Every construction project generates risk. CDM 2015 does not leave it to chance who manages that risk, or how. The regulations distribute the risk assessment obligation across duty holders in a way that is specific enough to be enforceable — and specific enough to create liability gaps when it is ignored.
This guide explains the legal framework behind construction risk assessments, who must produce them, what they must cover, and what the principal contractor must do with them.
The legal basis
Construction risk assessments in the UK sit within a framework of overlapping duties. The primary sources are:
CDM 2015 Regulation 9(2) — designers must "consider the general principles of prevention" when preparing or modifying designs, to "eliminate foreseeable risks to the health and safety of" those carrying out construction work, those who maintain or clean the structure, and workers using the structure as a workplace. Where risks cannot be eliminated, Regulation 9(3) requires designers to "take steps to reduce or, if that is not possible, control the risks through the subsequent design process." Risk information that cannot be eliminated must be provided to the principal designer and included in the health and safety file.
CDM 2015 Regulation 8(3) — any person who appoints a designer or contractor "must take reasonable steps to satisfy themselves" that the appointee has the "skills, knowledge and experience, and, if they are an organisation, the organisational capability, necessary to fulfil the role." A subcontractor's risk assessment is one of the primary ways principal contractors demonstrate they carried out this check.
CDM 2015 Regulation 15(2) — every contractor must "plan, manage and monitor construction work carried out by them or under their control" to ensure it is "carried out without risks to health or safety." The risk assessment is the documented output of the planning stage.
CDM 2015 Regulation 15(9) — contractors must provide workers with information that includes the risks to their health and safety identified by the risk assessment and the measures taken to protect them. Risk assessments are the source document for this information.
The Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 sit behind CDM 2015 and impose a general duty on all employers to assess and control workplace risks. On construction sites, CDM 2015 structures how that general duty is fulfilled by each duty holder.
Who produces risk assessments?
Three separate risk assessment obligations apply on a typical multi-contractor project:
Designers (including the principal designer) carry out design risk assessments — identifying and eliminating or reducing hazards that arise from design decisions before they become physical risks on site. A staircase positioned in a poor structural location, a façade detail that requires working at height during installation and future maintenance, a mechanical room that cannot be safely accessed for cleaning — these are design risks that CDM Reg 9 requires designers to identify and either eliminate or control.
Subcontractors and contractors carry out task-level risk assessments covering the specific activities they will carry out on site. These are distinct from design risk assessments because they address the execution risks specific to a particular trade, site layout, and workforce.
The principal contractor does not generally produce risk assessments for subcontractors' work, but has a duty under Regulation 8(3) to review and verify those produced by the subcontractors it appoints.
The RAMS requirement in practice
In UK construction practice, subcontractor risk assessments are almost always submitted as part of a RAMS document — Risk Assessments and Method Statements. The two are distinct:
- Risk assessment: identifies the hazards present in the activity, who is at risk, what controls are in place to reduce the risk to an acceptable level, and who is responsible for implementing each control.
- Method statement: describes the sequence of operations for carrying out the work, the equipment and materials to be used, and how the risk controls will be implemented step-by-step in practice.
CDM 2015 does not use the term "RAMS" explicitly. The obligation to produce them is spread across Regulation 15 (contractor duties to plan, manage, and monitor) and Regulation 15(9) (obligation to provide workers with information on identified risks and control measures). HSE's L153 Approved Code of Practice makes the expectation explicit: the construction phase plan must address how risks identified during the pre-construction phase will be managed, and contractors are expected to produce risk assessments and method statements for the work they carry out.
The critical point: RAMS must be specific to the work on the actual project. A generic document with the previous project's address edited out does not satisfy the obligation. The risk assessment must address the specific hazards present on this site, with the actual control measures the specific workforce will use.
What the principal contractor must do
When a subcontractor submits RAMS to the principal contractor, the review is not a formality. The principal contractor has three specific obligations:
Review for adequacy. The RAMS must cover the activities the subcontractor will actually carry out, with controls that address the actual hazards on site. Generic controls ("follow safe working practices") that do not describe specific measures are not adequate.
Check for consistency with the construction phase plan. CDM 2015 Regulation 15(3) requires contractors to "comply with any directions given by the principal contractor" and "comply with the relevant parts of the construction phase plan." RAMS that conflict with the CPP — for example, describing a working sequence that creates interface risks with another trade — must be returned for revision before work starts.
Verify competence. The RAMS review is also a competence check under Regulation 8(3). If the risk assessment demonstrates that the subcontractor does not understand the hazards associated with their own work, that is evidence the subcontractor may not have the "skills, knowledge and experience" required for the appointment.
If RAMS are inadequate, the principal contractor must return them for revision and must not allow the work to commence until revised RAMS have been received and approved. Allowing work to proceed on inadequate RAMS creates liability for the principal contractor, not just the subcontractor.
Documentation and retention
When HSE investigates a construction incident, one of the first requests is for the risk assessment covering the activity that led to the incident. The question is not whether a risk assessment existed at some point — it is whether there is a dated, signed document demonstrating:
- That the specific hazards were identified before work started
- That specific control measures were recorded
- That the document was reviewed and accepted by the principal contractor
- That the workers who carried out the activity received the information in the risk assessment before they started
The most common audit failure is not the absence of a risk assessment but the absence of evidence that it was reviewed, that it was project-specific, and that workers received its contents before work started.
Keep risk assessments on file for the duration of the project. For any project where a RIDDOR-reportable incident occurred, retain them for at least three years (the RIDDOR record-keeping period). For notifiable projects where the health and safety file is produced, residual risk information from design risk assessments transfers into the H&S file at completion.
Common gaps in practice
- Generic RAMS accepted without review. The principal contractor's obligation under Regulation 8(3) is to satisfy themselves the subcontractor is competent — accepting RAMS without reading them does not satisfy this obligation.
- RAMS submitted after work starts. The purpose of the RAMS review is to assess risk before exposure. RAMS submitted after mobilisation are post-hoc.
- No record that workers received the information. Regulation 15(9) requires contractors to provide workers with information on the identified risks and the measures taken. An induction record or toolbox talk record should confirm this for each operative.
- RAMS not updated when scope changes. If the subcontractor's work scope changes materially after initial approval, the RAMS should be revisited. A document approved for groundworks does not cover an extension to include drainage.
For a structured document collection checklist covering RAMS and all other pre-mobilisation requirements, see our subcontractor onboarding documents guide. For the broader competence checking framework, see our subcontractor compliance checklist.
SubComply automates document collection and RAMS tracking — so you always have a timestamped record of what was received, reviewed, and approved before each subcontractor started work.
Sources
- The Construction (Design and Management) Regulations 2015 (SI 2015/51), Regulations 8, 9, 15
- Health and Safety at Work etc. Act 1974
- Management of Health and Safety at Work Regulations 1999 (SI 1999/3242)
- HSE L153 — Managing health and safety in construction (Approved Code of Practice)
- HSE — CDM 2015 guidance
This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.
Last reviewed: 19 August 2026