Managing WHS risks and preventing harm: 10 practical steps

Managing WHS risks means finding the hazards in your work, judging how likely harm is and how bad it could be, controlling the risk, and checking that the controls keep working. A person conducting a business or undertaking (PCBU) has a primary duty of care under the WHS Act. The WHS Regulations then require the PCBU to eliminate risks so far as is reasonably practicable, and to minimise any that can't be eliminated. The steps below show how to do that on a real site.

Who is responsible for WHS risks?

The PCBU has the primary duty of care, but every worker has duties too. In practice, one person should own the risk process day to day, usually a supervisor, site manager or WHS coordinator. That person doesn't carry the duty alone. They make sure the crew knows the process, and that hazards reported by anyone get written down and followed up.

Someone without authority over the work can't fix a risk they don't control. Give the owner the time, budget and sign-off to act.

1. Name a person to own the process

Write down who runs risk management, who approves controls and who checks that they're in place. A one-page responsibility list is enough for a small business. On a larger site, put the same details in the WHS management plan so every subcontractor can see them.

2. Find the hazards with the people doing the work

Walk the site or workplace, and look at what could hurt someone: height, plant, chemicals, manual handling, electricity, heat, noise, traffic, bad housekeeping and fatigue. Then ask the workers. They know which jobs are done differently from the procedure, and which hazards only show up at 4 pm.

Consulting workers is a legal duty as well as good practice. The WHS Act requires you to consult workers on matters that affect their health and safety, including identifying hazards and deciding on controls.

Use a hazard report form so reports are written down and can be tracked, not lost in a conversation.

3. Assess each risk

For each hazard, ask two questions: how likely is it that someone gets hurt, and how serious would the injury be? Record the answers in a risk register so you can compare risks and see which ones to deal with first. A risk that could kill someone needs action now, even if it rarely happens.

4. Control the risk, starting at the top

The model WHS Regulations require you to eliminate the risk where you can. If you can't, you must minimise it, working down the hierarchy of control measures:

1. Substitute or isolate. Use a less hazardous substance, or put the hazard out of reach.
2. Engineer it out. Guards, ventilation, mechanical lifting aids, or a fixed barrier that stops access to a hazard.
3. Change the way the work is done. Procedures, permits, rotation, supervision and signage.
4. Protective equipment. PPE such as respirators, hearing protection and gloves. It is the last line, not the first.

Two examples from real worksites:

• Silica dust. Engineered stone has been banned from use and supply since 1 July 2024, so the control is to not use it at all. Where silica is still present, such as concrete or masonry cutting, the controls are wet cutting, on-tool extraction, and RPE only as a last layer.
• Working at height. Fix a guardrail or use a scaffold before relying on a harness. A harness is a backup for when edge protection can't be installed.

5. Write the controls down

For high-risk tasks, a safe work method statement (SWMS) is the usual record. For routine tasks, a safe operating procedure (SOP) does the job. Either document should say who does what, what the controls are, and what to do if something goes wrong.

A procedure nobody reads doesn't control anything. Keep it short, and write it in the words the crew use.

6. Train and tell people

Once the controls are set, workers need to know them. Run a short induction, then toolbox talks on the hazards for each job. Record who attended and what they were told, and check that they can do the task safely, not only that they signed the sheet.

Tell people when a control changes. A new exclusion zone that is only on a whiteboard in the site office will be missed.

7. Control access to hazardous areas

Only trained and authorised people should enter areas with plant, confined spaces, live electrical work or hazardous energy. Use signage, physical barriers and a permit-to-work system where the risk needs one. Check every so often who still needs access and why, because access lists tend to grow.

8. Protect health, not just safety

Some harm builds up slowly. Silica and lead exposure can cause lung disease and nerve damage, and fatigue and stress raise the chance of mistakes. Control exposure to hazardous substances, provide breaks and rostering that allow proper rest, and make sure people can report a problem without being pushed to keep working.

9. Inspect and audit

Inspections find the gaps between what the procedure says and what happens on the day. Use a checklist, record what you found and what you fixed, and look for repeat problems. Three inspections that find the same unguarded machine point to a control that isn't working, not three separate mistakes.

Audits are a wider check, usually once a year, that looks at whether the whole system works. A WHS audit can be run from the same checklists.

10. Investigate incidents and near misses

Every incident and near miss tells you where a control failed. Ask why it happened, not who was at fault. Then change the control, and tell the workers what changed. Incidents that cause serious injury or death must be reported to the regulator, so know your state or territory's notification rules before you need them.

When to review your controls

A control only counts while it works. The model WHS Regulations require a review in these cases:

For more on this, read why reviewing your risk controls matters.

Keep your risk documents in one place

Most of the failures above are not about knowing what to do. They happen because the risk register lives in one spreadsheet, the SWMS is a copy from last year's job, and the signed sign-on sheet is in a filing cabinet at head office. When something changes, nobody knows which version is current.

Common questions

Is managing WHS risk the same as having a safety management system? Not quite. Risk management is the process of finding hazards and controlling them. A safety management system is the wider set of policies, procedures and records that support that process. Most businesses need both, and the safety management system guide explains how they fit together.

How often should I review my risk assessments? There is no fixed period in the model WHS Regulations. Review when one of the triggers above happens, and at a regular interval you set in your own procedures, such as every 12 months.

Do I need to write everything down? The law requires some records for specific tasks, such as a SWMS for high-risk construction work. Writing down the rest makes it much easier to show what you did and to keep it working.

Who is liable if a control fails? The PCBU carries the primary duty, and officers have a duty of due diligence. Controls that were written down, communicated and reviewed are much easier to defend than verbal instructions.

This is general information, not legal advice. Check the current law with your WHS regulator.