Guides & resources
Risk assessment for restaurants, hotels and shops: five steps and a free template
How to do a risk assessment in a restaurant, hotel or shop with your team: example hazards, when to review, and a free template with an action plan (PDF).
Short answer: A risk assessment is a careful look at what could hurt people at work, who could be harmed and how, and what you’ll do about it. Every UK employer has to make one, and with five or more employees you must record the significant findings. What protects people is the action plan: every fix with a name and a date.
It’s 21:30 on a Saturday at the Riverside site. Leo, 17 and on his third shift, slips by the pot wash, catches the shelf and is fine. The risk assessment in the office says “non-slip mat at the pot wash”. The mat went out to be cleaned on Thursday, and nobody had been asked to bring it back.
On Monday, Nadia, area manager for ten restaurants, opens the group’s risk assessments. Seven were copied from one template three years ago, one with another site’s name still at the top. None says who checks the mat, and none mentions anyone under 18.
This guide is for GMs who walk the floor in restaurants, hotels and shops, and the ops and area managers who run several sites. It covers UK law first and isn’t legal advice. Keep the free risk assessment template (PDF) open while you read.
What is a risk assessment?
A risk assessment is how you find what could cause harm in your workplace and decide what to do about it. UK law asks for a “suitable and sufficient” one (regulation 3(1)), which HSE explains as “good enough to protect people from any harm that you can predict.” Its guide to managing risk is blunt about the binder: “Do not rely purely on paperwork as your main priority should be to control the risks in practice.”
Hazard or risk: what’s the difference?
A hazard is anything that could cause harm: a wet floor, hot oil, an abusive customer. The risk is how likely the harm is and how bad it could be. The same wet floor is a higher risk in Saturday service than at 07:00 in an empty kitchen.
Is a risk assessment a legal requirement?
Yes. In the UK, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer, whatever its size, to assess the risks, and to record the significant findings once it has five or more employees. In the US, no federal rule we found asks for a general written one, though narrower written duties apply.
In the UK
Regulation 3(6) has you record “the significant findings of the assessment” and any group of employees identified as “especially at risk”, and Northern Ireland’s regulations say the same. There’s no set form: HSE says “You can use a risk assessment template to help you keep a simple record”, but adds: “Do not just copy an example and put your company name to it as that would not satisfy the law and would not protect your employees.”
Consulting staff on health and safety “in good time” is law too (1996 Regulations, or the 1977 Regulations where a union is recognised), but neither names the risk assessment. HSE’s guidance says you “should consult” staff when you do one, though not formally before every task-specific assessment. Fire is a separate duty, covered at the end.
In the US
The OSH Act’s General Duty Clause requires a workplace “free from recognized hazards” likely to cause death or serious physical harm. Narrower written duties apply, such as a PPE hazard assessment with “a written certification” (29 CFR 1910.132(d)). California’s written Injury and Illness Prevention Program must include procedures for “identifying and evaluating work place hazards” (8 CCR 3203).
How to do a risk assessment in five steps
The five steps to risk assessment are HSE’s, and its current guide lists them as identify hazards, assess the risks, control the risks, record your findings, and review the controls. They’re guidance: the law asks for a suitable and sufficient result, not a method.
1. Identify the hazards on a normal shift
Walk it when it’s busy: a kitchen at 10:00 on a Monday hides the pot wash at 21:30 on a Saturday. Go area by area, nights included, with the workplace safety inspection checklist as your route. Walk it with the people who work there: in HSE’s café example, the manager “talked to staff” and “looked at the accident book”.
2. Decide who could be harmed, and how
For each hazard, name the people and the moment: chefs at close, the new starter on prep, room attendants on a heavy checkout morning, the night porter after midnight. HSE asks how “employees, contractors, visitors or members of the public might be harmed”, so guests count too. Then write how: a burn, a strained back, a cut, a threat.
3. Rate each risk and decide on controls
Rate each hazard Low, Medium or High for how likely and how bad. That scale is our suggestion: the law sets no matrix, and HSE’s own template has no rating column. HSE says you’re “not expected to eliminate all risks”, but you need to do everything “reasonably practicable” to protect people. Our rule of thumb: remove the hazard if you can, change the set-up if you can’t, and lean on rules, training and kit last.
4. Record it and turn it into an action plan
Write down the significant findings, not every thought from the walk, and put each action you can’t take on the spot into a health and safety action plan. HSE’s template has columns for “Who needs to carry out the action?”, “When is the action needed by?” and “Done”. We’d add who checked it. An action with no name is a wish. More on reducing workplace incidents.
5. Tell the team and review it
Regulation 10 says staff get “comprehensible and relevant information” on the risks the assessment found, and where not everyone reads English first, comprehensible is the hard part. Tell each shift what changes for them, make safety a standing item at your staff meetings, and set a date to look at it again.
What are the most common hazards in a kitchen, hotel or shop?
In catering, HSE’s FAQ names the main causes of accidents and ill health as slips, trips and falls, manual handling, hot surfaces and harmful substances, dermatitis, and cuts from knives. Its shop example adds deliveries, violence, working at height and freezer work, and there’s no hotel example.
Restaurant kitchens, cafés and pubs
A kitchen risk assessment starts with the floor. HSE calls slips and trips “the single most common cause of major injury in UK workplaces”, and across all industries, slips, trips or falls on the same level were 30% of non-fatal injuries to employees reported under RIDDOR in 2024/25. HSE’s food preparation example, for restaurants, cafés, pubs, takeaways and hotel kitchens, adds hot oil and surfaces, knives, skin problems, chemicals, gas, electrics and machinery. Behind the bar, add kegs and the cellar steps.
Cleaning chemicals need their own COSHH assessment, and food hazards like allergens belong in your HACCP plan, not here. Your opening and closing checklists carry the daily controls. More on how restaurant teams run the shift.
Hotels
A hotel risk assessment borrows the kitchen list and adds housekeeping and nights. Stripping beds and pushing linen trolleys is manual handling: the Manual Handling Operations Regulations 1992 ask you to avoid hazardous handling where reasonably practicable and assess the rest, and HSE notes “the law does not set specific weight limits.” Add COSHH for housekeeping chemicals, and the night porter working alone. More on how hotel departments stay in step.
Retail shops
A retail risk assessment can start from HSE’s shop example: twelve mostly part-time staff on three shifts, one of them pregnant. On your floor, add roll cages, the stockroom stepladder, abuse at the till and whoever opens alone. For the busiest weeks, see retail peak season. More on how retail teams run the store day.
People who need a closer look
The 1999 Regulations name two groups for a closer look: workers under 18, and new and expectant mothers. Lone working and violence go in your general assessment too. All four change by site and by week, so a group template can’t cover them alone.
Young workers
Risk assessment for young workers comes before their first shift. Regulation 3(4) says you can’t employ anyone under 18 unless you’ve “made or reviewed an assessment” of the risks to young persons, and regulation 3(5) has it take account of their “inexperience, lack of awareness of risks and immaturity”. Think slicer, fryer and closing alone.
New and expectant mothers
If you employ “women of child-bearing age” and the work could put a new or expectant mother or her baby at risk, your general assessment must include that risk (regulation 16). Once she tells you in writing, HSE says “you must complete an individual risk assessment”.
Lone workers
You don’t need a separate lone working risk assessment, but HSE’s guide INDG73 says “you have a duty to include risks to lone workers in your general risk assessment”. Think of the night porter, the 06:00 opener and the closer cashing up alone: how do they call for help, and who notices if they don’t?
Violence and abuse
HSE counts “verbal abuse or threats” as work-related violence, and your general assessment covers it: refusing a sale, the guest who’s had too much, the shoplifter at the door. Put what staff should do in your employee handbook. The assessment alone won’t reduce violence, HSE says, “but the actions you take following on from it should.”
Risk assessment template
Our free risk assessment template has three pages: the risk assessment, the action plan with an owner, a due date and a check for each action, and examples from restaurants, hotels and shops. Fill in one per site and area, on the floor, with your team: download the risk assessment template (PDF).
How to do the risk assessment
- Pick one site and one area or task, and walk it during a normal busy shift.
- Ask the people who work there what went wrong or nearly did, and list every hazard.
- For each hazard, write who could be hurt and when, then rate it Low, Medium or High.
- Note what you already do and decide what more is needed, starting with the High ones.
- Copy every action onto the action plan with one name, a due date and who checks it.
- Tell every shift what changes, and set a date to look at it again.
Example hazards in restaurants, hotels and shops
| Hazard | Who and when | Rating | Action |
|---|---|---|---|
| Wet floor at the pot wash | Kitchen porters and chefs, worst in the evening rush | High | Non-slip mat, mop kept at the station, spills cleaned at once, shoes with grip |
| Hot oil when changing the fryer | Chefs, at close while the oil is still hot | High | Change the oil only once it has cooled, trained staff only, fire blanket in reach |
| Knives and the meat slicer | Prep chefs and new or young starters, during prep | Medium | Guard always on, trained before first use, never a new starter alone |
| Kegs and the cellar steps | Bar staff, during service and at close | Medium | Handrail and lighting fixed, keg trolley, no carrying kegs on the steps |
| Stripping beds and pushing linen trolleys | Room attendants, during mid-morning checkouts | Medium | Lighter trolleys, beds pulled out on wheels, heavy rooms shared out fairly |
| Night porter alone at reception | Night porter, from midnight to the morning shift | Medium | Panic alarm, front door locked at night, check-in call with the duty manager |
| Abusive customer at the till | Shop staff, in the evening and when refusing a sale | High | Never challenge alone, conflict training, report every incident |
| Roll cages and heavy deliveries | Shop staff, at delivery and on the shop floor | Medium | Push not pull, one cage at a time, gloves and safety shoes, shown on day one |
These are examples, not your assessment: rate each row for the site in front of you. Low, Medium and High is our suggested scale, not a legal requirement.
One risk assessment per site, or one for the group?
Both: a shared base for what every site has in common, and a site layer each GM writes with their own team. The duty sits with the employer, but hazards sit at an address.
| Assess once, for the group | Assess at each site |
|---|---|
| Tasks done the same way everywhere, like changing fryer oil | The layout: stairs, cellar, yard, loading bay |
| Cleaning chemicals you buy centrally | Who opens and closes alone, and when |
| What staff do when a customer turns abusive | Young workers, pregnancy and particular needs |
Ops writes the base with two or three GMs, and each GM adds what’s different on their own walk. Copied to a site unchanged, the base has the same weakness as the copied example HSE warns about.
Regulation 5 also asks for arrangements to monitor and review the measures you take. We’d give the monitoring to the ops manager: read every site’s action plan side by side once a month, and when one site logs a near miss at the fryer, ask the others about theirs.
How often should a risk assessment be reviewed?
UK law sets no fixed interval for reviewing a risk assessment. Regulation 3(3) says to review it if “there is reason to suspect that it is no longer valid” or after “a significant change”, and HSE suggests considering one after accidents, near misses or problems your workers spot. Look again when:
- the menu, equipment, layout or opening hours change
- you take on someone under 18, or a pregnant employee tells you in writing
- someone gets hurt, or nearly does, here or at another site in the group
HSE’s template has a “Date of next review” field, so set one and give it an owner. Once a year is a sensible default, but that’s good practice, not law. COSHH and fire law say “regularly”, with no set period.
Keeping the action plan moving on every site
Leo didn’t need a better document. He needed the mat back, a shift lead who checks it, and a near miss that reaches someone who can fix it. Nadia needs to see that on all ten sites.
Todolo is one app for the whole shift, an employee app that needs no computer or company email address. In Todolo Operations, the action plan becomes work someone owns:
- The person on shift raises it. If the mat’s missing at close, whoever’s closing reports it from that site’s closing routine, on their phone, with a photo and a note.
- Every action has an owner. Each one becomes an incident with a named person, a due date and a severity on your own scale.
- Reports reach the right manager. A workflow can send a near miss to that site’s manager.
- Every shift hears it. Read confirmation shows who read a post, not that you consulted them, and chat can be read in each person’s own language.
- Ops sees every site. Done, overdue or with a deviation, day by day.
TOD, Todolo’s AI teammate, answers questions from your own handbooks.
ESS Group reports accidents and near misses through Todolo workflows, separately from fault reporting.
Todolo doesn’t do the assessment, has no risk assessment module or matrix, isn’t a lone worker alarm and doesn’t make you compliant. The walk, the judgement and the duty stay yours.
Common questions about risk assessment
Who is responsible for doing a risk assessment?
The employer. HSE says “You can do it yourself or appoint a competent person to help you”, and the GM often walks it with the team. But under regulation 21, you can’t use the mistakes of an employee, or of the competent person you appointed, as a defence.
Do I need a written risk assessment with fewer than five employees?
You still do the assessment; you just don’t have to write it down (regulation 3(6)). HSE says “it is useful to do this, so you can review it later”. Fire is different: see below.
Can ChatGPT do a risk assessment?
It can draft a list of hazards, but it can’t walk your site, ask your night porter what worries them, or see that your cellar steps are steep. HSE says a copied example won’t do, so treat a draft like any template: check, change and rate it on the floor with your team.
Is a risk assessment the same as a fire risk assessment or a HACCP plan?
No. In England and Wales, fire has its own law, the Regulatory Reform (Fire Safety) Order 2005: the responsible person assesses fire risk, and since 1 October 2023 has had to record it whatever the headcount. Scotland and Northern Ireland have their own rules. A HACCP plan covers food safety for guests, not harm to people at work.
Do agency staff and temps need to be covered?
Yes, whatever their contract. Regulation 3(1)(a) covers your employees and 3(1)(b) “persons not in his employment” affected by your business, so casual, seasonal and agency staff and contractors are covered either way. Show them the hazards on their first shift: they’re the least likely to know where the mat goes.
Start with one area this week
Pick one site and the area where things go wrong most: the pot wash, the night desk, the delivery door. Walk it in the busiest hour with whoever’s on, ask what nearly went wrong, and fill in page one. Before you leave, put a name and a date next to every action on page two.
In thirty minutes we’ll show you how your action plan, every fix with its owner and due date, would work in Todolo, site by site. There’s no long contract to sign, and there’s a 30-day money-back guarantee.