ISO 45001 clause 6.1.2.2: assess OH&S risks and system weaknesses
ISO 45001:2018 clause 6.1.2.2 requires processes to assess OH&S risks from identified hazards, taking the effectiveness of existing controls into account. It also requires determination and assessment of other risks related to establishing, implementing, operating and maintaining the OH&S management system. A risk assessment must therefore examine both the work and the system that manages it.
What clause 6.1.2.2 requires in practice
Clause 6.1.2.2 requires processes for two assessments. The first assesses OH&S risks arising from the hazards that have been identified, while taking account of how effective existing controls are. The second determines and assesses other risks connected with establishing, implementing, operating and maintaining the OH&S system, such as dependence on a scarce skill or unreliable communication.
The organisation must also define its methodology and criteria for assessing OH&S risks, with regard to scope, nature and timing, so that assessment is proactive rather than reactive and used systematically. Documented information on the methodology and criteria is maintained and retained. The clause does not specify a scoring scale, a number of rating levels or an acceptance threshold. What it expects is a method that suits the work, is applied consistently and can be explained, together with a realistic view of whether controls described on paper are actually working.
Assess the hazardous event or exposure
Understand the identified hazard, the people exposed and the circumstances in which harm could occur. Consider likelihood and severity using information and competence appropriate to the work. Existing controls influence the assessment only if their effectiveness is understood; a control written in a procedure may not be consistently available or applied.
Worker participation helps reveal actual conditions, workarounds and non-routine situations. Specialist assessment may be needed for particular technical or health exposures. A general awareness course or simple scoring matrix does not replace that competence.
Define methods and criteria before relying on scores
The methods and criteria must be defined with respect to scope, nature and timing so that assessment is proactive and systematic rather than reactive. Maintain and retain documented information on those methods and criteria. The standard does not prescribe one numerical matrix or universal acceptance threshold.
Whatever method is chosen, people should understand how evidence leads to the conclusion. Explain uncertainty and significant assumptions. Avoid adjusting a score merely to fit a preferred decision, and do not treat a low score as permission to disregard applicable legal or other requirements.
Assess risks to the management system too
Other risks can undermine the system’s ability to operate: loss of key competence, ineffective worker reporting, unreliable provider coordination or inadequate resources may be relevant. These are distinct from the likelihood and severity of a particular hazardous exposure, although the two can interact.
Connect the assessment with action planning and operational control. A risk record should identify what needs attention and allow the organisation to evaluate whether the response works. It is not a one-time document created only to support an audit.
Why defined risk assessment matters to the business
Risk assessment is how an organisation decides what to fix first. If the method is vague or inconsistent, priorities depend on who happens to be in the room, and money is spent on the loudest concern rather than the most serious one. A defined method also protects the organisation when a decision is challenged, because it can show how a conclusion was reached. Assessing risks to the system itself prevents a quieter kind of failure, in which the arrangements for preventing harm slowly weaken through lost expertise or poor communication. For customers who audit suppliers, a consistent assessment approach is a sign of a managed operation and speeds up due diligence.
How to implement clause 6.1.2.2
The clause leaves the method to the organisation. One way Sterling teams develop a working approach is described below. Keep explanations of uncertainty in the record, so a reviewer can see how a judgement was reached.
- Decide how likelihood and severity of harm will be judged, and write the criteria in language operational managers can apply.
- Define when assessment happens, so that it is carried out before work and change rather than after an event.
- Test the method on a few real tasks with workers present, and adjust it where results seem implausible.
- Verify the effectiveness of existing controls by observation and discussion, not simply by reading procedures.
- Identify which assessments need specialist competence and arrange access to it.
- Create a separate view of risks to the system, such as skill dependence or weak reporting routes, and give each an owner.
- Keep the methodology and criteria as controlled documented information and review them when experience shows weaknesses.
Two illustrative assessments
A construction team assesses vehicle and pedestrian interaction during deliveries. It checks the actual layout, timing, people involved and effectiveness of current separation and coordination arrangements. Workers identify a recurring conflict during a particular delivery period. Competent planners use that information to evaluate suitable controls; the example does not prescribe technical distances or traffic design.
A software support business assesses work-related risks associated with repeated unplanned overnight response. It considers the actual pattern, worker experience and effectiveness of existing staffing and handover arrangements. Separately, it identifies a system risk that concerns are not reaching decision-makers. Addressing only the work schedule while leaving the reporting gap unresolved would be incomplete.
Evidence and common mistakes
Documented methods and criteria are explicitly required, alongside the broader planning information. Assessment records should make the hazard or system issue, controls considered and decision understandable. The exact form can vary with complexity and consequences.
Common weaknesses include assuming controls are effective because they were purchased, using the same rating for every task and ignoring uncertainty. Another is reassessing only after injury. Proactive assessment should be connected to change, new knowledge and the actual work conditions identified by the system.
Frequently asked questions
Is a five-by-five matrix mandatory?
No. Choose suitable methods and criteria and document them as required. The method must support proactive, systematic assessment.
Can existing controls reduce the assessed risk?
They can inform the assessment when their effectiveness is understood. Do not assume a documented control works without evidence.
What are other system risks?
They are risks affecting the management system’s establishment and operation, such as gaps in competence, resources or reliable information.
Check the reasoning behind one assessment
Ask Sterling to review your OH&S risk-assessment process and its evidence, with technical scope agreed separately. The Risk Management course supports structured reasoning. Effivity ISO & GRC automation software can be scoped to agreed needs. See hazard and risk planning and the guide.