A step-by-step guide to conducting a rooftop risk assessment

Key takeaways:

You are legally required to conduct a rooftop risk assessment before any work at height begins. This process must align with The Work at Height Regulations 2005. The HSE specifies five steps that you must follow when completing a risk assessment – identify the hazards, assess the risks, control the risks, record your findings, and review your controls. When controlling the risks, the hierarchy of fall protection states that you should avoid work at height if possible. But if this isn’t practical, then you should prioritise collective edge protection such as guardrails over personal protective equipment (PPE) like harnesses. 

The HSE found that falls from height accounted for around a quarter of all fatal injuries to UK workers from 2025-26. But most of these incidents are entirely avoidable if the risks are spotted in advance.

Before any work is carried out on your roof, you must always conduct a comprehensive rooftop risk assessment to determine where the dangers lie, and put the correct measures in place to control the risks. Your risk assessment must be compliant with The Work at Height Regulations 2005, so it’s important that you carry out each step correctly. Follow our step-by-step guide below to ensure you get it right the first time.

1) Identify the hazards

The first step to a rooftop risk assessment is determining which hazards are present on your roof. The best way to do this is by walking the roof yourself – but if access isn’t safe, then you can review your drawings or inspection records instead. 

Here’s what you need to check:

• Unprotected edges, including parapets below 1100mm
• Fragile surfaces, like skylights, rooflights, and ageing fibre cement sheets
• The access route onto the roof, such as fixed ladders, hatches, and landings
• Any plant, pipework, or changes in level that could create trip hazards or push your workers towards the edge
• Whether the rooftop has been exposed to adverse weather, like wind, rain, or ice

The HSE guidance on fragile surfaces states that you should always assume a roof is fragile until a competent person has confirmed it is non-fragile. This means putting the relevant precautions in place to prevent a fall through that surface. More on that below…

2) Evaluate the risks

Now you’ll need to assess how likely each hazard is to harm each person who accesses the rooftop, from your monthly maintenance workers to your annual gutter cleaners, and to what severity. The easiest way to do this is with a risk matrix:

1. Score the likelihood of harm to each person from one to five (very unlikely to almost certain)
2. Score the severity from one to five (minor injury to fatality)
3. Then, multiple the two together

The higher the score, the more urgently you need to control the hazard.

3) Put the correct controls in place

Once you have assessed every risk on your rooftop, the next step is controlling those risks. The HSE’s hierarchy of controls provides a simple framework to follow before any work at height takes place. You must:

1. Avoid working at height if it is practical to complete the job in another way
2. If work at height cannot be avoided, you must install collective protection, like roof guardrail systems, walkways, and skylight covers, to prevent the likelihood of falls
3. If the risk can’t be eliminated with collective protective, you should issue each worker with personal fall protection, like a work restraint or fall arrest harness, to minimise the severity of a fall

Collective protection automatically protects everyone on the rooftop, whereas a harness only protects the person that’s wearing it. That’s why you should always prioritise collective protection over personal protection.

4) Record your findings

If you employ five or more people, you must write down the key findings from your working at height risk assessment. You’ll need to include:

• The site address, roof area, and date of assessment
• The name of the competent person who has carried out the assessment
• Details of each hazard, including who it affects and how
• The existing controls already in place and any further controls needed
• Who is responsible for implementing those controls and by when
• The date your next inspection will be carried out

Make sure the findings you record are specific to your site. If you just use a generic template for all the buildings you manage, it may not stand up to scrutiny if an accident occurs on your rooftop.

5) Review and update your document

A height safety risk assessment should be a work in progress. Make sure you review and update the document after:

• Any change occurs to the roof or its plant
• Any change occurs in who accesses the roof or how often
• An accident or near miss
• A failed inspection

You’ll need to ensure that each piece of collective protection on your rooftop is checked on a regular basis, too. For example, you’ll need to inspect your permanent roof guardrails every 12 months and hold a System Technical File for the lifetime of the system. If you’re not sure when you need to carry out inspections for each system, contact the manufacturer for advice.

Protect everyone accessing your rooftop with Katt Safety

We supply a range of permanent collective protection systems, including modular aluminium guardrails, walkways, skylight covers, and fixed access ladders, to keep everyone safe when accessing your rooftop. All our systems are designed to the relevant British Standards and are backed by a 10-year warranty as standard for your piece of mind.

Not sure which protection you need? Simply send us your drawings, and we’ll identify the safest and most efficient solution for your site. Contact our expert team to get started.

FAQs

Who is responsible for carrying out a rooftop risk assessment?

Both the employer and the building owner/duty holder are responsible for carrying out a rooftop risk assessment. The employer of the people working on a roof is responsible for assessing the risks to their safety, while the building owner or duty holder is responsible for the safety of the roof itself.

What does HSE require in a roof assessment for roofing work?

When carrying out a rooftop risk assessment, you must follow these five steps: identify the hazards, assess the risks, control the risks, record your findings, and review the controls. The HSE also mandates that you follow the hierarchy of controls when planning roof work, which means putting collective protection ahead of PPE.

How often should a rooftop risk assessment be reviewed?

You should review your risk assessment whenever something changes (like the roof layout or plant on it, or who accesses it), and after any accident or near miss. Even if nothing changes, we recommend that you review the document annually, alongside your annual guardrail inspection.

Is a harness enough to control the risk of a fall from a roof?

A harness may be enough to control fall risks on your roof. However, you should always prioritise collective protection, like guardrails, walkways, and skylight covers, above personal fall protection. Personal protection should only be used as a last resort if the risk can’t be controlled by collective protection.