too late to finish off a document that’s meant to appear older than it is. It’s more meaningful to document what assessment and measures existed before the event, what failed, and how the company prevented a recurrence.

How much the preparation costs and what should be in the quote

The price can’t honestly be determined just by the number of employees. An office with twenty people may be simpler than a workshop with three workers, several machines, chemical substances, and occasional work at height.

The quote is influenced above all by:

• the number and diversity of workplaces,
• the number of work activities and technologies,
• the level of risk in the operation,
• the state of the existing documentation,
• the need for an on-site walk-through,
• the number of related regulations and work procedures,
• the extent of help with clearing defects,
• the ongoing management required.

Ask whether the price includes a walk-through of the operation, consultation with managers and employees, an action list of defects, an update to training, and a follow-up check. A table on its own, without knowledge of the workplace, easily ends up as a generic register that doesn’t match the company’s actual activities and risks.

How to recognize a quality provider

A quality provider first asks about activities, machines, changes, and problem spots. They don’t start by offering a number of pages of documentation.

Warning signs:

• a finished assessment without a walk-through of the workplace,
• activities and equipment you don’t have in the company,
• the same risk and the same measures for all professions,
• measures formulated as “exercise caution”,
• missing responsibilities and deadlines,
• a scoring assessment without an explained method,
• no link to training, PPE, and work procedures,
• a contract without a clear scope of updates and deliverables.

An external OSH professional (OZO) in risk prevention may prepare the documentation and help with its management, but they need the company’s cooperation to do so. Without knowledge of the actual procedures, only a better-formatted template comes into being. We discuss how the scope and price of external cooperation differ in OSH outsourcing.

When an audit and ongoing management make sense

A one-off audit fits situations where the operation is fundamentally changing: relocation, taking over premises, introducing a new technology, rapid company growth, or preparing for an expected audit. The output shouldn’t be just a list of shortcomings, but also their priority, responsibility, and a deadline for remediation.

Ongoing management makes sense where machines, procedures, employees, or suppliers change regularly. The provider then keeps watch over the interconnection between the risk assessment, training, workplace inspections, and the rest of the OSH documentation — precisely what falls apart first in a small business.

But first, have the actual scope determined. A small, stable office usually doesn’t need the same regime as a warehouse, a service operation, or a manufacturing workshop.

What the article is based on

• SOHE services – an overview of services in OSH, fire protection, and inspections that the risk assessment connects to.
• OSH documentation for a company – everything a company should have and how the individual documents relate to one another.
• OSH training for employees – when to train, what the training should include, and how to document it.
• A labor inspectorate audit – what an inspector examines and what documents to prepare.
• A workplace accident in a company: what to do right away – the first steps, the accident log, and the connection to a review of risks.
• OSH outsourcing: the cost of an external OSH professional (OZO) – the scope and price of external cooperation in risk prevention.
• Act No. 262/2006 Coll. – the Labor Code; Section 102 governs risk prevention and the identification, evaluation, and documentation of risks.
• Act No. 309/2006 Coll. – further requirements for occupational safety and health and professional competence in risk prevention.
• Government Regulation No. 390/2021 Coll. – on closer conditions for providing personal protective equipment and washing, cleaning, and disinfecting agents.
• The State Labor Inspection Office (SÚIP) summary report on the results of inspection actions for 2023 – findings on formal and outdated risk assessments and the connection to PPE.

The legal and methodological sources were verified as of July 21, 2026.

This text is for informational purposes and does not substitute for a legal opinion. The specific regime of the risk assessment, its scope, and the frequency of its reviews must be set according to the actual operation, the manufacturer’s documentation, the usage environment, and the risk assessment.

Need a risk assessment that matches your operation and can be documented during an audit or after an accident — built on a walk-through of the workplace, not on a downloaded template? We’ll look at your activities, workplaces, and existing documentation and propose a scope that matches the actual level of risk. Get in touch with us at info@sohe.cz; we’ll also connect the risk assessment with other SOHE services so the documentation ties together.