Hazard vs risk: what's the difference? With examples

A hazard is a thing or situation that could harm someone. A risk is the chance that the hazard actually will cause harm, together with how serious that harm could be. A wet floor is a hazard; the chance that someone slips on it and breaks a wrist is the risk.

If you searched "difference between hazard and risk" or "hazard vs risk", that's the short answer. The rest of this page gives the official definitions, examples from real workplaces, and how the two fit into a risk assessment and the hierarchy of controls.

What is a hazard?

Safe Work Australia's Code of Practice: How to manage work health and safety risks defines a hazard as "a situation or thing that has the potential to harm a person". Its examples include noisy machinery, a moving forklift, chemicals, electricity, working at heights, a repetitive job, and bullying and violence at work.

A hazard exists whether or not anyone is near it. An unguarded edge on a roof is a hazard on a Sunday when the site is empty, and it's the same hazard on Monday when the roofers arrive.

Hazards come in several kinds: physical (noise, heat, moving plant), chemical (solvents, dusts, fumes), biological (bacteria, bites), ergonomic (lifting, repetitive work) and psychosocial (high job demands, harassment, aggression). The hazard library lists the common ones with the controls that work for each.

What is a risk?

The same code defines risk as "the possibility harm (death, injury or illness) might occur when exposed to a hazard". In practice a risk has two parts:

• Likelihood: how probable it is that someone will be harmed. This depends on how often people are exposed, for how long, and what controls are already in place.
• Consequence: how bad the harm would be if it happened, from a minor cut to a death.

That's why a risk is always about people meeting a hazard. The empty roof is still hazardous, but the risk of a fall only arises when someone works near the edge.

What is the difference between a hazard and a risk?

A hazard is the source of harm. A risk is the chance that the source will cause harm, and how badly. You find hazards by looking. You work out risks by thinking about who is exposed, how often, and what could happen.

The code puts the link plainly: you can't eliminate a risk without eliminating the hazard. Every other control only reduces the risk.

Hazard and risk examples

Each row below names a hazard, the risk it creates, and a control that reduces it.

For the first row, the slips, trips and falls hazard page lists more controls, most effective first.

Same hazard, different risk

One hazard can carry very different levels of risk, which is why you assess risks rather than just listing hazards.

• A ladder used for two minutes to change a light globe in a storeroom carries a lower risk than the same ladder used all day on a busy site, on uneven ground, by someone carrying materials.
• A forklift in a fenced yard where only the driver works carries a lower risk than one in an aisle that order pickers walk through all shift.
• Noise from a concrete saw is a bigger risk for the operator using it for hours than for a worker passing by.

The hazard is identical each time. The exposure, the people and the controls change the risk.

How hazards and risks fit into risk management

Under the model WHS laws, managing a risk starts with finding the hazard. The model WHS Regulations require a duty holder managing risks to identify reasonably foreseeable hazards (regulation 34), then eliminate the risks so far as is reasonably practicable, or minimise them if elimination isn't (regulation 35). The same duty to eliminate or minimise is in section 17 of the model WHS Act.

The code sets out four steps:

1. Identify hazards. Walk the site, talk to the people doing the work, and check incident reports and manufacturer information.
2. Assess risks, if necessary. Work out how likely harm is and how serious it could be. The code says this step may not be needed if the risk and its controls are well known.
3. Control risks. Put in the most effective control that's reasonably practicable, and keep it working.
4. Review. Check the controls are working, especially after a change or an incident.

A risk matrix turns step 2 into a rating, by scoring likelihood against consequence, so you can see which risks to deal with first. The risk assessment form records each hazard, its risk rating, the controls and the rating that remains. For a full walk-through, read risk assessment 101.

How the hierarchy of controls treats hazards and risks

The hierarchy of controls ranks controls from most to least effective. Where the WHS Regulations require a risk to be managed and it can't be eliminated, regulation 36 of the model WHS Regulations requires you to work down it in order:

1. Eliminate the hazard, which removes the risk with it. Do the work at ground level instead of at height.
2. Substitute, isolate or engineer. Swap in something less hazardous, put distance or a barrier between people and the hazard, or use a physical control such as a guard or extraction.
3. Administrative controls. Procedures, training, signs and rosters reduce exposure.
4. Personal protective equipment. The last line, used for whatever risk remains.

Notice that only the top level deals with the hazard itself. Everything below it leaves the hazard in place and works on the risk, which is why the lower controls depend on people following them. The hierarchy of controls guide works through each level with worksite examples.

Common questions

Is a hazard the same as a risk? No. A hazard is what could cause harm. A risk is the chance that it will, and how serious the harm could be. You can have a hazard with a low risk, such as a chemical stored sealed in a locked cabinet.

What is residual risk? The risk that remains after your controls are in place. A risk assessment usually records a rating before and after controls, so you can check the controls have brought the risk to an acceptable level.

Do I need a written risk assessment for every hazard? Not always. The code says a risk assessment isn't required when the law sets out how a hazard must be controlled, and may not be needed when a code of practice or well-known industry controls already suit the situation. The WHS Regulations do make a risk assessment mandatory for some high-risk work, such as confined space entry, diving work and live electrical work.

Who should identify hazards? The PCBU is responsible, but the people doing the work know the hazards best. The model WHS Act requires the PCBU to consult workers, so far as is reasonably practicable, when identifying hazards and assessing risks (sections 47 and 49).

This is general information, not legal advice. Check the current law with your WHS regulator.