ISO 45001 Hazard Identification and Risk Assessment: A Practical Guide

Hazard identification and risk assessment is the spine of ISO 45001. Get this right, and everything downstream—your objectives, your operational controls, your management review focus—cascades logically from evidence. Get it wrong, and you have a system disconnected from reality.

I’ve reviewed hundreds of HIRAs. The weak ones read like compliance theatre: “identified” hazards that no worker would recognise, controls that exist on paper but not in practice, risk ratings that feel arbitrary. The strong ones are living documents that drive daily operational decisions.

This guide shows you how to conduct a HIRA that’s both compliant with ISO 45001 and genuinely useful for managing risk.

Understanding Hazards and Risks: The Foundation

Before you start identifying, clarify the distinction between hazards and risks. Many people conflate them, which muddies the HIRA process.

A hazard is something with potential to cause harm. Examples: unguarded machinery, chemical fumes, repetitive manual handling, high workload, poor leadership. Hazards exist regardless of current controls.

A risk is the likelihood and severity of harm from a hazard. The same hazard can be high-risk in one context and low-risk in another. Machinery is high-risk if it runs frequently with multiple operators and weak guarding. The same machinery is lower-risk if it runs once monthly with a trained operator and robust guarding.

HIRA identifies both: all hazards that exist in your operations, and the current and residual risk each creates. This distinction is essential because it shapes your control strategy. You might accept some hazards (which cannot be fully eliminated) if their residual risk is low. You must actively control hazards where residual risk remains high.

The Five Hazard Categories ISO 45001 Expects You to Address

ISO 45001 doesn’t mandate a specific HIRA methodology, but it does expect comprehensive coverage across hazard types. Many organisations narrow their focus and miss critical risks.

Physical Hazards

These are the most visible: machinery and equipment, noise, vibration, temperature extremes, radiation, poor lighting, slips/trips/falls, manual handling. Most organisations identify physical hazards well. The challenge is often in assessing residual risk after controls—just because a machine has a guard doesn’t mean it’s adequately controlled.

Chemical Hazards

Toxic substances, corrosives, dusts, gases, skin sensitisers. Many organisations have a chemicals register but don’t assess exposure pathways thoroughly. Where might workers be exposed unintentionally? What happens if containment fails? Who cleans up spills?

Biological Hazards

Pathogens, moulds, allergens, animal-borne diseases. Post-COVID, organisations have become more aware of biological hazards, but they’re often underestimated in non-healthcare sectors. Construction workers might be exposed to legionella in old buildings. Office workers might encounter mould in poorly maintained spaces.

Psychosocial Hazards

This is where organisations stumble most. Workload and time pressure, role ambiguity, poor relationships, bullying/harassment, lack of support, organisational change. These aren’t “soft” hazards—they cause burnout, mental health conditions, and sometimes tragic outcomes. Yet many HIRAs omit them entirely, citing “it’s not relevant to our operations.” This thinking is outdated and auditors increasingly challenge it.

Psychosocial hazard identification requires a different method than physical hazards. Walk-through observation doesn’t reveal organisational stress. You need worker surveys, focus groups, and exit interview analysis to understand psychosocial risk.

Ergonomic Hazards

Repetitive strain, poor posture, inadequate workstation design, manual handling of heavy or awkward loads. Ergonomic risks often develop gradually—a worker might suffer strain injury without obvious incident. Assess job design: Are tasks varied? Are workstations adjustable? Is there adequate rest time? Can workers alternate between standing and sitting?

The Three-Step HIRA Process

Step 1: Identify All Hazards

Comprehensive hazard identification uses multiple methods simultaneously. No single method captures everything.

Process Walkthrough: Physically tour your operations. Observe work as it happens, not as it’s supposed to happen. What do workers actually do? What shortcuts might they take? What could go wrong if someone became distracted or fatigued?

Worker Interviews and Focus Groups: Ask frontline workers directly: What do you worry about on the job? When have you had a close call? What’s uncomfortable or frustrating about your work environment? Workers see hazards managers don’t because they work in the hazardous areas daily.

Incident and Near-Miss Review: Analyse past incidents. If someone was injured or nearly injured, there’s a hazard to address. Patterns in near-misses reveal emerging risks before serious incidents occur.

Regulatory and Industry Benchmarking: Review regulations applicable to your industry. What hazards are commonly cited in inspections? What have competitors or similar organisations identified? Industry associations often publish hazard guides.

Checklist Review: Use a comprehensive checklist covering physical, chemical, biological, psychosocial, and ergonomic hazards as a sanity check. Checklists shouldn’t be your primary method (they miss context-specific risks), but they’re useful to ensure you haven’t overlooked obvious categories.

Involve cross-functional teams in identification: operations personnel (understand processes), workers (experience hazards daily), management (see strategic context), HR (know workforce demographics and capabilities). Psychosocial hazard identification especially benefits from HR and employee relations involvement.

Document your identification process: How did you identify hazards? Who was involved? What methods did you use? This transparency demonstrates thoroughness to auditors and, importantly, to your workforce.

Step 2: Assess Risk—Current and Residual

For each identified hazard, assess risk in two states: current risk (with existing controls in place) and residual risk (with proposed control improvements implemented).

Risk assessment asks two questions: How likely is harm? How severe would harm be? You can assess qualitatively (High/Medium/Low) or quantitatively (numerical scores). Most organisations use qualitative assessment for simplicity, though quantitative is more rigorous.

Likelihood Factors: How often is the hazard encountered? How many people are exposed? What’s the frequency of exposure? Machinery used daily by 10 operators is higher-likelihood than occasional use by one trained operator.

Severity Factors: What’s the worst plausible outcome? Injury severity ranges from minor (first aid, back to work same day) to fatal. Chemical exposure might cause acute symptoms (severity medium) or chronic illness years later (severity high).

A common tool is a risk matrix: plot likelihood (X-axis) against severity (Y-axis) and assign risk rating to the resulting cell. A hazard with high likelihood and high severity is obviously high-risk. A hazard with low likelihood and low severity is low-risk. Medium combinations deserve thoughtful assessment.

Current risk factors in existing controls: Is machinery guarded? Are workers trained? Is PPE available? Be honest—if a control isn’t consistently used, don’t assume it’s controlling risk.

Residual risk assumes proposed controls are implemented effectively. If you plan to upgrade guarding, assess risk with improved guarding in place. If you propose additional training, assess risk assuming trained competence.

Step 3: Define Controls Using the Hierarchy

For each identified hazard, define controls prioritising the hierarchy of controls. This hierarchy is fundamental to ISO 45001’s effectiveness philosophy.

1. Elimination: Remove the hazard entirely. This is the ideal but often isn’t feasible. Example: Instead of managing chemical hazard, switch to a non-toxic alternative. Instead of manual handling, implement mechanical lifting. Not always possible, but always worth exploring.

2. Substitution: Replace with a safer alternative. Example: Replace noisy compressor with quieter model. Replace toxic solvent with less hazardous solvent. Replace shift work with day shifts to reduce fatigue.

3. Engineering Controls: Redesign the process or workplace to minimise hazard exposure. Examples: machinery guarding, ventilation systems, noise dampening, automated processes. Engineering controls are more reliable than relying on human behaviour.

4. Administrative Controls: Procedures, training, supervision, job rotation to reduce exposure. Examples: safe work method statements, training on machinery operation, supervision of high-risk tasks, rotation to reduce repetitive strain. Administrative controls depend on consistent human compliance.

5. Personal Protective Equipment (PPE): The final resort: hard hats, safety glasses, gloves, respirators. PPE is least effective because it depends entirely on consistent, correct use. A worker might forget PPE or use it incorrectly. Never rely on PPE as your primary control for high-risk hazards.

The critical discipline in this step is explaining your choices. For high-risk hazards, if you’ve chosen PPE instead of engineering controls, document why: “Elimination impossible because chemical is essential to process. Substitution explored; no safer alternative exists. Engineering controls evaluated; cost-benefit assessment shows additional guarding would not substantially reduce residual risk given current process design. Therefore, administrative controls (training, supervision) and PPE (respirators, gloves) are primary controls.”

A HIRA where you can justify your control choices is far stronger than one with arbitrary decisions. Auditors respect transparent reasoning.

Risk Assessment Methodologies: Which Approach Fits Your Operations?

ISO 45001 doesn’t mandate a specific methodology, which gives you flexibility. Choose based on your complexity and risk profile.

Risk Matrix (Qualitative)

The most common approach: create a simple matrix with likelihood (Low/Medium/High) on one axis and severity (Low/Medium/High) on the other. Assign risk ratings to each cell (9 combinations). This is intuitive, quick, and works well for most organisations.

Strength: Simple, fast, easy to communicate. Weakness: Subjective; two assessors might rate the same hazard differently.

Bow-Tie Analysis

Maps a hazard (on the tie knot), the events that could trigger it (left side), and consequences if it occurs (right side). Particularly useful for complex processes where failures cascade. Example: chemical leak might be triggered by equipment failure, human error, or natural disaster; consequences could be worker exposure, environmental contamination, or business disruption.

Strength: Reveals multiple failure pathways and mitigation strategies. Weakness: Time-intensive for large HIRAs.

FMEA (Failure Mode and Effects Analysis)

Systematic assessment of how something could fail, what would result, and how likely/severe the failure is. Common in manufacturing and safety-critical systems. For each potential failure mode, rate likelihood, severity, and detection difficulty; calculate a Risk Priority Number to prioritise remediation.

Strength: Rigorous, forces discipline in thinking through failure scenarios. Weakness: Complex; requires training to apply effectively.

What-If Analysis

Workshops where you ask: What if X failed? What if someone made mistake Y? What if conditions Z occurred? This is less structured than matrix or FMEA but works well for brainstorming and revealing non-obvious risks. Particularly useful for psychosocial hazards, where risk factors are more qualitative.

Strength: Creative, uncovers non-obvious risks. Weakness: Less systematic; output depends heavily on facilitator skill.

Which to choose? Many organisations combine methods: use risk matrix as primary framework (simple, systematic), supplement with what-if for complex processes or psychosocial hazards (creative insight), and apply FMEA for safety-critical operations (rigour). There’s no single “correct” approach—use what fits your operations and capabilities.

Worker Participation in HIRA: Moving Beyond Theatre

Clause 5.4 requires “consultation and participation” of workers in OH&S decisions. HIRA is the prime opportunity for genuine participation. Yet many organisations treat worker involvement as box-checking: send a survey, hold a meeting, claim participation.

Genuine participation is different. It means workers actively shape the HIRA, not just react to management findings. It means management visibly acts on worker input, even when it contradicts initial management assumptions.

Involve workers early: Bring them into hazard identification process design, not just asking them to identify hazards from a pre-structured form. Ask: How should we identify hazards? What methods will surface issues frontline workers know about?

Use multiple engagement methods: Surveys reach many people but lack depth. Workshops and focus groups allow dialogue and build shared understanding. Individual interviews surface sensitive issues (like psychosocial concerns) where people might not speak openly in groups.

Document worker input explicitly: When finalising your HIRA, show which hazards came from worker suggestions. Publish the feedback explicitly: “Workers identified workload as a psychosocial hazard. Management assessment confirmed this is a significant risk. Proposed controls include workload assessment, training on time management, and team capacity review.”

Close the loop: If workers suggest hazards or controls that management doesn’t include, explain why in writing. “Suggestion: Implement four-day work weeks. Response: Operational requirements require five-day week structure. However, we are exploring flexible start times and compressed hours as alternative fatigue management controls.”

When workers see their input directly influence outcomes (even if not always adopted), they invest in the system. When suggestions disappear into a black hole, they disengage.

Common HIRA Mistakes and How Consultants Fix Them

Mistake 1: HIRA Conducted Entirely by Management

Management assessments miss frontline insights. A manager might rate machinery hazard as “medium risk” because guarding looks adequate. A worker uses the machinery daily and knows the guarding catches on materials sometimes, defeating the guard’s purpose. The worker’s insight reveals actual higher risk.

Fix: Mandate worker participation from identification phase. Don’t ask workers to review a management-drafted HIRA; involve them in creating it.

Mistake 2: Physical and Chemical Hazards Only

Psychosocial hazards are overlooked because they’re “not traditional safety” or “everyone deals with stress.” Yet psychological strain causes burnout, mental health conditions, and sometimes tragic outcomes. Ergonomic hazards are overlooked because “we don’t have a manufacturing process,” ignoring that office work has ergonomic risks too.

Fix: Explicitly assess all five categories. If assessment shows psychosocial/ergonomic risks as low, document why (e.g., “Role clarity is strong; high autonomy; supportive team structure mitigates psychological strain”). Never omit categories; always show you’ve considered them.

Mistake 3: Controls Not Following Hierarchy

HIRA identifies high-risk machinery hazard and control is “PPE—provide safety glasses.” Why isn’t the machinery guarded? “Cost,” or “It’s designed that way.” This violates hierarchy logic: engineering controls are more reliable than PPE. If a high-risk hazard’s primary control is PPE, you’ve skipped important hierarchy steps.

Fix: For each high-risk hazard, justify why you haven’t applied higher-order controls. If engineering controls are cost-prohibitive, explore substitution or process redesign. If hazard truly can’t be eliminated/substituted/engineered, then administrative controls + PPE is acceptable. But show the reasoning.

Mistake 4: Risk Register Never Reviewed Operationally

HIRA is completed as a project deliverable, then filed. Risk register sits static. New hazards emerge; old ones are forgotten. The system becomes disconnected from operations.

Fix: Embed risk register review into operational calendar. Schedule quarterly risk register reviews. Make it a standing agenda item at safety committee meetings. When incidents or near-misses occur, ask: Is this hazard in our register? Are controls adequate? Update register within days of identified new hazards.

Mistake 5: Residual Risk Still Unacceptably High

HIRA proposes controls but doesn’t verify they’ll reduce risk adequately. When controls are implemented, residual risk remains high because controls were insufficient. The system didn’t prevent the incident it was supposed to prevent.

Fix: In HIRA, be honest about residual risk. Don’t assume training will eliminate operator error—quantify how much risk training reduces (research shows behaviour change is often modest). Don’t assume workers will wear PPE—assess residual risk if PPE is only worn 80% of the time (realistic compliance rate). After controls are implemented, audit their effectiveness and update risk ratings based on actual effectiveness, not hoped-for effectiveness.

From HIRA to OH&S Objectives

Your HIRA findings should directly inform your OH&S objectives (Clause 6.2). If HIRA identifies “high residual risk in manual handling due to weak lifting technique and insufficient workstation design,” your objectives should include “Reduce manual handling risk by 30%” and “Implement workstation ergonomic design standards.”

This connection ensures objectives aren’t arbitrary. They’re grounded in actual risk. When management review assesses objective achievement, you’re measuring what matters: risk reduction, not just compliance.

Documenting Your Risk Register: What Should It Include?

Your risk register is the living document of your HIRA. It should include:

Establishing HIRA Review Triggers

HIRA isn’t a once-per-year compliance task. Establish triggers for when HIRA is reviewed:

Scheduled Review: Annual comprehensive review ensures no hazards are forgotten. Quarterly light reviews address emerging issues.

Process Changes: New equipment, process redesign, layout change, new product line—any significant operational change requires HIRA update. Ask: What new hazards does this introduce? Are existing controls still adequate?

Incidents and Near-Misses: Every incident triggers immediate hazard review. Ask: Was this hazard in our register? Were controls adequate? What control improvements do we need?

Regulatory Changes: New regulations might introduce hazard categories you hadn’t considered. Update HIRA to address new requirements.

Workforce Changes: New employee cohorts (younger, different capability, different languages) might experience hazards differently. Revisit hazard assessment if workforce composition significantly changes.

Frequently Asked Questions

Conclusion: Making HIRA Your Strategic Guide

Your HIRA is only as valuable as the decisions it informs and the actions it drives. A comprehensive, participatory HIRA conducted through a robust methodology becomes your roadmap for risk management. Your objectives are grounded in actual hazards. Your operational controls target real risks. Your management review focuses on data that matters.

The organisations that reap real value from ISO 45001 are those that use HIRA not as a compliance document but as a strategic tool—regularly updated, genuinely participatory, transparently linking findings to management decisions.

If you’re beginning HIRA or want to strengthen an existing assessment, contact Anitech Group. We facilitate comprehensive HIRA processes that combine rigor with practicality, ensuring your hazard identification drives genuine risk management improvement.

Contact Anitech Group to strengthen your HIRA process.