Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.2 Hazard identification and assessment of risks and opportunities
Clause 6.1.2 is the technical core of OH&S planning. It has three parts: 6.1.2.1 Hazard identification, 6.1.2.2 Assessment of OH&S risks and other risks to the OH&S management system and 6.1.2.3 Assessment of OH&S opportunities and other opportunities for the OH&S management system. The outputs feed directly into 6.1.4 Planning action and the controls you apply under 8.1.2 Eliminating hazards and reducing OH&S risks.
ISO 45001 defines a hazard as a source that could cause injury and ill health (3.19); this includes hazardous situations and circumstances that could lead to exposure. An OH&S risk (3.21) combines how likely a work-related hazardous event or exposure is with how severe the resulting injury or ill health could be. An OH&S opportunity (3.22) is any circumstance that could lead to better OH&S performance.
6.1.2.1 Hazard identification
You must establish, implement and maintain a hazard identification process that is ongoing and proactive – it should find hazards before they cause incidents, not only afterwards. Ideally it starts at the concept stage of any new workplace, facility, product or activity and continues through design, operation and the full life cycle. Hazards can be physical, chemical, biological, psychosocial, mechanical, electrical, or related to movement and energy.
The standard lists what the process must take into account, as a minimum. In plain terms, your process should cover:
- How work is organized and social factors – workload, working hours, victimization, harassment and bullying, as well as leadership and the culture of the organization. These psychosocial hazards are often overlooked by traditional risk assessments;
- Routine and non-routine activities and situations – including hazards from infrastructure, equipment, materials, substances and the physical workplace; from product and service design, research, testing, production, construction, service delivery, maintenance and disposal; from human factors; and from the way the work is actually performed;
- Past incidents – relevant incidents and emergencies, inside or outside your organization, and their causes;
- Potential emergency situations – for example a machine fire, a natural disaster near the workplace, or civil unrest where workers are deployed (see 8.2 Emergency preparedness and response);
- People – everyone with access to the workplace (workers, contractors, visitors and others), people nearby who could be affected by your activities, and workers at locations you do not directly control, such as mobile workers, drivers, service engineers on customer sites, home-based workers and lone workers;
- Other issues – the design of work areas, processes, installations, machinery, operating procedures and work organization, and how well they suit the needs and capabilities of the workers involved; situations near the workplace caused by your work-related activities; and situations near the workplace that you do not control but which could harm people in your workplace;
- Change – planned or actual changes to your organization, its operations, processes and activities, or to the management system itself (see 8.1.3 Management of change);
- New knowledge – changes in what is known about hazards, from published research, regulator alerts, worker feedback and your own operating experience.
Although ISO 45001 does not deal with product safety for end users, hazards to workers during manufacture, construction, assembly or testing of products must be considered.
Practical methods for identifying hazards
Hazards exist at all levels in an organization and can be found through many sources, including reporting systems, inspections, audits, brainstorming sessions and expert judgement. Workers play a key role: being the ‘hands-on’ people, they are often more aware of the potential causes of harm than anyone else. Select a work process, work area or activity and identify task-related hazards by observing the work and discussing it with the workers who do it. Review relevant documentation such as inspection reports, injury and ill-health records, safety committee minutes, safe operating procedures, checklists and job descriptions. Other useful methods include:
- Conducting pre-start discussions on the work to be carried out;
- Encouraging workers to recognize and report hazards while performing work, without fear of reprisal;
- Carrying out safety inspections and audits of the workplace and work procedures;
- Conducting job safety analyses (or similar task evaluation processes);
- Monitoring, measuring and testing the working environment, e.g. noise, dust and fumes;
- Analysing proposed new or modified plant, materials, processes or structures;
- Conducting hazard surveys, including worker well-being or stress surveys for psychosocial hazards;
- Reviewing product information, e.g. safety data sheets and operating manuals;
- Researching publicly available data on hazards, e.g. industry or regulator safety alerts;
- Looking at past incident and near-miss reports.
No single method suits every organization or situation. Simple methods that draw on the experience of operating staff work well for most activities; when new, modified or complex processes and equipment are introduced, more formal techniques may be needed.
Job safety analysis (JSA)
A job safety analysis (also called job hazard analysis) breaks a job or task into its basic steps and identifies the hazards and safe practice for each step. Prioritize jobs with the highest injury or ill-health rates, jobs that are new, jobs that have changed significantly, and jobs complex enough to need written instructions. The most reliable approach is for a small group of experienced workers and supervisors to observe the task and discuss it; involving more people widens the experience base and helps the resulting controls to be accepted. A JSA typically records:
- Job physical requirements and environmental conditions;
- Personal protective equipment required;
- The sequence of basic job steps;
- Potential incidents or hazards associated with each step;
- Safe job practice for each step.
A typical sequence for developing a JSA is:
- Select an experienced worker or team to observe and explain the purpose of the exercise;
- Observe the task and record the steps used to complete it, then review the steps with the worker or team;
- Observe the task a second time to identify and record hazards, looking for impact, contact with chemicals, being caught in or between, cuts, burns, slips, trips and falls, over-exertion and cumulative trauma;
- Observe the task a third time to develop control measures for each hazard;
- Review the draft with the safety coordinator, department manager, supervisor and affected workers, then issue the final version.
Communicate the completed JSA to everyone who does, or will do, the work, transfer the hazards to your hazard register, and review JSAs periodically, after incidents and whenever new hazards, equipment or methods are introduced. JSAs quickly become out of date if they are not reviewed.
Workplace inspections
Workplace inspections range from informal walk-throughs to formal, in-depth evaluations, and look for hazards and unsafe practices across the site. Base the frequency on the risk of each area: for example, high-risk areas such as workshops, process plant and plant rooms monthly (or more often if the risk warrants), medium-risk areas every three months, and low-risk areas such as offices, store rooms and kitchens at least twice a year. Line managers and supervisors usually plan and lead inspections in their own areas, with help from safety representatives or other workers. Statutory inspections required by law should be scheduled separately.
HAZID and HAZOP studies
Where appropriate, use structured hazard identification (HAZID) studies to spot potential hazards early, for example before projects start or before large-scale process changes. A HAZID brings together a team of experienced personnel to identify hazards, causes, consequences and safeguards; it may need reliability data from equipment suppliers and should draw on lessons learned. Hazard and operability (HAZOP) studies use a workshop of operations staff, supervisors, design engineers and safety professionals to work systematically through deviations from normal process operation, so that malfunctions that could cause injury or ill health are anticipated and prevented. Both should be led by competent people.
Things to ask when listing hazards
To make sure the process is thorough, consider:
- Non-routine activities such as maintenance, repair, cleaning, commissioning and emergency response;
- People who work off-site, at home, on other premises or on the road;
- The experience and age of workers and contractors, and groups who may face different levels of risk such as young or inexperienced workers, people with disabilities, and new or expectant mothers;
- Foreseeable unusual conditions, such as loss of power or controls that may be unavailable in an emergency;
- Risks to visitors, the public and other interested parties;
- Hazards generated outside your organization or outside your direct control, such as extreme weather.
Useful questions include (this is not a complete list): Can any part of the body be caught in or between objects? Do tools, machines or equipment present hazards? Can a worker slip, trip or fall? Can a worker suffer strain from lifting, pushing or pulling? Is there exposure to extreme heat or cold, excessive noise or vibration, falling objects, poor lighting, harmful radiation, hot, toxic or corrosive substances, or dust, fumes, mists or vapours? Are workloads, working hours or relationships at work causing stress, fatigue or conflict?
6.1.2.2 Assessment of OH&S risks and other risks
You must establish, implement and maintain a process to:
- assess the OH&S risks arising from the hazards you have identified, taking into account how effective your existing controls are; and
- identify and assess the other risks associated with setting up, implementing, operating and maintaining the OH&S management system.
Your methods and criteria for assessing OH&S risks must be defined in terms of their scope, nature and timing, so that assessment is proactive rather than reactive and is applied systematically. You must both maintain documented information on the methods and criteria (e.g. a risk assessment procedure and risk matrix) and retain it (e.g. completed assessments and earlier versions of the criteria).
Different methods can be used for different hazards or activities. The complexity of the method should depend on the hazards involved, not on the size of the organization. An assessment can be as simple as a structured discussion with the workers involved, or it can use specialist techniques. For some complex situations expert advice is worthwhile, and some legislation requires more detailed assessments for specific hazards, for example:
- Process equipment (HAZOP) and failure mode and effects analysis (FMEA);
- Manual handling and ergonomic assessments;
- Hazardous substances (COSHH in the UK);
- Display screen equipment;
- Noise and vibration;
- Machinery, work at height and confined spaces;
- Fire and Legionella risk assessments;
- Work-related stress and other psychosocial risks.
Carry out or review a risk assessment when:
- There is uncertainty about how a hazard may result in injury or ill health;
- The work has not been done before, or involves high-risk activities;
- A new hazard has been identified, or several hazards could interact to create new or greater risks;
- After an incident or a case of work-related ill health;
- Before introducing new equipment, substances, work practices or procedures;
- Before changing a workplace, activity or process where the change may create a risk;
- Changes occur that may affect the effectiveness of existing controls;
- At regular scheduled intervals appropriate to the workplace.
When assessing risks, review relevant information such as operating procedures, safety data sheets, incident and injury data, workplace observations, legal requirements (see 6.1.3), industry codes of practice and national or international standards.
Determining likelihood, severity and the level of risk
There is no single correct way to rate risk. Estimate likelihood and severity giving due weight to the effectiveness of the controls already in place. Likelihood is affected by how often the task is done, the conditions, how many people are exposed and for how long. Severity considers the type of injury or ill health that could result, the number of people exposed and any knock-on effects. A typical three-band approach is:
Acceptable – risk is low and adequately controlled. Maintain and monitor the controls through routine procedures and reduce the risk further where reasonably practicable.
Tolerable – further action is required. Carry out a formal risk assessment, develop a safe system of work or JSA, and reduce the risk to as low as reasonably practicable (ALARP), implementing additional controls where the cost and effort are proportionate to the benefit. Confirm the controls with the supervisor and seek specialist advice where needed before work proceeds.
Intolerable – work must not start, or must stop, until the risk has been eliminated or reduced. Except in exceptional circumstances, risk reduction is essential whatever the cost, time or effort involved.
Once the level of risk is known, controls are selected using the hierarchy of controls – elimination, substitution, engineering controls and reorganization of work, administrative controls including training, and finally adequate personal protective equipment. Planning those actions is covered in 6.1.4 and their implementation in 8.1.2. Reassess the risk once new controls are in place.
Other risks to the OH&S management system
Do not stop at task-based risk assessment. Assess the risks that could stop the management system from working, using whatever method suits you (many organizations add them to a simple risk and opportunity register). Consider day-to-day operations and decisions, such as peaks in workload or restructuring, and external issues such as economic change. Practical sources include ongoing consultation with workers about changes in workload, monitoring new legal requirements and revisions to collective agreements, and checking that resources keep pace with changing needs, such as training or the purchase of improved equipment.
6.1.2.3 Assessment of OH&S opportunities and other opportunities
You must also establish, implement and maintain a process to assess:
- OH&S opportunities to improve OH&S performance, taking into account planned changes to the organization, its policies, processes or activities, including opportunities to adapt work, work organization and the work environment to workers, and opportunities to eliminate hazards and reduce OH&S risks; and
- other opportunities to improve the OH&S management system.
Assess each opportunity for its benefits and its potential to improve OH&S performance. Examples include:
- building OH&S requirements into the earliest planning stage of new facilities, relocations, process redesigns or machinery replacement;
- reducing monotonous work or work at a hazardous pre-set pace;
- using new technology to remove people from hazardous tasks;
- improving the safety culture, for example by developing competence beyond the minimum or encouraging prompt reporting of incidents;
- making top management’s support for the system more visible;
- improving incident investigation and worker consultation and participation;
- benchmarking against your own past performance and that of other organizations, and joining OH&S forums.
Remember that OH&S risks and opportunities can create other risks and opportunities for the organization, such as costs, productivity or reputation.
Worker participation, review and training
Clause 5.4 requires you to emphasize the participation of non-managerial workers in identifying hazards and assessing risks and opportunities (see 5.4 Consultation and participation of workers). Involve them in inspections, JSAs and risk assessment workshops, and trial new controls with them. Review hazard identification and risk assessments at planned intervals and whenever conditions, tasks or the workforce change, and report the results to top management through management review. Make sure workers are trained in hazard identification and reporting, the risk assessment process and the hierarchy of controls, through induction, toolbox talks and awareness training, and that they know the hazards and controls relevant to their own work.
You should seek and record evidence that your organization has an ongoing, proactive hazard identification process covering all the factors listed in 6.1.2.1, including psychosocial factors, non-routine work, people outside the organization’s direct control and changes; that OH&S risks are assessed against defined, proactive methods and criteria that are maintained and retained as documented information, taking account of existing controls; that other risks to the management system and both kinds of opportunity are assessed; and that non-managerial workers have taken part in these activities.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.