Workplace Hazard Identification and Risk Assessment: A Practical Guide

Most workplace injuries are not caused by rare, unpredictable events. They come from hazards that were visible beforehand: a trailing cable, an unguarded machine, a solvent stored next to a heat source, a worker lifting awkward loads all day. Hazard identification and risk assessment is the discipline of finding those problems early and deciding, in a structured way, what to do about them.

This guide is for supervisors, engineers, HSE officers and anyone asked to "do the risk assessment" for a task or site. It covers the core concepts, a five-step method, an adaptable risk matrix, and how to turn findings into controls that work.

Hazard vs Risk: Get the Language Right

These two words are often used interchangeably, but they mean different things, and mixing them up leads to weak assessments.

• A hazard is anything with the potential to cause harm: a substance, a piece of equipment, a work method, an environment or a behaviour.
• A risk is the combination of how likely it is that the hazard will cause harm, and how serious that harm could be.

A drum of flammable solvent is a hazard. The risk depends on the situation: sealed and stored in a ventilated flammables cabinet away from ignition sources, the risk is low. Open, in a hot workshop where grinding is taking place, the risk is high. The hazard has not changed; the controls around it have.

Common Workplace Hazard Categories

Grouping hazards into categories helps you avoid blind spots. Typical examples:

Category	Examples	Typical harm
Physical	Moving machinery, working at height, slippery floors, noise, vibration, heat stress	Crush injuries, falls, hearing loss, heat exhaustion
Chemical	Solvents, acids, cleaning agents, welding fumes, dusts, fuels	Burns, poisoning, respiratory illness, fire
Biological	Sewage, contaminated waste, mould, infectious agents in healthcare	Infections, allergic reactions
Ergonomic	Repetitive tasks, heavy or awkward lifting, poor workstation layout	Back injuries, musculoskeletal disorders
Electrical	Damaged cables, overloaded sockets, exposed conductors, unsafe temporary supplies	Electric shock, burns, arc flash, fire
Fire and explosion	Flammable materials, hot work, gas cylinders, poor housekeeping	Burns, smoke inhalation, structural damage
Psychosocial	Excessive working hours, fatigue, harassment, lone working	Stress, errors, reduced alertness

Climate matters too. On outdoor sites in Pakistan and the Gulf, heat stress during summer months is a serious hazard that deserves its own controls, such as shaded rest areas, water, acclimatisation for new workers and adjusted working hours in line with local regulations.

How to Find Hazards: Practical Techniques

Hazards are rarely found by sitting at a desk with a template. Use several sources together:

• Walk the workplace. Look at floors, overhead areas, access routes, storage, machinery and emergency equipment. Go at different times, including night shifts.
• Watch the task being done. Procedures describe how work should happen; observation shows how it actually happens.
• Talk to the people doing the work. Operators and technicians know which shortcuts are taken and which jobs feel unsafe.
• Review records. Incident reports, near-miss logs, first-aid records and maintenance histories reveal patterns. A simple pivot table can show which areas or tasks keep appearing; our Excel pivot tables guide for beginners shows how.
• Check safety data sheets (SDS) and manufacturer information.
• Think about non-routine work. Maintenance, cleaning, start-up, shutdown and breakdowns are where many serious incidents occur.

The Five-Step Risk Assessment

Many organisations use a five-step approach similar to the one promoted by the UK's Health and Safety Executive. It works for an office, a warehouse or a construction site.

1. Identify the hazards. Use the techniques above and list each hazard for the activity or area.
2. Decide who might be harmed and how. Consider employees, contractors, visitors, cleaners, delivery drivers and members of the public. Pay attention to people at higher risk, such as new or young workers, pregnant workers and people who do not read the site's main language.
3. Evaluate the risks and decide on controls. Rate each risk (see the matrix below), record the controls already in place, and decide what more is needed.
4. Record your findings and implement them. Write down the significant hazards, the controls, who is responsible and by when. An action without an owner and a date rarely gets done.
5. Review and update. Revisit the assessment after an incident or near miss, when equipment or processes change, when new people join, and at regular intervals.

Rating Risk with a Likelihood x Severity Matrix

A risk matrix gives a team a consistent way to compare risks and set priorities. A common version uses a 1 to 5 scale for each factor and multiplies them.

Likelihood scale

• 1 Rare: could happen only in exceptional circumstances
• 2 Unlikely: could happen but is not expected
• 3 Possible: might happen occasionally
• 4 Likely: will probably happen at some point
• 5 Almost certain: expected to happen regularly

Severity scale

• 1 Negligible: no injury or first aid only
• 2 Minor: minor injury, short time off work
• 3 Moderate: injury requiring medical treatment or several days lost
• 4 Major: serious injury, long-term illness or permanent disability
• 5 Catastrophic: fatality or multiple serious injuries

The matrix

Likelihood (rows) / Severity (columns)	1 Negligible	2 Minor	3 Moderate	4 Major	5 Catastrophic
5 Almost certain	5 Medium	10 High	15 High	20 Very high	25 Very high
4 Likely	4 Low	8 Medium	12 High	16 Very high	20 Very high
3 Possible	3 Low	6 Medium	9 Medium	12 High	15 High
2 Unlikely	2 Low	4 Low	6 Medium	8 Medium	10 High
1 Rare	1 Low	2 Low	3 Low	4 Low	5 Medium

A typical action guide might read:

• Low (1 to 4): manage through normal procedures and monitor.
• Medium (5 to 9): additional controls needed within a set timeframe.
• High (10 to 15): work should not start, or should be closely controlled, until the risk is reduced.
• Very high (16 to 25): stop the activity until effective controls are in place.

These bands are an example, not a standard. Many companies define their own matrix and thresholds, and your organisation's version should be used. Whatever the version, note that a "rare but catastrophic" risk still deserves serious attention; a score is a prompt for judgement, not a replacement for it.

A worked example

A maintenance crew must replace a light fitting in a warehouse, 6 metres above the floor, using a ladder. A fall from that height could cause serious injury (severity 4), and with a ladder, no second person and a busy floor, a fall is possible (likelihood 3). The initial score is 12, High. Switching to a mobile elevating work platform operated by a trained person, with the area below barricaded, reduces the likelihood to 1. The residual score is 4, Low. Recording both the initial and residual scores shows the value of the controls.

Choosing Controls: The Hierarchy of Controls

Once you know which risks matter, choose controls in order of effectiveness. The hierarchy of controls, promoted by bodies such as the US National Institute for Occupational Safety and Health (NIOSH), ranks options from most to least effective:

1. Elimination: remove the hazard entirely. Example: do the work at ground level by lowering equipment instead of working at height.
2. Substitution: replace it with something less hazardous. Example: use a water-based cleaner instead of a solvent.
3. Engineering controls: isolate people from the hazard. Examples: machine guards, local exhaust ventilation, guardrails, interlocks.
4. Administrative controls: change the way people work. Examples: permits to work, job rotation, signage, training, procedures.
5. Personal protective equipment (PPE): helmets, gloves, respirators, hearing protection, harnesses.

PPE is essential, but it is the last line of defence because it relies on correct selection, fit, maintenance and use every single time. If your control list is mostly "wear PPE" and "be careful", the assessment usually needs more work.

Toolbox Talks: Getting the Message to the Workforce

A risk assessment that stays in a file does not protect anyone. Toolbox talks are short, focused briefings, often 10 to 15 minutes at the start of a shift, that bring the findings to the people doing the work.

• Keep each talk to one topic, such as working at height, hot work or manual handling.
• Use real examples from your own site, including recent near misses.
• Speak the language of the crew. On many sites in Pakistan and the Gulf, that means delivering the talk in Urdu or another shared language, not only English.
• Ask questions, invite concerns, and record attendance.

Documentation That Stands Up

Good records make it clear what was assessed, by whom and what was decided. At a minimum, record:

• The activity, location and date, and the names of the assessors
• Each significant hazard and who could be harmed
• Existing controls, risk rating before and after additional controls
• Actions, owners and target dates
• Review date and the trigger for earlier review
• Links to related documents: method statements, permits, SDS, training records

Safety planning also belongs in project planning from the start, alongside scope, schedule and budget; our article on project manager skills covers how good managers handle risk across a project.

The Role of Structured Safety Training

Risk assessment is a skill that improves with practice and with a solid grounding in hazard types, regulations and control methods. Structured courses modelled on OSHA-style outreach training give supervisors and workers a common vocabulary and a consistent approach. The OSHA-30 Occupational Health, Safety and Environment training bootcamp covers hazard identification, risk assessment, safety procedures and emergency preparedness, while the Occupational Health, Safety and Environment in Industry bootcamp provides a broader industrial HSE foundation.

Keep in mind that official OSHA Outreach cards are issued only through OSHA-authorised trainers, and employers in different countries recognise different qualifications. Check what your employer or client requires. For specialised high-risk work, such as confined spaces, scaffolding, or high-voltage electrical systems including electric vehicle servicing, general awareness training is not enough: workers need task-specific training, formal authorisation and the correct PPE before they start.

Frequently Asked Questions

Who should carry out a risk assessment?

A competent person who understands the work and the hazards, ideally with input from the workers who perform the task. For complex or high-risk activities, involve HSE specialists and engineers.

How often should a risk assessment be reviewed?

Review it whenever something significant changes, such as new equipment, a new process or after an incident or near miss, and at a regular interval set by your organisation, often annually.

Is a generic risk assessment enough?

Generic assessments are a useful starting point for routine tasks, but they must be checked against site conditions. A task assessed for an indoor workshop may carry very different risks on an outdoor site in summer.

What is the difference between a risk assessment and a JSA?

A job safety analysis (JSA) breaks one specific task into steps and identifies hazards and controls for each step. A risk assessment can cover a whole area, process or activity. Many sites use both.

Does PPE make a high risk acceptable?

Not on its own. PPE should support higher-level controls such as elimination, substitution and engineering measures, not replace them.

Conclusion

Effective hazard identification and risk assessment comes down to looking carefully, rating risks consistently, choosing strong controls and keeping the workforce involved. If you are responsible for safety on a site, or want to move into an HSE role, the OSHA-30 HSE training bootcamp is a practical next step for building these skills in a structured way.