In England, hospitals routinely conduct a formal risk assessment practice to ensure the safety of patients and staff. However, although specific criticisms have been made on the practice, few investigated the formal risk assessment practice in the literature. This study investigates the risk assessment policies and procedures of one hundred hospitals in the English National Health Service (NHS) through content analysis. Findings revealed that hospitals provided varied descriptions of the terms risk and risk assessment. The concept of risk was often defined to be an undesired event, and risk assessment was often explained with the involvement of risk control step. Despite the variety in the descriptions of the risk terms, all hospitals recommended following similar steps to undertake risk assessments. Risk matrices- and therefore risk scoring – are at the heart of the formal practice, which increases the possibility of wrong risk prioritisation. This study provides several recommendations for the improvement of current guidelines by considering both Safety-I and Safety-II approaches.