Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer and self-employed person to make a suitable and sufficient assessment of the risks to their employees and to anyone else affected by their work, and to record the significant findings where five or more people are employed. The HSE’s five steps still describe the job well: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the findings, and review.
A method statement is not a legal requirement in itself. It is the practical answer to the question a risk assessment raises: given these risks, how exactly will the work be done? On construction projects the principal contractor will expect one for every high-risk activity, and the Construction (Design and Management) Regulations 2015 make the construction phase plan the document that draws them together. Together they are known as RAMS; outside construction the same document is often called a safe system of work.
The common failure is generic paperwork. A risk assessment copied from the last job, listing hazards that are not present and missing the one that is, fails the suitable and sufficient test and gives the site team nothing to work with. A good one is specific to the task, the place and the people, short enough to be read at the point of work, and reviewed when the work changes.