Definition of Risk Assessment in Child Care: A 2026 US Practitioner Guide

The US Consumer Product Safety Commission has recalled more than 10 million infant inclined sleepers, rock ‘n play products, and crib bumpers since 2019, and licensing inspectors keep finding those exact products on the floor of US child care centers in every region of the country.

Each one represents a risk assessment in child care failure: a hazard never identified, never scored, or never removed.

Risk Assessment in Child Care: The Practitioner Cheat Sheet
The definition of risk assessment in child care is the structured process of identifying hazards a child could be harmed by, scoring likelihood and severity, and applying a control. The American Academy of Pediatrics, APHA, and the National Resource Center publish Caring for Our Children 4th Edition as the national health and safety performance standards that anchor every US state licensing code.
The 5×5 likelihood-severity matrix is the working tool. A score of 15 or higher is an immediate-control hazard; 8 to 14 enters the monthly walkthrough cycle; below 8 is a documented watch item. Cutoffs are what turn the matrix from decoration into a decision tool.
Seven hazard buckets catch the majority of what state inspectors cite: sleep environment, falls, choking and airway, poisoning, water, transportation, and person-to-person (background, supervision, behavior). The CDC documents drowning as the leading injury-death cause for ages 1 to 4; sleep-related deaths dominate infant fatality reviews.
Risk assessment in child care must split by age band. Infant rooms hinge on safe sleep and feeding; toddler rooms hinge on falls, choking, and sightlines; preschool rooms hinge on playground equipment, water play, and behavior. One template across all three age bands misses the dominant hazard in at least two of them.
The legal floor is the federal Child Care and Development Block Grant Act of 2014 plus 50 state licensing codes. The strictest applicable standard, usually CFOC or NAEYC accreditation, is the right working benchmark, not the cheapest state minimum.
The Consumer Product Safety Commission has recalled more than 10 million infant inclined sleepers, rock ‘n play units, and crib bumpers since 2019. Inspectors keep finding recalled products in licensed US centers. Every recalled product on a floor is a risk assessment in child care failure.
The binder problem is the most common stall: a beautifully formatted document no one on the floor has read in six months. Living programs use one-page room cards, weekly five-minute huddles, and a written record of every hazard found and what was done about it.

The definition of risk assessment in child care is not a checklist taped to a wall. It is the disciplined work of seeing the room the way an injured child would.

We work with directors, owners, and licensing specialists who want fewer ER trips, fewer state citations, and fewer 2 a.m. phone calls. The path runs through a working risk assessment program.

This guide lays out the definition, the 5×5 scoring math, the seven hazard buckets, the age-specific controls, the US regulatory floor under the Child Care and Development Block Grant Act, the Caring for Our Children 4th Edition standards, and the implementation traps. Written for the practitioner who has to make it work on Monday morning.

Figure 1. Risk assessment in child care: the numbers shaping US programs in 2026.

What Risk Assessment in Child Care Actually Means

Risk assessment in child care is the structured process of identifying hazards that could harm a child in a care setting, evaluating how likely each hazard is to cause harm and how severe that harm could be, then deciding what control to apply.

The American Academy of Pediatrics, the American Public Health Association, and the National Resource Center for Health and Safety in Child Care and Early Education jointly publish Caring for Our Children, 4th Edition, the spine of every US state licensing rule.

The point is not paperwork. A real risk assessment in child care answers three questions in plain English: what could hurt a child here, how bad could it get, and what are we doing about it. That language is what separates a working program from a binder no one opens. Directors who can answer all three for every room pass inspections; the rest write corrective action plans.

The discipline is borrowed from ISO 31000 risk management principles and adapted for early childhood settings. We treat risk assessment in child care as one node inside a broader enterprise risk management lifecycle, with the same identify-analyze-evaluate-treat-monitor loop that a hospital or bank would run, scaled to a single classroom or a family home.

Why Risk Assessment in Child Care Beats a Pure Compliance Checklist

A checklist tells you whether outlet covers are installed. Risk assessment in child care tells you whether outlet covers are the right control for the eighteen-month-olds in Room 3 who climb the bookshelf next to the outlet. The two look similar on paper and behave nothing alike under real conditions. Checklists encode last year’s hazards; risk assessment anticipates this year’s.

The federal CCDBG Act of 2014, reauthorized and refined since, requires states to set health and safety standards across ten topic areas, but it does not script the controls.

That gap is where risk assessment in child care lives. Providers who treat the federal floor as a ceiling stop thinking; providers who treat it as a starting point keep looking. Our guide to hazard identification and risk assessment walks the difference.

Compliance binders also age badly. A 2022 binder will not flag a 2024 CPSC recall on weighted infant sleep products unless a person actively maps recalls to inventory. Risk assessment in child care, run quarterly with a documented walkthrough, catches what the binder cannot. The risk register discipline makes the difference visible.

Figure 2. Leading injury mechanisms in US child care, per CDC and CPSC surveillance.

The Hazard Map: Where Risk Assessment in Child Care Focuses First

Inspectors and accreditors converge on a short list of hazard categories. We organize ours into seven buckets drawn from CDC injury surveillance data, CPSC recall history, and the deficiencies that show up most often in state licensing reports. These seven categories catch roughly 90% of what the Caring for Our Children standards flag, and they map cleanly onto the risk identification step of the ERM cycle.

Hazard bucket	What it covers in child care	Primary control example
Sleep environment	Crib safety, soft bedding, weighted sleep products, sleep position, room sharing, supervision during nap	Bare crib policy; recalled-product audit monthly; in-room visual checks every 15 minutes per CFOC 3.1.4.1
Falls	Climbing structures, changing tables, stairs, low furniture used as ladder, slip on wet floors, playground surfacing depth	Fall-zone surfacing 9-12 inches deep per ASTM F1292; one hand on child during diapering; non-slip mats at sinks
Choking and airway	Foods cut wrong, small parts, latex balloons, drawstrings on clothing, cords on blinds	Choking-hazard food list per AAP; small-parts test cylinder; cordless window coverings per CFOC 5.1.4.4
Poisoning	Cleaning chemicals, medications, plants, lead paint, art supplies, hand sanitizer ingestion	Locked chemical storage above 5 feet; medication double-lock; ASTM-certified art supplies only
Water	Bathtubs, sinks, sensory tables, pools, splash pads, buckets, toilets	No standing water unattended; 1:1 ratio for infants in water; pool fencing per CPSC pool safely
Transportation	Field trip vehicles, car seat installation, bus stop crossing, vehicle heat exposure	Car seat inspection by CPST; vehicle sweep checklist signed at every stop; named transportation lead
Person and supervision	Staff background checks, ratio breaches, bullying and behavior, drop-off and pickup verification, mandated reporter duties	FBI fingerprint + state child abuse registry per CCDBG; named pickup list with photo ID; daily supervision plan

 

Each row is a starting point. The full picture comes from working room by room: bucket-level risk assessment in child care surfaces the obvious; room-by-room work surfaces what licensing inspectors actually cite.

The operational risk management process pattern of identify-analyze-evaluate scales down to a single nap room or a family home without losing its shape.

Scoring Likelihood and Severity in Child Care Risk Assessment

The math of risk assessment in child care does not need to be elaborate. We use a 5×5 likelihood-by-severity matrix because it survives the test every framework should pass: a tired closing-shift teacher can use it without a manual.

Likelihood runs from rare (1) to almost certain (5); severity runs from minor first aid (1) to fatality or permanent disability (5). The product is the inherent risk score.

Figure 3. The 5×5 risk matrix adapted for child care risk assessment.

What matters is not the number itself but the cutoffs. We treat a score of 15 or higher as an immediate-control hazard, written, signed, and re-checked within 24 hours.

Scores of 8 to 14 enter the monthly walkthrough cycle. Anything below 8 is a documented watch item. Without cutoffs, the matrix becomes decoration. Compare formats in the 5×5 vs 4×4 risk matrix guide.

Scoring is a conversation, not a calculation. Two experienced teachers usually agree on severity within one band but split on likelihood. The right answer is to score it together, write down why, and move on.

Risk assessment in child care that pretends to be precise to a single integer wastes the team’s time. The heat map presentation technique works just as well in a classroom as in a board pack.

Risk Assessment in Child Care Across Age Groups: Infants, Toddlers, Preschoolers

The single biggest mistake we see in risk assessment in child care is using one assessment for the whole building. An eight-month-old and a four-year-old share almost no hazard exposure in common.

The US Centers for Disease Control and Prevention documents drowning as the leading cause of unintentional injury death for children ages 1 to 4, while sleep-related deaths dominate infant fatality reviews per the AAP safe sleep recommendations.

Figure 4. Hazard weight shifts by age band in child care risk assessment.

Age band	Dominant hazards	Top control	CFOC reference
Infants (0-12 mo)	SUID/SIDS, suffocation, choking on food, falls from changing table, fluid temperature burns	Bare crib + back-to-sleep + 15-min visual checks	CFOC 3.1.4.1, 3.1.4.5
Toddlers (12-36 mo)	Falls from climbing, choking on round/hard foods, ingestion of small parts, biting, escape from gate	Sightline supervision + small-parts inventory + cut food <0.5 in	CFOC 4.5.0.10, 6.2.3.1
Preschool (3-5 yr)	Playground falls, water play drowning, bus and pedestrian, allergen exposure, behavioral incidents	Surfacing depth + 1:1 water + named allergen plan + behavior protocol	CFOC 6.2.1.1, 6.3.1.1, 3.5.0.1

 

Infant rooms hinge on sleep environment and feeding; toddler rooms hinge on falls, choking, and supervision sightlines; preschool rooms hinge on playground equipment, water play, and behavioral incidents.

A program that runs the same risk assessment in child care template across all three age bands will miss the dominant hazard in at least two of them, and the licensing inspector will find it before the parents do.

The US Regulatory Backdrop for Risk Assessment in Child Care

The legal floor for risk assessment in child care in the United States is set by a stack of federal statutes, state licensing codes, and voluntary accreditation standards that operate in parallel. Knowing which one applies and when is half the battle for directors juggling reports.

The stack changes when you cross a state line, when ownership changes, or when a center adds infant care to a previously preschool-only license.

Layer	Authority	What it requires	Year
Federal floor	HHS Office of Child Care under CCDBG Act 2014	10 health and safety topics, background checks, monitoring, training	2014 / reauth pending
Federal nutrition	USDA CACFP	Meal patterns, allergen handling, food safety	Updated 2017, ongoing
National standards	AAP, APHA, NRC (Caring for Our Children 4th Ed.)	686 detailed performance standards across 10 chapters	Edition 4 released 2019
State licensing	State child care licensing agency (50 + DC)	Ratios, square footage, training hours, inspection cadence	Updated by each state
Accreditation	NAEYC, NECPA, NAFCC, Cognia	Voluntary higher standard, multi-year cycle	NAEYC standards updated 2022
Quality rating	State QRIS systems (Quality Rating and Improvement)	Tiered ratings tied to reimbursement	All 50 states have some form

 

State licensing variation is the trap. The HHS Office of Child Care state profiles publish biennial summaries, and the gap between the highest-standard states and the lowest is wider than most operators assume.

Risk assessment in child care done well treats the strictest applicable standard, usually CFOC or NAEYC, as the working benchmark rather than the cheapest state minimum. The framing borrows from COSO ERM 2017 governance principles.

Figure 5. Most-cited deficiencies in US child care licensing reports.

Where Risk Assessment in Child Care Programs Stall and How to Fix Them

We audit child care risk programs for owners and franchise systems, and the same failure modes show up across the country.

The list below is what we find on the first walkthrough; the fixes are what stick after twelve months. The pattern is consistent enough that we put it on a one-page handout the first time we visit a new site.

• The binder problem. A beautifully formatted risk assessment in child care document that no one on the floor has read in six months. Fix: replace the binder with one-page laminated room cards, refreshed quarterly.
• The single-template trap. One assessment used for infants, toddlers, and preschoolers. Fix: separate assessments per age band, signed by the lead teacher for that room.
• The dead-stat list. Recall inventory that has not been checked against the current CPSC database in over a year. Fix: monthly recall sweep, calendared, with sign-off.
• The phantom score. Hazards rated low because no one wants to write an action plan. Fix: blind scoring by two staff, dispute resolution by the director, documented disagreements.
• The training gap. New hires onboarded into procedures without exposure to the risk assessment. Fix: 30-minute orientation module on the room’s top five hazards, signed before unsupervised contact with children.
• The parent blind spot. Risk assessment treated as internal-only. Fix: a parent-facing one-pager per room, posted at sign-in, listing the top three hazards and the controls in place.
• The drill gap. Fire, lockdown, and severe-weather drills run quarterly but never debriefed. Fix: written after-action note within 48 hours, distributed to the team, surfaced in the next risk review.

The most common stall point is the binder problem. Living programs use one-page room cards, weekly five-minute huddles, and a written record of every hazard found and what was done about it. The discipline matches what we recommend in our guide to risk and control self assessment, scaled down to a classroom.

Figure 6. CPSC recall trend feeding into child care risk assessment updates.

What’s Coming Next for Risk Assessment in Child Care: 2026-2028

Three shifts are already reshaping risk assessment in child care, and operators who get ahead of them will outpace those who wait.

The first is steady tightening of state safe-sleep enforcement following implementation of the Safe Sleep for Babies Act of 2021, which banned inclined sleepers and crib bumpers. State licensing agencies are now writing citations that reference the federal ban directly.

The second shift is expansion of CPSC recall surveillance into second-hand and donated products entering centers.

Donations from parents, estate sales, and church drives are a known gap.

Expect state inspectors in 2026 and 2027 to ask for a documented intake screen on every donated item. Risk assessment in child care will need a donations-control row added to the hazard map.

The third shift is integration of mental health and behavioral risk into previously physical-only assessments. The National Center on Early Childhood Health and Wellness has been pushing trauma-informed care into licensing language.

Expect risk assessment in child care templates in 2027 to carry a behavioral-and-emotional row alongside the seven physical hazard buckets, with controls for de-escalation, suspension policy, and staff burnout monitoring.

We also expect federal CCDBG reauthorization conversations to push more states toward continuous quality improvement frameworks that bake risk assessment in child care into licensing renewal rather than treating it as a one-time inspection event.

Programs already using Caring for Our Children Basics as their internal floor will move first; the rest will scramble. Our risk management lifecycle guide gives the broader pattern this fits into.

Frequently Asked Questions About Risk Assessment in Child Care

What is the legal definition of risk assessment in child care under US law?

There is no single federal statutory definition of risk assessment in child care. The closest legal anchor is the CCDBG Act of 2014, which requires states to set health and safety standards across ten topic areas including building safety, emergency preparedness, prevention of shaken baby syndrome, and child abuse prevention. Each state then writes its own licensing code, and the working definition is whichever version applies at the center’s address.

How often should risk assessment in child care reviews happen?

Caring for Our Children 4th Edition recommends a full written risk assessment annually, with quarterly room-level walkthroughs, monthly recall sweeps, and weekly informal huddles.

Daily checks are also expected for high-frequency hazards like sleep environment and food allergens. Risk assessment in child care is not a once-a-year event; the annual document is the artifact, but the discipline is continuous.

What documentation does risk assessment in child care require?

A defensible risk assessment in child care file contains: the hazard inventory by room and age band, the 5×5 scoring with named scorers, the control description, the responsible person, the due date, the verification record, and the next review date.

Most state inspectors will also ask for evidence of staff training on the assessment and parent communication about top hazards. Photos of remediations close the loop.

How does risk assessment in child care differ from a daily safety checklist?

A daily checklist asks whether named controls are in place: are crib mattresses bare, are outlet covers installed, are chemicals locked. Risk assessment in child care asks the prior question: which hazards exist in this room at all, how severe could they get, and which controls are the right ones to apply. Checklists are downstream of the risk assessment; never the other way around.

Who should perform risk assessment in child care: the director, staff, or an outside auditor?

All three. The director owns the program-level assessment. Lead teachers own the room-level assessment, because they see the conditions daily.

An outside auditor, whether a state licensor, an accreditation reviewer, or a private consultant, validates the work at least once a year. Risk assessment in child care done only by the director misses what the floor sees; done only by staff misses what governance requires.

Can parents see the risk assessment in child care for their child’s room?

They should. Best-in-class US programs post a parent-facing one-pager per room at sign-in, listing the top three hazards and the controls in place, with a date and the director’s signature.

Parents who can see the work trust the center more, ask better questions, and report concerns earlier. Risk assessment in child care that is hidden from parents tends to be hidden from staff too.

Does NAEYC accreditation require formal risk assessment in child care?

Yes. The NAEYC Early Learning Program Standards require a written health and safety plan with documented hazard analysis, control measures, and review cycles.

Accredited programs typically run a more rigorous risk assessment in child care than the state licensing minimum, which is one reason NAEYC accreditation correlates with lower citation rates and lower injury rates in CDC surveillance data.

How does risk assessment in child care apply to family child care homes?

Family child care homes face the same hazard categories as centers but in a residential setting that adds kitchen, bathroom, garage, and yard exposures. The National Association for Family Child Care publishes accreditation standards that adapt CFOC principles to home settings.

Risk assessment in child care in a home should explicitly cover firearms storage, pets, swimming pools, and shared household chemicals. None of those hazards exist in a center setting.

The Bottom Line on Risk Assessment in Child Care

Risk assessment in child care is the difference between a center that gets lucky and a center that runs on a system. The 5×5 matrix, the seven hazard buckets, the age-band split, and the immediate-control cutoff are not innovations.

They are the working tools we have seen survive licensing changes, ownership transitions, and the kind of late-night incident that ends careers. Adopt them, document them, and rehearse them.

The federal floor under CCDBG is just that, a floor. Caring for Our Children and NAEYC accreditation give a working ceiling. Risk assessment in child care sits between the two, translating standards into the specific controls that fit the specific rooms in the specific building you run. The children in your rooms next Monday are counting on the translation.

Continue reading the Risk Publishing risk assessment library: operational risk management framework, differences between strategic and operational risks, guide to audit risk assessment, and implement COSO enterprise risk management.

Adjacent reading on early childhood and safety: definition of community risk assessment, risk identification techniques, role of an enterprise risk management system, and operational risks examples. To start a conversation, visit the contact page or the about page.