Risk Assessment Builder

What this tool does

CM8-36 turns a risk assessment into something you can actually score, sort and act on. You record each hazard, who it can harm, what you already do about it, and how bad it could be. The tool scores the risk before and after controls, bands it, ranks what still needs attention, and prints a document you can put in front of an auditor, an inspector, a client or an insurer.

Everything runs inside this single file. There is no account, no upload and no network request of any kind, so your hazards, your incidents and your site names never leave the computer you are using.

It is deliberately country-neutral. The 5×5 matrix and the 4 / 9 / 15 band split are the most widely used convention, but every threshold is a setting you can change to match your own scheme.

The five steps

Almost every national guide describes the same sequence, and this tool is laid out to follow it:

1. Identify the hazards. Walk the area. Ask the people who do the work. Read your accident and near-miss records — they tell you what actually goes wrong here, not what should.
2. Decide who might be harmed and how. Not just employees: contractors, visitors, cleaners, delivery drivers, members of the public, and anyone whose situation changes the risk — new and expectant mothers, young workers, lone workers, people with a disability.
3. Evaluate the risk and decide on controls. Score what you have now, then decide what more is reasonable. Record both.
4. Record your findings and act on them. The action plan is the part that changes anything. An assessment with no owner and no date is a filing exercise.
5. Review. See when to review.

Scoring: likelihood × severity

Likelihood is how probable harm is, given the way the work is actually done and the controls actually in place — not the way the procedure says it is done.

Severity is the realistic worst outcome, not the worst imaginable one and not the average one. If a fall from that platform would realistically kill someone, severity is 5 even if it has never happened.

Scoring is a judgement, and two competent people will sometimes differ by a point. That is acceptable. What matters is that you are consistent across your own assessments, because the ranking is what drives where you spend money and attention.

Bands and thresholds

Scores are banded so that a register of eighty hazards can be read at a glance. The defaults follow the common 5×5 convention:

• Band — Default score — What it normally means
• Low — 1–4 — Controls are adequate. Monitor, but no further action needed.
• Medium — 5–9 — Reduce further where reasonably practicable, with a timescale.
• High — 10–15 — Act promptly. Consider restricting the work until controls are in place.
• Very high — 16–25 — Stop. Do not start or continue until the risk is reduced.

All three cut-offs are settings, so you can match a corporate scheme, a client's scheme or a 3×3 matrix instead. The tolerable threshold is separate: it is the residual score above which you consider a hazard not yet adequately controlled, and it drives the "not yet tolerable" figure and the red markers in the charts.

Residual risk, and the trap in it

Residual risk is the score once your further controls are actually in place. Two rules keep it honest:

• Residual can never exceed initial. The tool refuses an entry where it does, because a control cannot make a hazard worse.
• Severity rarely falls. Controls usually reduce how likely harm is, not how bad it would be. Guarding a machine makes contact less likely; it does not make the amputation less severe. Dropping severity should mean you have genuinely changed the outcome — a lower working height, a smaller quantity of chemical, a less energetic process. If you find yourself reducing severity to make a number look better, you are assessing the paperwork, not the risk.

The reduction percentage is shown per hazard and in total. Treat it as a sense check: a register that claims to remove 90 % of all risk on paper usually has optimistic after-control scores.

Choosing controls

Controls are not equal, and the order they are considered in matters. The widely used hierarchy, most effective first:

1. Eliminate — stop doing it, or design the hazard out entirely.
2. Substitute — a less hazardous substance, a lighter component, a lower voltage.
3. Engineering controls — guards, interlocks, extraction, barriers, mechanical handling.
4. Administrative controls — safe systems of work, permits, training, signage, rotation.
5. Personal protective equipment — the last line, because it protects one person, only when worn correctly, and fails silently.

A register where most further controls are training and PPE is a register that has skipped the top of the hierarchy. That is the most common weakness inspectors find.

The action plan

Every hazard needing further control gets an owner, a due date and a status. The Reports tab lists the outstanding actions ordered by due date and marks the overdue ones, and the headline tiles show how many are open and how many have slipped.

Name a person, not a department. Set a date you believe in. An action with no owner and no date will not happen, and after an incident it reads very badly indeed.

When to review

Assessments go stale. Review when any of these happen, and not only on the anniversary:

• The work, the equipment, the substances or the layout change.
• An incident or a near miss shows the assessment was wrong.
• New people start, particularly young or inexperienced workers.
• New information appears — a safety alert, a manufacturer's notice, an updated code of practice.
• Enough time has passed that nobody can remember whether it still reflects reality.

Keep the superseded version. Being able to show what you knew and when you knew it is worth a great deal if anything is ever questioned. Export a .json backup before you make significant changes.

Printing and sharing

Print Report produces a document built from whatever the current filter shows: the header you set on the Settings tab, the headline figures, the charts, the summary by activity, the action plan, the full hazard register and your closing notes. Print to PDF to circulate it.

The scope line under the title states the filter in force, so a reader cannot mistake a filtered extract for the whole assessment. If you are issuing it as the assessment of record, clear the filters first.

Saving your work

Your hazards, settings and report header are written to this browser's local storage as you type, and the toolbar shows the time of the last save. That storage belongs to one browser on one computer: another browser, a private window, a second machine or a clean-up tool that clears site data will not have it.

Treat Export .json as the real save — one file containing everything, which Import .json restores anywhere. Export CSV gives you the register for spreadsheet work. Reset asks twice, then erases the in-memory data and every storage key this tool uses. There is no undo, so export first.

Accuracy & disclaimer

This tool records and scores the judgements you enter. It cannot see your workplace, it does not know what is reasonably practicable in your circumstances, and it has no view on whether your controls are adequate. A confident-looking score derived from an optimistic judgement is still an optimistic judgement.

Risk assessment duties, the competence required of the assessor, matrix conventions, reporting thresholds and record-retention periods all differ by country and by industry. This is a record-keeping and calculation aid, not legal advice or a compliance certificate. Have anything significant reviewed by a competent person, and check what your own jurisdiction requires.