Hazard identification and risk assessment are the foundation of every ISO 45001 OH&S management system. Clause 6.1.2 requires organizations to establish ongoing, proactive processes to identify hazards, assess OH&S risks and opportunities, and determine appropriate controls. Getting this right drives every other OHSMS element — from objectives to operational controls to monitoring.
What the Standard Requires
Organizations must establish, implement, and maintain ongoing and proactive processes for hazard identification. These processes must take into account how work is organized, social factors (workload, hours, harassment, bullying, victimization), routine and non-routine activities, past incidents (internal and external to the organization), potential emergency situations, people (including those with access to the workplace and their activities), and other factors including the design of work areas, processes, materials, equipment, and infrastructure.
Sources of Hazards to Consider
Risk Assessment Methodology
After identifying hazards, assess the associated OH&S risks considering the effectiveness of existing controls. While no specific methodology is prescribed, the approach must produce consistent, repeatable results. Common methods include risk matrices (likelihood vs. severity scoring), Job Hazard Analyses (JHAs), Failure Mode and Effects Analysis (FMEA), bowtie analysis, and qualitative expert assessment.
The Hierarchy of Controls
ISO 45001 Clause 8.1.2 requires application of the hierarchy of controls when determining how to address hazards and reduce risks. Controls higher in the hierarchy are preferred because they are inherently more reliable:
- Elimination: Physically remove the hazard entirely
- Substitution: Replace with a less hazardous process, material, or equipment
- Engineering controls: Isolate people from the hazard through physical barriers, ventilation, guarding, or work reorganization
- Administrative controls: Change the way people work through procedures, training, signage, and scheduling
- Personal protective equipment (PPE): Protect the individual with appropriate equipment
Best Practices for Hazard Identification and Risk Assessment
- Use multiple methods: workplace inspections, JHAs, safety observations, and incident investigations
- Involve workers who perform the actual work — they understand the real hazards
- Consider both acute hazards (falls, struck-by) and chronic hazards (noise, chemicals, ergonomics)
- Include social and psychosocial factors as required by the standard
- Review assessments when processes, equipment, or materials change
- Document the rationale when higher-order controls are not feasible
- Use hazard analysis software to systematically document and track assessments
Common Pitfalls
- Relying solely on historical incident data rather than proactive identification
- Ignoring psychosocial hazards (stress, bullying, fatigue)
- Jumping to PPE without considering higher-order controls
- Conducting one-time assessments instead of ongoing, proactive processes
- Not involving workers in hazard identification activities
