Risk Management

Risk management is the identification, assessment and prioritisation of risk.  The process involves four steps:

  1. Identify Hazards – find out what could cause harm.
  2. Assess Risks, if necessary – understand the nature of the harm that could be caused by the hazard, how serious the harm could be and the likelihood of it happening.
  3. Control Risks – implement the most effective control measure that is reasonably practicable in the circumstances.
  4. Review Control Measures – ensure they are working as planned.

1. Identify Hazards

Identifying hazards involves finding all of the things and situations that could potentially cause harm to people.

Hazards generally arise from these aspects of work:

  • Physical work environment
  • Equipment, materials and substances used at the workplace
  • Work tasks and how they are performed
  • Work design and management

Methods you can use to identify hazards in your workplace include:

  • Inspecting the workplace and observing how work tasks are performed
  • Consulting your workers about any health and safety problems they have encountered in doing their work
  • Analysing your records of workplace incidents, near misses and worker complaints
  • Reviewing any information and advice about hazards and risks relevant to your particular industry or the type of work that you do

2. Assess Risks

You should do a risk assessment when:

  • There is uncertainty about how a hazard may result in injury or illness
  • The work activity involves a number of different hazards and there is a lack of understanding about how the hazards may interact with each other to produce new or greater risks
  • Changes at the workplace occur that may impact on the effectiveness of control measures.

Assessing risks involves considering:

  • How severe the potential harm caused by the hazard could be, including: – what type of harm could occur (e.g. muscular strain, fatigue, burns, laceration) – whether the hazard could cause death, serious injury or illness, or only minor injury – how many people are exposed to the hazard
  • How hazards may cause harm, including:
    – The effectiveness of existing control measures and whether they control all types of harm
    – How work is actually done, rather than relying on written manuals and procedures
    – Infrequent or abnormal situations, as well as how things are normally meant to occur
    – Maintenance and cleaning processes, as well as breakdowns of equipment and failures of health and safety controls
  • the likelihood of harm occurring, including:
    – How often the task is done
    – How often people are near the hazard
    – Whether it has happened before, either in your workplace or somewhere else, and how often.

The level of risk will increase as the likelihood of harm and its severity increases.

3. Control Risks

The ways of controlling risks are ranked from the highest level of protection and reliability to the lowest.  This is known as the hierarchy of risk control. Where possible, implement the highest order risk controls.

1. Eliminate:
Remove the hazard completely from the workplace (e.g. remove trip hazards on the floor or dispose of unwanted chemicals). This is the most effective control measure and must always be considered before anything else.
2. Substitute:
Substitute or replace the hazard with a less hazardous work practice (e.g. replace solvent based paints with water-based paints)
3. Isolate:
As much as possible, separate the hazard or hazardous work practice from people by distance or using barriers (e.g. place guards around moving parts of machinery)
4. Engineering Controls:
These are physical control measures (e.g. use a trolley to lift heavy loads)
5. Administrative Controls:
These should only be considered when other higher order control measures are not practicable. These are work methods or procedures that are designed to minimise the exposure to a hazard (e.g. develop a procedure on how to operate machinery safely or use signs to warn people of a hazard)
6. Personal Protective Equipment (PPE):
Ear muffs, hard hats, masks, gloves, protective eyewear and other forms of PPE should be a last option as they do nothing to change the hazard itself. Effectiveness also relies on the proper fit, use and maintenance of the equipment.

In some cases you may need to implement a combination of control measures to provide the highest level of protection that is reasonably practicable.
When selecting and implementing a combination of control measures it’s important that you consider whether any new risks might be introduced as a result.

4. Review Control Measures

Control measures you implement must be reviewed and, if necessary, revised to make sure they work as planned.
There are certain situations where you must review your control measures, including:

  • When a control measure is not effective in controlling the risk


You can review control measures using the same methods as the initial hazard identification step.