Risk assessment examples for care homes: one universal template for every hazard

A risk assessment in social care is a written record of a specific hazard to a specific person, how likely it is to cause harm, how bad that harm could be, and what you are doing to reduce it without stripping away the person's freedom. The risk assessment examples below cover the hazards that come up in almost every care home: falls, choking, going out alone, manual handling, medication and behaviour. Every one of them fits a single universal template, which you can copy from this page and use from the first day a resident moves in.

The short answer

A good care home risk assessment names one hazard, one person, and one owner. It scores likelihood and severity on a simple matrix, lists the controls that are actually in place, and states the residual risk that everyone has agreed to live with. It is reviewed on a fixed date and again whenever something changes. It links to the care plan so that staff on the floor know what to do, and it is written with the person, not about them. If you can build that once as a template, you never need a different form for falls, choking, behaviour or fire evacuation again. The rest of this article shows how, with worked examples.

What is a risk assessment in care, and what it is not

Managers new to the sector often ask what is a risk assessment in care, because the phrase gets used for everything from a fire survey to a note in a care plan. Strictly, a risk assessment is a structured judgement: what could go wrong, how likely is it, how serious would it be, and what reduces it. It is not a list of everything a person cannot do. It is not a reason to say no. And it is not a document that lives in a filing cabinet and is signed once a year.

In practice there are two families. Generic risk assessments cover the building and the tasks that happen in it: hoists, kitchens, hot water, legionella, lone working. Individual risk assessments cover one resident and one hazard: this person's falls, this person's swallowing, this person's trips to the shop alone. Both matter. The individual ones are the ones inspectors read most closely, because they show whether you actually know the people you support.

Where the duty comes from

The legal base is layered. The Health and Safety at Work etc. Act 1974 places a general duty on the employer to protect staff and anyone affected by the work. The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient assessment of the risks, recorded if you employ five or more people. For care providers, Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires you to assess the risks to the health and safety of people receiving care and to do all that is reasonably practicable to mitigate them.

Alongside that sits the Mental Capacity Act 2005, which shapes how you assess risk for a person who may lack capacity to weigh it themselves, and the Care Act 2014, whose wellbeing principle tells you that safety is one outcome among several, not the only one. None of these say which form to use. They say you must think, write it down, act on it, and review it. That is the whole job.

At a glance: the risk assessments most care homes need

The point of the table is not the list. It is the two right-hand columns. If a risk assessment has no named owner and no review trigger, it will drift out of date and nobody will notice until an incident.

Individual risk assessments: one person, one hazard

The single most common weakness I see in risk assessment in care homes is the general risk assessment that tries to cover a person's whole life on one sheet. It ends up saying very little about anything. The fix is one hazard per assessment. A resident might have five or six live assessments. That sounds like more paperwork, but each one is short, specific and useful, and each can be reviewed on its own cycle. A choking assessment reviewed after a chest infection does not force you to re-do the falls assessment at the same time.

Individual risk assessments should read like the person. Use their name, their words where you have them, and their routine. The hazard is not falls in general. It is that Mark stands up quickly from his armchair after lunch and has fallen twice on the rug by the television in the last three months. That sentence already tells a new member of staff more than most whole forms.

Positive risk taking and risk enablement

Positive risk taking is the idea that a life without any risk is not a life most people would choose, and that our job is to support people to do the things that matter to them as safely as reasonably possible. Risk enablement is the same idea from the planning side: what is risk enablement in practice? It is the process of finding controls that make the activity possible rather than reasons to stop it.

This matters most in learning disability and mental health services, where a history of overprotection has done real harm. It also matters for older people in residential care who are quietly told they cannot go into the garden alone. A risk assessment that says the person wants to walk to the corner shop, that they have done it safely for years, that they carry a card with the home's number, and that staff phone if they are not back within an hour, is a better document than one that says accompany at all times. Inspectors under the Right support, right care, right culture guidance look for exactly this.

The five steps, applied to a care home

The Health and Safety Executive's five steps to risk assessment are old, simple and still the best frame. Translated into a care home they look like this.

1. Identify the hazard. Be specific. Not the bathroom, but the wet floor between the shower and the toilet when Jean showers without staff.
2. Decide who might be harmed and how. Usually the resident, but also staff, other residents and visitors. Say what the harm would look like: a fractured hip, a burn, a road traffic accident, distress.
3. Evaluate the risk and decide on controls. Score likelihood and severity before controls, list the controls you will put in place, then score again. The second score is the residual risk.
4. Record your findings and act on them. Write it up in the template, link it to the care plan, and make sure the controls actually happen. A control that says non-slip mat in place is only a control if the mat is there.
5. Review and update. Set a date. Set triggers. Version the document so you can show what changed and when.

Every worked example later in this article follows these five steps. If your current forms do not, that is the first thing to change.

Scoring: the 5x5 matrix

Most care homes use a five-point scale for likelihood and a five-point scale for severity, multiplied together to give a score between 1 and 25. Likelihood runs from rare (1) to almost certain (5). Severity runs from negligible (1) to catastrophic (5), where catastrophic means death or permanent serious harm. A score of 1 to 4 is usually treated as low, 5 to 12 as medium, and 15 to 25 as high, though the bands are yours to set as long as you use them consistently.

Two rules keep the scoring honest. First, score the risk twice: once with no controls, once with the controls you actually have. If the two scores are the same, your controls are not doing anything. Second, be truthful about severity. A fall for a frail person on anticoagulants is not negligible. A learning disability resident crossing a dual carriageway is not negligible. Managers sometimes score low because a high score feels like an admission of failure. It is the opposite. A high score with strong controls and a documented decision is exactly what good practice looks like.

The universal template: what every risk assessment must contain

People search for risk assessment templates uk and find dozens of different forms for different hazards. You do not need dozens. One template, used for everything, means staff learn it once and inspectors can read it quickly. It needs these fields.

• Person's name, date of birth and room, or the area or task for a generic assessment
• The hazard, in one plain sentence
• Who could be harmed and how
• Likelihood, severity and score before controls
• Controls in place, each one specific and checkable
• Likelihood, severity and score with controls (residual risk)
• Whether the residual risk is accepted, and by whom
• The person's views, and whether they have capacity to make this decision
• If they lack capacity, the best-interests decision and who was consulted
• Links to related documents: care plan section, PBS plan, PEEP, SALT report
• Author, date, version number and next review date
• Review triggers specific to this hazard

If a form on your shelf lacks the person's views, the residual score or the review triggers, it will not stand up. Those three fields are where most weak assessments fall down.

Example 1: falls

Mark is 72, lives in a residential home and has Parkinson's disease. He has fallen twice in three months, both times standing up from his armchair in the lounge after lunch. Before controls: likelihood 4 (likely), severity 4 (major, given his bone density and the hard floor edge), score 16, high. Controls: chair raised to the correct height for him, rug removed and replaced with a flat non-slip surface, staff prompt him to sit for a minute before standing, physiotherapy referral for a walking review, medication review because his afternoon dose coincides with the falls, a sensor mat at night. With controls: likelihood 2, severity 4, score 8, medium. Residual risk accepted by Mark and his daughter.

Mark's view is recorded in his words: he does not want to be followed around and he will use the frame in the lounge but not in his room. That is a positive risk decision and it is written down. Review triggers: any fall, any change in medication, any change in walking pattern noticed at handover. Next review in three months. This is the shape every falls assessment should take. If you want the post-fall process that sits behind it, see falls in care homes: risk and post-fall.

Example 2: choking and swallowing

Priya is 44 and has a learning disability, cerebral palsy and a SALT recommendation for IDDSI level 6 soft and bite-sized food and level 2 mildly thick fluids. She eats fast when excited. Before controls: likelihood 4, severity 5, score 20, high. Controls: IDDSI levels on the kitchen board and in the care plan, staff trained in the specific textures and in first aid for choking, meals served in a quiet area with one member of staff sitting with her, no food from visitors without checking, a small plate and a teaspoon to slow the pace, and a rule that agency staff do not support her meals until they have read the plan and been shown once. With controls: likelihood 2, severity 5, score 10, medium.

The severity stays at 5 because choking can kill, and no control changes that. What the controls change is the likelihood. That is an honest score and it is what a good assessment looks like. Review triggers: any coughing at meals, any chest infection, any weight change, any new SALT advice. For the clinical side see choking risk, dysphagia and IDDSI.

Example 3: going out alone

Dean is 29, has a mild learning disability and autism, and has lived in a supported residential setting for two years. He wants to walk to the local shop and back, about ten minutes each way, on his own. Before controls: likelihood 3, severity 4, score 12. The hazards identified with him are crossing the main road, being approached by people who might exploit him, and getting anxious if the shop is busy. Controls: a travel training programme of six accompanied trips with a fading level of support, a card in his wallet with the home's number, an agreed route that uses the pedestrian crossing, a mobile phone he has shown he can use, a time limit of 45 minutes before staff phone him, and a weekly check-in about how it is going. With controls: likelihood 2, severity 3, score 6, low.

Dean has capacity for this decision and that is recorded, with the discussion that happened. His mother's worries are recorded too, with the explanation given to her. This is what risk enablement looks like on paper. Review triggers: any incident when out, any change to the route, any report of people approaching him. Six-monthly review.

Example 4: a manual handling risk assessment example

A manual handling risk assessment example for a nursing home resident is one of the most searched forms in the sector, and one of the most badly done, because people copy the generic HSE task template and forget the person. Elsie is 88, weighs 52 kilograms, has advanced dementia and osteoporosis, and cannot weight-bear. She is transferred by full-body hoist between bed and chair four times a day.

The hazards are to Elsie (skin tears, fear, a fall from the sling) and to staff (back injury from awkward postures in a small room). Before controls: likelihood 3, severity 4, score 12. Controls: named sling type and size, sling checked before each use, two trained staff for every transfer, the bed at working height, a described approach for telling Elsie what is happening because she becomes frightened by the hoist, the bedside table moved before starting, hoist serviced under LOLER every six months and recorded. With controls: likelihood 1, severity 4, score 4, low. Review triggers: any weight change over three kilograms, any skin damage, any change of equipment, any report of distress. It is reviewed with the staff who do the transfers, not just the manager.

Example 5: self-administration of medication

Tom is 58, lives in a mental health residential service, and wants to hold and take his own medication as he did before admission. Before controls: likelihood 3, severity 4, score 12. The hazards are missed doses leading to relapse, accidental double dosing, and other residents accessing his medicines. Controls: a capacity assessment confirming he understands his medication and the risks, a lockable drawer in his room and a key he keeps, a weekly compliance aid filled by the pharmacy, a weekly count by a senior with Tom, an agreed sign that he is struggling (missed morning doses two days running triggers a conversation, not confiscation), and PRN medicines held by staff for now at his request. With controls: likelihood 2, severity 3, score 6, low.

This is a graded approach. Self-administration is not all or nothing. The assessment can say which medicines he manages and which staff manage, and it can move in either direction over time. The eMAR record needs to reflect this too, so that staff do not record doses they have not given. See eMAR for how self-administered items are shown separately on the round.

Example 6: behaviour that challenges

Sam is 24, autistic, with a learning disability and a history of hitting out when the environment is noisy or when routines change without warning. He has a positive behaviour support plan. The risk assessment sits alongside it and does a different job: it scores the risk of injury to Sam, to other residents and to staff, and it lists the controls. Before controls: likelihood 4, severity 3, score 12. Controls: the PBS plan itself with its early warning signs and proactive strategies, a maximum of two other residents in the lounge when the television is on, a visual timetable updated the night before, staff trained in his specific de-escalation approach, and a clear statement that physical intervention is a last resort and any use is recorded and reviewed as a restrictive practice. With controls: likelihood 2, severity 3, score 6.

The link to the PBS plan is the key. The risk assessment should not repeat the whole plan. It should say where it is and what it covers. The plan holds the strategies; the risk assessment holds the score and the controls. A safeguarding risk assessment template follows the same shape when the hazard is harm from another person rather than from an activity: name the risk, the people involved, the controls and the review.

Example 7: personal emergency evacuation

A PEEP is a risk assessment with a different name. The hazard is fire, the person is the resident, and the controls are the plan for getting them to safety with the staff on duty at the worst time of day. It fits the universal template exactly: mobility, awareness of the alarm, assistance needed, equipment, route, refuge, and the number of staff it takes. Most homes keep PEEPs in a separate fire folder, which is fine, but they should be created in the same system and reviewed with the same discipline. The most common gap is a PEEP that assumes day staffing when the fire happens at 3am with two staff on for twenty residents.

Because every resident needs a PEEP from the day they arrive, it is the first risk assessment you write for anyone. Everything else can follow in the first week. A full guide is at PEEPs in care homes.

Linking risk assessments to the care plan

A risk assessment nobody reads on shift is a piece of paper. The controls have to appear in the care plan section that staff use every day, in plain instructions. Mark's falls assessment becomes a line in his mobility plan: prompt Mark to sit for a minute before standing, offer the frame in the lounge. Priya's choking assessment becomes a line in her eating and drinking plan with the IDDSI levels and the rule about sitting with her. The risk assessment holds the reasoning and the score. The care plan holds the instruction.

When they are separate documents in separate folders, they drift apart. The care plan gets updated after a review and the risk assessment does not, or the other way around. Digital care records that link the two, so that a change in one prompts a check of the other, remove most of that drift. If you are on paper, the practical fix is a cross-reference line in each document and a rule that both are opened together at every review.

Capacity, consent and the person's own view

Every individual risk assessment should say whether the person has capacity to make the decision it is about. That is not a blanket statement. Dean has capacity to decide about walking to the shop. He may not have capacity to decide about a complex financial matter. Capacity is decision-specific and time-specific under the Mental Capacity Act 2005, and the risk assessment should record the decision in question, the conclusion, and how it was reached.

Where the person has capacity and chooses to take a risk, the assessment records their choice and the information they were given, and the controls are the ones they agree to. Where they lack capacity, the assessment records a best-interests decision, who was consulted, and why the less restrictive options were or were not chosen. Either way, the person's own words belong on the page. An assessment with no evidence that the person was involved is a red flag for an inspector, and it should be a red flag for you.

Review frequency and review triggers

There is no legal review interval for individual risk assessments. The usual practice is monthly for high risks, three-monthly for medium and six-monthly or annually for low, and always after an incident or a change. The interval matters less than the triggers. A falls assessment reviewed every month on the dot but not after the fall on the 14th has missed the point.

Write the triggers into the document itself, specific to the hazard. For falls: any fall, any medication change, any change in mobility. For choking: any coughing at meals, chest infection, weight change. For going out alone: any incident, any change of route. Then make sure your incident process actually opens the relevant assessment. In a good system, logging a fall on the incident form prompts the falls assessment for review automatically. On paper, the manager's incident review checklist should include the line: which risk assessments need updating?

Versioning and the audit trail

When an inspector or a coroner asks what the risk assessment said on the day of the incident, you need to be able to answer. That means every version is kept, dated and attributed, and the current one is clearly the current one. On paper this means never overwriting, always adding a new page, and keeping the old one behind it. Digitally it means the system holds every version and shows who changed what.

This is one of the places where a universal template earns its keep. If every hazard uses the same scored, versioned format, you can pull a resident's full risk history in one view and see how scores have moved over time. Kiwi, for example, treats every risk assessment as the same scored and versioned object, with PEEPs first because every resident needs one, so the history is there without anyone having to file it.

Involving the person and their family

Involvement is not a signature box. It is a conversation, recorded. Sit down with the person, explain the hazard in words they understand, ask what they think, ask what would make them feel safer and what would make them feel controlled. Write down what they said. Where there is a family member or advocate, do the same. Where the person and the family disagree, record both views and the decision, with the reasoning.

In learning disability services use easy-read versions or pictures where they help, and record that you did. In mental health services be careful about the difference between a person's genuine choice and a symptom of relapse, and record the discussion honestly. In nursing homes, where the person may not be able to take part, record what you know of their previous wishes and who told you. Involvement done properly makes the assessment better, not just more defensible.

Making sure staff have actually read it

A risk assessment only protects anyone if the staff on shift know what it says. The failure mode is obvious: a new assessment is written on Tuesday, filed, and the weekend agency worker never sees it. Three things close that gap. First, key controls go into the care plan and the handover, in plain language. Second, new and updated assessments are flagged at handover as important, and the manager checks that flag was seen. Third, agency and bank staff get a short briefing that covers the live risk assessments for the people they are supporting, and that briefing is recorded.

Digitally this is easier: a read receipt on the assessment, a flag on the resident's profile, a handover item that clears only when acknowledged. On paper it means a signature sheet on the front of the assessment and a manager who checks it. Either way, the question an inspector will ask a care worker is simple: what are the risks for this person and what do you do about them? If the answer matches the document, you are fine.

Risk management in health and social care: the home-level view

Individual risk assessments are one half. Risk management in health and social care also means the home has an overview: a risk register that lists the significant risks to the service as a whole, who owns them, and what is being done. Typical entries are staffing levels at night, a resident whose needs are outgrowing the service, a building issue such as a lift out of order, dependency on a single senior for medication, and financial risk from a delayed fee review.

The register is reviewed at the management or governance meeting, and it is where individual risk assessments feed upwards. If four residents have had falls in a month, that is not four individual problems. It is a service-level pattern that belongs on the register with an action. Inspectors under the Well-led key question ask how you know what the risks to the service are and what you are doing about them. A dated register with actions is the answer. If you want to see how the audit and governance side fits together, CQC compliance shows one way of holding it in a single place.

Generic risk assessments: premises and tasks

These are the ones that look most like a factory risk assessment, and that is because they are. Hot water outlets and scald risk, legionella, window restrictors, bed rails, hoists and slings under LOLER, kitchen equipment, cleaning chemicals under COSHH, lone working at night, the garden and any ponds or steps, vehicles. Each one needs an assessment, a named owner and a review date. Most are annual, with a re-check after any change or incident.

They can use the same template. The person field becomes the area or task. The scoring works the same way. The difference is that the controls tend to be physical or procedural rather than personal, and the review is usually calendar-based rather than event-based. Keep them in a separate folder from the individual assessments so that a resident's file is not cluttered with the legionella survey, but build them the same way. A staff member who has learned to read one has learned to read all of them.

Common mistakes

• One general risk assessment for a person's whole life, which says nothing specific about anything
• Scoring risks low to avoid a high number, rather than scoring honestly and controlling well
• Controls written as aspirations (staff to be vigilant) rather than actions you can check (staff sit with Priya at every meal)
• No residual score, so nobody can tell whether the controls are working
• No record of the person's views or their capacity for the decision
• Reviewing on a calendar but not after the incident that should have triggered it
• Overwriting the old version so the history is lost
• Risk assessments and care plans that contradict each other because they were updated separately

What good looks like on inspection day

An inspector will usually pick two or three residents and track their records from admission. For risk assessments they want to see that a PEEP was in place on day one, that the hazards specific to that person were identified in the first week, that each assessment is scored, has controls that match the care plan, records the person's involvement, and has been reviewed on the stated date and after any incident in the file. They will then talk to a care worker and ask what the risks are for that person. They will look at the incident log and check that the incident on the 14th led to a review on or shortly after the 14th.

What they do not want is a beautifully formatted folder that nobody on the floor recognises. Inspection-ready evidence is a record that matches what staff say and what actually happens. If your assessments are specific, scored, versioned, linked to the plan and known to the team, the inspection will go well on this point whatever your forms look like. If you want to see how scored and versioned assessments look in a live system before you decide how to organise yours, you can book a demo and walk through a resident's risk history end to end.

Final conclusion

Risk assessment in care is not a form. It is a habit of thinking clearly about one person and one hazard, writing down what you decided and why, and checking later whether it worked. One universal template with a hazard, a score before and after controls, the person's view, the links to the care plan and a set of review triggers will cover falls, choking, going out alone, manual handling, medication, behaviour and evacuation without a different sheet for each. Build it once, use it everywhere, version it, and make sure the people on shift know what it says. That is what keeps residents safe, keeps their freedom intact, and stands up when someone asks what you knew and when.

Frequently asked

How many risk assessments should a care home resident have?

As many as there are real hazards, and no more. A typical resident has a PEEP plus three to six individual risk assessments covering things like falls, swallowing, skin, medication or going out alone. One assessment per hazard is better than one long form that tries to cover everything.

What scoring system should a care home use for risk assessments?

Most homes use a 5x5 matrix: likelihood from 1 to 5 multiplied by severity from 1 to 5, giving a score from 1 to 25. Score once without controls and again with them so you can show the controls are working. The exact bands matter less than using them consistently across the whole service.

How often should risk assessments be reviewed in a care home?

There is no fixed legal interval. Common practice is monthly for high risks, three-monthly for medium and six-monthly or annually for low. The more important rule is that every assessment is reviewed after an incident or a change in the person's needs, so write those triggers into the document.

What is a risk assessment in health and social care?

It is a recorded judgement about a specific hazard: who could be harmed, how likely that is, how serious it would be, and what controls reduce it. In care settings it also records the person's own view and, where relevant, their capacity to make the decision. It should link directly to the care plan so staff know what to do.

What is positive risk taking in social care?

Positive risk taking means supporting people to do the things that matter to them as safely as reasonably possible, rather than stopping activities because they carry some risk. The risk assessment records the person's choice, the controls agreed, and the residual risk accepted. It is central to good learning disability and mental health support and is expected by inspectors.

Does a manual handling risk assessment need to be individual to each resident?

Yes, for anyone who needs support to move. A generic task assessment for hoisting does not capture the person's weight, skin, pain, fear or the layout of their room. The individual assessment names the equipment, the sling size, the number of staff and the approach, and it is reviewed with the staff who do the transfers.

Can a resident refuse the controls in their risk assessment?

If they have capacity to make that decision, yes. Record the information you gave them, their decision and the controls they did agree to, and continue to offer support. If they lack capacity for the decision, a best-interests process applies and the least restrictive effective option should be chosen and recorded.

Sources

• Health and Safety at Work etc. Act 1974
• Management of Health and Safety at Work Regulations 1999
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 12: Safe care and treatment
• HSE: Risk assessment, a brief guide to controlling risks in the workplace
• Mental Capacity Act 2005 Code of Practice
• CQC: Right support, right care, right culture
• Regulatory Reform (Fire Safety) Order 2005
• Lifting Operations and Lifting Equipment Regulations 1998 (LOLER)