How to conduct a risk assessment

Knowing how to conduct a thorough risk assessment is essential for charities. Not only are they a legal requirement, but they also help charities avoid disruption – disruption that will directly affect their services and the communities they serve – by identifying potential threats and the right controls needed to mitigate them.  

For charities, that could mean anything from keeping charity shops and public-facing venues safe, to planning fundraising events, to managing lone working on home visits, to supporting staff and volunteers’ mental health.  

Risk assessments can come in many forms. They  might cover everyday workplace hazards, remote and hybrid working, or the impact of new digital tools, including those that use artificial intelligence (AI) – on your people and operations. Workplace risk assessments provide a framework for managing risks across offices, shops, community spaces and home working alike.  

Risk assessments provide the clarity that charity professionals are seeking. They lay out risks plainly and show teams exactly the actions they can take to tackle them.  

HR software specialists Breathe HR have created useful guidance for charities on health and safety duties and risk assessments, including six steps to simplify them. In this article, we explore each step in more detail and how charities can apply them to manage their own risks.  

You can find Breathe HR’s full guidance on managing risk by clicking the button below.  

Find out more  

How to conduct a risk assessment 

Step one: Identify potential hazards 

The first place to start when conducting a risk assessment is by listing the risks you could face. This step is about taking a careful look at: 

You don’t need to list every single thing. You just need to identify the significant hazards - the ones that could cause real, meaningful harm – while still paying attention to less obvious issues like poor lighting or repetitive tasks.  

For charities, common hazards to consider include: 

You can also use risk assessments to think about the impact of new digital tools, including those that use AI - for example by considering how you’ll manage data-security and misinformation risks when handling service-user, supporter or donor information.   

This first step is not about dissuading you from running events, opening shops or using new tools. It’s about being honest about what could realistically cause harm so you can put the right controls in place.  

Step two: Consider who might be harmed and how 

The second step involves noting down those most likely to be affected by each hazard and how they could be harmed. In a charity context, that typically includes:  

Mapping out who is affected will help you decide what actions need to be taken to support those people and how big the impact of each risk could be. Remember to consider groups with higher or different levels of risk, such as new or expectant mothers, lone workers and people with health conditions or disabilities.  

Step three: Evaluate the risks and employ controls 

Once you’ve identified your risks and who they will affect, the next step is to evaluate them and decide what to do in response. A simple way to do this is to think about:  

Some charities use a risk rating (for example, multiplying likelihood by impact) to prioritise what needs attention first. 

Significant risks for charities might include: 

Fortunately, charities can control risks around data breaches by ensuring proper cyber security measures are employed, like only working with third-party tools with proper security accreditation such as ISO 27001 (the international standard for information security management systems).  

Controls don’t need to be complicated. They just need to be proportionate. Simple signage, training, adjusted processes, or better equipment can all count. 

For example: 

Many charities are also thinking about how emerging technologies fit into their risk picture. In the 2025 Charity Digital Skills Report, a third of charities said they would like their CEO to prioritise understanding the risks and opportunities around new technology, including AI. A thorough risk assessment helps you surface those risks alongside more familiar health and safety issues, so they can be managed sensibly rather than ignored. 

Step four: Involve your team 

“This is the step most people skip in the risk assessment process, and it matters,” says Breathe HR. Involving more people in the risk assessment process makes it easier to spot risks that might otherwise be missed if only one person is completing it.  

Different teams will have different perspectives. Those working directly with service users or on fundraising events will know more about their day-to-day work (and potential risks) than a HR professional. Likewise, HR professionals may have a greater understanding of legal requirements or workplace health and safety protocols. By working together, these teams can complete a far more thorough risk assessment than by doing so apart.  

Additionally, creating an environment where people feel comfortable raising concerns is just as important as the paperwork. Employees and volunteers have a duty to flag issues – whether that’s stress, a health condition or something they’ve noticed in the environment – but they’ll only do so if they feel safe to speak up without fear of consequences. 

Step five: Share your risk assessment 

Risk assessments are not a box-ticking exercise. They exist to inform teams of the risks involved in their work and – most importantly – what they can do to prevent incidents or mitigate their impacts. They are actionable documents intended to support organisations with better decision-making that benefits the people they serve.  

To fulfil their purpose, they have to be accessible. As Breathe HR notes, you can have the most comprehensive risk assessments in the world, but “if they’re sitting in a folder nobody opens, they’re not protecting anybody”.  

Keeping a digital copy of your risk assessments in the cloud makes them more accessible to teams, wherever they are working from.  

A joined-up HR and health and safety software can keep all your important documents together in one place, making them easy to find and easier to control who needs access.  

Breathe HR also points out that if you have five or more employees, recording the significant findings of your risk assessment is a legal requirement, so having a clear, central system can also help you demonstrate compliance to trustees, funders or regulators when needed. 

Step six: Shape your training  

The results of your risk assessments should inform the training you choose to provide. For example: