The Definition of Risk Assessment

Definition of Risk Assessment

A risk assessment is a structured process for finding the hazards in a task, workplace or process, estimating the risk each one creates, and deciding what controls are needed to bring that risk to an acceptable level. Risk is usually judged by combining two things: how likely it is that harm will occur and how severe that harm could be.

ISO 31000:2018, the international guideline for risk management, describes risk assessment as three linked steps: risk identification, risk analysis and risk evaluation. ISO 45001:2018, the occupational health and safety management system standard, requires organizations to identify hazards and assess the risks to workers in clause 6.1.2, and then plan controls using the hierarchy of controls.

Risk assessments range from a quick field level risk assessment done by a crew before starting work to a detailed engineering study of a chemical process. The method should match the complexity of the hazard.

Legal and Standards Requirements

United States

OSHA does not have a single general standard titled "risk assessment," but several standards require a formal hazard or risk evaluation:

• PPE hazard assessment: 29 CFR 1910.132(d) requires employers to assess the workplace for hazards that call for personal protective equipment and to keep a written certification that the assessment was done.
• Process hazard analysis: the process safety management standard, 29 CFR 1910.119(e), requires a process hazard analysis for covered processes involving highly hazardous chemicals.
• Permit spaces: 29 CFR 1910.146 requires employers to evaluate the workplace to find permit-required confined spaces and the hazards inside them.
• General duty: under Section 5(a)(1) of the OSH Act, employers must protect workers from recognized serious hazards, which in practice requires knowing what those hazards are.

OSHA's Recommended Practices for Safety and Health Programs also list hazard identification and assessment as a core element of an effective program.

United Kingdom

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a "suitable and sufficient" assessment of the risks to employees and others affected by the work. Employers with five or more employees must record the significant findings and any group of employees identified as especially at risk.

Voluntary standards

ISO 45001, ANSI/ASSP Z10.0 and ISO 31000 all treat risk assessment as the starting point for planning controls.

How a Risk Assessment Works

1. Define the scope

Decide what is being assessed: a single task, a job, a piece of equipment, a site or a process. Include non-routine work such as maintenance, cleaning and emergencies, which often carry the highest risk.

2. Identify hazards

List everything that could cause harm, including physical, chemical, biological, ergonomic and psychosocial hazards. Walk the area, talk to the people who do the work, and review incident reports, near misses and safety data sheets. See hazard identification.

3. Analyze the risk

For each hazard, estimate how likely harm is and how severe it would be, taking existing controls into account. Many organizations use a risk matrix for this step. A qualitative assessment uses categories such as low, medium and high, while a quantitative assessment uses numerical estimates.

4. Evaluate and decide on controls

Compare each risk against the organization's criteria for what is acceptable. Where the risk is too high, add controls in order of the hierarchy: elimination, substitution, engineering controls, administrative controls and then PPE.

5. Record, communicate and review

Write down the findings and the controls, share them with the workers affected, and track open actions. Many organizations keep this information in a risk register. Review the assessment when the work changes, after an incident, or at a set interval.

Common Types of Risk Assessment

• Job or task hazard analysis: breaks a job into steps and identifies hazards and controls for each. See job hazard analysis.
• Field level or point-of-work assessments: short checks done on site before work begins to catch conditions a planned assessment could not anticipate.
• Site or workplace assessments: cover a whole facility, including layout, traffic, emergency exits and shared hazards.
• Specialist assessments: cover specific hazards such as noise, manual handling, chemicals, fire or lone work.
• Process hazard analysis: uses structured methods such as HAZOP or what-if analysis for complex industrial processes.

Tips for Better Risk Assessments

• Involve workers who actually do the task. They know the shortcuts, workarounds and conditions that do not appear in procedures.
• Assess the work as it is really done, not only as it is written.
• Consider who is exposed, including contractors, visitors, new workers and people who work alone.
• Do not rely on PPE or training alone when a higher level control is practical.
• Be specific. "Be careful" is not a control. "Install a guard on the conveyor tail pulley" is.
• Record the residual risk that remains after controls, so decision makers know what they are accepting.

For workers who travel or work alone, the risk assessment should cover how they will get help in an emergency. Scheduled check-ins or lone worker monitoring can be one of the controls identified.

Example of Risk Assessment

A water utility planned to have a technician inspect valve chambers at remote pump stations. The risk assessment team, which included two experienced technicians, identified several hazards: possible low oxygen levels in the chambers, slips on wet ladders, driving on rural roads and the fact that the technician would be working alone with poor cell coverage.

The team rated the confined space hazard as high. It changed the procedure so that chambers would be inspected from above with a camera wherever possible, eliminating most entries. For the remaining entries, it required a gas test, a second person and a written permit. For lone travel, it added a check-in schedule and a satellite communicator. The team recorded the residual risk and set a review for six months later.

Frequently Asked Questions: Risk Assessment

Is a risk assessment required by law?

It depends on the location. In the UK, employers must carry out a suitable and sufficient risk assessment under the Management of Health and Safety at Work Regulations 1999. In the US, OSHA requires specific assessments, such as the PPE hazard assessment and process hazard analysis, rather than one general risk assessment.

What is the difference between a hazard and a risk?

A hazard is something with the potential to cause harm, such as a chemical or an unguarded machine. Risk is the combination of how likely that harm is and how severe it would be.

How often should a risk assessment be reviewed?

Review it whenever the work, equipment, people or location change, after an incident or near miss, and at a regular interval set by your safety program. Many organizations review significant assessments at least once a year.

Who should carry out a risk assessment?

Someone competent in the work and the hazards involved, working with the people who do the task. Complex processes may need specialists such as process safety engineers or industrial hygienists.

Does a risk assessment have to be written?

Writing it down is good practice and is often required. OSHA requires written certification of the PPE hazard assessment, and UK employers with five or more employees must record significant findings.