What did your stress risk assessment find? The questions to ask
HSE says employers have a legal duty to assess the risk of work-related stress and act on it, and with five or more workers to write the risk assessment down. These seven questions help you find out what the assessment found and what changed because of it.
In CIPD’s 2025 survey of 1,101 UK organisations, 64% said they were taking steps to identify and reduce stress at work, 28% said they were not and 8% did not know. These are what respondents reported for their own organisations, not an audit. They do not show whether an organisation has done a risk assessment. The questions in this guide are for finding out what yours is doing about stress, what its risk assessment found and who is acting on the findings. CIPD, Health and wellbeing at work 2025, survey of 1,101 UK organisations, YouGov, March to April 2025
Enter your details to read the full guide
The rest of the guide covers what the law and HSE actually ask of an employer, where the board comes in and what these questions are not, then seven questions to ask about work-related stress, each with why it matters and what a strong and a weak answer sound like: what the last risk assessment found, which groups it found especially at risk, what was decided and who owns it, which of the board’s own decisions changed the risk, who on the board speaks for it, where ISO 45003 fits and whether a manager who noticed someone struggling would know what to do. One-off, you won’t need to do this again on this device.
What the law asks for, and where the board comes in
The health and safety duty on work-related stress is older and plainer than much of what is said about it.
What the law asks for
The Health and Safety at Work etc. Act 1974 gives every employer a duty to ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees (section 2), and a related duty to others affected by its work (section 3). The Management of Health and Safety at Work Regulations 1999 require a “suitable and sufficient” assessment of the risks (regulation 3(1)) and, where there are five or more employees, a record of its significant findings and of any group it identified as especially at risk (regulation 3(6)). None of these provisions uses the word stress. HSE says it belongs there: employers “have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it”, assessing it “in the same way as” other risks. For most people, HSE adds, the write-up “does not need to be a big exercise”, just a note of “the main points about the significant risks and what you decided”. So “written down” means the significant findings, not a separate stress document or a stress policy. This is the law in Great Britain.
Where the board comes in
HSE and the Institute of Directors say health and safety “must be led by the board”, and that the board should review health and safety performance “at least once a year”. Their guidance covers health and safety in general, not stress specifically; HSE treats work-related stress as a health and safety risk, so we read it as covering stress too. For employers using its Management Standards approach, HSE also suggests a project champion: a director responsible for sickness absence or health and safety, who represents the project at the board and updates it on progress. None of this asks the board to carry out the assessment. In our view, leading on stress starts with knowing what the assessment found.
They are not a checklist, not an audit and not a test of whether anyone’s assessment is suitable and sufficient, which is not ours to judge. HSE and the Institute of Directors publish their own, wider questions for directors in Leading health and safety at work; the seven below are ours, not HSE’s. ISO 45003 is voluntary guidance, and nothing here assesses anyone against it.
Seven questions to ask about work-related stress
Ask them in any order and in your own words. Each comes with why it matters, then what a strong and a weak answer sound like. A weak answer is not a failing: it tells you where to look next.
What did our last risk assessment find about work-related stress?
Once there are five or more employees, the record the law asks for is the significant findings of the assessment. Hearing that an assessment exists is not the same as hearing what it says, and only the second gives anyone something to act on. Knowing the main things it found lets you test everything else against them, including any wellbeing plan.
- A strong answer: “Two things stood out: workload in the claims team since the case system went in last year, and deadlines moved at short notice in client services.”
- A weak answer: “It’s done and filed.” That tells you the assessment exists, not what it found.
- If there isn’t one: “Stress isn’t in our risk assessment” or “I don’t think we’ve done one.” Then assessing stress is the first action, and questions 2 to 4 depend on it. HSE’s stress risk assessment page has a template and example assessments, from a nine-person bakery to a 150-person college. HSE’s Management Standards cover six areas of work design that can affect stress.
Which groups did it find were especially at risk?
The regulations ask for exactly this: where there are five or more employees, the record includes any group the assessment identified as especially at risk. Naming a group turns a finding into something you can follow: you can ask about that team or role at the next review and check whether later decisions landed on the same people.
- A strong answer: “New starters in the claims team in their first three months, and team leaders in client services covering vacancies.”
- A weak answer: “Overall we’re in a reasonable place.” That describes the organisation, and the question asked for a group.
What did we decide to do about each finding, who owns it and by when?
HSE describes the duty as doing a risk assessment and acting on it, so the findings are only half of it. Its Management Standards guidance says each action should be assigned to an individual or function and have an agreed realistic timescale for completion, and that the action plan should be agreed with senior managers and employee representatives. Without an owner and a date, nobody is due to report back on a finding.
- A strong answer: “Each finding has an action, a named owner and a date. The claims team action is done. The client services one slipped by a month because the new workflow tool arrived late, and it has a new date.”
- A weak answer: “It’s with the wellbeing working group.” That says who holds the file, not who owns each action or when it is due.
Which of our own decisions this year changed the risk?
The regulations require an assessment to be reviewed if there is reason to suspect it is no longer valid or there has been a significant change in the matters it relates to. Many of the largest changes to how work is organised, such as a restructure, new targets, a system rollout or a change to where people work, are signed off at board level. So the board sees many changes before they happen. HSE and the Institute of Directors advise boards to “design-in” health and safety when implementing change. For stress, that means asking for the risk to be looked at again before the change goes live.
- A strong answer: “The restructure in June. We looked again at the risk for the two merged teams before it went live, and again three months in.”
- A weak answer: “It’s reviewed every year.” A yearly review is a fine backstop; the weak part is waiting for it after a change.
Who on the board speaks for this, and when did we last hear from them?
HSE and the Institute of Directors say board members have both collective and individual responsibility for health and safety. For Management Standards work, HSE suggests a director as champion, who represents the work at the board and updates it on progress. Asking who that is here, and when the board last heard from them, shows whether those updates are actually reaching it.
- A strong answer: “Our operations director holds health and safety. Stress risk was last on the agenda in September, with the three-month review of the merged teams, and it comes back in April.”
- A weak answer: “It came up at a strategy day once.” That was one discussion, and it names nobody who will bring the next update.
Where does ISO 45003 fit, if we use it?
ISO 45003, published in 2021, gives guidelines, not requirements, for managing psychosocial risk within an occupational health and safety management system based on ISO 45001. Because it contains no requirements, there is no accredited certification to it. Adopting it is voluntary, as it is for ISO 45001. It can be a useful reference for how to look at psychosocial risk. It does not replace the risk assessment the law asks for, and the employer remains responsible for that.
- A strong answer: “We use it as a reference for how we look at psychosocial risk. The findings and the actions are our own, and they are in the risk assessment.”
- A weak answer: “We’re aligned to ISO 45003, so that’s covered.” Alignment with voluntary guidance does not tell you what the assessment found.
If a manager noticed someone struggling, would they know what to do? How do we know?
An organisation’s risk assessment usually looks at risk across teams and roles. An individual’s struggle may show first in their work, to the person who manages it. This question tests whether the arrangements reach the line: whether managers in the teams the assessment flagged know the early warning signs and where to signpost, and whether anyone has asked them if they feel able to act on what they notice.
- A strong answer: “We started with the teams the assessment flagged: managers in the claims team and in client services have been trained to spot early warning signs and know where to signpost. We asked them afterwards whether they feel able to act on it, and the ones who said not yet have a follow-up session booked.”
- A weak answer: “I imagine they’d raise it with HR.” That is a guess, and it suggests nobody has asked the managers.
Mental Health for Managers for the teams your assessment flags
Our Mental Health for Managers session is half a day (three hours), onsite or online, for up to 20 people, with a conversation about your organisation before delivery. It sits alongside any changes to the work itself, not in place of them: it helps the managers in those teams recognise early warning signs before challenges escalate, know when and how to signpost to professional support and help someone returning from mental health-related absence. Tell us the teams your assessment flagged and we will send a rough quote.
Enquire about Mental Health for ManagersThis guide is general information for employers and people leaders, not legal, HR or health and safety advice. It describes health and safety law in Great Britain, not employment or equality law. The seven questions and the strong and weak answers are ours, not HSE’s: they are not a compliance checklist, and nothing here assesses anyone against ISO 45003. The duty is from the Health and Safety at Work etc. Act 1974, section 2 and section 3, and the Management of Health and Safety at Work Regulations 1999, regulation 3. HSE’s position and the starting points in question 1 are from Work-related stress and how to manage it: stress risk assessment, and its guidance on owners and timescales for actions from Management Standards step 4: record your findings. Board leadership and the “design-in” advice on change are from Leading health and safety at work (INDG417), published by HSE and the Institute of Directors, and the project champion from Management Standards: before you start. ISO 45003’s scope is from ISO’s catalogue entry for ISO 45003:2021, the position on certification from BSI’s page on ISO 45003 and the choice to adopt ISO 45001 from HSE’s page on ISO 45001. The stat bar is from Health and wellbeing at work 2025, published by CIPD in September 2025 from a YouGov survey of 1,101 HR professionals and managers with a major say in HR decisions, with fieldwork from March to April 2025. It is what respondents reported for their organisation, not an audit. Related reading: our post ISO 45003 explained: what it covers, what it does not and the duty that already applies.