an unguarded moving machine part is a hazard
Hazard identification and risk assessment sit at the centre of ISO 45001.
If an organisation does not understand what could cause injury or ill health, it cannot build an effective Occupational Health and Safety Management System. ISO 45001 requires organisations to identify workplace hazards, assess associated occupational health and safety risks and determine the controls needed to reduce those risks.
The basic logic is straightforward: a hazard is something with the potential to cause injury or ill health, while risk considers the potential consequence of that hazard together with the likelihood or exposure associated with it.
The purpose of hazard identification and risk assessment is not to produce a large spreadsheet for an auditor. It is to help the organisation answer a practical management question:
Where could people be harmed, how serious could that harm be, and what should we do first? ISO 45001 Hazard Identification…
an unguarded moving machine part is a hazard
the risk is that a worker could make contact with it and suffer serious injury
ISO 45001 requires organisations to identify workplace hazards, assess associated occupational health and safety risks and determine the controls needed to reduce those risks.
Hazard identification and risk assessment sit at the centre of ISO 45001.
The purpose of hazard identification and risk assessment is not to produce a large spreadsheet for an auditor.
If an organisation does not understand what could cause injury or ill health, it cannot build an effective Occupational Health and Safety Management System.
A hazard is a source or situation with the potential to cause injury or ill health.
Hazards can arise from:
Examples include:
A hazard exists even if no incident has happened yet.
That matters because ISO 45001 is built around prevention rather than waiting for harm to occur.
OH&S risk is the combination of:
In practical terms, risk assessment asks:
How likely is this hazard to cause harm?
and
How serious could that harm be?
A simple risk matrix might consider:
But the calculation is only a decision-support tool.
The real objective is to understand the risk well enough to choose the right controls.
This distinction is often misunderstood.
A hazard is the source of potential harm.
A risk describes the possibility and seriousness of that harm occurring.
The hazard tells you what could cause harm.
The risk assessment helps determine how much attention that hazard requires.
Hazard identification determines what the Occupational Health and Safety Management System needs to control.
If hazards are missed, the rest of the system can look complete while significant risks remain unmanaged.
A good hazard-identification process helps the organisation:
The purpose is not simply to reduce a risk score.
The purpose is to improve control over real work.
A meaningful risk assessment tells management where action matters most.
Hazard identification should be systematic.
It should also be practical.
A useful process normally includes several sources of information.
Start with the activity itself.
Ask:
Avoid starting only with a generic hazard checklist.
The work should drive the assessment.
Go where the activity happens.
Look at:
Many hazards are easier to understand through observation than through documentation.
Workers are one of the most important sources of hazard information.
They know:
This is why worker consultation and participation are so important in ISO 45001.
A risk assessment completed without input from the people doing the job can miss critical detail.
Past events show where controls have failed or nearly failed.
Review:
Do not only ask:
"What happened?"
Also ask:
"What hazard was present, why did the controls fail, and could the same problem happen elsewhere?"
Hazards do not only exist during normal production.
Consider:
Many serious incidents occur during non-routine activities because normal controls are not enough.
Risk can differ depending on who is exposed.
Consider:
A control suitable for an experienced worker may not be sufficient for someone unfamiliar with the site.
A practical ISO 45001 hazard assessment should consider different categories of hazards.
Examples include:
Examples include:
Examples include:
Examples include:
Depending on the workplace:
Examples include:
Workplace health and safety is not limited to physical hazards.
Relevant factors can include:
The exact assessment needs to reflect the organisation's circumstances.
Once hazards are identified, evaluate the associated risks.
A practical risk assessment can follow these steps.
Describe the source of harm clearly.
Avoid vague entries such as:
"Safety risk."
A better description is:
Forklift movement in shared pedestrian area.
Consider:
Then identify the potential harm.
For example:
Hazard: forklift movement
Person exposed: warehouse employee
Potential harm: collision causing serious injury
Before assigning a risk rating, establish what controls are already in place.
Examples:
Existing controls affect the actual risk.
Use the organisation's defined methodology.
A common approach considers:
For example:
And:
This can then produce a risk rating.
The exact scale is less important than consistency and sound judgement.
Ask:
Is the remaining risk acceptable?
If not, identify additional controls.
Do not simply reduce the number on the risk matrix without changing the workplace.
A risk rating should only improve when actual risk has been reduced.
Many organisations distinguish between:
The risk before considering controls.
The risk remaining after controls are applied.
This can help demonstrate whether controls materially reduce exposure.
But be careful.
Do not treat the risk register as a mathematical exercise.
If a control exists on paper but is not implemented properly, the residual risk should not be treated as low.
The effectiveness of controls matters.
One of the most important principles in ISO 45001 is the hierarchy of controls.
Not all controls are equally effective.
Where practicable, organisations should prioritise controls higher in the hierarchy.
Remove the hazard completely.
Example:
Eliminate the need for employees to work at height by performing the task from ground level.
This is generally the strongest control because the hazard no longer exists.
Replace the hazard with something less hazardous.
Example:
Replace a hazardous chemical with a less hazardous alternative where suitable.
Physically separate people from the hazard or redesign the process.
Examples:
Change how work is organised.
Examples:
Administrative controls rely more heavily on human behaviour.
Examples:
PPE is important.
But it is generally the final layer of protection rather than the first control considered.
PPE is visible, relatively easy to issue and often cheaper initially than physical modifications.
That can make it attractive.
But it does not remove the hazard.
For example:
Hazard: employee exposure to excessive machine noise.
A weak approach may be:
Issue hearing protection.
A stronger assessment asks:
ISO 45001 encourages this more systematic approach.
A practical risk register might look like this:
The format should support decisions.
It should not become so complicated that supervisors stop using it.
ISO 45001 risk assessment and South African legal risk-assessment requirements are closely related, but they should not automatically be treated as identical.
South African occupational health and safety requirements can impose specific risk-assessment duties depending on the activity and applicable regulations.
These may include specialist requirements relating to areas such as:
ISO 45001 provides a management framework for identifying and controlling OH&S risks.
It does not replace activity-specific legal risk assessments.
Where specific South African legislation requires a particular assessment methodology, competent person, measurement or technical evaluation, that requirement needs to be addressed separately within the overall OHSMS.
Hazard identification can help reveal where legal requirements may apply.
For example:
Hazard: hazardous chemical exposure
This may trigger the need to investigate applicable requirements relating to:
But the hazard register itself does not prove legal compliance.
The organisation still needs a process for determining which requirements apply and evaluating whether they are being met.
Organisations often use different levels of risk assessment.
A structured documented assessment completed for:
This typically forms part of the main OH&S risk-management process.
Used closer to the actual work, particularly where conditions can change.
Examples include:
These can help workers identify changing conditions before beginning work.
They should complement rather than replace the broader formal risk-assessment process.
Contractors can introduce hazards that the organisation does not encounter during routine internal work.
Examples include:
The organisation should determine how contractor risks will be managed.
This can include:
Contractors should not operate as a separate safety universe inside your workplace.
Their activities need to connect appropriately to the organisation's OHSMS.
Workplaces change constantly.
Risk assessments need to reflect changes such as:
Do not wait for an incident to discover that a change introduced a new hazard.
Risk management should form part of change planning.
Risk assessments should be reviewed when necessary to remain current.
Triggers can include:
A risk assessment created during ISO implementation and never revisited will quickly lose value.
The people involved should have appropriate competence for the assessment being performed.
This may include:
The exact team depends on the complexity of the risk.
For a straightforward task, internal operational knowledge may be sufficient.
For specialised hazards, technical expertise may be required.
Workers should not be treated merely as people who sign the completed risk assessment.
Their involvement can improve the quality of the assessment.
Workers often know:
Useful participation can include:
This is one of the reasons ISO 45001 places such strong emphasis on worker consultation and participation.
Risk assessment should influence OH&S improvement priorities.
For example:
High risk: repeated vehicle/pedestrian interaction
Possible objective: implement physical segregation across high-risk warehouse areas
High risk: manual handling injuries
Possible objective: reduce high-risk manual lifting through mechanical aids
High risk: recurring contractor incidents
Possible objective: improve contractor prequalification and monitoring
Objectives should address real business risk.
Not generic statements such as:
"Improve safety performance."
Once a risk has been assessed, controls need to move into normal operations.
This may affect:
A risk assessment that does not change anything is unlikely to be doing its job.
The hazards may look similar while the actual work is different.
Build the assessment around your activities.
Keep the source of harm separate from the assessment of likelihood and consequence.
More numbers do not automatically create better risk management.
Use a method people can understand and apply consistently.
Risk should reduce because controls improve.
Not because someone changes a number.
Work through the hierarchy of controls.
This can cause assessments to miss how work actually happens.
Maintenance, breakdowns and temporary work can introduce major hazards.
Contractor work can create serious risk.
New equipment or processes can invalidate old assessments.
The real output is better control.
The register is only evidence of the decision-making process.
When reviewing hazard identification, ask:
Have routine activities been considered?
Have non-routine activities been considered?
Have emergency situations been considered?
Have employees been consulted?
Have contractors been considered?
Have visitors and others who may be affected been considered?
Have machinery and equipment hazards been considered?
Have chemical hazards been considered?
Have physical hazards been considered?
Have ergonomic hazards been considered?
Have biological hazards been considered where relevant?
Have psychosocial and organisational hazards been considered where relevant?
Have previous incidents and near misses been reviewed?
Have changes been considered?
Have different sites and working environments been considered?
Confirm that:
Hazards are clearly described.
People potentially exposed are identified.
Potential harm is understood.
Existing controls are recorded.
Risk criteria are defined.
Risk criteria are consistently applied.
Additional controls are identified where necessary.
The hierarchy of controls is considered.
Responsibilities are assigned.
Actions are tracked.
Residual risk reflects actual control effectiveness.
Significant changes trigger review.
Workers are involved appropriately.
Specialist competence is used where required.
A hazard is a source with the potential to cause injury or ill health. Examples include machinery, hazardous substances, work at height, noise, electrical energy and unsafe work conditions.
OH&S risk considers the likelihood that a hazardous event or exposure may occur together with the severity of the injury or ill health that could result.
A hazard is the source of possible harm. Risk describes how likely that harm is and how serious the consequences could be.
Yes. Hazard identification and assessment of occupational health and safety risks are core parts of ISO 45001.
No single universal risk matrix is prescribed. The organisation needs a suitable and consistent method for assessing OH&S risk.
The hierarchy of controls prioritises stronger risk controls. In general, organisations should consider elimination first, followed by substitution, engineering controls, administrative controls and personal protective equipment.
Sometimes PPE is necessary, but it is generally lower in the hierarchy of controls. Organisations should consider whether the hazard can be eliminated or controlled more effectively before relying mainly on PPE.
Worker consultation and participation are important parts of ISO 45001. Involving people who perform the work can significantly improve hazard identification and control selection.
They should be reviewed often enough to remain current and whenever relevant changes, incidents, control failures, new hazards or other significant developments occur.
Contractor activities need appropriate risk management where they can affect OH&S performance. This may involve contractor risk assessments, coordination, permits, induction and monitoring depending on the work.
Not automatically. ISO 45001 provides an OH&S management-system framework, while South African legislation and regulations may create specific risk-assessment requirements for particular activities. Both need to be addressed where applicable.
People conducting or contributing to risk assessment should have appropriate competence for the hazards and activities involved. More complex risks may require specialist expertise.
A risk assessment is useful only when it changes how risk is managed.
It should help your organisation decide:
If the final result is simply another register stored in a folder, the process has missed its purpose.
ISO Specialist South Africa can help organisations identify hazards, assess OH&S risks and integrate appropriate controls into a practical ISO 45001 management system.
We start with the work as it actually happens.
Then we build the management process around the risks that actually matter.
Not sure whether your organisation is ready for ISO 45001 certification?
Our ISO 45001 Readiness Checklist helps you assess the key areas of your Occupational Health and Safety Management System before you start implementation or prepare for certification.
It gives you a practical way to review how you identify hazards and manage risks, meet your legal requirements, involve workers in health and safety, and handle incidents. You’ll see where you’re already strong, where the gaps are, and what steps you need to take to become certification-ready.