ISO 45001 hazard identification and risk assessment: method, worked example and record

What does ISO 45001 hazard identification require?

ISO 45001:2018 requires you to establish a process that identifies hazards continually, not once before the audit, and then to assess the risks those hazards present to the people doing the work. Both requirements sit under clause 6.1.2, "Hazard identification and assessment of risks and opportunities", inside the planning clause of the standard.

Three sub-clauses divide the work: 6.1.2.1 hazard identification, 6.1.2.2 assessment of OH&S risks and other risks to the management system, and 6.1.2.3 assessment of opportunities. Clause 6.1.4 turns the results into planned action; clause 8.1.2 decides which controls come first.

The people covered are wider than the payroll. The standard defines a worker as a person performing work or work-related activities under the control of the organisation, so a forklift driver supplied by an agency and a contractor's welder on your roof both belong in the assessment.

Hazard, risk and opportunity: keeping the three apart

A hazard is the source of potential harm: a moving conveyor, a solvent drum, an unguarded edge, a night shift worked alone. The OH&S risk is the combination of how likely that hazard is to cause injury or ill health and how bad the outcome would be. Registers that confuse the two fill up with lines such as "risk of falling", which name an outcome but never the source you can remove.

Risks to the management system are different: a safety coordinator leaving with no successor, or a new site brought into scope without assessment. Opportunities are the positive side, such as a planned equipment replacement that lets you design out a manual handling task.

Identifying hazards, step by step

1. Break the scope into tasks, not departments

A department called "warehouse" hides a dozen exposures. List the tasks people perform at each site and shift: receiving, put-away, picking at height, battery charging, cleaning, maintenance. Our scope guide explains how the boundary of the system is set in the first place.

2. Include routine and non-routine work

Breakdown repairs, shutdowns, tank cleaning and commissioning of a new machine deserve their own lines, because the usual controls may not be in place.

3. Go and look with the people who do the job

Clause 5.4 requires consultation and participation of workers, and hazard identification is where it pays back fastest. The operator knows the guard removed to clear jams. Walk the task with them and ask what nearly went wrong last month.

4. Use what has already happened

ISO 45001 treats near misses as incidents, since an incident is an occurrence that could or does result in injury and ill health. Incident reports, first aid logs and inspection findings point to hazards the register should already hold; one that appears in an investigation but not in the register reveals a gap.

5. Consider people and conditions, not only equipment

Fatigue, working alone, workload and language barriers are hazards too, and many registers stay silent on psychosocial risk; ISO 45003 gives guidance on managing it inside an ISO 45001 system, although it is not a standard you certify against.

How to assess OH&S risk consistently

Most organisations rate each hazard for likelihood and severity on short scales, combine the two into a score and set bands that trigger action. Three disciplines matter more than the matrix.

• Written criteria. Each level of severity and likelihood has a description, so two supervisors scoring the same task reach the same answer.
• Existing controls stated first. Record the controls actually in place and in use, then score the risk as it stands, then score it again once the planned controls are working.
• One method across sites.

Where a law prescribes a control, the assessment should show it; the legal register guide covers clauses 6.1.3 and 9.1.2.

Choosing controls with the hierarchy of controls

Clause 8.1.2, "Eliminating hazards and reducing OH&S risks", fixes the order in which controls are considered. The examples in the right-hand column are illustrations for a warehouse, not text from the standard.

A register where every line ends in "wear PPE" or "toolbox talk" suggests the higher levels were never considered. Where elimination is not practicable, note why. Management of change under clause 8.1.3 should send any altered task back through the assessment.

A worked example: a regional distribution centre

A two-shift distribution centre with peak-season agency staff and contract cleaners produced these lines. Scores use a five-by-five scale for illustration only.

Two of these lines came from a near-miss report and a comment in a safety committee meeting, which is exactly how the process is supposed to work.

The record auditors ask for, and the mistakes that weaken it

On the site tour, auditors typically pick a task in progress and ask for its assessment. What holds up is a hazard register tied to tasks and sites, risk assessments showing controls before and after, the last review date and who took part, and a trail to permits, method statements and investigations. Competence counts too, including the ability to recognise hazards (7.2); the training guide covers the evidence.

• Generic assessments. A template describes someone else's building and misses your tasks.
• Written in the office. Nobody who does the work was asked.
• Contractors left out. Their tasks are often the most hazardous on site. The contractor management guide covers how to bring them in.
• No trigger for review. A new machine or an incident arrives and the assessment stays unchanged.
• Investigations that stop short. Clause 10.2 expects an incident to lead back to the risk assessment; if the register is unchanged after a lost-time injury, the loop is broken.

Hazard identification and risk assessment: questions buyers ask