Council lone worker risk assessments get rejected in audits for one reason: they describe a job title instead of the actual hazards someone faces on a specific visit. This guide sets out how to write a lone worker risk assessment for council staff that survives HSE scrutiny in 2026 and actually changes what happens when someone works alone.
- A lone worker risk assessment for council staff must name tasks, not job titles - unaccompanied home visit after 5pm is a hazard, social worker is not.
- HSE's five-step framework - identify, decide who's harmed, evaluate, record, review - is the minimum structure that holds up in a 2026 audit.
- Paperwork without a check-in mechanism is a document, not a control measure - pair it with a lone worker app or GPS device.
- Set dated review triggers: annually, after any incident, and whenever a role or site changes.
Why this matters
Councils employ some of the widest range of lone workers of any UK employer - highways inspectors on unlit roads, environmental health officers visiting unregistered premises, park wardens locking up after dark, home care and social work staff entering private households alone. Each of those roles carries a different hazard profile, and a single generic risk assessment covering "field staff" doesn't satisfy Section 3 of the Health and Safety at Work Act 1974, which puts the duty of care on the employer regardless of where the work happens.
When an incident does occur, RIDDOR sets firm reporting windows: 10 working days for specified injuries, 15 working days for injuries causing more than seven days off work. Auditors and insurers both check whether the risk assessment that preceded the incident actually named the task involved - if it didn't, the council is exposed on liability, not just compliance paperwork.
Getting the structure right also determines whether GPS fleet tracking for local council fleets and lone worker technology actually get used as intended, rather than sitting as an unused line item on a procurement spreadsheet.
What you'll need
- HSE's five-step risk assessment framework as your structural template
- A full inventory of roles and tasks that involve lone working, not just job titles
- Incident and near-miss logs from the last 12 months for every relevant department
- Escalation contacts, including out-of-hours numbers and named backups
- A device or app capable of location sharing, check-in prompts, and a panic alert
- 2-3 hours per distinct task type for a first draft; less for annual reviews
The steps
1. List every task that involves lone working, not every job
A job title hides ten different hazard levels. A housing officer doing a scheduled daytime visit to a known tenant is not the same risk as the same officer serving an eviction notice unaccompanied at 6pm. Break the role down by task, location type, and time of day before you write a single control measure.
Common mistake: writing one risk assessment per department instead of per task - this is the single most common reason council lone worker RAs fail inspection.
2. Map hazards specific to council work
Work through HSE's five steps for each task: identify the hazards, decide who might be harmed and how, evaluate the risk and existing controls, record the findings, and set a review date. Council-specific hazards include aggressive members of the public, isolated rural or industrial sites, working at height on street furniture, needle-stick and biohazard exposure for waste and grounds teams, and driving alone after dark between sites.
Common mistake: copying hazards from a generic office lone worker template - council field hazards rarely match office-based risk profiles.
3. Score likelihood and severity
Use a 5x5 matrix (likelihood 1-5, severity 1-5) to produce a risk rating from 1 to 25. Anything scoring above 15 needs a control measure in place before the task is approved to be done alone, not after.
Common mistake: scoring every task as "low" by default because the officer has done the job for years - experience doesn't change the hazard, only the perceived one.
4. Set control measures matched to the rating
High-risk tasks need more than a phone number written on a form. Pair the assessment with a buddy system for the highest-risk visits, mandatory check-in intervals, and a device with a panic function. Best lone worker safety devices for care workers covers the device categories that map to different risk tiers - the control measure has to match the score, not the budget available.
Common mistake: listing "lone worker app installed" as the control without specifying who monitors alerts and when.
5. Assign check-in intervals and escalation steps
Write the actual number into the document: 30-minute check-ins for high-risk visits, hourly for medium-risk, start/end-of-shift only for low-risk desk-based fieldwork. Name who receives a missed check-in alert and how long before it escalates to a supervisor or the police.
Common mistake: setting a check-in interval with no automatic escalation path, so a missed check-in just sits unread in an inbox.
6. Record, sign off, and distribute
Every assessment needs a named approver - typically a departmental H&S officer or line manager - and a distribution list that includes the worker themselves, not just a filing system. A risk assessment nobody has read protects nobody.
Common mistake: filing the signed document in a shared drive the field worker never opens.
7. Set review triggers with dates attached
Don't write "review periodically." Write "review by [date], or immediately following any incident, near-miss, role change, or new site addition." A 2026 review cycle that isn't dated becomes a 2027 review cycle nobody actioned.
Common mistake: relying on an annual calendar reminder with no incident-triggered review clause.
8. Audit compliance in practice
Spot-check whether the device or app named in the control measure is actually carried and switched on. A risk assessment that names a lone worker app as its primary control is worthless if the app sits uninstalled on half the fleet's phones six months later.
“If a lone worker's risk assessment doesn't name a task, it doesn't cover that task.”
Common mistake: treating the audit as a paperwork check rather than a device-in-hand check.
Troubleshooting
- Staff forget to check in: switch from manual phone check-ins to an app that pushes automated prompts and logs the response time.
- Assessments read identically across roles: rewrite by task, not job title - a single department can have five different risk profiles.
- Devices left in the vehicle once the worker is on foot: mandate a handheld or app-based device separate from the vehicle-mounted tracker for any task involving lone working outside the vehicle.
- Escalation contact unreachable out of hours: build a rota with a named primary and backup contact, reviewed quarterly.
- Paper forms go stale between reviews: move sign-off to a digital format with a review-date reminder built in, rather than a physical folder nobody revisits until the next inspection.
- New starters given last year's generic template: issue task-specific assessments at induction, not a department-wide document dated from a previous review cycle.
Tools and resources
- HSE's five-step risk assessment framework as your baseline structure
- How to set up a lone worker safety policy for field staff for the policy layer that sits above the individual assessment
- Best lone worker safety devices for care workers for matching device type to risk tier
- GPS fleet tracking for local council fleets for councils that also need vehicle-side visibility alongside on-foot lone worker protection
- Incident and near-miss logs from the previous 12 months, pulled by department
Crystal Ball's lone worker technology is built for exactly this gap - a risk assessment names the control measure, and the app or device is what makes that control measure real rather than aspirational. Councils running Crystal Ball across mixed fleets get the vehicle tracking and lone worker protection under one system, so the audit trail from risk assessment to device usage doesn't break at the handover point.
What to do next
Once the individual risk assessments are written, the harder problem is procurement and rollout across every department that has lone workers - social care, highways, environmental health, parks. Best fleet tracking software for local government fleets covers how councils shortlist a system that covers both vehicle tracking and lone worker protection without running two separate contracts.
FAQ
Is a lone worker risk assessment a legal requirement for council staff?
Yes. Section 3 of the Health and Safety at Work Act 1974 puts a duty of care on the employer regardless of where the work happens, and the Management of Health and Safety at Work Regulations 1999 requires a written assessment once you employ five or more staff.
How often should a council review a lone worker risk assessment?
At least every 12 months, plus immediately after any incident, near-miss, role change, or new site addition. A dated review clause is what auditors check first in 2026.
What's the difference between a general risk assessment and a lone worker risk assessment?
A lone worker risk assessment adds hazards specific to working unaccompanied - communication failure, delayed emergency response, and aggression with no colleague present - on top of the standard task hazards already covered elsewhere.
Do council lone workers need a dedicated device or app?
For any task scoring above 15 on a 5x5 risk matrix, yes - a written control measure without a check-in mechanism or panic alert is a document, not a control.
What happens if a lone worker misses a scheduled check-in?
The assessment should name an automatic escalation path - typically an alert to a supervisor within a set number of minutes, with a defined backup contact if the primary is unreachable.
How long does it take to write a lone worker risk assessment for council staff?
Budget 2-3 hours per distinct task type for a first draft. Annual reviews of an existing assessment take considerably less once the task breakdown is already done.
Who should sign off a council's lone worker risk assessment?
A named departmental health and safety officer or line manager, with the document distributed directly to the affected worker rather than filed away unread.
What should be logged after a lone-working incident?
The task involved, time and location, response time to any alert raised, and whether the existing control measure functioned as written - this feeds directly into the next review cycle.
One last thing
The single biggest gap in council lone worker risk assessments isn't the paperwork - it's the handover between the assessment naming a device as a control measure and that device actually being carried, charged, and switched on during the task it was written for. Audit the device usage, not just the document, and the 2026 review will look very different from the 2025 one it replaces.
