Management system guidance
6.1 Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018.
Our range of templates cover the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.2 Identifying occupational hazards
ISO 45001:2018 defines a hazard is a source with a potential to cause injury and ill health, or even the circumstances that could lead to injury and ill health. Hazard identification should be undertaken and include all operational activities. A follow up risk-assessment should be communicated to all workers and contractors before they begin work.
Hazards exist at all levels in an organization, and are detectable through many sources including reporting systems, inspections, audits, brainstorming sessions and expert judgement. Workers play an important role in the assessment process. Being the ‘hands-on’ people, they are more aware of the potential causes of harm or injury. The goal is to proactively identify hazards and define their key characteristics before they lead to accidents, incidents or other safety-related occurrences.
Identified hazards and their potential consequences must be documented and fed into the risk assessment processes. The hazard identification process should consider all possible hazards that may exist within the scope of your operations and activities, including interfaces with other systems, both within and external to your organization.
Hazard identification
Select a work process, work area or specific activity and identify task-related hazards by observing the work flow and through discussion with the workers who undertake the task. List the potential hazards or incidents that could happen while doing a process or task.
Review all relevant documentation such as inspection reports, illness/injury reports, Health and Safety Committee minutes, policies and procedures, inventory reports, safe operating procedures, checklists, job descriptions, and routines, etc. Proactive hazard identification techniques, include inputs from Job Safety Analysis, checklists, hazard surveys, HAZID/HAZOP studies, workplace inspections and audits. Other examples of methods that can help to identify health and safety hazards before an incident occurs include:
- Conducting pre-start discussions on the work to be carried out;
- Encouraging workers to recognise and report hazards while performing work;
- Carrying out safety inspections and audits of the workplace and work procedures;
- Conducting job safety analyses (or similar task evaluation processes);
- Monitoring, measuring and testing the working environment;
- Analysing proposed new or modified plant, material, process or structure;
- Conducting hazard (or risk) surveys;
- Reviewing product information, e.g. safety data sheets, operating manuals;
- Researching publicly available data on hazards, e.g. media articles, industry or safety regulator alerts;
- Looking at past incident and near-miss reports.
No single method of hazard identification and evaluation will suit every company or situation. Simple methods, utilizing the experience of loss prevention and operating personnel, work well in a broad range of operations and activities. When new, modified, or complex processes and equipment are introduced, more formal methods of hazard evaluation and risk analysis may be required
Job Safety Analysis (JSA)
Using a job safety analysis template your organization determines physical requirements, environmental conditions and safety factors relating to a specific job or task. Job safety analysis is used for stationary or repetitive production tasks or product movement, in which the job, equipment and work environment change very little.
For those jobs with the highest injury or illness rates, jobs that are new to our operations, jobs that have undergone major changes in processes and procedures or jobs complex enough to require written instructions, will have a job safety analysis and task-based risk assessment performed.
Your organization’s approach to completing a Job Safety Analysis should be to form a group of experienced workers and supervisors to complete the analysis through discussion. The advantage of this method is that more people are involved in a wider base of experience and promoting the acceptance of the resulting recommendations. Members of the Health & Safety Committee participate in this process.
There are many ways to develop the Job Safety Analysis, however, observation and team approach is proven to be the most reliable. By watching the tasks, the observer can see first-hand what is required, recognize the hazards and recommend alternatives. A job safety analysis consists of:
- Job physical requirements;
- Job environmental conditions;
- Personal protective equipment required;
- Sequence of basic job steps;
- Potential accident or hazards associated with each step;
- Safe job practice for each step.
The most important person in Job Safety Analysis process is the Supervisor, who is in constant contact with workers and is familiar with the hazards in their Department. Supervisors are in a better position to recognize and correct unsafe acts and conditions as they occur. Below is the sequence used to develop a Job Safety Analysis form:
- Select the most experienced employee or team to observe;
- Explain the purpose of your observations;
- Observe the task and record the steps used to complete the task;
- Review the steps with the observed Employee or team for clarity;
- Observe the task a second time and identify any hazard potentials and record the findings;
- Look for hazard types including:
- Impact;
- Contact with chemicals;
- Caught on or between;
- Lacerations;
- Burns;
- Fall or slip;
- Over exertion;
- Cumulative trauma;
- Observe the task a third time to develop corrective measures to all hazard potentials;
- Review your findings with the Employee or team for clarity;
- Complete the Job Safety Analysis.
After the draft copy of the Job Safety Analysis is completed, it is reviewed by a team consisting of the Safety Coordinator, Department Manager, Supervisor and affected Workers. All questions are discussed by the team. A final version is then drafted.
Once the analysis is completed, the results are communicated to all workers who are, or will be, performing the work. All of the identified hazards are then transferred to the hazard register for monitoring. Completed Job Safety Analysis forms should be reviewed by the Supervisor.
New hires and transfers review relevant JSAs as part of the Employee's job performance evaluation. Annually, the Job Safety Analysis forms should be reviewed by the Supervisors and Employees. Job Safety Analysis should be reviewed with the Employee during an accident investigation to help identify possible causes or problem areas.
All new hazards, operations, equipment and tools are updated on the Job Safety Analysis forms and communicated to all Employees as soon as possible. Job Safety Analysis forms can become out-of-date if not reviewed periodically.
Workplace inspections
Your organization carries out safety inspections of the workplace and work procedures using the Workplace Inspection Form. A workplace inspection generally consists of an informal walk-through of the work area is used to identify lapses in safety procedures, and can vary from an informal visual inspection to formal in-depth evaluations. Workplace inspections looks for safety hazards and unsafe practices throughout the facility.
The frequency at which formal workplace inspections are carried out is dependent on the associated risk of the work area. Inspections may be required on a more frequent basis depending on local conditions, use of the work area, and any local arrangements for informal or statutory checks. High-risk areas are inspected monthly (or more frequently if the level of risk indicates), medium risk areas are inspected every 3 months, and low risk areas are inspected every 6 months.
For low risk workplaces such as general areas including offices, store rooms, print rooms and kitchens, etc., are inspected at least twice per year. For higher risk workplaces such as shop floors, workshops, process equipment areas and plant rooms, etc., inspections are carried out monthly.
Line Managers and Supervisors are responsible for planning and instigating workplace inspections within their area of control and responsibility. They may choose to request the assistance of Health & Safety Coordinators or other workers when undertaking this task. The following table offers a guide to determining the frequency; however, an assessment of each individual work area needs to occur to determine the frequency.
Hazard identification and operation study (HAZID/HAZOP)
Where appropriate, your organization can undertake qualitative HAZID studies for the early identification of potential hazards; e.g. before projects commence or large-scale process changes are conducted to identify associated safety failure modes. HAZID reviews are also conducted for critical equipment and spares. HAZIDs can be done:
- During design and implementation;
- Before tasks are done;
- While tasks are being done;
- During inspections;
- After incidents.
The HAZID method, accepted as one of the best techniques for identifying potential hazards and operability problems, involves the following:
- Assembly of a team of experienced project personnel;
- Presentations detailing the scope of the HAZID;
- Identify hazards, causes, consequences and safeguards.
These reviews may require suppliers or manufacturers (OEM) to provide reliability reports and data related to risk associated with the equipment and spares, and conditions of use. The process also determines if additional risk studies are required in addition to mandatory Job Safety Analysis (JSA). Lessons learned must also be considered in HAZID reviews as relevant. HAZID reviews must be conducted by competent personnel. Lessons learned should be considered during HAZID reviews as relevant.
HAZOP studies can be conducted in a workshop format, bringing together a multi-disciplined team of operations personnel, experienced supervisors, design engineers and HSE professionals. The workshop should utilize a clearly defined step-by-step methodology, and consider standardized deviations from normal process operations. By analysing complex workplace operations, which, if malfunctions were to occur, your organization aims to prevent injury or ill-health.
Observe the basic steps of each activity
By breaking the task into steps or a series of steps or tasks, look for changes in activity, direction or position, while watching for potential hazards. By watching the tasks, you can see first-hand what is required, recognize the hazards and recommend alternatives. Consideration should be given to modifying the steps which are hazardous, changing the sequence of steps, or adding additional steps.
If you spot straight forward problems, take action immediately, for example cleaning up a spill. If you find a situation where there is immediate or significant danger to people, move those persons to a safer location first and attend to the hazard urgently. The Health & Safety Advisor and the Supervisor should follow up on why the situation occurred to identify additional hazards and risks.
List the potential hazards
Using a hazard identification register identify hazards by considering the operational environment and the various organizational capabilities (people, processes, technologies) which could contribute to the safe delivery of the service or product’s availability, functionality or performance.
The hazard identification process also considers hazards that are generated outside of our organization and hazards that are outside our direct control, such as extreme weather. Hazards related to emerging safety risks are also an important way for our organization to prepare for situations that may eventually occur.
Other methods of hazard identification include workshops or meetings in which subject matter experts conduct detailed analysis scenarios. These sessions benefit from the contributions of a range of experienced operational and technical personnel. Existing Health & Safety Committee meetings are used for such activities; the same group may also be used to assess the associated health and safety risks. To ensure the hazard identification process is thorough, ensure that:
- Review all hazards associated with the of the work areas and activities performed;
- Review non-routine activities such as maintenance, repair, cleaning, and emergency response;
- Review all incident and near-miss records;
- Consider people who work ‘off-site’, either at home, on other premises and drivers, etc.;
- Look at the way the work is organized or ‘done’;
- Assess the experience and age of workers and contractors doing the work and systems being used;
- Assess foreseeable, unusual conditions such as the possible impact on hazard control procedures that may be unavailable in an emergency situation or power failure;
- Examine risks to visitors or the public, and other interested parties;
- Assess groups of people that may present a different level of risk such as young or inexperienced workers, persons with disabilities, or new or expectant mothers.
To ensure the hazard identification process is thorough, ensure you identify potential hazards, by asking the following questions (this is not a complete list):
- Can anybody part get caught in or between objects?
- Do tools, machines or equipment present any hazards?
- Can an employee make harmful contact with objects?
- Can an employee slip, trip or fall?
- Can an employee suffer a strain from lifting, pushing or pulling?
- Is an employee exposed to extreme heat or cold?
- Is excessive noise or vibration a problem?
- Is there a danger from falling objects?
- Is lighting a problem?
- Can weather conditions affect safety?
- Is harmful radiation a possibility?
- Can contact be made with hot, toxic or caustic substances?
- Are there dust, fumes, mists or vapours in the air?
To ensure the hazard identification process is thorough, the ensure that risks are identified taking account of (this is not a complete list):
- Routine and non-routine activities;
- Effectiveness of existing controls;
- Activities of all persons having access to the workplace, including contractors and visitors;
- Human behavior, capabilities and other human factors;
- Identified hazards originating outside the workplace capable of adversely affecting the health and safety of persons under the control of the organization within the workplace;
- Hazards in the vicinity of the workplace by work-related activities under our control;
- Infrastructure, equipment, and materials at the workplace; provided by our organization or others;
- Changes or proposed changes in the organization, its activities or materials;
- Modifications to the SMS or temporary changes, their impact on operations, processes, and activities;
- Applicable legal obligations relating to risk assessment and implementation of necessary controls;
- Design of work areas, processes, installations, machinery/equipment;
- Design of operating procedures and work organization, including adaptation to human capabilities;
- Information from employee consultations, review and improvement activities in the workplace;
- Information on best practice;
- Communications from workers and other interested parties;
- The nature of hazards and the magnitude of the risk.
All business activities are to be assessed to ensure that any changes to processes and operations do not result in adverse health and safety hazards. On occasions where your organization does not have a degree of control or influence over the hazard or risk, its details are escalated to the risk register for Top management action
Risk assessment process
Risk assessments are undertaken with varying degrees of detail depending on the type of hazard and the information, data and resources available. It can be as simple as a discussion with your workers or involve specific risk analysis tools and techniques developed for specific risks or recommended by safety professionals.
The assessment of the severity of a health and safety risk drives management attention and supports planning for mitigation. It is recommended that risk assessments are conducted by competent personnel, involving the workers who are, or will be directly involved in the process. A risk assessment is done when:
- There is uncertainty about how a hazard may result in injury or illness;
- The work has not been done before;
- The work involves high risk activities;
- A new hazard has been identified;
- After an incident, accident or workplace illness;
- Regularly scheduled times appropriate to the workplace;
- Before the introduction of any equipment or substance;
- Before the introduction of a new work practice or procedure;
- Before changing a workplace or a work practice, or an activity or process, where the change may give rise to a risk to health or safety;
- The work activity involves a number of different hazards and there is a lack of understanding about how the hazards may interact with each other to produce new or greater risks;
- Changes at the workplace occur that may impact on the effectiveness of control measures.
When determining the risks, the following relevant information is reviewed:
- Operating procedures, on-the-job training guides, policies, material safety data sheets (MSDS);
- Experience within the workplace, records and observations, incident and injury data;
- Legislative requirements;
- Industry codes of practice;
- National/International standards.
More detailed risk assessments are required for manual tasks that require a worker to lift, lower, push, pull, carry or otherwise move, hold or restrain anything that involves one or more of the following:
- Repetitive or sustained force;
- High or sudden force;
- Repetitive movement;
- Sustained or awkward posture;
- Exposure to vibration;
- Entry to confined spaces;
- Use of hazardous chemicals;
- Exposure to excessive noise and air pressure;
- Remote and isolated work;
- Exposure plant and machinery.
For some complex situations, expert or specialist advice may be useful when conducting a risk assessment. The risk assessment methodology covers all OH&S related hazards. Some legislation, standards and guidance require more detailed risk assessments for specific hazards.
- Process Equipment Risk Assessment (HAZOP)
- Failure Mode Effects Analysis (FMEA)
- Manual Handling Risk Assessment
- Chemical Use Risk Assessment (COSHH)
- Display Screen Equipment/Visual Display Unit Assessment
- Noise Risk Assessment
- Atmospheric Hygiene Assessment
- Machinery Risk Assessment
- Fire Risk Assessment
- Ergonomic Risk Assessment
- Legionella Risk Assessment
- Work at Height Risk Assessment
Determining the likelihood, severity and calculating the level of risk
There is no one simple or single way to determine the level of risk. Ranking hazards requires the knowledge of workplace activities, the urgency of situations, and objective judgment. Severity and likelihood estimations are established giving due consideration to the effectiveness of existing control measures.
Determine the likelihood of harm occurring. The level of risk will increase as the likelihood of harm and its severity increases. The likelihood of harm occurring may be affected by how often the task is completed, in what conditions, how many people are exposed to the hazard and for what duration.
Evaluation of how severe the harm could be. This includes looking at the types of injuries, illnesses, harm or damage that can result from the hazard, the number of people exposed, and the possible chain effects from exposure to the hazard.
Risk assessment involves considering the possible results of someone being exposed to a hazard and the likelihood of this occurring. A risk assessment assists in determining how severe a risk is, whether existing control measures are effective, what action should be taken to control a risk, and how urgently action needs to be taken.
The risk assessments include the Identifying factors that may be contributing to the risk, and a review of existing health and safety information that is reasonably available from an authoritative source that is relevant to the particular hazard.
Acceptable - generally considered as sufficiently low, insignificant and adequately controlled. Continue to review and reduce the risks wherever it is reasonably practicable, as per cost and legal requirements. Monitor risk controls to ensure that they are maintained at their present level or at a lower level of risk that current day-to-day work practices can effectively manage. Ongoing monitoring and management required by workers and line supervisors using routine procedures.
Tolerable - corrective action required. Develop a Safe System of Work, prepare Job Safety Analysis. Formal risk assessment is required. The risk must be reduced to ALARP (As-Low-As-Reasonably-Practicable). Proposed risk controls should be implemented if the resources, costs, time or effort are in proportion to the benefits that can be potentially achieved. The following process must be applied:
- Consult hazard register, ensure controls are effectively implemented;
- Confirm activity, risk assessment and controls with the Supervisor;
- Seek advice from the H&S Advisors, implement additional controls;
- Supervisor confirms controls, assess and approve/reject the activity.
Intolerable - imperative to eliminate or reduce risk to a lower level by the introduction of controls. Formal risk assessment is required. A LoR that is considered unacceptable regardless of the benefits associated with the activity. Except where there are exceptional reasons or extraordinary circumstances, measures to reduce the risk are essential regardless of the resources, costs, time or effort required.
Risk control and mitigation
All hazards that have been assessed are dealt with in order of priority. The most effective risk control options are selected to eliminate or minimise the risks. The hierarchy of controls (See the diagram opposite) ranks the risk control options from highest level of protection and reliability to lowest. This is used to determine the most effective control measures in order to:
1. Identify a response strategy to treat, terminate, tolerate or transfer the impact;
2. Identify response actions to improve control measures as required. These will be SMART;
3. Identify a response action owner for each action and confirm with them that they accept accountability for implementing the action within the time allowed.
Consultation with workers is required in the selection and implementation of risk control measures in the workplace. Risk controls are trialled to determine effectiveness and workers are involved in the feedback process. The following options from the hierarchy of controls are available for treating risks and may be applied individually or in combination:
- Elimination by removing the hazard from the workplace. The most effective control measures eliminate the hazard and associated risks. This can be achieved through removing the hazard or selecting alternate products or equipment to eliminate the risk. If a hazard cannot be eliminated then risks can be minimised by lower control measures;
- Substitution by less hazardous processes, activities, materials, or equipment, etc., separate the hazard from the workplace or people – e.g. chemical store room kept locked except to an authorised person, lock out procedures on faulty equipment or appropriate guarding for machinery;
- Engineering controls that include designs or modifications to plant, equipment, and processes that isolate the source of exposure. Modify existing machinery or plant or purchase different machinery or plant to provide a physical solution using e.g. trolleys, hoists or cranes, fixed guard rails;
- Administrative controls that alter how the work is done, including its timing, policies and rules, work practices, standards and operating procedures; training, housekeeping, and equipment maintenance, and hygiene practices.
These risk control options should be considered last as they do not control the source of the hazard but rely on human behaviour or supervision and are therefore less effective; - Personal Protective Equipment (PPE): equipment worn by individuals to reduce exposure such as contact with chemicals or exposure to noise, etc. PPE offers the lowest level of protection and should only be used as a last resort to deal with the hazard. Where the hazard cannot be removed or reduced by any other means and requires the use of gloves, safety glasses, aprons, eye protection or safety boots.
The Health and Safety Advisors and Process Owner should be responsible for the development of risk controls. Each control measure has a designated person and date assigned for the implementation of risk controls. This ensures that all required safety measures are completed and documented. These control methods are considered in the order and are appropriately placed:
- At the source - where the hazard comes from;
- Along the path - where the hazard travels;
- At the worker.
Once the risk controls have been put into place, your workers must be trained or made aware of it. When mitigation is completed, the risk is reassessed to reflect the effects of any newly introduced control measures.
Reviewing and reporting
Regular reviews are essential to ensure that hazards and risk are being appropriately managed and that the relevant data about them remains accurate and reliable. The Health and Safety Manager should repeat the hazard and risk assessment process annually, when site conditions change, when new tasks are added or when new workers join, in order to prevent the development of unsafe working conditions.
Regular reports are necessary to inform and provide assurance to Top management and other key stakeholders, that health and safety hazards are being appropriately managed. Reporting is based on current data captured in the Health and Safety Risk Assessments, which are reviewed in time for the next reporting cycle.
Performance monitoring
Safety performance monitoring should be conducted by the Health and Safety Manager through the collection of safety data and safety information from a variety of sources typically available to your organization. Data availability to support informed decision-making is one of the most important aspects of the safety management system. Using this data for safety performance monitoring and measurement are essential activities that generate the information necessary for safety risk decision-making.
Monitoring takes a variety of forms and range from self-assessment, inspections and internal audits, to detailed reviews by independent external experts. Inspections are undertaken at regular intervals to identify hazards and verify implementation of risk controls.
Training requirements
Training and awareness records and documented sign-offs are retained to demonstrate that our workers have been made aware of the hazards and the controls. Where hazards cannot be eliminated immediately, workers must be trained and empowered to take the necessary steps to warn others of the hazard. Training should be given to workers to provide knowledge of:
- Hazards and hazard identification;
- Reporting of hazards;
- Overview of risk assessment process;
- Hierarchy of controls.
The training provided to individuals should be determined by training needs assessment, and included in awareness training, Tool Box Talks, and in general inductions. Annually, the job safety analysis forms should be reviewed by the Supervisors with all Workers. Job safety analysis forms should be reviewed with the Worker during an incident investigation to help identify possible causes or problem areas.
Upon completion of the investigation using this example or another method, you should document the results of the investigation and summarize on the Hazard Log for tracking purposes and to identify any follow up activities. Follow up is needed to ensure the problem has been corrected or adequately controlled.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.