If you've read Part 1, you'll have a solid grounding in the five steps to risk assessment and how to apply them in the context of site, task and machine. That's the starting point — the level of understanding we'd expect from a candidate coming through an entry-level unit assessment, and a perfectly good foundation.
But it isn't the whole story. And I'll be honest with you: I've developed a nagging feeling recently that as an industry we talk about risk assessment a great deal while actually applying it rather superficially. The outcomes and controls we arrive at tend to mirror what we've always done — PPE on, method statement written, job started. The process has become a ritual rather than a genuine analytical exercise.
Two things have sharpened this view for me. The first was working through the NEBOSH General Certificate with Compassa, which gave me the opportunity to study health and safety legislation in considerably more depth than our industry-specific qualifications typically demand. The second — and more pressing — is the steady stream of accident reports I hear about week after week from our trainees. Most students can tell me about a serious incident in their immediate circle of contacts. An apprentice recently suffered a life-changing injury using a brushwood chipper. This can't be right. If our risk assessments were genuinely fit for purpose, the accident rate would look very different.
So this article is an attempt to dig a little deeper. We'll look at some specific points where our industry's thinking doesn't quite accord with proper risk assessment principles — and flag the areas of the Management of Health & Safety at Work Regulations 1999 that sit behind each one. Our advanced courses cover all of these topics in detail, but this should give you a useful framework to start thinking differently.
Where Our Thinking Falls Short
Before getting into the detail of the regulations, it's worth identifying some patterns that I see repeatedly — you might recognise a few.
We lean too heavily on PPE and procedures. Chainsaw trousers, helmets, face screens — all essential — but PPE sits at the bottom of the hierarchy of controls. We'll come back to that hierarchy in detail, but the short version is that we've got it largely upside down. We reach for PPE first and ask harder questions later, if at all.
We've "risk assessed out" things that are actually solutions. I was told recently that a local authority arboricultural team had risk assessed out the use of two-rope climbing systems. I'd be genuinely interested to see their workings. Two ropes exist as a control measure — removing a control measure and calling that a risk assessment outcome is, to put it politely, an oxymoron.
Training and cultural signals undermine the controls we do have. A climbing arborist receiving a one-hour update on two-rope working and concluding the whole thing is a joke — that's a predictable outcome when the organisation's investment in the topic signals it isn't being taken seriously. The risk assessment might say "two anchor points at all times" but if the culture says otherwise, the document is wallpaper.
We've drifted back into old habits post-Covid for the wrong reasons. I've heard from assessors that candidates are being used as casualties again in aerial rescue training rather than rescue dummies. Covid pushed us toward dummies for distancing reasons — but the benefits turned out to go well beyond that: eliminating the risk of spiking one another on poles or featureless stems, removing the problem of students hanging around waiting to be rescued, and giving a more realistic and controllable rescue scenario. Going back isn't progress.
We rarely ask whether we could have done more. That question — could I have done more to reduce this risk? — is actually the legal standard. It's the So Far As Reasonably Practicable test, and we'll look at it in detail below. In practice, most risk assessments don't get anywhere near it.
The Management Regulations: What They Actually Require
The Management of Health & Safety at Work Regulations 1999 go considerably further than the five steps. Our advanced courses work through the following areas in detail.
So Far As Reasonably Practicable (SFARP)
This is the legal standard that qualifies most health and safety duties in the UK. It means doing everything to reduce risk unless the cost — in time, money or effort — is grossly disproportionate to the benefit. The important point is that the burden of proof sits with the employer: you'd need to demonstrate that further action was not reasonably practicable, not simply that you'd ticked a box. In practice this is a high bar, and most operations in arboriculture and forestry haven't come close to exhausting the available controls before concluding that they've done enough.
Suitable and Sufficient
The regulations require that risk assessments are suitable and sufficient — a legal standard, not a style guide. A suitable and sufficient risk assessment identifies the significant risks, is proportionate to the nature of the work, and remains valid over time. A generic document that hasn't been reviewed since 2019 and was written for a different type of site is unlikely to meet this standard. This matters because "we have a risk assessment" and "we have a suitable and sufficient risk assessment" are two very different things.
Assessing Risk Properly
You can't manage what you haven't measured. Proper risk assessment requires both an estimate of likelihood — how probable is it that this hazard causes harm — and severity — how bad would the harm be. Both need to be considered before and after controls are applied. The residual risk after controls is the figure that matters. If the residual risk is still unacceptably high, you haven't finished yet.
Risk matrices and scoring systems exist to help with this, though they can become a distraction if the numbers feel more important than the thinking. The point is to arrive at a defensible judgement about whether the controls are adequate — not to produce a number that makes the form look complete.
The Principles of Prevention
Schedule 1 of the Management Regulations sets out the General Principles of Prevention — a ranked list of approaches to controlling risk. These are directly derived from the EU Framework Directive and represent a deliberate hierarchy of what employers should be considering, in order. They include avoiding the risk altogether where possible, substituting the dangerous for the less dangerous, and giving priority to collective protective measures over individual ones. PPE features near the bottom — a last resort, not a first response. Most arboricultural risk assessments begin and end with the bottom of this list.
The General Hierarchy of Controls
Related to the principles of prevention is the hierarchy of controls — Eliminate, Substitute, Engineer, Administrate, PPE — which most people in the industry will have encountered in some form. The hierarchy exists to ensure that we work down from the most effective controls toward the least. The problem in practice is that we tend to work up from PPE and rarely make it past administrative controls such as training, procedures and supervision. These are not ineffective, but they rely on human behaviour remaining consistent — which it doesn't. Engineered controls and elimination don't carry this weakness.
A Starting Point for Advanced Study
The topics above form the backbone of our advanced risk assessment work here at Scott Fraser Training. Each one connects to a specific part of the Management Regulations, and together they build a picture of what a genuinely robust approach to risk management looks like — as opposed to the compliance exercise that risk assessment has become in much of our industry.
In Part 3, we'll work through each of these areas with practical examples drawn from arboricultural and forestry operations, and look at how applying them properly changes the conclusions you'd reach on some common scenarios.
In the meantime, if you're preparing for an advanced unit assessment or simply want to develop your understanding, the Management of Health & Safety at Work Regulations 1999 are freely available from the HSE website and are worth reading alongside this series.
Scott Fraser Training & Assessments offers advanced training and CPD in health and safety for arboricultural and forestry professionals, based in Kent. View our courses or contact us to discuss your training requirements.
