Method statements and risk assessments are usually said in that order and written in the other. The risk assessment comes first, because it identifies the hazards and the controls; the method statement comes second, because it applies those controls at the steps of the work. A method written first describes how the job is usually done and then an assessment is written to fit it, which is how a control gets missed. The HSE's guidance, cited below, gives risk assessment as five steps: identify hazards, assess the risks, control the risks, record your findings, review the controls, and says that if you employ 5 or more people you must record your significant findings. The risk assessment and method statement tool on this site builds the method from the assessment, free.
The assessment finds the controls
For a task on a site: the hazards, the people at risk, the likelihood and severity, and the control for each with the residual risk. Regulation 3 of the Management of Health and Safety at Work Regulations 1999, cited below, requires every employer to make a suitable and sufficient assessment of the risks to the health and safety of their employees, and regulation 3(6) requires an employer with five or more employees to record the significant findings and any group of employees especially at risk. The controls are the assessment's output and the method's input.
The method applies them
Each step of the work names the control it applies from the assessment: the isolation before the cut, the edge protection before the edge, the exclusion zone before the lift. A method that does not reference the assessment's hazards by number is one where a control can be missing without anyone noticing.
When the order is reversed
The method describes the usual sequence; the assessment is written afterwards to justify it; a hazard the usual sequence never controlled is not in either document. A site audit finds it. The tool on this site prevents the reversal by building the method from the assessment's rows.
Keeping the pair together
One document, one header, one sign-on, one version, kept against the job. DailyLogDesk Pro keeps the signed pair and the reviews against the job, in the version the crew was briefed on; the free tool prints them.
Questions people ask about method statements and risk assessments
Can one person write both?
Yes, and usually does; the discipline is the order, not the author.
Do I need a method statement for every risk assessment?
For tasks where how the work is done is the control, which on site is most of them. A desk-based risk needs no method.
Is the tool free?
Yes, without an account.