Regulation 3 covers far more than staff: visitors, contractors, residents and neighbours all count if the undertaking puts them at risk. The assessment must be revisited when there is reason to think it is no longer valid, and employers with five or more employees must record the significant findings. Whoever carries it out must be a competent person for the risks involved, which for routine office hazards can be a capable manager. The depth has to be proportionate too: a low-risk office needs far less analysis than a factory floor or a care setting.
On top of the general duty, specific regulations demand their own assessments: hazardous substances under COSHH, manual handling, display screen equipment, noise and vibration among them. Each is the same method pointed at a particular hazard. The method itself is set out in what are the 5 steps of risk assessment, and the competence question in can anybody write a risk assessment.