Do I need a stress risk assessment? What the law actually requires

The short answer

You already assess risk. Working at height, manual handling, machinery, dust.

Work-related stress sits under the same duty. It is a hazard like any other, and it must be assessed like any other. If you employ five or more people, the assessment has to be written down.

Most firms have not done it. Not through negligence, and not because anybody made a decision to skip it. Stress does not look like a hazard. It has no ladder and no dust, there is nothing to photograph, and until fairly recently nobody ever asked to see it.

Where the duty comes from

Two pieces of law.

The Health and Safety at Work etc. Act 1974, sections 2 and 3, which places a general duty on employers to ensure the health, safety and welfare of employees so far as is reasonably practicable. Health includes mental health.

The Management of Health and Safety at Work Regulations 1999, which require a suitable and sufficient assessment of the risks to which employees are exposed, and require it to be recorded where five or more people are employed.

Neither mentions stress by name. Neither has to. The duty is to assess risks to health, and work-related stress is a risk to health.

What “suitable and sufficient” means in practice

This is where most employers go wrong, because the phrase sounds like it could mean anything.

The Health and Safety Executive publishes the Management Standards, a framework covering six areas of work design: demands, control, support, relationships, role and change. The Standards themselves are not mandatory. But HSE has said that an employer following the Management Standards approach correctly is adopting an approach it considers suitable and sufficient.

In other words, they are not the law, but they are the benchmark a regulator measures you against. Which makes them the sensible thing to work to.

Note what those six are, incidentally. Not feelings. Design. How much work, how much say over it, what support exists, how people treat each other, whether roles are clear, and how change is handled. Four of the six are questions about how the work is organised, which is why a decent assessment usually produces things you can actually fix.

The document is not the duty

This is the part that catches out the firms who think they are covered.

HSE has been explicit that having a policy and a risk assessment is not sufficient on its own. The employer is responsible for ensuring those arrangements are effective and monitored.

An assessment run in 2019, filed, and never revisited is not a compliant risk assessment, whatever it says on the cover. The duty is ongoing.

What actually happens if you have not done one

Two different risks, and most people worry about the wrong one.

Regulatory action is real but rare. In December 2025 the HSE served a notification of contravention on the University of Birmingham over the management of work-related stress. It was one of the first high-profile enforcement actions of its kind in the UK. Prosecutions for work-related stress remain uncommon.

If it does start, the escalation runs: notification of contravention, then a fee for intervention invoice, then an improvement notice, which is publicly registered and a criminal offence to ignore, and then prosecution.

The honest summary is that you are unlikely to be prosecuted and increasingly likely to be asked.

The more immediate exposure is civil. Employment tribunals and personal injury claims arising from work-related stress take account of whether a stress risk assessment existed. Its absence is treated as evidence of failure. And insurers increasingly ask about documented psychosocial risk management at employer liability renewal.

Which is the real argument. The assessment is not primarily a shield against a regulator you may never meet. It is the document that exists when a former employee’s solicitor writes to you.

Not knowing is not a defence. It is an exhibit.

What it is costing you anyway

Setting the law aside entirely, the numbers make their own case.

HSE’s figures show 964,000 workers suffering work-related stress, depression or anxiety in 2024/25, with 22.1 million working days lost to it. That is 62% of all working days lost to work-related ill health in Great Britain.

CIPD puts average sickness absence at 9.4 days per employee per year, the highest in over fifteen years, with mental ill health the leading cause of long-term absence at 41% of cases.

For a firm of fifty people, average absence alone is roughly 470 lost days a year.

Can you do it yourself?

Yes, and some employers do. HSE publishes the Indicator Tool, the survey and the workbook free of charge.

Two things usually stop it working. Staff do not tell their own manager the real answer, so an internal survey under-reports, sometimes badly. And the analysis and action plan is a piece of work nobody has time for, which is why most internal attempts end as a spreadsheet in a folder.

If you do it yourself, do those two things properly or the exercise is worse than useless, because you will have documented a problem and then done nothing about it, which is a considerably worse position than never having looked.

The objection nobody says out loud

If I ask the question, I will get an answer, and then I am on the hook for it.

That is the real reason most firms have not done this, and it deserves a straight response.

An employer who assessed the risk and acted on it is in a strong position, even when something still goes wrong. An employer who never looked has nothing to show. The assessment does not create the liability. It answers it.

The worms are in the tin either way. The only question is whether you found them or somebody else did.