Reviewing risk controls: why it matters and how to do it

Reviewing risk controls means checking that each control is still in place, still working as intended, and still the best option for the risk. You do it on a set schedule and whenever something changes. The model WHS Regulations require a review in specific cases, including when a control isn't working and before a change at the workplace. A review is the step that stops a control that worked last year from quietly failing today.

What does the law require?

Regulation 38 requires you to review and, if necessary, revise your control measures when any of these happens:

• a control measure isn't effective in controlling the risk
• before a change at the workplace that may give rise to a new or different risk
• before a new hazard or risk is identified
• consultation with workers shows a review is needed
• a health and safety representative requests a review

If you run a safe work method statement (SWMS), regulation 302 adds that the SWMS must be reviewed and revised when the controls change under regulation 38. The review isn't a box to tick at the start of a job. It's an ongoing duty.

The regulations don't set a fixed review period. The schedule is yours to choose, and it should match the risk.

What a review asks

Every review comes back to three questions for each control:

1. Is it in place? A guard can be on the drawing and missing from the machine. Check the physical control, not the paperwork.
2. Is it working? Does the guard stop the blade reaching the hand? Does the extraction actually capture the dust at the source?
3. Is it still the best option? A new product, a better machine or a changed method may give a higher-level control that wasn't available before.

Asking "is it still the best option?" keeps the review from being a simple inspection. It's also where you find ways to reduce risk further, not just keep it where it is.

How to run a review

Use a checklist so you don't skip steps. Then work through the controls in this order.

1. Ask the people doing the work. Ask whether the control is easy to use, whether it stops the problem, and what gets in the way. Workers often know about a shortcut long before a supervisor does.
2. Inspect the physical controls. Check that guards are fitted and undamaged, signs are visible and readable, barriers are in place, and extraction and ventilation are running.
3. Watch the task being done. A control only works if the crew follows it. Observe the job, not the procedure as written.
4. Check the PPE. Confirm it's the right type, fits the worker, is in good condition and is stored properly.
5. Record what you found. Note each control reviewed, what you found, the action needed, who owns it and the date it's due.
6. Close the loop. Tell the workers what changed and why. A review that changes nothing on site, or that nobody hears about, does little good.

Here is an example from a concrete cutting crew:

• Control: wet cutting with a water feed to the saw.
• Check: the water feed is connected, the slurry is being cleaned up, and the cutter is using the feed for the whole cut.
• Finding: the water supply is clogging on the second day of each job, so the crew cuts dry.
• Action: replace the filter, add a pre-start check, and talk through the change with the crew.

How often should you review?

There is no fixed interval in the law, so set one based on risk. A common starting point is:

• High-risk controls (for example, fall protection, live electrical work, isolation of plant): every three months, and before any change.
• Medium-risk controls: every six months.
• Lower-risk controls: once a year.

Whatever you choose, write it down, and make sure the person responsible knows when the next review is due.

After an incident or near miss

An incident or near miss is one of the strongest signals a control isn't working. Review the control involved as part of the investigation, before work resumes where that's practical. Ask why the control didn't stop the problem, then change it if needed.

Some incidents must also be reported to the regulator. The notifiable incident rules explain when, and the review doesn't replace that reporting.

A quick control review table

Keep a workplace inspection checklist for the routine checks, and a risk register for the full record. A machine with moving parts, for example, has its own hazard page covering entanglement and moving parts.

Common mistakes

• Reviewing only at the start of a project. Controls drift over time, and new workers or plant change the work.
• Checking the paperwork and not the site. A signed inspection form doesn't show a guard is fitted.
• Ignoring the crew. The people using the control often know where it fails.
• Not closing the loop. If the fix isn't passed on, the same problem comes back.
• Assuming a fix is permanent. Treat a changed control as a new control and review it again.

Make reviews part of the job

A review that lives in a notebook or an email chain is hard to show to an inspector and easy to forget. Findings that come from workers should go on a hazard report the same day, so they're tracked to a close-out. Keep the review record with the SWMS, the risk register and the job's documents. Then the next person on the job can see what was checked and what changed.

Common questions

Do I need to review every control? Yes, every control needs a review at some point, and the regulations require one in specific cases. Start with the high-risk controls, then work down the list.

How often should I review controls? The law doesn't set a period. Review high-risk controls more often, such as every three months, and lower-risk ones less often, such as once a year. Review sooner whenever a trigger in regulation 38 happens.

What if I find a problem during a review? Treat it like a new hazard. Assess the risk, put in a better control, and record a new review date. Don't just tidy up the problem and move on.

Does an app or software have to do this? No. A checklist and a register on paper meet the duty. Software helps by sending reminders and keeping a searchable record, which matters once you have many sites or many controls.

This is general information, not legal advice. Check the current law with your WHS regulator.