ISO 45001 Hazard Identification and Risk Assessment in Practice
How to move from a paper risk register to a real assessment that prevents injuries at work
Hazard identification and risk assessment are at the heart of an occupational health and safety management system under ISO 45001:2018. They decide where controls, training and resources should be focused. Yet in many organisations they become a long table prepared once and only revisited before an audit.
The standard requires an ongoing, proactive process to identify hazards that considers routine and non-routine activities, human factors, contractors and visitors, changes and emergencies. It also requires the hierarchy of controls to be applied when determining actions.
1. Hazard and risk: a basic distinction
| Term | Meaning | Example |
|---|---|---|
| Hazard | A source with potential to cause injury or ill health | A forklift moving in a pedestrian aisle |
| Risk | Combination of the likelihood of an event and the severity of the resulting injury | The chance that the forklift strikes a worker and causes serious injury |
Confusing the two produces registers that list “forklift” without describing how it could cause harm.
2. Where hazards come from
- Routine and non-routine activities: daily production, cleaning, maintenance, start-up after shutdown.
- Human factors: fatigue, shift work, workstation design, time pressure.
- Physical environment: noise, heat, lighting, slippery surfaces.
- Chemical and biological agents.
- Psychosocial hazards: workload, harassment, lone working. ISO 45003 gives guidance on managing them.
- Contractors, visitors and other workers on site.
- Emergencies: fire, spills, power failure.
- Changes: new equipment, a revised layout, new processes.
A good practice is to write each hazard as a sentence linking activity, event and outcome: “During [activity], [hazard] may lead to [harm]”. For example: “During truck loading, pedestrians in the forklift aisle may suffer crushing injuries.”
3. Assessing risk
Many organisations use a likelihood and severity matrix:
| Score | Rating | Required action |
|---|---|---|
| 1–4 | Low | Acceptable with existing controls and monitoring |
| 5–9 | Medium | Additional controls within a set time |
| 10–16 | High | Urgent controls before work continues, or clear restrictions |
| 20–25 | Unacceptable | Stop the activity until the risk is reduced |
More important than the numbers is consistency: every assessor should understand the likelihood and severity criteria in the same way, and the reasoning should be recorded.
4. The hierarchy of controls
| Order | Level | Example |
|---|---|---|
| 1 | Elimination | Removing the need to work at height through design |
| 2 | Substitution | Using a less hazardous cleaning chemical |
| 3 | Engineering controls | Barriers between pedestrians and forklifts, machine guards |
| 4 | Administrative controls and training | Permits to work, procedures, signage, training |
| 5 | Personal protective equipment | Helmets, gloves, hearing protection |
PPE is the last resort, not the first answer. Auditors often find registers where the only control is “wear PPE”.
5. Consultation and participation of workers
ISO 45001 stresses consultation and participation of non-managerial workers in hazard identification, risk assessment and the choice of controls. The person who does the task every day knows its real risks better than any table. This can be achieved through:
- Joint safety walks.
- Safety committees.
- Reporting of near misses without fear of blame.
- Reviewing the risk assessment with work teams at their workplace.
6. Reviewing and updating the assessment
The risk assessment is reviewed:
- Periodically, for example at least once a year.
- After any incident or near miss.
- Before any change to processes, equipment or sites.
- When new legal requirements are issued.
- When monitoring results change, such as noise or chemical exposure measurements.
It is linked to objectives, training programmes, emergency plans, internal audit and management review.
7. Common mistakes
- A generic register copied from another organisation that does not reflect the site’s activities.
- Non-routine activities such as maintenance and deep cleaning left out.
- No re-assessment after controls are applied (residual risk).
- PPE relied on as the main control.
- Workers and contractors not involved.
Conclusion
A good risk assessment is a living document that reflects what really happens at work, is built with the people who do the work, applies the hierarchy of controls and is reviewed after every change or incident. It is the foundation on which every other element of ISO 45001 is built.
Pick one non-routine activity at your site, such as line maintenance, and check: is it in the risk assessment?