Risk assessment 101: what it is and how to get it right

A risk assessment is a structured way to judge how likely a hazard is to hurt someone, how serious that harm could be, and which controls will reduce it. You use the result to decide what to fix first. The model WHS Regulations require you to eliminate risks so far as is reasonably practicable and, if you can't, to minimise them, and a documented assessment is how you show you did.

What is the difference between a hazard and a risk?

People often use these words as if they mean the same thing. They don't.

• A hazard is anything that could cause harm. It's a thing or a situation: a wet floor, an unguarded blade, a heavy box to lift.
• A risk is the chance that the hazard will cause harm, together with how bad that harm could be. A worker slipping on the wet floor and fracturing a wrist is a risk. So is losing a finger to the blade.

You find hazards by walking the site and asking the crew. You assess risks by working out, for each hazard, how likely harm is and how serious it could be.

Hazards usually fall into a few groups:

Psychosocial hazards are the ones most often left out. The model Code of Practice on psychosocial hazards, published in 2022, treats them as a WHS risk like any other.

How do you run a risk assessment?

The model Code of Practice, How to manage work health and safety risks, sets out the process as four steps: identify hazards, assess risks, control them, and review the controls. In practice, five steps work well:

1. Identify the hazard. Use walkarounds, incident reports, toolbox talk feedback and job hazard analyses. Ask the people doing the task what goes wrong. Our step-by-step hazard assessment guide covers the walkaround in more detail.
2. Assess the risk. Estimate how likely harm is, given the controls that already exist, and how bad it could be. Use a matrix to combine the two.
3. Control the risk. Where the rating is too high, apply the controls in order: eliminate, substitute, isolate, engineer, change the work, then PPE. The hierarchy of controls post covers this in detail.
4. Record it. Write down the hazard, the rating, the controls and who is responsible for each one.
5. Review it. Check the controls still work, and reassess when the work, plant or people change.

How to use a risk matrix

A risk matrix puts likelihood on one axis and consequence on the other. Each box gives a rating, so you can compare hazards and rank them. This is a simple version you can adapt:

Two rules keep ratings honest:

• Be realistic about likelihood. Count how often people are exposed to the hazard, not how often it has caused a serious injury. A forklift that passes a pedestrian every ten minutes is a likely contact, even if nobody has been hit yet.
• Consider the worst credible outcome. For consequence, ask what could reasonably happen, not what usually does.

A low-likelihood event with a fatal outcome can still outrank a common, minor one. Our managing WHS risks post shows how the assessment fits into the rest of the risk process. Set your rule for what is acceptable, and write it into your risk register so supervisors rate things the same way.

A worked example: pedestrians and a forklift

A loading bay has a forklift reversing between pallets while two packers work nearby.

• Hazard: a moving forklift in a space shared with pedestrians.
• Likelihood: likely, because the bay is busy and visibility is poor when the forklift reverses.
• Consequence: serious or fatal if someone is crushed.
• Rating: high or extreme. The control must be strong.

The controls, starting at the top:

1. Isolate. Put pedestrians behind a barrier or a painted walkway, out of the forklift's path.
2. Engineer. Install a reversing camera or proximity sensor, and one-way traffic routes.
3. Change the work. Set a rule that the forklift stops and sounds the horn at blind corners, and that nobody walks behind a reversing vehicle.
4. PPE. High-visibility vests for pedestrians. This helps, but it's the last layer, not the main control.

Record the rating before and after the controls, so you can show the risk came down.

What a good assessment needs

Most failed assessments are not wrong in one big way. They fall short in small ones:

• Involve the crew. The people doing the task know the shortcuts and the workarounds. Consultation is also a legal duty under the WHS Act.
• Don't skip the soft risks. Fatigue and workplace stress can be assessed the same way as a guard on a machine. A fatigue risk assessment form gives you a starting point.
• Think about lone work and after-hours access. Security and emergency arrangements are part of the assessment.
• Look at the current task, not the old one. An assessment written for last year's method is out of date.
• Use a form people will fill in. A risk assessment form keeps each assessment consistent, so you can compare them later.

Keep the record in one place. When the controls change, update the assessment and the crew's procedure at the same time.

Common questions

Do I need a formal risk assessment for every task? No. A quick check before a routine, low-risk job may be enough. Write a formal assessment for new work, high-risk tasks and any job where conditions change.

What is the difference between inherent and residual risk? Inherent risk is the level before any controls are applied. Residual risk is what's left once the controls are working. Your aim is to get the residual risk down to an acceptable level, and to confirm it stays there.

Who should take part in a risk assessment? The people who do the work, their supervisor, and any health and safety representative should all take part. Their knowledge makes the assessment accurate, and their involvement is required by the WHS consultation duties.

How often should I reassess? Reassess when the work, plant, substances or people change, after an incident or near miss, and when a control isn't working. Otherwise, review on a set schedule you choose.

This is general information, not legal advice. Check the current law with your WHS regulator.