ISO 45001 Clause 6.1.2: Identify Hazards and Assess Risk
ISO 45001:2018 clause 6.1.2 requires ongoing hazard identification and assessment of risks and opportunities. It separates identifying what could cause injury or ill health from evaluating the associated OH&S risks, other risks to the management system and opportunities to improve. The assessment must inform decisions about work, rather than end with a completed scoring sheet.
What clause 6.1.2 requires in practice
Clause 6.1.2 has three parts that answer different questions. Under 6.1.2.1, the organisation maintains an ongoing, proactive hazard-identification process that looks at how work is organised, routine and non-routine activity, past incidents, emergencies, people affected, changes and new knowledge. Under 6.1.2.2, it assesses OH&S risks from the hazards found, allowing for the effectiveness of existing controls, and assesses other risks to the system. The methods and criteria are defined and documented so assessment is proactive and systematic. Under 6.1.2.3, it assesses opportunities to improve performance and the system.
Outputs are therefore a way of finding hazards, a defined method for judging risk, and a way of weighing improvement options. A note recognises that OH&S risks and opportunities can themselves create other risks and opportunities for the organisation.
6.1.2.1: examine how work really happens
Hazard identification is proactive and ongoing. It considers work organisation and social factors, routine and non-routine activities, human factors, past relevant incidents, potential emergencies, affected people, surrounding conditions, change and new knowledge. Include workers performing activities at locations outside the organisation’s direct control.
Observe relevant activities and involve the people who perform them. A task description may omit interruptions, awkward handovers or maintenance conditions. Consider workers, contractors, visitors and others who could be affected. Do not assume that a hazard is irrelevant because no incident has been reported or because the activity is brief.
Why separating hazards, risks and opportunities matters
When these three ideas are blended, organisations end up with long lists and no decisions. A hazard says what could cause harm; a risk says how likely and how severe the harm could be given the controls; an opportunity says what could be improved. Keeping them distinct helps assign action to the right owner, avoids dismissing a hazard because its score looks low, and makes space for proactive improvements rather than only repair work. It also supports accurate reporting to leadership, since management can see where the real exposure lies. Customers and regulators asking how risks are determined can receive a straightforward, consistent answer.
How to implement clause 6.1.2
The three parts feed one another, so set them up together. One route used by Sterling teams is described below, with worker participation throughout. Keep competent specialist input available for exposures that need technical measurement or judgement. Record only what helps people act, and review it with the workers affected.
- Observe real tasks with the people who perform them, including non-routine work and work at customer locations.
- Agree how hazards will be described so that assessors can see the activity, the people exposed and the potential harm.
- Define the risk-assessment method and criteria, test them on a few real tasks, and document them.
- Check whether existing controls are in use before allowing them to reduce an assessed risk.
- Identify risks to the system itself, such as loss of key competence or unreliable reporting, and allocate them to accountable processes.
- Invite improvement ideas from workers, assess them for benefit and side effects, and feed accepted ones into planning.
Illustrative BPO example: a new customer operating window
A hypothetical BPO provider accepts a contract that changes working hours and workload distribution. Workers report that demand peaks leave little opportunity to raise concerns through existing supervisory routes. The assessment examines work organisation, hours, available resources and worker experience rather than treating the change as purely commercial.
The team evaluates relevant hazards and controls with appropriate expertise, then considers options for adapting the arrangement. Useful evidence includes the actual work assumptions, consultation and participation, decisions and follow-up after introduction. A generic office checklist might contribute, but would not by itself capture the changed operating conditions.
6.1.2.2: assess risks using defined criteria
Assess OH&S risks from the hazards identified, taking account of existing controls and their effectiveness. A control described in a procedure should not automatically be assumed effective; examine whether it is suitable, implemented and maintained. Uncertainty about the evidence is itself relevant to the decision.
Methods and criteria need a defined scope, nature and timing that supports proactive and systematic assessment. Maintain and retain the required information on them. A numerical matrix can be one tool, but is not a substitute for competent judgement or an applicable legal requirement. Avoid changing scoring conventions between sites without recognising the effect on comparisons.
Distinguish other risks to the system
The clause also addresses risks to establishing, operating and maintaining the OH&S system. For example, losing access to essential competence or failing to communicate legal changes can weaken the system even before a specific exposure is observed. Connect these concerns to accountable processes, not only the task-level hazard assessment.
This distinction helps assign action. An operational hazard may need a work-control decision, while an unreliable review process may require clearer responsibility or resources. They can interact, but combining them in one undifferentiated list can make it harder to choose the appropriate response.
Illustrative construction example: an altered access arrangement
A fictional project changes how contractors reach a work area. The assessment involves affected workers and competent site personnel, considering routine access, non-routine deliveries, nearby activities and relevant emergency implications. It checks whether previous controls remain effective under the new arrangement.
The team documents the assessment basis, authorises appropriate arrangements and checks their use. The method must fit the actual project; this example does not provide a traffic plan or technical separation requirements. The important evidence is the connection between changed conditions, evaluated risks, controls and later review.
6.1.2.3: evaluate opportunities as decisions
OH&S opportunities include adapting work, work organisation and the environment to workers, eliminating hazards and reducing risks. Other opportunities can improve the management system. A proposed improvement should be evaluated for its intended benefit and any new conditions it introduces, particularly during planned change.
For practical implementation, state what the opportunity could improve and which process would carry it out. A new reporting method may improve access, but also require different support and information controls. Calling an idea an opportunity does not establish that it is effective or ready for unrestricted introduction.
Evidence and recurring mistakes
An auditor may follow a hazard through assessment, control selection and monitoring, asking workers whether the documented account reflects the work. Required information about risks, opportunities and assessment methods must be preserved as applicable. A particular register format or branded scoring method is not mandatory.
Common weaknesses include assessing only normal operations, treating absence of injury as evidence of low risk, assuming every listed control works and excluding contractors or remote work. Review the assessment when relevant knowledge or conditions change; an annual review date alone cannot capture every necessary trigger.
Explore each numbered part
6.1.2.1 · identify hazards in work as performed
Hazard identification needs to be ongoing and proactive, covering how work is organised as well as equipment and physical conditions. Clause 6.1.2.1 includes routine and non-routine activities, people, past incidents, emergencies, change and new knowledge. This guide shows how worker participation and concrete task observation reveal hazards that generic checklists can miss.
6.1.2.2 · assess OH&S risks and system weaknesses
Risk assessment needs to consider how likely harm is, how serious it could be and whether existing controls actually work. Clause 6.1.2.2 also addresses risks to the management system. This guide explains proactive methods, documented criteria and worker input, with examples that distinguish a supported assessment from an attractive but unreliable risk score.
6.1.2.3 · assess opportunities to improve work
Opportunities are practical chances to improve OH&S performance and the system that supports it. Clause 6.1.2.3 includes adapting work to workers and finding ways to eliminate hazards or reduce risk. This guide explains how to assess those possibilities with worker input, without assuming every proposed technology or wellbeing initiative is automatically an effective improvement.
Frequently asked questions
Are psychosocial factors within the clause?
Yes. The source includes social factors such as workload, working hours and harmful workplace behaviours. Relevant concerns need appropriate assessment and competent support.
Must every site use identical scores?
A shared method may help, but criteria must suit the scope and nature of the work. Consistency should improve decisions rather than force unlike situations into misleading comparisons.
Does an assessment authorise a worker to perform a task?
No. Assessment informs controls. Competence, supervision, authorisation and applicable task requirements still need to be addressed through the organisation's arrangements.
Connect assessment to useful control
Discuss hazard-assessment and implementation support with Sterling, including employee learning and agreed Effivity ISO & GRC automation software. Certification is decided independently and does not guarantee legal compliance. Enrol in ISO 45001 Awareness for a shared foundation.
Return to clause 6 planning or the overview; continue with selecting controls through the hierarchy.
Connect this topic with the wider clause 6.1 process and the complete ISO 45001 requirements guide.