Undertaking a risk assessment is recommended for all organisations, regardless of size or sector. It may not be necessary to implement significant prevention procedures if the risks faced are minimal. In order to determine this, an initial risk assessment should be undertaken and the findings documented.
HMRC guidance states that "it will rarely be reasonable to have not even conducted a risk assessment."