The Process Hazard Analysis (PHA) is the analytical engine of your PSM program. Under 29 CFR 1910.119(e), employers must systematically identify, evaluate, and rank the hazards of their covered processes. The PHA drives decisions about engineering controls, administrative procedures, training priorities, and risk mitigation investments. A well-conducted PHA is the difference between a facility that proactively manages risk and one that reacts to incidents after they occur. Ecesis PSM software helps manage PHA findings, track corrective actions, and maintain revalidation schedules through its task management and compliance calendar tools.
What OSHA Requires
Under 29 CFR 1910.119(e), the employer must perform an initial PHA appropriate to the complexity of the process using one or more of these methodologies:
- What-If
- Checklist
- What-If/Checklist
- Hazard and Operability Study (HAZOP)
- Failure Mode and Effects Analysis (FMEA)
- Fault Tree Analysis
- An appropriate equivalent methodology
The PHA must address the hazards of the process, previous incidents, engineering and administrative controls, consequences of failure of controls, facility siting, human factors, and a qualitative evaluation of possible safety and health effects of failure of controls. The PHA must be performed by a team with expertise in engineering and process operations, and must include at least one employee with experience and knowledge specific to the process being evaluated. The employer must establish a system to promptly address findings and recommendations, document actions taken, and communicate results to affected employees. PHAs must be updated and revalidated at least every five years.
Step-by-Step Implementation
Select the Right Methodology
The methodology should match the complexity of the process:
- What-If: Best for simple processes or as a preliminary screening tool. Uses brainstorming to identify hazard scenarios
- Checklist: Effective for well-understood processes with established industry standards. Systematic but may miss novel hazards
- What-If/Checklist: Combines brainstorming creativity with checklist thoroughness. Good for moderate-complexity processes
- HAZOP: The most rigorous methodology. Systematically examines every process parameter for deviations. Best for complex or high-consequence processes
- FMEA: Focuses on equipment failure modes and their effects. Useful for mechanical systems and control systems
- Fault Tree: Works backward from an undesired event to identify contributing causes. Best for analyzing specific catastrophic scenarios
Most facilities use HAZOP for complex processes and What-If/Checklist for simpler ones. Document your rationale for methodology selection.
Assemble the PHA Team
PHA quality depends directly on team composition. OSHA requires:
- At least one member with expertise in engineering and process operations
- At least one employee with experience and knowledge specific to the process being evaluated
- A team leader trained in the PHA methodology being used
Best practice teams also include a maintenance technician familiar with the equipment, an instrument or controls engineer, and a safety professional. For complex processes, consider engaging an external PHA facilitator with methodology expertise while your internal team provides process knowledge.
Conduct the Analysis
Before starting, ensure process safety information is complete and current. During the analysis, systematically address every area OSHA requires:
- Identify hazards for each process section, node, or equipment item
- Review previous incidents (including near misses) for the process and similar processes
- Evaluate existing engineering controls (safety instrumented systems, relief devices, containment) and administrative controls (procedures, training, inspections)
- Assess consequences if controls fail
- Consider facility siting (proximity of occupied buildings, control rooms, and property lines)
- Evaluate human factors (ergonomics, alarm management, operator workload, accessibility)
Document each scenario, its causes, consequences, existing safeguards, and any recommendations for additional risk reduction.
Manage Findings and Recommendations
The PHA will generate findings and recommendations that OSHA requires you to promptly address. Establish a system to:
- Prioritize recommendations by risk level
- Assign each recommendation to a responsible person with a target completion date
- Document the employer's response to each recommendation (accept, reject with documented rationale, or modify)
- Track implementation to completion
- Communicate resolved findings and any interim protective measures to affected employees
Plan for Revalidation
OSHA requires PHAs to be updated and revalidated at least every five years from the date of the initial analysis. Revalidation involves:
- Reviewing the previous PHA to ensure it still reflects current process conditions
- Incorporating any process changes made since the last PHA
- Evaluating new incident data and industry lessons learned
- Assessing whether recommendations from the previous PHA were implemented and are effective
- Applying current PHA methodology standards and best practices
Schedule revalidation dates in your PSM compliance calendar well in advance to allow adequate preparation time.
Common Pitfalls to Avoid
How Software Supports This Element
Ecesis PSM software supports the PHA element throughout the analysis lifecycle:
- Task management: Track PHA findings and recommendations with assigned owners, due dates, status tracking, and documented resolution
- Compliance calendar: Automatic scheduling of five-year revalidation deadlines with advance notifications
- Document management: Store PHA reports, worksheets, and team documentation in a centralized repository accessible to employees
- Incident integration: Incident data from your facility feeds into PHA revalidation to ensure new hazard scenarios are captured
Frequently Asked Questions
Which PHA methodology should I use?
OSHA does not mandate a specific methodology. The choice should match your process complexity. HAZOP is most common for complex chemical processes because of its systematic node-by-node approach. What-If/Checklist works well for simpler processes. Many facilities use a combination of methods across different process units.
How long does a PHA typically take?
Duration depends on process complexity and the methodology used. A simple What-If analysis for a single process unit might take 2 to 3 days. A full HAZOP for a complex process can take 2 to 4 weeks of team meetings. Plan for adequate time rather than rushing, as incomplete PHAs are a frequent OSHA citation.
Can we reject PHA recommendations?
Yes, employers can reject recommendations if they document the rationale. OSHA expects a thoughtful written explanation of why the recommendation was not adopted, often including an alternative risk mitigation measure. Simply marking a recommendation as rejected without justification is a compliance risk.
What happens if we miss the five-year revalidation deadline?
Missing the revalidation deadline is a citable violation. Schedule revalidations in your compliance calendar with enough lead time (typically 6 to 12 months) to assemble teams, gather updated PSI, and conduct the analysis before the deadline.
Do we need to retain all previous PHA reports?
OSHA requires retention of the current PHA and all documentation related to its findings and resolution. Best practice is to retain all previous PHA reports and revalidations to demonstrate program continuity and to reference during future analyses.
Ecesis PSM Compliance Software
PSM Software
Centralized platform to manage all 14 PSM compliance elements
Management of Change
Submit, route, and approve change requests through defined workflows
Incident Investigation
Report, investigate, and track corrective actions to completion
Training Management
Deliver and track PSM training with comprehension verification
Mechanical Integrity
Schedule inspections, track deficiencies, and manage maintenance
PSM Compliance Calendar
Track deadlines across all 14 elements automatically


