The Difference Between a Risk Assessment and a Method Statement

If you've ever been handed a RAMS pack and wondered whether the two documents inside are basically the same thing written twice, you're not alone. A risk assessment and a method statement do different jobs — and confusing them leads to paperwork that looks thorough but protects nobody.

What a Risk Assessment Is

A risk assessment is an analysis. Its job is to identify what could go wrong, who could be harmed, and what controls will reduce that risk to an acceptable level.

Under Regulation 3 of the Management of Health and Safety at Work Regulations 1999, almost every employer and self-employed person must carry out a suitable and sufficient risk assessment before work begins. "Suitable and sufficient" means it must reflect the actual task, the actual site, and the actual people doing the work — not a generic template pasted in without thought.

A risk assessment typically records:

• The hazards present (e.g. working at height, moving machinery, hazardous substances)
• Who is at risk and how
• Existing controls already in place
• Additional controls needed
• The residual risk level after controls are applied
• Who is responsible and when the assessment is reviewed

The output is a decision: is the risk adequately controlled? The assessment drives what you do. It does not, by itself, tell workers how to do it step by step.

What a Method Statement Is

A method statement is an instruction document. It describes the sequence of work in enough detail that operatives know exactly how to carry out the task safely.

There is no single regulation that universally mandates a method statement for all work — but they are commonly required by:

• Principal contractors under CDM 2015, as part of managing construction phase health and safety
• Client specifications and permit-to-work systems, particularly in facilities management, utilities, and industrial settings
• High-risk activities such as work at height, confined space entry, or hot works, where a step-by-step safe system of work must be documented

A method statement typically includes:

• A description of the activity and its location
• Plant, equipment, and materials to be used
• The sequence of operations, written in plain English
• The controls identified in the risk assessment, translated into practical steps
• Responsibilities — who supervises, who does what
• Emergency and rescue arrangements where relevant

Think of it this way: the risk assessment answers "what are the risks and how do we control them?" — the method statement answers "how do we actually do the job safely, step by step?"

How They Work Together as a RAMS

In practice, the two documents are almost always produced together and issued as a single RAMS (Risk Assessment and Method Statement) pack. They are complementary, not interchangeable.

The method statement should be consistent with the risk assessment — if the risk assessment identifies that edge protection is required for work at height under the Work at Height Regulations 2005, the method statement must describe how and when that edge protection is erected and inspected. Controls that appear in the risk assessment but never make it into the method statement are controls that won't get followed on site.

Common Mistakes to Avoid

Generic documents. A risk assessment copied from a previous job and never updated for site-specific conditions is unlikely to be "suitable and sufficient" under the 1999 Regulations.

Controls that stop at the risk assessment. If PPE, permits, or isolation procedures are identified as controls, they must appear as concrete steps in the method statement.

Method statements with no clear link to hazards. Some method statements describe the sequence of work but never explain why certain steps exist. Workers then skip steps they don't understand.

Mistaking a fire risk assessment for a RAMS. A fire risk assessment carried out under the Regulatory Reform (Fire Safety) Order 2005 is a standalone statutory document — it does not require a method statement and follows its own format and review duties.

A Practical Rule of Thumb

Use this to sense-check your documents before submitting them:

• Could a competent person read your risk assessment and understand every significant hazard and why the chosen controls are appropriate? If yes, the risk assessment is doing its job.
• Could an operative read your method statement and carry out the task safely without needing to ask questions? If yes, the method statement is doing its job.

If either answer is no, the document needs more work — regardless of how many pages it runs to.

The Bottom Line

A risk assessment and a method statement are distinct documents with distinct purposes. One analyses risk; the other instructs on method. Together as a RAMS, they form a complete safe system of work. Keeping the distinction clear means your documentation is genuinely useful to the people on the tools — which is the entire point.