Risk assessment is the structured process of identifying the hazards in an activity, estimating how likely and how serious the harm they could cause is, and deciding which controls to apply to eliminate or reduce that risk to an acceptable level. It is the step that turns hazard identification into prioritised action.
Risk assessment is the structured process of examining an activity, task or workplace to identify the hazards present, estimate how likely and how serious the harm they could cause is, and decide which control measures are needed. It is not a document or a form: it is the reasoning that connects what could go wrong to what the organisation decides to do about it.
The reference definition from CCOHS, the Canadian occupational health and safety centre, describes risk assessment as "a thorough look at your workplace to identify those things, situations, processes that may cause harm, particularly to people", followed by estimating how likely and severe the harm is and deciding which controls to apply. It is a sequence: identify, assess, control.
Legally, risk assessment is no longer good practice but a requirement. ISO 45001:2018, in clause 6.1, requires the organisation to identify hazards on an ongoing basis and to assess occupational health and safety risks as the foundation of its management system. In the European Union, the Framework Directive 89/391/EEC obliges the employer to evaluate the risks to workers' safety and health. In the UAE, federal OSH under MoHRE and, in Abu Dhabi, the OSHAD-SF framework, require employers to assess workplace risks. In every case the logic is the same: you cannot manage a risk you have not assessed.
Confusing hazard with risk is the most common mistake, and the most expensive. A hazard, according to CCOHS, is "any source of potential damage, harm or adverse health effects". Risk is "the chance or probability that a person will be harmed or experience an adverse health effect if exposed to a hazard". The hazard exists in itself; the risk depends on exposure, likelihood and severity.
An example makes the distinction clear. A pool of oil on the floor is a hazard. If nobody passes through, the risk is low. If it lies across a forklift route during a busy shift, the risk is high, even though the hazard, the oil, is exactly the same. All risk assessment lives in this separation: you identify the hazard, then assess the risk in the real context of exposure.
A hazard is what could cause harm. Risk is the likelihood combined with the severity of that harm occurring. An assessment that does not separate the two ends up controlling symptoms instead of causes.
An accident nobody foresaw is almost never unforeseeable. It is, almost always, a risk that was not assessed, or was assessed and ignored. Risk assessment is the difference between an organisation that reacts to incidents and one that anticipates them. It is also, in most legal regimes, an obligation whose absence is itself a non-conformity.
Risk assessment is the backbone of the management system. It is where priorities, controls and the evidence an auditor will ask for all come from. Without current, traceable assessments, every audit turns into a scramble to reconstruct justifications, and every incident raises the uncomfortable question of why that risk was not mapped. A good assessment turns diffuse perception into defensible priorities.
The cost of an incident rarely fits in the shift report. According to the National Safety Council's Injury Facts 2024, the average cost of a disabling injury is around USD 48,000 and a fatality approaches USD 1.54 million. On the other side of the equation, the International Social Security Association estimates a return of about 2.2 monetary units for every unit invested in prevention. Risk assessment is the mechanism that directs that investment to where it prevents the greatest loss.
A well-run risk assessment protects people without stopping production. When controls are chosen by the right hierarchy rather than by convenience, the operator works with the risk reduced at source, not merely protected at the end of the chain. That cuts absenteeism, time off and the turnover that follows a serious accident, and it sustains a culture where safety and operations pull in the same direction.
The most established model is the HSE's, the British health and safety authority, summarised in five steps that apply to any sector. The sequence matters: skipping a step is the fast route to an assessment that looks complete on paper and fails on the ground.
1. Identify the hazards: walk through the activity and the workplace to recognise everything that could cause harm, from physical and chemical sources to organisational and ergonomic factors.
2. Assess the risks: for each hazard, estimate how likely the harm is and how serious it would be, considering who is exposed and under what conditions, including non-routine situations.
3. Control the risks: apply measures following the hierarchy of controls, starting by eliminating the hazard and turning to PPE only when nothing higher is feasible.
4. Record your findings: document the hazards, the assessed risks and the controls decided, so the evidence is ready for those who audit and those who do the work.
5. Review the controls: reassess periodically and whenever something changes in the process, the equipment or the people, to confirm the controls remain effective.
The HSE is blunt about the purpose: risk assessment is not a paperwork exercise but a means to control real risks. An assessment that produces a perfect document and no change on the ground has failed at the essential thing.
The most widely used tool for turning the assessor's judgement into a comparable criterion is the risk matrix. The logic, in the CCOHS formulation, is simple: risk = probability × severity. You cross the likelihood of the harm occurring with the severity it would have, and the meeting point gives the risk level, which sets the priority for action.
The 3×3 and 5×5 grids are industry conventions, not formats mandated by any standard: they can and should be calibrated to context. What the matrix offers is consistency. Without it, the same hazard gets different ratings depending on who assesses it. With it, the organisation prioritises by the numbers and concentrates resources where the risk is greatest, instead of treating everything as equally urgent.
Not every assessment needs the same degree of precision. CCOHS distinguishes three approaches, and the skill lies in choosing the one proportionate to the risk.
Combines severity and probability into descriptive categories, typically in a matrix, to produce a risk level compared against pre-determined criteria. It is quick, accessible and suitable for most day-to-day tasks, but it depends on the assessor's judgement.
Assigns numerical values to the qualitative factors and uses those values to rank and prioritise risks. It sits in the middle: more objective than pure qualitative, without requiring the data of a fully quantitative analysis. This is the scored-matrix format, where each axis gets a scale and the product sets the rating.
Calculates risk from data collected over time or across multiple situations, with methods such as FMEA (failure mode and effects analysis) and decision-tree analysis. It is the most data-intensive and is reserved for critical risks, where uncertainty is too costly to be handled by categories.
Identifying the risk is half the job. The other half is choosing the right control, and not all controls are equal. The hierarchy of controls, defined by NIOSH, ranks actions from most to least effective, and that order is not a suggestion: it is the criterion that separates a mature assessment from one content to hand out protective equipment.
NIOSH is explicit: elimination, substitution and engineering controls are more effective because they control exposure without relying on constant human behaviour. PPE, at the bottom of the hierarchy, protects only the person wearing it, always, correctly, and fails silently when that does not happen. An assessment that jumps straight to PPE has skipped the controls that actually reduce the risk.
Beyond the generic matrix, each type of risk has its own techniques. Choosing the right one is part of the assessor's competence.
Breaks a task down into its steps, identifies the hazards of each step and defines the controls. It is the technique of choice for repetitive manual work and for preparing procedures and permits to work.
A systematic, guideword-led analysis that examines process deviations in complex facilities. Governed by IEC 61882, it is the reference in chemical and energy processes.
A structured analysis built on "what if?" questions, useful for exploring scenarios in less standardised processes or early design stages, often as an entry point before a formal HAZOP.
Works through every possible failure mode of a system and prioritises it by a risk priority number. Governed by IEC 60812, it is inductive and strong in equipment reliability and quantitative prevention.
Visualises, in a single bow-shaped diagram, the causes of a top event on the left, the consequences on the right, and the prevention and mitigation barriers in the middle. It is powerful for communicating critical risk to management and for verifying that barriers actually exist.
On a stamping line, the risk assessment identifies the crush point between die and part as a hazard of severe severity and high likelihood. Rather than settling for PPE and training, the team applies the hierarchy: physical guards and two-hand controls, engineering controls that remove the exposure, with the procedure as a complementary layer, not the main defence.
A crew maintaining medium-voltage lines assesses the electrical risk and work at height before every intervention. The assessment feeds the permit to work (PTW): without lockout/tagout (LOTO) controls and isolation validation, the task does not proceed. In the field with no signal, the assessment must be available offline, at the point where the decision is made.
In a process unit with exothermic reactions, HAZOP examines every possible deviation of temperature, pressure and flow. The risk assessment does not treat hazards in isolation: it maps how a cooling failure can escalate into a release, and defines the barriers that break that chain before the major event.
At the recovery boiler, the critical risk of smelt-water contact demands a barrier assessment whenever there is an intervention. The assessment identifies the controls that prevent water ingress, verifies they exist and work, and treats their absence as an absolute stop for the operation, not an observation to correct later.
Beyond the classic occupational risks, the assessment covers exposure to potent active ingredients and the risk of cross-contamination. The hierarchy of controls applies equally to worker safety and product integrity: containment at source before PPE, with the procedure closing the system.
Risk assessment coexists with HACCP hazard analysis: the same probability-and-severity reasoning applies to operator safety on the line and to food safety. A mechanical hazard on a filler and a microbiological hazard at a critical control point both pass through the same logic of assessment and prioritised control.
The first mistake is confusing the paperwork with the goal. An assessment that produces a document and no change on the ground has met the form and failed the function. The HSE insists that assessing risk is only part of the process of controlling it, not an end in itself.
The second is letting the assessment age. CCOHS is clear: you must review regularly to confirm the controls remain effective and that changes in the workplace have not introduced new hazards or raised the priority of hazards once ranked lower. A three-year-old assessment of a process that has changed describes a risk that no longer exists and ignores the one that does.
The third is stopping at PPE. Whenever the first and only response to a risk is to hand out protective equipment, the controls that would eliminate or reduce it at source have been skipped. The fourth is assessing only normal operation and forgetting non-routine situations, start-up, shutdown, maintenance, emergency, which is precisely where serious incidents cluster.
The quality of a risk assessment eventually shows in the organisation's numbers. When the right risks are identified and controlled at the right point in the hierarchy, injury frequency falls, and that reads in the total recordable incident rate. The assessment acts upstream of the indicator: it reduces the event the indicator counts.
TRIR = (number of recordable cases × 200,000) ÷ total hours worked
The 200,000 factor represents 100 full-time workers over one year. Risk assessment is one of the leading indicators that best predicts the trend of this lagging indicator: how many assessments are current, how many top-of-hierarchy controls were implemented, how many high risks were treated.
The assessment acts upstream of the result. To go deeper on the outcome metric, refer to the full page: [TRIR — Total Recordable Incident Rate].
For decades, risk assessment lived in spreadsheets and paper binders. The result was predictable: out-of-date assessments, filed in folders nobody opened between audits, disconnected from the real work they were meant to describe. The hazard changed on the ground and the document stayed the same.
EHSQ software changes that by taking the assessment to the point where the work happens. The operator consults and records the task assessment on a mobile, even offline, before starting; the risk matrix is consistent across the whole organisation; and the chosen control is born linked to an action with an owner and a deadline, not a forgotten line in a sheet. The assessment stops being an archive and becomes part of the workflow.
The biggest leap is predictive. When every assessment, every identified hazard and every near miss feed the same base, patterns become visible: which types of risk recur, which controls fail, where the next serious injury is most likely. It is the difference between reacting to what has already happened and anticipating what is still to come, linking risk assessment to leading indicators and predictive management.
.webp)
A hazard is any source of potential harm; risk is the likelihood of that harm occurring, combined with its severity. The hazard exists in itself; the risk depends on exposure. A pool of oil is a hazard; the risk is only high if people move through it.
According to the HSE, they are: identify the hazards, assess the risks, control the risks, record your findings and review the controls. The sequence matters, and the last step, the review, is the most often forgotten and one of the most important.
Yes, in most regimes. ISO 45001:2018 requires it at the core of its management system; in the EU, the Framework Directive 89/391/EEC obliges the employer to evaluate risks; in the UAE, federal OSH under MoHRE and the OSHAD-SF framework in Abu Dhabi require workplace risk assessment.
It is the ranking of control measures from most to least effective: elimination, substitution, engineering controls, administrative controls and, last, PPE. It prioritises controlling the risk at source over relying on individual behaviour.
Because it protects only the person wearing it, always and correctly, and fails silently when that does not happen. It does not reduce the hazard, only creates a final barrier. The controls higher in the hierarchy remove or isolate the hazard without depending on constant human behaviour.
It is a tool that crosses the likelihood of harm with its severity to produce a risk level. It serves to prioritise: it concentrates resources on the highest-level risks and ensures the same hazard is rated consistently by different assessors.
The qualitative uses descriptive categories of likelihood and severity, is quick and suits most tasks. The quantitative calculates risk from data, with methods such as FMEA, and is reserved for critical risks. Between the two sits the semi-quantitative, which scores the factors numerically
Periodically and whenever something changes: new equipment, a new process, changes in the team, after an incident or a near miss, or when new information about a hazard emerges. An out-of-date assessment describes a risk that may no longer match reality.
Job safety analysis (JSA/JHA) breaks a task down into its steps, identifies the hazards of each and defines the controls. It is the ideal technique for manual work, repetitive tasks and for preparing procedures and permits to work.
EHSQ software takes the assessment to the point where the work happens, even offline, keeps the risk matrix consistent, generates controls with an owner and a deadline, and cross-references the data to reveal patterns. Glartek links risk assessment to leading indicators, making it possible to anticipate where the next serious incident is most likely.
Request your demo
Start your EHSQ software journey with Glartek and become a leader in your industry.
Schedule Demo.webp)
Discover the power of the only AI-Native EHSQ software built for the frontline
.webp){kind=small}
