Are there any fixed rules about how risk assessments should be made?

No. 

COSWP para. 1. 4. 1 states: “There are no fixed rules about how risk assessment should be undertaken, although section 1. 10 (sic) gives the main elements. The assessment will depend on the type of ship, the nature of operations and the type and extent of the hazards and risks. The intention is that the process should be simple, but meaningful.”