How Should You Risk-Assess Violence and Aggression at Work?

A workplace violence risk assessment should examine the real situations in which staff may be abused, threatened or assaulted, identify who could be harmed, and match practical controls to the people, place, task and time. In Ireland, the assessment must be written and its findings should feed into the organisation's Safety Statement.

What counts as work-related violence and aggression?

The Health and Safety Authority (HSA) defines work-related violence and aggression as an incident in which staff are abused, threatened or assaulted in circumstances related to their work, involving an explicit or implicit challenge to their safety, wellbeing or health. That is wider than physical assault. Threats, intimidating behaviour and verbal abuse can all be warning signs and sources of harm that the assessment should consider.

Public-facing work creates many possible interfaces: a cashier refusing an age-restricted sale, a receptionist dealing with a distressed visitor, a care worker entering a home, a hospitality employee managing an intoxicated customer, or a public-service team enforcing a decision. The job title alone does not reveal the risk. The circumstances do.

What is the legal duty in Ireland?

Section 19 of the Safety, Health and Welfare at Work Act 2005 requires every employer to identify workplace hazards, assess the risks and possess a written risk assessment. Section 20 requires a written Safety Statement based on that hazard identification and risk assessment. Where violence and aggression is a foreseeable workplace hazard, it belongs in that process.

The Act requires a risk assessment to be reviewed when there has been a significant change or another reason to believe it is no longer valid. It also requires the employer to implement improvements identified through the most recent assessment. The HSA's violence and aggression material is guidance that helps employers apply those duties; it is not a separate regulation or a substitute for assessing the circumstances of the actual workplace.

The HSA says all employers, regardless of business size, must carry out and keep a written workplace risk assessment. Its violence and aggression risk-assessment guidance and sample assessment are useful starting points, but a copied template is not evidence that local risks have been understood or controlled.

1. Prepare with evidence, not assumptions

Bring together evidence before rating the risk. Useful inputs include:

• incident, near-miss, security and customer-complaint records;
• staff reports of threats, intimidation, harassment or recurring verbal abuse;
• patterns by site, task, time, day, staffing level and type of interaction;
• information from safety representatives, supervisors and workers doing the job;
• changes to opening hours, services, access, staffing, cash handling or lone work;
• lessons from neighbouring sites, similar operations and relevant regulator guidance.

Low reporting does not necessarily mean low risk. Staff may see abuse as “part of the job”, may not know what to report, or may believe nothing will happen after they report it. Ask specifically about incidents that did not cause injury and about situations in which a worker felt unsafe.

2. Identify the situations and triggers

Describe the interaction that could lead to harm rather than writing a vague hazard such as “aggressive customers”. Consider:

• refusing alcohol, tobacco, refunds, entry, treatment, accommodation or another service;
• handling cash, medicines, high-value goods or confidential decisions;
• long queues, delays, complaints, enforcement activity and bad news;
• working alone, opening or closing, night work and reduced staffing;
• home visits, outreach work, transport duties and unfamiliar locations;
• intoxication, acute distress, cognitive impairment or a history of threatening behaviour;
• poor visibility, restricted escape routes, isolated rooms or uncontrolled access;
• online or telephone threats that could translate into an in-person risk.

A useful scenario is specific: “one employee closes the store after 23:00 and carries the till drawer through a customer-accessible area.” That makes it possible to test whether staffing, layout, cash arrangements, communications and emergency support are adequate.

3. Identify who may be harmed and how

Assess groups and circumstances, not only average exposure. New and young workers, lone workers, security staff, workers with limited experience or language support, and employees who regularly communicate refusals or enforce rules may face different risks. Consider contractors, agency staff and workers moving between locations as well as permanent site teams.

Record the possible harm realistically. It may include physical injury, shock, anxiety or longer-term psychological harm. Also consider secondary harm: a rushed escape through traffic, an unsafe restraint attempt, or a colleague entering a situation without enough information.

4. Choose controls that change the risk

Training is important, but it should not carry the whole control plan. Start by considering whether the risky interaction can be eliminated or redesigned, then combine physical, organisational and people measures. Depending on the assessment, controls may include:

• changing service, payment, refund, appointment or access arrangements to remove predictable flashpoints;
• improving visibility, lighting, counters, waiting areas, exits and secure staff-only space;
• planning staffing levels and avoiding lone work during higher-risk tasks or times;
• providing a tested way to summon help, with a clear response when an alert is raised;
• sharing relevant risk information before visits while respecting privacy and data-protection requirements;
• setting clear limits on what staff should do, including when to disengage, leave, call a manager or contact emergency services;
• training people in procedures, communication and de-escalation appropriate to their role;
• recording and following up incidents, near misses and recurring lower-level aggression.

A control should name an owner and a completion date. “Remind staff to be careful” is not a reliable control. “Move the closing cash count to a locked back office by 30 October; area manager to confirm at every site” is testable.

5. Plan the response before an incident

Workers need a simple response they can use under pressure. Define how to call for help, who responds, when to withdraw, where to move, when to contact An Garda Síochána or emergency services, and how colleagues and members of the public will be protected. Test any alarms, radios, phones or escalation routes rather than assuming they work.

After an incident, first deal with immediate safety and medical needs. Then preserve relevant information, notify the right people, support the worker, and review what happened without blaming the person exposed. Support may need to continue after the initial event; managers should know how follow-up and a safe return to work will be handled.

6. Record incidents and know the reporting threshold

The HSA recommends keeping a record of all violence and aggression incidents as good practice. Capture enough detail to support prevention: what happened, where and when, the task, staffing, trigger, warning signs, controls in use, response, harm, support provided and follow-up actions. Avoid unnecessary personal data and restrict access appropriately.

Internal records are not the same as statutory reporting. The HSA states that a workplace violence or aggression incident is reportable when an employee is injured and cannot perform their normal work duties for three consecutive days, excluding the day of the accident. Check the HSA's current reporting guidance against the facts of the case. Serious incidents may also require contact with An Garda Síochána or another relevant body independently of HSA reporting.

7. Review after signals, not just on an anniversary

Review the assessment when an incident or near miss suggests a control failed, when work or staffing changes, when a site is redesigned, when opening hours change, or when new information shows the assessment may no longer be valid. A scheduled periodic review is useful, but it should not delay action on new evidence.

Check whether controls work in practice. Ask whether staff know the escalation route, whether help arrives, whether alarms are tested, whether lone-working arrangements are followed, and whether actions close on time. Look for patterns across multiple sites; repeated “minor” incidents may point to a system problem.

How do you make the assessment work across multiple sites?

Use a common method and definitions, but retain a site-level assessment. A city-centre late-opening store, a daytime clinic and a rural home-visiting team do not have the same exposure. Central teams can set minimum controls and reporting fields; local managers should add the site, task, staffing and community factors that change the risk.

For oversight, track a small set of useful questions: which sites have completed the assessment, which high-risk actions are overdue, whether staff have received the relevant information and training, whether incidents are rising, and whether reviews were completed after significant events. The goal is not a perfect dashboard. It is timely control of a real hazard.

Primary sources

• Irish Statute Book: Safety, Health and Welfare at Work Act 2005, section 19
• Irish Statute Book: Safety, Health and Welfare at Work Act 2005, including section 20
• HSA: Work-related violence and aggression overview
• HSA: Violence and aggression risk assessment
• HSA: Control measures for workplace violence and aggression
• HSA: Reporting incidents and legislative requirements