Hazard and Risk - Risk Assessment

Risk assessment is a term used to describe the overall process or method where of identifying hazards, assessing the risk of hazards, and prioritizing hazards associated with a specific activity, task, or job. It considers the probability or likelihood of harm from exposure and the potential consequence or severity of harm from exposure to a hazard.  

A risk assessment is a thorough look at your workplace to identify those things, situations, processes, etc. that may cause harm, particularly to people. After the identification of a hazard, it should be reviewed to determine how likely and severe the potential harm is. When this determination is made, you can decide what measures should be in place to effectively eliminate or control the harm from happening (hazard control).

Some important terms related to risk assessments include:

Hazard - a potential source of injury, adverse health effect, or damage to people, structures, equipment, or the environment. A common way to classify hazards is to categorize them as biological, chemical, ergonomic, physical, psychosocial, and safety hazards.

Hazard identification – the process of finding, listing, and characterizing hazards.

Risk - the combination of probability and severity that a person will be harmed or experience an adverse health effect if exposed to a hazard. Risk can also be applied to situations with property or equipment damage, or harmful effects on the environment.

Probability - the extent to which an event is likely to occur. The probability of harm may also be referenced as the likelihood of harm. 

Severity - the seriousness of an incident, injury, or illness. Severity, or consequence, describes the highest level of damage possible from a hazard and is often described in terms such as catastrophic, critical, moderate, minor, or negligible. 

In general, risk can be expressed as: Risk = probability x severity 

Hazard control - control measure(s) and action(s) taken to reduce the risk of a hazard based on the risk assessment. Hazard control should also include monitoring, re-evaluation, and compliance with decisions (the term “controls” or “control measures” are also used and have the same meaning). Recommending or determining hazard controls may be incorporated into the risk assessment process, or completed separately following a risk assessment. 

For definitions and more information about what hazards and risks are, please see the OSH Answers document Hazard and Risk.

Risk assessments are very important as they form an integral part of an occupational health and safety management plan. They help to:

• Create awareness of hazards and risks.
• Identify who may be at risk (e.g., workers, cleaners, visitors, contractors, the public, etc.).
• Determine whether a control program is required for a particular hazard.
• Determine if existing control measures are adequate or if more should be done.
• Prevent injuries or illnesses, especially when done at the design or planning stage.
• Prioritize hazards and control measures.
• Meet legal requirements where applicable.

The aim of the risk assessment process is to evaluate hazards and then remove that hazard or minimize the level of its risk by adding control measures, as necessary. By doing so, you have created a safer and healthier workplace.

The goal is to try to answer the following questions:

1. What can happen, and under what circumstances?
2. What are the possible consequences?
3. How likely are the possible consequences to occur?
4. How severe are the possible consequences?
5. Has an adequate level of risk reduction been achieved, or is further action required?

There may be many reasons a risk assessment is needed, including:

• Before new processes or activities are introduced.
• Before changes are introduced to existing processes or activities, including when products, machinery, tools, or equipment change.
• When new information concerning harm becomes available.
• When hazards are identified.
• Before working in a new environment.
• When new information on hazard controls or good practices becomes available.
• Before performing maintenance or commissioning of equipment
• Before completing routine or non-routine tasks.
• When the legislation requires a risk assessment to be done. 

In general, determine:

• What the scope of your risk assessment will be (e.g., be specific about what you are assessing such as the lifetime of the product, the physical area where the work activity takes place, or the types of hazards).
• The resources needed (e.g., training a team of individuals to carry out the assessment, the types of information sources, etc.).
• What type of risk analysis measures will be used (e.g., how exact the scale or parameters need to be in order to provide the most relevant evaluation)?
• Who are the stakeholders involved (e.g., manager, supervisors, workers, worker representatives, suppliers, etc.).
• What relevant laws, regulations, codes, or standards may apply in your jurisdiction, as well as organizational policies and procedures?

In general, to do an assessment, you should:

1. Assemble a risk assessment team. Assessments should be done by a competent person or team of individuals who have a good working knowledge of the situation being studied. Include the supervisors and workers who work with the process under review on the team or as sources of information, as these individuals are the most familiar with the operation. The health and safety committee or representative should also be consulted. 
2. Select the job or process to assess. Refer to the above section, “When should a risk assessment be done”, to help prioritize your assessments. Ideally, risk assessments should be done for all jobs. Jobs or tasks with higher injury and illness rates, worker concerns, and other factors should be considered first.  
3. Break down the job or process into tasks. Divide the job or process into tasks or basic steps to better understand the hazards. 
4. Identify the hazards of each task. After the basic steps or tasks have been recorded, identify the hazards of each step or task. List the hazards based on observations and inspections, previous causes of incidents and injuries, feedback from workers and supervisors directly involved in the task, and other considerations.   
5. Assess the risk of each hazard. For each hazard, determine the likelihood of harm, such as an injury or illness occurring, and its severity. Use a risk assessment method appropriate for your workplace (see further below for details on risk assessment methods). Consider normal operational situations as well as non-standard events such as maintenance, shutdowns, power outages, emergencies, extreme weather, etc. Review all available health and safety information about the hazard, such as Safety Data Sheet (SDS), manufacturer's literature, information from reputable organizations, results of testing, workplace inspection reports, records of workplace incidents (accidents), including information about the type and frequency of the occurrence, illnesses, injuries, near misses, etc. Make sure you understand the minimum legislated requirements for your jurisdiction.
6. Control the risk of each hazard. Using the hierarchy of controls, identify the actions necessary to eliminate the hazard or control the risk.
7. Evaluate the effectiveness of controls. Establish a review process for monitoring controls to ensure they remain effective. 
8. Communicate the results. Workers, supervisors, and other individuals involved with the job or process being assessed should be aware of the risk assessment results. Workers must be aware of every hazard associated with their job and the controls in place to protect them. Keep any necessary documents or records. Documentation may include detailing the process used to assess the risk, outlining any evaluations, or detailing how conclusions were made.

When doing an assessment, also take into account:

• The methods and procedures used in the processing, use, handling, or storage of the substance, etc.
• The actual and the potential exposure of workers (e.g., how many workers may be exposed, what that exposure is or will be, and how often they will be exposed).
• The measures and procedures necessary to control such exposure by means of engineering controls, work practices, and hygiene practices and facilities.
• The duration and frequency of the task (how long and how often a task is done).
• The location where the task is done.
• The machinery, tools, materials, etc., that are used in the operation and how they are used (e.g., the physical state of a chemical or lifting heavy loads for a distance).
• Any possible interactions with other activities in the area and if the task could affect others (e.g., cleaners, visitors, etc.).
• The lifecycle of the product, process, or service (e.g., design, construction, uses, decommissioning).
• The education and training the workers have received.
• How a person would react in a particular situation (e.g., what would be the most common reaction by a person if the machine failed or malfunctioned).

It is important to remember that the assessment must take into account not only the current state of the workplace but any potential situations as well.

By determining the level of risk associated with the hazard, the employer and the health and safety committee (where appropriate) can decide whether a control program is required and to what level.

See a sample risk assessment form.

Overall, the goal is to find and record possible hazards that may be present in your workplace. It may help to work as a team and include both people familiar with the work area, as well as people who are not - this way you have both the experienced and fresh eye to conduct inspections and evaluations. In either case, the person or team should be competent to carry out the assessment and have good knowledge about the hazard being assessed, any situations that might likely occur, and protective measures appropriate to that hazard or risk.

To be sure that all hazards are found:

• Look at all aspects of the work.
• Include routine and non-routine activities such as maintenance, repair, or cleaning.
• Look at the incidents, near-miss, and hazard reports.
• Include people who work off-site either at home, on other job sites, drivers, teleworkers, with clients, etc.
• Look at the way the work is organized or done (include the experience of people doing the work, systems being used, etc.).
• Look at foreseeable unusual conditions (for example: possible impact on hazard control procedures that may be unavailable in an emergency situation, power outage, climate event, etc.).
• Determine whether a product, machine or equipment can be intentionally or unintentionally changed (e.g., a safety guard that could be removed).
• Review all of the phases of the process or lifecycle.
• Examine risks to visitors or the public.
• Consider the knowledge, experience, training, and education of the individuals performing the work.
• Consider the groups of people that may have a different level of risk such as young or inexperienced workers, persons with disabilities, or new or expectant mothers.

It may help to create a chart or table such as the following:

Table 1: Hazards, risks, and controls

Job: Delivery Driver

Task: Delivering Products to customers 

Please see further below for guidance on determining the risk and priority of each hazard, including the risk matrices in Table 2 and Table 3. 

More information is also available in the OSH Answers on Hazard Identification. 

Each hazard should be studied to determine its level of risk. Understanding how likely it is that a hazard will cause harm and how severe that harm could be.

To research the hazard, you can look at:

• Product information and the manufacturer documentation.
• Past experience (knowledge from workers, etc.).
• Legislated requirements and applicable standards.
• Industry codes of practice and good practices.
• Health and safety material about the hazard, such as safety data sheets (SDSs), research studies, or other manufacturer information.
• Information from reputable organizations.
• Results of testing (atmospheric or air sampling of the workplace, biological swabs, etc.).
• The expertise of an occupational health and safety professional or other technical experts.
• Information about previous injuries, illnesses, near misses, incident reports, etc.
• Observation of the process or task.

Remember to include factors that contribute to the level of risk, such as:

• The work environment (layout, condition, weather, etc.).
• The procedures for performing a task.
• The range of foreseeable conditions.
• The way the source may cause harm (e.g., inhalation, ingestion, etc.).
• How often and how much a person will be exposed.
• The interaction, capability, skill, and experience of workers who do the work.
• The physical, psychological, or cognitive abilities and characteristics of workers.
• Individual worker factors such as age, height, disabilities, allergies, sensitivities, and pregnant or breastfeeding workers.
• The number of people that could be impacted.
• Working alone or in a remote area. 

Ranking or prioritizing hazards is one way to help determine which hazards are the most serious and, thus, which to control first. Priority is usually established by taking into account the probability of employee exposure to the hazard and the potential severity of an incident, injury or illness associated with the hazard. By assigning a priority to the hazards based on the risks, you are creating a ranking or an action list. Risk assessments with clearly defined parameters for probability and severity will make it easier to determine which hazards should be addressed first. 

Numerous methods exist to analyze risk, and the method used will depend on many factors, including the experience level of the risk assessment team, the scope, the data available, and the level of detail required to adequately understand the risks. There is no one simple or single way to determine the level of risk. Nor will a single method apply in all situations. The organization has to determine which method will work best for each situation. Ranking hazards requires knowledge of workplace activities, the urgency of situations, and, most importantly, objective judgment.

For simple or less complex situations, an assessment can literally be a discussion or brainstorming session based on knowledge and experience. In some cases, checklists or a risk matrix can be helpful. For more complex situations, a team of knowledgeable personnel who are familiar with the work and risk assessment methodologies is usually necessary. Depending on the circumstances or situation being assessed, the legislation may specify how the risk assessment needs to be done, including what personnel need to be involved. 

Depending on the circumstances or situation being assessed, the legislation may specify how the risk assessment needs to be done, including what personnel need to be involved. 

Basic Qualitative Methods

The basic qualitative method combines severity and probability parameters to produce a level of risk that is compared against pre-determined risk criteria. This method evaluates risk based on the inherent characteristics of the hazard without assigning a numerical value. As an example, consider this simple qualitative risk matrix. Table 2 shows the relationship between probability and severity and how a risk rating can be determined.

Severity ratings in this example represent:

• High severity: fatal disease or injury, permanent disability, irreversible health effects, major fracture, poisoning, significant loss of blood, or serious head injury
• Medium severity: sprain, strain, localized burn, dermatitis, asthma, injury requiring limited days off work
• Low severity: an injury that requires first aid only; short-term pain, irritation, or dizziness

Probability ratings in this example represent:

• High probability: likely to be experienced once a year or more by an individual
• Medium probability: may be experienced once every five years by an individual
• Low probability: may occur once during a working lifetime

The priority for addressing hazards should be based on their risk rating. You can also develop general actions that correspond to the risk rating, such as:

• Immediately dangerous: stop the process and implement controls immediately
• High risk: investigate the process and implement controls immediately
• Medium risk: keep the process going; however, a control plan must be developed and should be implemented as soon as possible
• Low risk: keep the process going, but monitor regularly. A control plan should also be investigated.
• Very low risk: keep monitoring the process

Let's look at an example using criteria from Table 2: When painting a room, a step stool must be used to reach higher areas. The individual will not be standing higher than 1 metre (3 feet) at any time. The assessment team reviewed the situation and agrees that working from a step stool at 1 m is likely to:

• Cause a short-term injury such as a strain or sprain if the individual falls. A severe sprain may require days off work. This outcome is similar to a medium severity rating.
• Occur once in a working lifetime as painting is an uncommon activity for this organization. This criterion is similar to a low probability rating.

When compared to the risk matrix chart (Table 2), these values correspond to a low risk rating.

The workplace decides to implement hazard control measures, including the use of a stool with a large top that will allow the individual to maintain stability when standing on the stool. They also provided training to the individual on the importance of making sure the stool's legs always rest on the flat surface and are secure. The training also included steps to avoid excessive reaching while painting.

Other types of qualitative risk assessments include hazard and operability (HAZOP) analysis, bowtie analysis, and other similar risk matrices.

Semi-quantitative Methods

Semi-quantitative methods involve assigning numerical values or scores to various qualitative risk factors and then using these scores to rank or prioritize risk. This approach combines elements of both qualitative and quantitative risk assessment techniques. This method offers a middle-ground approach between qualitative and quantitative risk assessments, making it a flexible tool for a wide range of applications. 

Semi-quantitative methods involve assigning numerical values or scores to various qualitative risk factors and then using these scores to rank or prioritize risk. This approach combines elements of both qualitative and quantitative risk assessment techniques. This method offers a middle-ground approach between qualitative and quantitative risk assessments, making it a flexible tool for a wide range of applications. 

Below is an example of a semi-quantitative risk matrix (Table 3) that could be used. 

Table 3: Example of a semi-quantitative risk matrix

When using this method, it is important to clearly define the parameters for assigning scores for severity and probability, so all team members understand the scoring criteria. Using Table 3, a hazard assigned as having an unlikely probability of occurring (probability score of 2) and minor severity (severity score of 2) is a moderate riskwith a risk rating score of 4.

Remember!  Risk = probability x severity.  

The qualitative and semi-quantitative risk matrices above are just a couple of examples. These matrices can be customized to further refine risk by considering more detailed criteria for probability and severity. Quantitative methods are also sometimes used, which calculate risk based on data collected over a period of time or multiple situations. Examples include failure mode and effects analysis (FMEA) and decision tree analysis (these methods are not covered in this fact sheet). 

Field-level Risk Assessment 

A field-level risk assessment (FLRA) is another method that is commonly used in industries and workplaces where workers are exposed to dynamic and changing work environments. Field-level risk assessments can use qualitative or semi-quantitative methods for assessing risk, including the matrices shown above.  

The purpose of a field-level risk assessment is to identify, assess, and manage hazards and risks in real-time or on-site as work progresses, with a focus on ensuring the safety of workers. Field-level risk assessments are often completed in addition to formal risk assessments that have already been done before that specific day. Field-level risk assessments can also supplement safety meetings with teams as you work together through a common task, highlighting hazards and control measures that are currently in place. It can also be a good opportunity to brainstorm additional controls or better ways to complete the task. These risk assessments can help continue the safety conversation and avoid complacency. 

Similar to other risk assessments, each step of the task should be written down and hazards identified. The risk of each hazard can then be assessed based on the likelihood and severity of harm. Then, the team will determine if the current controls in place are adequate, or if further measures are needed prior to work beginning. An example of a table that may assist with a field-level risk assessment is shown in Table 4. Risk matrices similar to those in Table 2 or Table 3 can also be used to assess the risk for each hazard.  

Table 4: Field-level risk assessment

Job or work activity being assessed:________________________________________

Once you have established the priorities, the organization can decide on ways to control each specific hazard. Hazard control methods are often grouped into the following categories:

• Elimination.
• Substitution.
• Engineering controls.
• Administrative controls.
• Personal protective equipment.

For more details, please see the OSH Answers Hazard Control.

It is important to know if your risk assessment was complete and accurate. It is also essential to be sure that any changes in the workplace have not introduced new hazards or changed hazards that were once ranked as lower priorities to higher priorities.

It is good practice to review your assessment on a regular basis to make sure your control methods are effective.

It is very important to keep records of your assessment and any control actions taken. You may be required to store assessments for a specific number of years. Check for local requirements in your jurisdiction.

The level of documentation or record keeping will depend on:

• Level of risk involved.
• Legislated requirements.
• Requirements of any management systems that may be in place.

Your records should show that you:

• Conducted a good hazard review.
• Determined the risks of those hazards.
• Implemented control measures suitable for the risk.
• Reviewed and monitored all hazards in the workplace.