After a CDM risk assessment, test the assumptions behind each residual-risk control before the construction phase plan goes to site. Residual risks travel into the pre-construction information and the construction phase plan marked as controlled, and nothing in that chain checks whether the conditions behind those controls still hold.
In 2005, one such assumption, about how fill would be placed over a railway, went untested until 29 concrete arch units fell onto a live line.
A CDM risk assessment is the designer's process, under CDM 2015, of eliminating foreseeable construction risks where reasonably practicable, reducing or controlling the rest, and passing on information.
The standard next step after a CDM risk assessment
A CDM risk assessment follows the sequence of any risk assessment. Designers name the foreseeable hazards in their design, as in risk identification, eliminate what they can, and reduce or control the rest. What remains is recorded as residual risk: the hazard, the control that manages it, and what the next duty holder needs to know to apply it.
Those entries then travel. The client assembles pre-construction information, with the principal designer coordinating the design content, and issues it to the contractors who will plan the work. The principal contractor uses it to draw up the construction phase plan before the site is set up. Each handover moves the entry one step closer to the people doing the work.
On site, the plan is broken down into risk assessments and method statements (RAMS) for individual activities: excavation, lifting, backfilling, temporary works. Contractors often rate each activity on a risk matrix and list the controls against it. Supervisors typically brief each method statement to the crew in toolbox talks, and workers often sign to confirm they have understood it.
Changes are meant to feed back into the same chain. A substituted material, a resequenced activity or a value engineering proposal alters the design, so the design risk assessment is revised and updated information flows back down to site. At handover, the residual risks that matter for future maintenance and demolition go into the health and safety file. In common practice, a design risk register carries each entry forward, though CDM 2015 prescribes no format for it.
What that step adds
The chain puts duties in the right order. Regulation 9 requires designers to eliminate foreseeable risks so far as is reasonably practicable, to reduce or control what cannot be eliminated, and to provide information about the remaining risks. The client supplies pre-construction information, the principal designer coordinates it, and the principal contractor plans the build. Each duty has a named holder. Elimination comes first, and information about what remains accompanies the reduction or control rather than replacing it.
Its main strength is timing. HSE's L153 guidance notes that the earliest design decisions can fundamentally affect the safety of everyone who later builds, maintains or demolishes a structure. It tells designers to warn those planning the work about "elements of the building that could become unstable". A risk designed out at concept stage costs a line on a drawing. The same risk found on site costs a stoppage, a redesign or an injury.
The information flow matters as much as the hierarchy. A control nobody on site has heard of does not exist in practice, and the path from register to toolbox talk is how a design decision reaches the person placing the material. It also makes acceptance traceable. Treating a residual risk as tolerable, the step covered after risk evaluation, is recorded against a named duty holder at each stage rather than left implicit.
Take the residual risk your construction phase plan leans on hardest, name the site reading that would show its control failing, and decide who stops work when it does. Start the Walk →
Where the standard playbook breaks down
The chain carries the entry, not the reasoning behind it. A line such as "keep fill differential under 500mm" records a control. It does not record what has to stay true for the control to work: that the reader knows why the limit matters, that nobody changes the material or sequence, that someone measures the result.
L153 lets designers leave risks from routine construction activities out of their information unless the design worsens or significantly alters them. Whether an activity is routine is a judgement the register never shows.
In 2003, work started on a Tesco supermarket over the Chiltern main line at Gerrards Cross, carried on precast concrete arch units buried in fill. White Young Green were the overall designers and the planning supervisor under the CDM regulations then in force. Widening the scheme to four tracks without raising the crown had made the arch flatter.
According to the HSE's investigation report, the system appeared "particularly 'sensitive' to asymmetric loading", and its manual limited the difference in fill level between the two sides to 500mm. In today's CDM terms, it was a residual risk handed to construction to manage. The risk reached site; its reasoning did not. The outline design submission to the railway, known as Form A, stated that the concept had no unusual features.
Jackson Civil Engineering, principal contractor from April 2003, saw the structure, the HSE recorded, as a "big culvert", and the HSE found nothing to show that either designer had specifically emphasised the sensitivity to Jackson. Jackson proposed replacing part of the limestone fill with lighter incinerator bottom ash. The HSE knew of no calculations for that loading sequence, and the backfill method statement was never sent to either designer.
In June 2005, Jackson's own engineers found the crown between 125mm and 191mm below its design level, against a tolerance of 25 to 30mm. Of the first reading, the report says: "Nothing resulted." On 29 and 30 June, contrary to the method statement, fill went over the crown before the sides had been brought up. At about 19:30 on 30 June, the arch gave way onto both tracks.
According to the HSE, one train had just started off from the station towards the tunnel, about 50 yards away; another braked hard and stopped perhaps 250 yards short. The HSE's assessment was that "the potential was there for multiple fatalities; they were narrowly avoided." The Institution of Civil Engineers' review of the case names an inadequate review of the change from one fill to two, and warning signs that nobody acted on.
The roles have changed since 2005, when a planning supervisor held the coordinating duty, but the split is the same. Every party held a document that recorded the risk. None held a check on whether the 500mm control still described the work, and by June the condition it depended on had gone. It is the same gap that stops a risk register from helping anyone decide.
The step to take first
The step to take first is a checkpoint before the construction phase plan is signed off, repeated whenever a change touches a significant residual risk: a substituted material, a resequenced activity, a value engineering proposal. It takes the few entries where a failed control would be catastrophic and asks, for each one, what has to stay true for the control to hold. The checkpoint adds no new document; it puts a question to the existing ones. The same check applies after a transport risk assessment: write down the operating conditions each critical control needs before authorising the work.
The five-step Universal Decision-Making Method gives that question a structure. Frame the decision the entry represents: accepting this residual risk and proceeding. List the Tentative Elements, the controls and alternatives still open. Surface the Assumptions each control depends on, written by the person who will rely on it. Decide what Sufficient Certainty means here; a live railway beneath the work demands more evidence than an empty site. Then Implement and Monitor.
Monitoring is where Gerrards Cross turned. The crown readings existed, well outside tolerance. The specification had not required them, and nothing linked them to a decision about whether filling should continue. Monitoring protects a decision only when the trigger and the owner are named before work starts.
A typical register line reads: asymmetric loading, controlled by following the method statement. When the fill or the sequence changes, nothing in the entry shows that the control has stopped protecting the structure.
The entry names the condition the control depends on: fill levels either side within 500mm of each other, measured at every lift. A differential or crown reading beyond its limit stops filling until a designer has reviewed it.
For a client or principal designer, three questions cover most of the ground. Which residual risks would kill someone if the control failed? For each, what condition does the control assume, and who on site knows it? What reading or event would show that condition failing, and who has the authority to act? The same test applies at the scale of a single task, as set out after a workplace risk assessment, and to the RAMS that come back for review.
A CDM risk assessment records that a risk was considered. The checkpoint records what the decision to proceed rests on, which is the part most likely to change once work begins.
You could sign off the construction phase plan and still leave the conditions each residual-risk control depends on untested.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.