Risk Assessment

A risk assessment is a systematic process for identifying workplace hazards, estimating how likely each one is to cause harm and how severe that harm could be, and deciding which controls are needed to reduce the risk to an acceptable level. It turns a list of hazards into a ranked, documented plan for action.

Risk assessment sits at the center of every modern safety program. It tells safety managers and operations leaders where to spend limited time and money first, and it gives supervisors and workers a shared picture of what can go wrong on a task and what keeps them safe.

What Is a Risk Assessment?

In occupational safety, a hazard is anything with the potential to cause harm, such as a moving forklift, a solvent or a fall from height. Risk combines two factors: the likelihood that the hazard will actually cause harm, and the severity of that harm if it does. A risk assessment examines both factors for each hazard and records the result.

There is no single OSHA standard titled "risk assessment" for general industry, but the concept runs through OSHA guidance and several rules. OSHA's Recommended Practices for Safety and Health Programs (OSHA 3885) lists hazard identification and assessment as a core element and tells employers to characterize hazards by the severity of potential outcomes, the likelihood of an event and the number of workers who could be exposed. Specific standards also require formal assessments, including the PPE hazard assessment in 29 CFR 1910.132(d) and the process hazard analysis in the Process Safety Management standard, 29 CFR 1910.119(e).

Internationally, ISO 45001 requires organizations to establish a process for hazard identification and the assessment of occupational health and safety risks (clause 6.1.2). Certified organizations must be able to show auditors how risks were identified, rated and controlled.

Why Risk Assessment Matters

Most organizations face more hazards than they can fix at once. A risk assessment provides a defensible way to decide what comes first, so attention goes to the hazards that could kill or seriously injure someone rather than to the ones that are easiest to fix.

• Prevention before harm: it finds problems before an incident does, which is the whole point of a proactive safety program.
• Better control choices: rating risk before and after controls shows whether a proposed fix actually reduces risk enough.
• Compliance evidence: documented assessments help demonstrate due diligence to OSHA, insurers, customers and ISO auditors.
• Worker engagement: involving the people who do the work surfaces hazards that managers may never see.

Types of Risk Assessment

Different situations call for different levels of detail. Most organizations use a mix of the following.

Baseline or Site-Wide Assessment

A broad review of an entire facility or operation, usually done when a site opens, when a safety program is first set up or on a regular cycle. It produces a risk register that becomes the starting point for more detailed work.

Task-Based Assessment

A focused review of a specific job, broken into steps. A job hazard analysis is the most common example. It suits routine tasks with known steps, such as changing a saw blade. A JHA is narrower than a risk assessment, which can cover a whole site or change and normally rates each hazard so you can prioritize. Adding a risk rating to a JHA effectively makes it a task-level risk assessment.

Point-of-Work or Dynamic Assessment

A quick check done by the crew right before work starts, often on a short form or card. It captures conditions that change daily, such as weather, nearby work or missing equipment.

Change-Driven Assessment

Any new equipment, process, chemical or layout should trigger a fresh look at risk. This is the link between risk assessment and management of change.

How to Conduct a Risk Assessment Step by Step

Methods vary, but most follow the same basic sequence.

1. Define the scope. Decide which area, process or task you are assessing and who will take part. Include at least one person who does the work every day.
2. Identify hazards. Walk the area, observe the task and review existing information such as incident reports, near miss reports, equipment manuals and Safety Data Sheets. Consider routine work, maintenance, cleaning and emergencies.
3. Identify who could be harmed and how. Think about employees, contractors, visitors and the public, and note groups with extra risk, such as new or young workers.
4. Rate the current risk. Estimate likelihood and severity with existing controls in place, using your organization's risk matrix.
5. Decide on additional controls. Work down the hierarchy of controls, starting with elimination and substitution before relying on procedures or PPE.
6. Rate the residual risk. Re-score the hazard assuming the new controls are in place and working. If it is still unacceptable, keep looking for better controls.
7. Assign actions. Give each new control an owner and a due date so it actually gets done.
8. Communicate and record. Share the findings with affected workers and keep the assessment where people can find it.
9. Review. Revisit the assessment after incidents, after changes and on a set schedule.

How to Calculate a Risk Score

Many organizations use a 5x5 risk matrix. Likelihood and severity are each rated from 1 to 5, and the risk score is the product of the two.

Risk score = Likelihood x Severity

A typical scale rates likelihood from 1 (rare) to 5 (almost certain) and severity from 1 (minor first aid) to 5 (fatality or permanent disability). The organization then sets bands for action, for example 1 to 4 low, 5 to 9 medium, 10 to 16 high and 20 to 25 critical. These bands are a company decision, not a regulatory requirement, so define them in writing and apply them consistently.

Worked Example

Consider a hypothetical warehouse where forklifts and pedestrians share the same aisles, and the only existing control is a speed limit sign.

• Likelihood of a pedestrian being struck: 3 (possible)
• Severity if it happens: 5 (could be fatal)
• Initial risk score: 3 x 5 = 15, which falls in the high band

The team installs physical barriers and marked pedestrian walkways that separate people from forklift routes, and adds blue warning lights on the trucks. Re-rated with these controls in place:

• Likelihood: 1 (rare)
• Severity: 5 (unchanged, because a strike could still be fatal)
• Residual risk score: 1 x 5 = 5, which falls in the medium band

Notice that severity rarely changes unless the hazard itself is reduced, such as by lowering speed or eliminating forklifts from an area. Most controls reduce likelihood.

Examples of Risk Assessment in Practice

• Manufacturing: assessing a press brake for caught-in hazards before deciding between guarding, light curtains and two-hand controls.
• Construction: rating fall, trench and struck-by risks for each phase of a project before mobilizing crews.
• Chemical handling: using Safety Data Sheets to assess exposure from a new cleaning product and selecting ventilation and gloves.
• Fleet operations: assessing route, fatigue and weather risks for long-haul drivers.
• PPE selection: completing the written hazard assessment OSHA requires before selecting personal protective equipment.

Common Mistakes and Best Practices

Mistakes to Avoid

• Doing it at a desk. Assessments written without visiting the work area miss real hazards.
• Jumping to PPE. Relying on gloves, glasses or harnesses when higher-level controls are practical leaves risk in place.
• Treating it as paperwork. An assessment with no assigned actions does not reduce risk.
• Never reviewing it. Conditions change, and an assessment that is years old may describe equipment that no longer exists.
• Inconsistent scoring. Without clear definitions for each likelihood and severity level, different assessors rate the same hazard very differently.

Best Practices

• Write clear descriptions for every rating level and train assessors on them.
• Use incident and near miss data to check whether your ratings match reality.
• Link each control to a tracked action with an owner and a due date.
• Store assessments centrally and make them easy to find on the shop floor.
• Set review triggers: after incidents, after changes and at least on a fixed cycle.

How SMS360 Helps

The SMS360 Risk Assessment module gives teams a consistent way to record hazards, rate risk before and after controls, and assign control measures to named owners with due dates. Assessments are stored in one place, so supervisors and auditors can find current versions quickly, and review reminders help keep them up to date. Dashboards show open actions and high-risk items across sites, and mobile access lets teams complete assessments where the work happens.

Frequently Asked Questions

What are the five steps of a risk assessment?

A common five-step approach is: identify the hazards, decide who might be harmed and how, evaluate the risk and decide on controls, record the findings and put them into action, and review the assessment regularly. Many organizations expand these into more detailed steps, such as rating residual risk and assigning control owners, but the core logic of find, evaluate, control and review stays the same.

Is a risk assessment required by OSHA?

OSHA does not have one general risk assessment standard, but several rules require specific assessments. Examples include the written PPE hazard assessment under 29 CFR 1910.132(d) and the process hazard analysis under 29 CFR 1910.119. OSHA's Recommended Practices also treat hazard identification and assessment as a core program element, and the General Duty Clause expects employers to address recognized serious hazards.

How often should a risk assessment be reviewed?

Review a risk assessment whenever something changes, such as new equipment, a new process or a new chemical, and after any incident or near miss related to the task. Many organizations also set a fixed review cycle, often annually, for assessments that have not otherwise been updated. High-risk activities may warrant more frequent reviews.

Who should carry out a risk assessment?

A competent person who understands the work and the assessment method should lead it, but it works best as a team effort. Include workers who perform the task, their supervisor and, where needed, a safety professional or engineer. Workers often know about shortcuts, workarounds and equipment problems that never appear in written procedures.