Step one is to identify the hazards: anything with the potential to cause harm, found by inspecting the premises, checking maintenance and incident records and asking the people who work or live there. Step two is to decide who might be harmed and how, named as groups rather than individuals: employees, residents, visitors, contractors, and anyone whose circumstances raise their exposure. The rest of the assessment can only ever be as good as this stage, which is why the first step in risk assessment has a page of its own.
Step three is the judgement: how likely is each harm, how serious would it be, and do the existing precautions reduce the risk as far as reasonably practicable? Step four is to record the significant findings and implement the extra controls, with an owner and a date against each; for general workplace assessments the written record is required where five or more people are employed. Step five keeps the document honest: review after any significant change, after incidents, and at sensible intervals, as covered under how often should risk assessments be done.