UK edition. This guide is written for volunteer-run clubs in the UK. Where rules differ — grants, tax, incorporation, safeguarding — follow the UK-specific pointers below or check with your national body.
The room booking form asks for it. So does the grant application. So does the external venue, and so — buried in the affiliation pack nobody read — does the insurance cover you assumed you already had. Somewhere between "let's do a quiz night" and a hundred and twenty people in a function room, a member of your committee has to produce a risk assessment. Usually at 11pm. Usually the night before the deadline. Usually by opening last year's, changing the date and hoping.
That copy-paste version is worse than useless, because it looks like diligence while containing none. A risk assessment is not really a document. It is twenty minutes of your committee sitting down and asking honestly what could go wrong at this event, in this room, with these people — and then writing down the cheap, obvious things that make each of those less likely. The document is the receipt for that conversation, not the conversation itself.
This guide gives you the five-column form your student association will accept, the hazards that genuinely turn up at society events (they are rarely the ones the template lists first), controls that cost nothing, a fully worked example for a 120-person quiz night, and a twenty-minute version you can run every week without anyone resenting it. It is general information rather than legal or safety advice — your student association's own form, policies and safety staff are the authority for your campus.
What a risk assessment is actually for
It does three jobs, and only one of them is paperwork.
It forces the thinking while you can still change something. Two weeks out you can move the start time, cap the numbers, swap home-cooked food for catering or move the speaker so its cable does not cross the doorway. On the night you can do none of that. Almost every genuinely bad society event story ends with "we noticed at the time, but it was too late to do anything".
It tells the people on the door what they are supposed to do. This is the part committees skip. An assessment written by one person, submitted, approved and never read again has protected nobody. The controls only exist if the four people running the event know they are theirs.
It is the key that unlocks everything else. In most systems your affiliation, your venue booking and your cover all hang off having an approved assessment on file. It is not a hoop you jump through after the event is confirmed — it is frequently the thing that confirms it.
What it is not: a shield. Writing "committee will monitor" next to a serious hazard is not a control, it is a sentence. And it is not permanent. An assessment written for a 40-person social in a seminar room does not cover the same social when 140 people RSVP and you move to the big hall. If the numbers, the venue, the timing or the activity changes, the assessment changes with it.
The single best habit: write the risk assessment and the event run sheet in the same sitting. Every "further action" in column five should end up as a line on the run sheet with a name and a time against it. If it cannot, it was never going to happen. Our end-to-end event guide covers the run sheet side in detail.
The five columns every form has
Association forms look different and ask the same five things. Learn the columns rather than the template and you can fill in any version of it.
| Column | What actually goes in it | The mistake committees make |
|---|---|---|
| 1. Hazard | A specific thing that can cause harm: "PA cable running across the main doorway" | Writing "the event" or "alcohol" with no detail |
| 2. Who might be harmed, and how | Members, committee, venue staff, contractors, passers-by — and the injury | Listing only "attendees" and forgetting your own volunteers |
| 3. Controls already in place | Things that are true today, not things you intend | Writing aspirations as if they were arrangements |
| 4. Risk rating with those controls | Likelihood × severity, honestly | Rating everything low so it sails through approval |
| 5. Further action, owner, date | One extra thing, one named person, one deadline | Leaving the owner column blank, which means nobody |
Rate it with a three-by-three grid
Five-by-five matrices are for organisations with a safety officer. A committee of six needs three levels each way, and it needs them defined in words a first-year can apply at speed.
Likelihood — Unlikely (has not happened at an event like this and would need something unusual) · Possible (has happened somewhere on campus in the last couple of years) · Likely (happens at most events of this type).
Severity — Minor (dealt with on the night: a graze, a spill, someone sent home in a taxi) · Serious (hospital, the event stops, a real amount of money lost) · Severe (life-changing injury, or the kind of incident that ends a society).
Multiply and you get three bands. Green: run it as planned. Amber: run it, with the named controls actually in place and a named person accountable for each. Red: do not run this event in this form — change the activity, the venue, the numbers or the time until it is not red.
Use two rating columns: risk before controls and risk after. That second column is the whole point. If a hazard is red before your controls and still red after, you have written a wish rather than a control, and the reviewer will notice before you do.
Your assessment goes to the students' union's activities team, almost always through the union's own online activity or event registration system rather than by email to a person. Until a societies coordinator signs it off, the room booking, the minibus, the external speaker and the union's insurance are all provisional — and committees discover that on the Thursday before a Saturday event with dispiriting regularity.
Typical lead times run ten to fifteen working days for a standard on-campus event, and considerably longer for anything on the union's higher-risk list: off-campus venues, external speakers, water, heights, vehicles, contact sport or overseas travel. Most unions also require named committee members to have completed activities or health and safety training before they can submit anything at all, so check that box in the first fortnight of your term rather than the week of the event. Some unions hold a generic assessment for your regular weekly activity and only ask for a fresh one when something changes.
Underneath the union sits health and safety law, which reaches clubs through the duty owed to people who are not employees, and the Health and Safety Executive publishes guidance written for voluntary organisations. This is general information — your union's societies handbook governs.
The hazards that actually happen at society events
Generic templates open with fire, electricity and manual handling. Real incident logs open with alcohol, getting home, and rooms with more people in them than the fire notice allows. Write for what actually happens.
| Hazard | What it actually looks like | Controls that genuinely work |
|---|---|---|
| Alcohol | Someone arrives already heavily affected after drinking beforehand — the highest-risk person is rarely the one you served | Two named sober committee members; free water on every table; food; a stated rule for turning people away; no unlimited free bar |
| Getting home | 11pm, dark, one person walking alone, no transport running | Finish before transport stops or arrange a shared taxi fund; a buddy rule; the welfare contact's number on the poster |
| Overcrowding | A room rated at 100 with 140 RSVPs, and everybody arrives in the same twenty minutes | Ticket to a hard cap below capacity; count people at the door; a nominated person who owns the number |
| Trips, cables, clutter | The PA lead across the main doorway; boxes stacked in front of the fire exit | Tape every cable; walk the room once before doors open; keep exits clear and photograph them |
| Food | Home-cooked curry sitting warm for four hours; an allergen nobody labelled | Buy catered or shelf-stable food; label everything; collect allergen information at sign-up, not on the night |
| Medical | Fainting, an asthma attack, a seizure, low blood sugar — and nobody knows who has what | A named first aid contact; a kit that has been checked; emergency contacts collected in advance; a quiet room |
| Set-up and pack-down | A 25kg speaker carried down stairs by one person at midnight; someone standing on a chair | Two-person lifts written into the run sheet; a step ladder, never a chair; pack down while people are still sober |
| Behaviour and exclusion | Harassment, a gatecrasher, someone who has to be asked to leave, pressure to drink | A code of conduct on the ticket page; a named welfare contact; a written script for asking someone to leave; venue staff briefed |
| Cash | $600 in a tin on a table by the door at 10pm | Sell tickets online in advance; two people count; nobody walks home holding it |
| Physical taster sessions | Thirty people who have never done the activity trying it in one hour | A qualified instructor; ratios; a briefing; kit checked; a genuine opt-out that is not embarrassing |
| Off-campus venues | Someone else's building, someone else's rules, and no idea where the assembly point is | Visit first; ask for their evacuation plan and capacity in writing; get the duty manager's mobile number |
| Fire and evacuation | Nobody on the committee can name the assembly point | Two committee members walk the exits before doors open; the assembly point goes on the run sheet and in the briefing |
Two patterns are worth naming because they cause a disproportionate share of real incidents. The first is the gap between RSVPs and capacity: free RSVPs convert at roughly 55–70%, so a free list of 140 for a 100-capacity room is fine right up until the week your society is popular and it is not. If capacity genuinely matters, sell a ticket — even at $2 — because paid tickets convert above 90% and give you a hard number.
The second is the last hour. Most of what goes wrong at a society event happens between the last drink and everybody actually being home: the pack-down, the walk to the station, the person who has quietly disappeared. Write controls for that hour specifically, because the templates never do.
Alcohol: the hazard your form is judged on
If your event involves alcohol, the reviewer will read that section first and skim the rest. It is worth writing properly.
The thing to understand is that your controls at the event are only half the picture. A large share of alcohol harm at student events originates before anyone arrives — people drink cheaply at home and turn up already at their limit. That means "we will serve responsibly" is an incomplete control on its own. The controls that actually move the needle are about arrival, atmosphere and exit.
Five rules that hold up anywhere. Never run an unlimited free bar — it converts a social into a drinking competition and no amount of monitoring rescues it. Always provide free water and genuinely appealing non-alcoholic options, positioned as an equal choice rather than an apology; a jug of tap water in the corner is not that. Always provide food, and put it out at the start rather than at the end. Never make drinking the price of belonging — no initiations, no forfeits, no "you have to" games; this is the single fastest way for a society to lose recognition. And name two sober committee members on the form, with their names on the run sheet and their phone numbers on the poster, whose only job is to notice people.
The exit deserves its own line. Decide in advance what happens if someone is too affected to get home safely: who stays with them, who calls whom, where the taxi money comes from, and who tells the association afterwards.
Where the venue holds the premises licence — the union bar, a pub, a hired hall — the designated premises supervisor and their staff carry the licensing obligations: refusing service to anyone drunk, refusing sale to under-18s, and operating whatever age-verification policy the licence requires. Your job is to brief the duty manager on what the night is, agree a signal for cutting someone off, and make sure your committee does not undermine them by buying for someone who has just been refused.
Where you want to serve alcohol somewhere unlicensed, a temporary event notice is the usual route and it has to be given to the licensing authority well in advance, with limits on how many any one person can give in a year. Most unions will not let a society do this independently; they will route you through their own licensed spaces instead, which is generally the right answer.
The rule that matters most is the initiations one. Union policy almost universally bans initiations, drinking games and any activity that pressures members to drink, and treats a breach as a disciplinary matter that can suspend the entire society rather than the individuals involved. This is general information — your union's alcohol and conduct policy is the authority.
Controls that are worth writing down
A control is only real if it changes something. Work down this order and stop as soon as the hazard is genuinely handled — the cheapest controls are almost always the ones at the top.
- Remove the hazard. Start the event at 6pm so people go home in daylight. Do not put the speaker where its cable crosses the doorway. Do not serve home-cooked food.
- Change the activity. Buy catered food instead of asking members to cook. Hire the equipment with an operator rather than running it yourselves. Book a venue with its own staff.
- Change the physical set-up. Tape the cable, move the tables to widen the exit route, prop the heavy door, bring a step ladder so nobody stands on a chair.
- Rules, roles and briefings. Named people, stated ratios, a fifteen-minute briefing before doors open, a written script for asking someone to leave.
- Equipment. First aid kit, torch, hi-vis for the door team, a charged phone that is not the president's dying one.
The four roles worth naming on every form, no matter how small the event: an event lead who makes the call when something is ambiguous; a welfare contact who is sober, named and whose number is on the poster; a door who owns the number in the room; and a first aid contact who knows where the kit is. On a small event two people can hold four roles, but the roles still get written down, because "someone will deal with it" is how nobody deals with it.
A workable staffing rule for socials is one committee member per 25 attendees, with a floor of three regardless of how small the event is — two is one bad moment away from nobody being in charge. The welfare and inclusion guide covers what the welfare contact's remit actually is, and just as importantly what it is not.
Then brief the team. Fifteen minutes before doors: who holds which role, where the exits and the assembly point are, where the first aid kit is, what the cut-off signal is, what to do if someone is unwell, and who to call. It is the highest-value quarter hour of the whole night.
Waivers, medical information and what a signature does not do
Committees reach for a waiver as if it were a control. It is not. A waiver does not stop anything happening, and it does not remove your duty to take reasonable care — which is exactly why an association reviewer will glance at your waiver and then go straight back to column five.
What a waiver genuinely does is worth having. It tells participants, in writing and before they commit, what the activity involves and what it demands of them. It records that they were told. It is the natural place to collect an emergency contact and any condition your first aid contact would need to know about. And when it is versioned and timestamped, it tells you exactly which wording a given person agreed to — which matters far more than the wording itself.
Collect the minimum and hold it briefly: emergency contact name and number, anything medically relevant to this activity, allergens and dietary needs, and access requirements. Do not collect a full medical history you have no plan for, and do not keep the list after the event — print or download it for the event lead, then delete it. The trips and tours guide goes deeper on this, because a weekend away raises the stakes considerably.
Paper waivers fail in the ways you would expect: unreadable, unsigned, left in a bag, impossible to check at the door, and impossible to find six months later when someone asks. Collecting them digitally as part of the sign-up — versioned, searchable, attached to the member record — takes the whole problem away, and a digital waiver flow means the event lead can see at a glance who has completed one and who has not.
Health details are special category data under UK GDPR, which means you need a specific condition to process them — in practice explicit consent, gathered for a stated purpose and deleted afterwards. Your students' union is usually the data controller and your committee handles the data on its behalf, so the union's data policy is the rule book you actually follow. Collect the condition, not the history; hand it to the first aid contact; delete it after the event.
On the waiver itself, temper your expectations sharply. A notice or a signature cannot exclude liability for death or personal injury caused by negligence — that is settled and it applies however the form is worded. A "disclaimer" that purports to do it is not just ineffective, it can look bad. Treat the document as an information and disclosure tool, and put your effort into column five.
Most unions publish approved participation-agreement and consent wording for affiliated societies. Use theirs rather than drafting your own; it is aligned with the union's insurance and its data policy. This is general information rather than legal advice — your union's activities team and data protection contact can confirm the specifics.
A worked example: the 120-person quiz night
A society with 180 members runs a quiz night. Ticketed at $5, capped at 120, in a campus function room with a stated capacity of 140, from 7pm to 11pm. The venue's own bar is open. Prizes are donated. Two committee members are rostered sober, four in total on the roster.
| Hazard | Who / how | Existing controls | Before | Further action (owner, when) | After |
|---|---|---|---|---|---|
| Intoxication; someone unwell | Members — injury, choking, needing hospital | Venue bar staff trained; food included in ticket; free water on tables | Amber | Two named sober committee members on the roster; welfare number on the ticket page and on the door poster (Welfare officer, 5 days before) | Green |
| Getting home after 11pm | Members — assault, road injury | Event finishes while transport still runs | Amber | $60 taxi contingency in the budget; buddy rule announced at last question (Events officer, on the night) | Green |
| Overcrowding at the door | Members, venue staff — crush, blocked exit | Hard ticket cap at 120 against 140 capacity | Green | Door team counts arrivals; late entry closes at 8.30pm (Door lead, on the night) | Green |
| PA cable across the main doorway | Everyone — trip, fracture | None yet | Amber | Reroute behind the stage and tape; walk the room at 6.30pm (Tech, on the night) | Green |
| Allergen in the catered food | Members — anaphylaxis | Caterer supplies an allergen list | Amber | Allergen question added to the ticket form; labels on every platter (Events officer, at set-up) | Green |
| No first aid response | Anyone — delayed treatment | Venue has a first aider on shift until 11pm | Amber | Society kit checked and brought; first aid contact named; venue duty manager's mobile on the run sheet (Secretary, 2 days before) | Green |
| Harassment or unwanted behaviour | Members — harm, exclusion | Code of conduct on the ticket page | Amber | Welfare contact named and visible; script for asking someone to leave briefed to the roster (President, at the 6.45pm briefing) | Green |
| Cash on the door | Committee — theft, loss | Tickets sold online in advance | Green | No cash sales at all; walk-ups directed to the online link (Treasurer, from booking) | Green |
| Pack-down after 11pm | Committee — manual handling injury | Four people rostered to stay | Amber | Two-person lift rule for the PA; nothing carried down stairs alone (Events officer, on the night) | Green |
| Evacuation | Everyone — injury in a real emergency | Venue has a plan | Amber | Two committee members walk the exits at 6.30pm; assembly point stated in the briefing and on the run sheet (Event lead, on the night) | Green |
Ten rows, twenty minutes, nothing invented and nothing exaggerated. Notice how many of the "further actions" cost nothing at all — the expensive one on that sheet is a $60 taxi contingency, and it is the line most likely to matter. If your flagship event is bigger than this, the ticketing guide covers capping numbers against a venue minimum without gambling the society's money.
The twenty-minute version for routine events
You do not write a fresh assessment for every Tuesday meeting. Write one standing assessment for your regular activity — same room, same shape, same numbers — get it approved once, and then run a five-question delta before each specific event:
- Is the venue different? (New room, off campus, outdoors, someone else's building.)
- Are the numbers materially different, or is it near capacity?
- Is alcohol involved, or is it involved differently?
- Is the activity different — anything physical, anything with equipment, anything new?
- Are the people different — under-18s, members of the public, guests from outside the society, anyone with an access or medical need you have been told about?
Five no's means the standing assessment covers it; note the date and move on. Any yes means you write the rows that change, not the whole document again. Most associations will accept exactly this, and many prefer it — a live one-page delta beats a fourteen-page document written once in September. Ask when you submit your standing assessment whether they will run it that way. The room bookings guide covers holding a recurring slot, which is the other half of making regular activity easy.
Sign-off, the night itself, and the debrief
Three practical points close the loop.
Sign-off should be at least two people. The event lead writes the assessment because they know the detail; the president or a nominated safety lead signs it because a second brain catches the thing the first one normalised; your student association approves it because that is what makes it count. Put a version number and a date on it, and if something material changes after approval — the venue moves, the numbers double — resubmit rather than hoping.
On the night, the assessment has to be present. A printed copy in the box with the first aid kit, a digital copy on two phones, and the four named roles briefed. If nobody on the night can tell you what the assessment says, you did the paperwork and skipped the safety.
Afterwards, write down what actually happened — including the near misses, which are free lessons nobody had to get hurt for. The wobbly table, the fire door propped open by a caterer, the person who nearly got left behind. A ten-minute debrief in the next committee meeting, with the notes attached to the event record, is what stops next year's committee rediscovering the same hazard the hard way. Recording incidents and near misses in the society's own system rather than a group chat means they survive the handover and can be quoted back in your next funding application, where "we run 30 events a year and log every incident" reads considerably better than silence. For the club-level version of this loop — an annual register rather than a per-event form — see our risk management guide.
Report anything that caused or nearly caused injury to your students' union's activities team, usually within 24 hours and on the union's own incident form. This is normally a condition of the insurance you are relying on, and late notification is a common way a society discovers a claim will not be paid.
Above that sits a separate legal obligation. RIDDOR sets out which deaths, specified injuries, over-seven-day incapacitations, occupational diseases and dangerous occurrences the responsible person must report, and to whom. Where your activity happens on university or union premises the responsible person is usually them rather than you — which is another reason to report upward quickly rather than deciding for yourself that it was minor.
Put the practical numbers on the run sheet before you need them: 999 (or 112) for emergencies, campus security, and the venue duty manager's mobile. Then write it up the same night, while the sequence is fresh — memory degrades fast, and the detail is exactly what gets asked for weeks later. This is general information; your union's incident procedure is the authority for your campus.
Frequently asked questions
Do we really need a risk assessment for a pizza night in a seminar room?
You need one on file, but you almost certainly do not need a new one each time. Write a single standing assessment covering your regular activity — the room, the usual numbers, food, the walk home afterwards — get it approved once, and then run the five-question delta before each session to check nothing has changed. A pizza night that suddenly attracts 90 people instead of 25, or moves to someone's flat, has changed enough to need its own rows. The real answer to "is this too small to bother" is that the assessment for a genuinely small event takes about ten minutes, so the question rarely earns the time spent debating it.
How long should a risk assessment actually take?
Twenty minutes for a normal on-campus event, once you have done two or three of them. The reason committees experience it as a weekend of work is that they start with a downloaded template and try to answer every prompt, most of which are written for a construction site. Start with the room and the hour instead: walk through the evening from set-up to pack-down, note the six to ten things that could realistically go wrong, and write one control against each. A big off-campus event, a trip away or anything involving an outside provider is a different job and deserves a couple of hours plus a site visit.
What do we do when a hazard is still high risk after every control we can think of?
You change the event, and that is a legitimate outcome rather than a failure. Move the finish time so nobody walks home at midnight, cap the numbers below the room's capacity, drop the activity that needs an instructor you cannot get, or move to a venue with staff and a licence. If you genuinely cannot get a hazard out of the red band, do not run it in that form and say so plainly on the form — reviewers trust a committee that shows its working far more than one whose every row is conveniently green. Escalate early to your association's staff; they have usually seen the same problem solved on another campus.
Who signs the risk assessment — the president or the whole committee?
At least two people, with the association as the third. The person running the event writes it because they know the detail, the president or a nominated safety lead signs it because a second reader catches what the first one had stopped seeing, and your student association approves it because that approval is usually what activates your cover and confirms your booking. Record all of that against the event rather than in someone's inbox, so next year's committee inherits both the assessment and the evidence it was approved. Our committee roles guide covers who should hold the safety brief on a small committee.
Does our student association's insurance actually cover us?
Usually yes for approved activities, and the word doing the work in that sentence is "approved" — cover typically attaches to activities your association has signed off, which is why the risk assessment is upstream of the event rather than filed after it. Every policy also carries an exclusions list, and student committees discover it at the worst possible moment. Read it once at the start of your term, and ask specifically about anything off campus, anything on or in water, anything at height, anything with a vehicle and anything involving a paid outside provider. This is general information rather than insurance advice — your association's staff can confirm what your society is actually covered for.
Your students' union almost certainly holds a block public liability policy covering affiliated societies' approved activities, frequently through the national insurance scheme most unions buy into. That scheme works from a graded activity list, and learning how your union's version is structured is twenty minutes very well spent.
Typically activities fall into three bands: ordinary things covered automatically, a middle band covered only if you notify the union in advance and get sign-off, and an excluded band the policy will not touch without a bespoke arrangement. Water, height, motorsport, martial arts and contact sport usually sit in the upper bands, as does anything with an outside instructor. Overseas travel is nearly always outside the standard policy and needs cover arranged separately through the union — societies planning a tour discover this far too late with some regularity.
Two habits are worth building. First, any external provider — an instructor, a coach company, a caterer — should give you their own certificate of insurance before you book, kept with the event record. Second, note the incident notification window in the union's procedure, because a late report is among the most common ways a society discovers a claim will not be paid.
This is general information rather than insurance advice — your union's activities team can confirm what your society is covered for.
Where ClubHelix fits
A risk assessment is only as good as the system around it: the sign-up form that collected the allergen and the emergency contact, the waiver that is versioned and searchable, the attendance number that tells you whether you were near capacity, and the incident log that survives the handover. When those live in four different tools owned by four different graduates, the assessment is an isolated document rather than part of how the society runs.
ClubHelix puts the society's sign-up and event forms, digital waivers and incident and near-miss reporting in the same place as the member register and the event itself — so the event lead can see who has completed a waiver, the welfare contact can pull the emergency contacts, and next year's committee inherits both the paperwork and the lessons. See how it fits together for university clubs and societies, and the pricing page covers the free tier for building the site and trying it out, with taking payments online and being found in search on the paid plans.
Keep the whole event trail in one place: forms and sign-ups, digital waivers and incident reporting that outlives your committee. Start free before your next event deadline.
