Risk Assessment Mapping: How to Visualise Hazards on Floorplans

Risk assessment is a foundational obligation for every employer, building owner, and facilities manager operating in the United Kingdom and Ireland. The legal requirement to identify hazards, evaluate risks, and implement controls has been embedded in statute for decades. Yet the dominant format for recording risk assessments remains the spreadsheet or word-processed register — a text-heavy, tabular document that lists hazards, likelihood scores, severity ratings, and control measures without any spatial reference. This approach satisfies the minimum legal threshold but fails to communicate where hazards exist in a building, how risks cluster in particular zones, and whether controls are proportionate to the physical environment. Risk assessment mapping addresses this gap by anchoring every identified hazard to a specific location on a floorplan, producing a visual representation of risk that is immediately comprehensible to managers, safety officers, maintenance teams, and visiting contractors.

Table of Contents

• •What Is Risk Assessment Mapping
• •The Limitations of Traditional Risk Registers
• •Regulatory Context
• •Spatial Risk Visualisation: Core Concepts
• •Hazard Mapping Methodology
• •Risk Heat Maps on Floorplans
• •Integrating Risk Scores with Locations
• •Digital Risk Registers
• •Review and Update Workflows
• •Linking Risk Assessment to Incident Data
• •Key Takeaways
• •Frequently Asked Questions
• •Next Steps

What Is Risk Assessment Mapping

Risk assessment mapping is the practice of plotting identified workplace hazards, their associated risk scores, and control measures onto scaled floorplans or site plans. Rather than describing a hazard in a standalone register entry — for example, "slip hazard in kitchen due to wet floor" — the hazard is pinned to the exact room, corridor, or zone where it occurs on a digital building layout. The result is a spatial risk register that combines the structured data of a traditional register with the visual immediacy of a marked-up floorplan.

A risk assessment map typically contains the following data layers: hazard type (chemical, biological, ergonomic, mechanical, environmental), likelihood rating, severity rating, residual risk score after controls, control measure descriptions, responsible persons, and review dates. When these data points are rendered on a floorplan using colour-coded markers, icons, or heat-map overlays, the building's risk profile becomes visible at a glance.

Risk assessment mapping is not a replacement for the underlying assessment process. The five-step risk assessment methodology — identify hazards, determine who might be harmed, evaluate risks, record findings, and review — remains unchanged. Mapping is an enhancement to step four: recording findings in a format that adds spatial context and improves the utility of the assessment for everyone who needs to act on it.

The Limitations of Traditional Risk Registers

Traditional risk registers have served the health and safety profession since the obligation to record significant findings was introduced. They take the form of spreadsheets, word-processing tables, or entries in generic compliance databases. While these formats capture the required information, they suffer from several systemic weaknesses that reduce their effectiveness in practice.

Lack of Spatial Context

A register entry describing a "manual handling risk in the post room" tells the reader that a risk exists and identifies the room by name. It does not show the reader where that room is located relative to other hazards, escape routes, or high-traffic corridors. For buildings with complex layouts — multi-floor offices, hospitals, manufacturing plants, educational campuses — the absence of spatial context means that the register cannot be used for route planning, zone-based prioritisation, or contractor induction briefings.

Difficulty Identifying Clusters

When hazards are recorded as discrete text entries, identifying spatial patterns requires the reader to mentally map each entry to a physical location. This cognitive burden makes it difficult to spot clusters — areas where multiple hazards converge and compound one another. A corridor junction that simultaneously presents a slip risk, an obstructed fire exit, and a trailing cable hazard may appear as three unrelated entries in a register. On a floorplan, the convergence is immediately visible and demands coordinated action.

Poor Accessibility for Non-Specialists

Risk registers are typically authored by health and safety professionals using technical language and scoring systems. Frontline staff, visiting contractors, and senior managers who need to understand the building's risk profile often find these documents inaccessible. A visual representation on a floorplan, using intuitive colour coding and simple icons, communicates risk levels without requiring specialist training.

Static Documents That Decay

Paper-based or file-based registers become outdated quickly. Changes in building use, layout modifications, new equipment installations, and seasonal variations in hazards all require register updates. Without a system that prompts review and facilitates in-place editing, registers decay into historical snapshots that no longer reflect current conditions.

Regulatory Context

United Kingdom

The Health and Safety at Work etc. Act 1974 establishes the general duty on employers to ensure, so far as is reasonably practicable, the health, safety, and welfare of employees. The Management of Health and Safety at Work Regulations 1999 (MHSWR) provide the specific requirement in Regulation 3 for employers to carry out suitable and sufficient assessments of risks to employees and others affected by their undertaking. Regulation 3 does not prescribe the format of the assessment, but Regulation 4 requires that significant findings be recorded where the employer employs five or more persons.

The Approved Code of Practice (ACOP) L21 accompanying the MHSWR clarifies that "suitable and sufficient" means the assessment must be appropriate to the nature of the work and should remain valid for a reasonable period. It must identify the significant risks arising from the work, enable the employer to identify and prioritise the measures needed, and be appropriate to the nature of the work. While the ACOP does not mandate spatial recording, the principle of suitability and sufficiency supports the argument that a spatial format is more suitable for complex buildings than a text-only register.

The Regulatory Reform (Fire Safety) Order 2005 requires a separate fire risk assessment for non-domestic premises in England and Wales. Fire risk assessments inherently require spatial understanding — the location of ignition sources, fuel loads, escape routes, and fire safety equipment. Mapping fire-related risks on floorplans is a natural extension of this process and supports the requirements in Articles 9 through 22 of the Order.

Ireland

The Safety, Health and Welfare at Work Act 2005 places a general duty on employers under Section 8 to manage and conduct work activities to ensure safety, health, and welfare. Section 19 requires the employer to identify hazards, assess risks, and prepare a written safety statement that specifies the hazards identified, the risks assessed, and the protective and preventive measures taken. The Safety, Health and Welfare at Work (General Application) Regulations 2007 supplement this with specific requirements for workplace conditions, manual handling, display screen equipment, and other risk categories.

The Irish framework, like the UK framework, does not mandate a particular format for recording risk assessments. However, the Health and Safety Authority (HSA) guidance documents recommend that risk assessments be accessible, understandable, and actionable. Spatial mapping meets all three criteria for buildings with complex physical environments.

Spatial Risk Visualisation: Core Concepts

Spatial risk visualisation is built on three core concepts: geo-referencing hazards to building coordinates, encoding risk severity through visual variables, and layering multiple risk categories onto a single view.

Geo-Referencing Hazards

Every hazard identified during a risk assessment is assigned a coordinate on a digital floorplan. This is analogous to placing a pin on a map. The coordinate anchors the hazard record to a specific physical location — a particular workstation, corridor section, plant room, or external area. Modern spatial infrastructure software such as Plotstuff enables assessors to drop hazard markers directly onto uploaded floorplans, automatically associating the marker with the underlying spatial data for the building.

Encoding Severity Through Visual Variables

Cartographic principles apply directly to risk mapping. The most effective visual variables for communicating risk severity are colour hue (green for low, amber for medium, red for high, dark red for critical), marker size (larger markers for higher-severity hazards), and icon shape (distinct symbols for different hazard categories such as chemical, electrical, manual handling, and slip/trip). These visual variables allow an observer to assess the building's risk profile without reading individual entries.

Layering Risk Categories

A building floorplan typically carries multiple categories of risk simultaneously. Chemical storage, electrical hazards, fire risks, manual handling zones, and ergonomic concerns may all be present on the same floor. Effective risk maps use toggleable layers — similar to GIS map layers — so that users can view all risks together or isolate a single category. This layered approach prevents visual clutter while preserving the ability to analyse interactions between different risk types.

Hazard Mapping Methodology

The process of creating a risk assessment map follows the standard five-step methodology with an additional spatial recording step integrated into the workflow.

Step One: Prepare the Floorplan

Obtain or create a scaled digital floorplan of the building or site. The floorplan should show room boundaries, corridors, stairwells, exits, and major fixed equipment. PDF architectural drawings, CAD files, or scanned plans can serve as the base layer. The floorplan must be accurate and current — outdated layouts will produce misleading risk maps.

Step Two: Walk the Building

Conduct a physical walk-through of every area within scope. During the walk-through, identify hazards using established techniques: observation, task analysis, consultation with employees, review of maintenance records, and reference to relevant standards and guidance. Record each hazard with its location, noting the room or zone where it was observed.

Step Three: Plot Hazards on the Floorplan

For each hazard identified during the walk-through, place a marker on the floorplan at the corresponding location. Attach the hazard record to the marker, including hazard description, hazard category, persons at risk, existing control measures, likelihood score, severity score, and residual risk rating. This step transforms the walk-through findings from a list into a spatial dataset.

Step Four: Evaluate and Score

Apply the organisation's risk scoring matrix to each hazard. Common approaches include a 5x5 likelihood-severity matrix producing scores from 1 (trivial) to 25 (intolerable), or a simpler 3x3 matrix with low, medium, and high ratings. The score determines the marker colour on the floorplan and the priority for additional control measures.

Step Five: Assign Controls and Responsibilities

For each hazard requiring additional controls beyond those already in place, record the planned control measure, the responsible person, and the target completion date. These fields attach to the hazard marker on the floorplan, creating an action tracker that is visible in spatial context.

Step Six: Review and Validate

Review the completed risk map with relevant stakeholders — department managers, safety representatives, maintenance teams, and (where appropriate) employee representatives. The visual format facilitates discussion and often surfaces additional hazards or concerns that were not identified during the initial walk-through.

Risk Heat Maps on Floorplans

Risk heat maps aggregate individual hazard scores into a continuous colour gradient overlaid on the floorplan. Rather than showing discrete markers for each hazard, a heat map interpolates between data points to produce a smooth visualisation of risk density and severity across the building.

How Heat Maps Are Generated

Heat map generation typically uses a kernel density estimation or inverse distance weighting algorithm. Each hazard marker contributes a weighted value based on its risk score. The algorithm spreads this value across a radius around the marker, with the intensity decreasing with distance. Where multiple hazards overlap, their contributions sum, producing hotter (higher-risk) zones.

Interpreting Risk Heat Maps

A risk heat map answers questions that individual markers cannot: Which floor has the highest overall risk density? Are there corridors or junctions where risks converge? Do high-risk zones align with high-traffic areas? Are there floors or wings with consistently low risk, suggesting either genuinely safe conditions or inadequate assessment coverage?

Practical Applications

Facilities managers use risk heat maps to prioritise capital expenditure on risk reduction measures. If a heat map shows that the basement plant rooms and the ground-floor kitchen are the two hottest zones, investment can be directed to those areas first. Contractors arriving on site can be shown a heat map during induction to understand which areas require particular caution. Senior leadership can use building-wide heat maps in board-level risk reporting.

Heat maps also provide a temporal dimension when generated at regular intervals. Comparing a heat map from January with one from July reveals whether interventions have reduced risk in targeted zones or whether new hazards have emerged elsewhere.

Integrating Risk Scores with Locations

The integration of risk scores with physical locations enables several analytical capabilities that are unavailable in traditional registers.

Zone-Based Risk Aggregation

Buildings can be divided into logical zones — departments, floors, wings, or functional areas such as reception, manufacturing, offices, and loading bays. By aggregating the risk scores of all hazards within a zone, managers obtain a composite risk rating for each area. This zone-level view supports resource allocation decisions and helps identify areas that consistently carry disproportionate risk.

Risk-Weighted Route Planning

In buildings where workers, visitors, or patients move through multiple areas, risk-weighted route analysis identifies paths that minimise exposure to high-risk zones. This is particularly relevant in hospitals, where patient transport routes should avoid areas with chemical or biological hazards, and in construction sites, where pedestrian routes must be separated from vehicle movements and active work zones.

Compliance Dashboards

When risk scores are linked to locations, compliance dashboards can display the percentage of the building that falls within acceptable risk thresholds, the number of overdue control actions by zone, and the trend in average risk scores over time. These dashboards translate spatial risk data into management metrics.

Digital Risk Registers

A digital risk register is a database-backed system that replaces static spreadsheets with a dynamic, queryable, and auditable record of risk assessments. When combined with spatial mapping, the digital risk register becomes a living document anchored to the building it describes.

Core Features of a Digital Risk Register

• •Structured data entry with mandatory fields for hazard type, location, likelihood, severity, controls, responsible person, and review date
• •Automatic risk score calculation based on the selected likelihood and severity values
• •Attachment support for photographs, supporting documents, and control measure evidence
• •Audit trail recording who created, modified, or reviewed each entry and when
• •Role-based access control ensuring that only authorised personnel can modify assessments
• •Notification and escalation workflows triggering alerts when reviews are overdue or when high-risk entries are created
• •Reporting and export capabilities for producing compliance documentation

Advantages Over Spreadsheets

Spreadsheets lack built-in audit trails, notifications, and concurrent editing controls. A digital register ensures data integrity, enforces completion of mandatory fields, and provides a reliable history of changes. When the register is integrated with a floorplan system, the spatial and tabular views of the same data remain synchronised — editing a hazard's risk score in the register updates the marker colour on the floorplan, and moving a marker on the floorplan updates the location field in the register.

Plotstuff, as a modern spatial infrastructure software platform, supports this bidirectional synchronisation between floorplan markers and structured data records, ensuring that the risk register and the risk map are always consistent.

Review and Update Workflows

Risk assessments must be reviewed regularly and updated whenever there is reason to believe they are no longer valid. Triggers for review include changes in work practices, introduction of new equipment, building modifications, incident reports revealing previously unidentified hazards, changes in legislation, and feedback from employees or safety representatives.

Scheduled Reviews

Best practice is to schedule a full review of risk assessments at least annually, with more frequent reviews for high-risk areas or where conditions change rapidly. A digital risk register with spatial mapping can automate review scheduling by attaching a review-due date to each hazard marker. When the date is reached, the system sends a notification to the responsible person and flags the marker on the floorplan with a review-overdue indicator.

Triggered Reviews

Certain events should trigger an immediate review of relevant risk assessments. These include workplace incidents (injuries, near misses, dangerous occurrences), significant changes to the building layout or use, introduction of new substances or processes, and findings from building inspections or audits. Spatial linking between incident data and risk assessments enables an automated trigger: when an incident is logged at a location, the system identifies all risk assessments that cover that location and prompts a review.

Version Control and Audit Trails

Every change to a risk assessment should be recorded with the date, the identity of the person making the change, and the reason for the change. Digital systems provide this automatically through transactional logging. The ability to retrieve previous versions of a risk assessment is essential for regulatory investigations, insurance claims, and internal governance.

Management of Change Process

When a building undergoes significant modification — a refurbishment, a change of use, or the installation of new plant — the management of change process should include a mandatory risk assessment review. The spatial approach simplifies this by allowing the change area to be highlighted on the floorplan and all hazard markers within that area to be flagged for reassessment.

Linking Risk Assessment to Incident Data

Risk assessments and incident reports are two sides of the same coin. Risk assessments predict where harm might occur; incident reports record where harm did occur. Linking the two datasets spatially creates a feedback loop that continuously improves the accuracy of risk assessments.

When an incident is plotted on a floorplan, the system can check whether a corresponding hazard was identified in the risk assessment for that location. If it was, the incident validates the assessment but may indicate that the control measures were insufficient. If it was not, the incident reveals a gap in the assessment — a hazard that was missed during the original evaluation. Either way, the linkage drives improvement.

Over time, buildings with spatially linked risk and incident data develop a rich evidence base for safety investment decisions. Areas with high risk scores and high incident rates are clear priorities. Areas with high risk scores but low incident rates may indicate that controls are effective. Areas with low risk scores but high incident rates point to under-assessment — the most dangerous gap.

Platforms like Plotstuff enable this integration by storing both risk assessment markers and incident markers on the same floorplan, with queryable relationships between the two datasets.

Contractor Integration

When contractors work on site, their activities introduce additional hazards that must be incorporated into the building's risk assessment. Spatial mapping allows the contractor's work zone to be defined on the floorplan, with temporary hazard markers added for the duration of the work. These temporary markers overlay the building's baseline risk map, giving a complete picture of current risk conditions.

Key Takeaways

• •Risk assessment mapping anchors every identified hazard to a physical location on a floorplan, adding spatial context to traditional register data
• •Text-heavy risk registers fail to communicate hazard clusters, spatial patterns, and the relationship between risks and building features
• •The Management of Health and Safety at Work Regulations 1999 (UK) and the Safety, Health and Welfare at Work Act 2005 (Ireland) require risk assessments but do not prescribe format, supporting the adoption of spatial methods
• •Risk heat maps aggregate individual hazard scores into a continuous visualisation that reveals building-wide risk patterns
• •Digital risk registers with floorplan integration provide audit trails, automated review scheduling, and bidirectional synchronisation between map markers and database records
• •Linking risk assessment data with incident reporting data creates a feedback loop that identifies assessment gaps and validates control effectiveness
• •Regular review workflows — both scheduled and triggered — keep risk assessments current and compliant
• •Zone-based risk aggregation and risk-weighted route planning are analytical capabilities enabled by spatial integration

Frequently Asked Questions

Is spatial risk assessment mapping a legal requirement?

No jurisdiction in the UK or Ireland mandates a specific format for risk assessments. The legal requirement is for the assessment to be "suitable and sufficient" (UK) or to identify hazards and assess risks in a written safety statement (Ireland). Spatial mapping is a methodological enhancement that improves the quality and utility of the assessment, but it is not a standalone legal requirement.

How often should risk assessment maps be updated?

Risk assessment maps should be reviewed at least annually and updated whenever a significant change occurs — a building modification, new equipment, a change of use, or an incident at a mapped location. High-risk areas may warrant quarterly or monthly reviews. The review frequency should be proportionate to the rate of change in the building and the severity of identified risks.

Can risk assessment mapping replace a written risk assessment?

A risk assessment map is a format for recording and presenting risk assessment findings. It contains the same data elements as a written register — hazard identification, risk scoring, control measures, responsible persons, and review dates. Provided all required elements are present, a spatial risk map can serve as the recorded assessment. Many organisations maintain both a spatial map and a tabular register synchronised through a digital system.

What types of buildings benefit most from spatial risk mapping?

Buildings with complex layouts, multiple floors, diverse functional areas, and high occupant numbers benefit most. Hospitals, universities, manufacturing facilities, large offices, shopping centres, and construction sites are prime candidates. Simple single-room workplaces may find that a traditional register is sufficient.

How does spatial risk mapping support contractor induction?

During contractor induction, a risk assessment map can be shown to the contractor to communicate the building's hazard landscape visually. The contractor can see which zones carry elevated risk, where active permits to work are in effect, and which routes to use for access and egress. This visual induction is faster and more effective than reading through pages of a written risk register.

Next Steps

If your organisation currently relies on text-based risk registers and you are considering a move to spatial risk assessment mapping, begin by digitising your existing floorplans and uploading them to a platform that supports marker-based data entry. Prioritise the building or floor with the highest risk density for your pilot. Transfer existing register entries to floorplan markers, validate the spatial accuracy during a physical walk-through, and then use the spatial view to identify clusters, gaps, and priorities that were not visible in the original register. From there, establish review schedules, link your risk data to your incident reporting system, and extend the approach to additional buildings as confidence and capability grow.