Implement and Monitor Organisational Procedures and Legal Requirements for Identifying Hazards, and Assessing and Controlling Risks

Managing risks is central to health and safety legislation, and the benefits to an organisation include improving workers' and others’ health and safety, and productivity.

There are different models for risk management. The number of steps may vary and the categories and presentation (format) in the risk matrix or risk levels may vary; this may depend on organisational preferences, the industry and the complexity of the regulatory environment in which the organisation operates. However, the objective is the same to manage risk at work effectively. If you have any questions about the procedure, always speak with your supervisor, manager or WHS officer.

Risk management procedure

The risk management model that is used by your organisation will be documented in its work health and safety policy and procedure. It will also detail the documents that must be completed as part of this process and any consultation that must occur. We will now look at a commonly used five-step risk management procedure. This model is used at Bounce Fitness for incidents, injuries and illnesses. Simply put, the steps are:

1. Identify the hazard
2. Assess the risk
3. Communicate and consult
4. Treat and control the risk
5. Monitor and review

A description for each step of the Bounce Fitness Risk Management Procedure is provided below.

Step 1: Identify the hazard/s

Bounce Fitness considers the nature of the risks when identifying and managing risks associated with strategic and operational objectives. Use the Risk Assessment Form for this procedure. Identifying hazards involves recognising things that may cause injury or harm to the health of a person, for instance, unguarded machinery.

Step 2: Assess the risk

The overall process of risk identification, risk analysis and risk evaluation is assessed using the Risk Assessment Form.

• Identify risk: This refers to identifying risk sources, areas of impacts, causes and possible consequences to form a comprehensive list of risks that will negatively or positively affect the organisation’s objectives.
• Analyse the risk: This refers to considering the range of causes, sources of risk, consequences (refer to the first diagram below labelled 'Consequence') and likelihood (refer to the second diagram below labelled 'Likelihood') 
• Evaluate the risk: Using the Risk Matrix (refer to the third diagram below labelled 'Risk Matrix') refers to calculating the level of risk by finding the intersection between the likelihood and the consequences. This information from the risk matrix will help you identify the risk level/rating and actions (refer to the fourth diagram labelled 'Risk Level/Rating and Action')

CONSEQUENCES: Evaluate the consequences of a risk occurring according to the ratings in the left-hand column.

Descriptor	Level	Definition
Insignificant	1	No injury
Minor	2	Injury/ill health requiring first aid
Moderate	3	Injury/ill health requiring medical attention
Major	4	Injury/ill health requiring hospital admission
Severe	5	Fatality

LIKELIHOOD: Evaluate the likelihood of an incident occurring in the left-hand column.

Descriptor	Level	Definition
Rare	1	May occur somewhere, sometime (once in a lifetime/hundred years)
Unlikely	2	May occur somewhere within the department over an extended period of time
Possible	3	May occur several times across the department or a region over a period of time
Likely	4	May be anticipated multiple times over a period of time. May occur once every few repetitions of the activity or event
Almost certain	5	Prone to occur regularly. It is anticipated for each repetition of the activity or event.

RISK MATRIX: Use the matrix to calculate the level/rating of risk by finding the intersection between the likelihood and the consequences.

	Consequence
Likelihood	Severe	Major	Moderate	Minor	Insignificant
Rare	Medium risk	Medium risk	Low risk	Low risk	Low risk
Unlikely	High risk	Medium risk	Medium risk	Low risk	Low risk
Possible	Extreme risk	High risk	Medium risk	Medium risk	Low risk
Likely	Extreme risk	Extreme risk	High risk	Medium risk	Medium risk
Almost certain	Extreme risk	Extreme risk	Extreme risk	High risk	Medium risk

RISK LEVEL/RATING AND ACTIONS: Based on the level/rating of risk you identified in the risk matrix determine the appropriate action.

Descriptor	Definition
Extreme risk	Notify workplace manager and/or management WHS/OHS nominee immediately. Corrective action should be taken immediately. Cease associated activity.
High risk	Notify workplace manager and/or managment WHS/OHS nominee immediately. Corrective actions should be taken within 48 hours of notification.
Medium risk	Notify nominated employee, HSR/HSC. Nominated employee, WHS/OHS representative/HSC is to follow up that corrective action is taken within 7 days.
Low risk	Notify nominated employee, HSR/HSC. Nominated employee, HSR/HSC is to follow up that corrective action is taken within a reasonable time.

This information is used to identify the most appropriate control measure to control the risk called the 'Hierarchy of Contol Measure'.

STEP 3: Communicate and consult 

Effective communication, consultation and education in risk management are necessary to achieve a successful integration of the risk processes into the  organisation.  

STEP 4: Treat and control  risk

The hierarchy of control measures  is used to select one or more options for treating and controlling risks including funding and other resource considerations.  

STEP 5: Monitor and review

Continual monitoring and reviewing of risk profiles are essential to maintain the effectiveness and appropriateness of the treatment applied by management.

To treat and control risks (Step 4) is challenging. However, the hierarchy of control measures is an excellent system for managing risks in the workplace which we explore further later in this topic. The following video, developed by Work Safety Australia, provides tips from three safety inspectors regarding conducting safety inspections. This video provides a handy overview of key concepts to keep in mind when performing your duties within the requirements of WHS legislation.

 

Hazard identification

The process of hazard identification refers to identifying the objects or situations that can cause harm to other people. All organisations must place an effective system for identifying existing and emerging (new) hazards, such as weekly WHS safety checks of the workplace using a risk assessment checklist, hierarchy of control matrix, and control measures. Hazards, in general, arise from the following aspects of work:

• the physical work environment
• the equipment, materials and substances used for work tasks and how they are performed
• the work design and management.

Having a hazard identification system will allow you to ensure that any hazards that exist or may impact your organisation in the future are quickly identified and managed effectively. Hazard identification methods are usually defined by an organisation’s policies based on their state or territory’s WHS legislative requirements. Below are examples of methods you can use for identifying hazards and guiding questions to help you implement these methods.

Before we continue, let us look at some common workplace hazards.

Common hazards

There are many common hazards in the workplace. WHS laws have specific provisions and regulations for each, and your organisation will have instructions and procedures for managing these hazards. The most common hazards within the workplace come in many forms as you can see from the following table.

Hazard	Example	Potential harm
Manual tasks	Tasks involving sustained or awkward postures, high or sudden force, repetitive movements or vibration	Musculoskeletal disorders such as damage to joints, ligaments, and muscles
Gravity	Falling objects, falls, slips and trips of people	Fractures, bruises, lacerations, dislocations, concussion, permanent injuries or death
Psychosocial	Excessive time pressure, bullying, violence, and work-related fatigue	Psychological or physical injury or illness
Electricity	Exposure to live electrical wires	Shock, burns, damage to organs and nerves leading to permanent injuries or death
Machinery and equipment	Being hit by moving vehicles, or being caught in moving parts of machinery	Fractures, bruises, lacerations, dislocations, permanent injuries or death
Hazardous chemicals	Acids, hydrocarbons, heavy metals, asbestos, and silica	Respiratory illnesses, cancers or dermatitis
Extreme temperatures	Heat and cold	Heat can cause burns and heat stroke or injuries due to fatigue. Cold can cause hypothermia or frostbite
Noise	Exposure to loud noise	Permanent hearing damage
Radiation	Ultraviolet, welding arc flashes, microwaves, and lasers	Burns, cancer or blindness
Biological	Micro-organisms	Hepatitis, legionnaires’ disease, Q fever, HIV/AIDS or allergies

Sourced from Model Code of Practice: How to manage work health and safety risks, used under CC BY 4.0. Safe Work Australia.¹

Techniques for identifying new, potential or existing hazards

Businesses and organisations need effective techniques to systematically identify new, potential or existing workplace hazards. Some of the most popular techniques include those in the following list.

• Task analysis: A task analysis itemises each step of the task and pinpoints potential hazards. A straightforward procedure for safe task performance is outlined and documented in an easy-to-use format.
• Behaviour analysis: Unlike task analysis, the emphasis in behaviour analysis is on looking at the behaviour of the workers. You are evaluating the way the employee performs the job rather than looking at the job itself. Are workers wearing all required safety equipment? Are they taking their and their co-worker’s safety seriously? Using behaviour analysis, you should be able to find any shortcomings in the behaviour of workers, which can then be changed and reinforced through training in specific areas.
• Environment analysis: This kind of analysis examines the actual workplace. You are looking at the physical aspects of the work environment. Are light, ventilation and temperature all adequate? Are these likely to cause any problems for the workers? How can they be overcome?
• ‘What if’ analysis: This analysis involves looking at a hazard from the point of view of ‘what if’ this was to occur. You would then use simulation techniques to attempt to establish whether or not any potential hazards exist. What if the machine overheated? What would this cause, and what types of hazards may exist if this happened?
• Fault tree analysis (FTA): FTA is a deductive, top-down method of analysing system design and performance. It involves specifying a 'top' event to analyse (such as a fire), followed by identifying all of the associated elements in the system that could cause the event to occur. Fault trees provide a convenient symbolic representation of how the combination of events can result in the top event occurring.
• Incident investigations: Whenever there is an incident in a workplace, you, as the supervisor or team leader of your work team, must take all practicable steps to help determine the cause of the incident and whether or not it represents a significant hazard. Depending on the approach used and other factors, procedures may range from a simple checklist for a specific piece of equipment right through to a full investigation involving multiple departments. When necessary, supervisors and team leaders should seek the advice of specialist practitioners in health and safety.

Risk assessment

As with any other aspect of a business, there is a risk in health and safety. The hazards you identified in the hazard identification program may never actually happen, or they may happen often. If the risk is higher, the consequence will be more significant; thus, the controls you implement should be stricter. Therefore, it is essential to attempt to determine what the risk of a hazard is.

Outlined below are the critical aspects of risk assessment.

Assessment of likelihood and level of risk

The first stage of risk assessment assesses the likelihood of harm (injury/illness/death) occurring. There are many hazards in the workplace, and only a fraction of them will pose a significant risk of actually occurring regularly. Therefore, you should attempt to determine how often a hazard is likely to cause harm and concentrate on those that are most likely to cause severe harm if not controlled. These should have your attention for further analysis before other hazards.

It is a legal requirement that all hazards be controlled; however, there needs to be some compromise, as you cannot fix everything all at once. This is why risk assessment is so critical. You work first on those that will happen most often before you attempt to control those hazards that are only likely to occur if a chain of events (however unlikely) occurs. This level of risk assessment is usually best undertaken by consulting with the workers who have direct or hands-on experience. It makes good sense to discuss matters with workers experienced in the area to determine what is most likely to happen.

Consequences

The second major risk factor that must be considered is the consequences of a specific hazard should it occur. You need to balance the chance of something happening with the consequences should it occur. Those hazards that will cause serious harm should be dealt with ahead of hazards that will only cause minor harm.

After your analysis, you will have ranked hazards, and they should be dealt with in approximately the following order.

1. Hazards that are almost certain to occur and can cause a severe injury, illness or death
2. Hazards that are unlikely but can cause a severe injury, illness or death
3. Hazards that are rare and the consequence is insignificant.

All identified hazards must be reported so that steps can be taken to address them. As in all cases, it is vital that any reports or documents to record hazards and manage controls are in line with legislation and your organisation’s policies, procedures, and standards. This assists in ensuring consistency between documents throughout your organisation. You may check your organisation’s policies or consult with your WHS officer or safety practitioner to determine the required information about documentation.

Hazard reports contain all the information on hazards in the workplace. The key to managing and implementing hazard reports is to process the information correctly and use the information to respond appropriately to the hazard. Typical hazard reporting methods can include the following documentation (where applicable):

• Risk assessments
• Incident reports
• Hazard reports
• WHS Issue Management logs
• Pre-start system and equipment checks

Steps in the hazard report management process

There are three steps in the hazard report management process. Each of these enables you to thoroughly understand the information in a hazard report and help you find a solution to the raised concerns.

1. Review the report details
   • What events led to the filing of this report?
   • What are the basic facts about the hazard? (time, place, people involved)
   • What is your impression of how severe the problem is?
2. Analyse existing data to examine the report's context
   • Is the report the result of a current trend?
   • Has the report been filed due to reasons not indicated in past similar reports?
3. Perform an initial risk assessment
   • How likely is the hazard to cause harm?
   • What is the nature of the hazard?

Responding to hazard reports

After you have successfully processed and managed a hazard report, you must use the information from the report to determine if and what action needs to be taken. For example, if the hazard report describes a hazard that is likely to occur, your response should involve halting work that interacts with that hazard until a control measure that eliminates or minimises it is placed. Be sure that your response is appropriate for the reported hazard and is based on your organisation’s policies, procedures, and the hierarchy of control measures, which will now be further discussed.

Whenever you have noted a significant hazard in your workplace, the WHS Regulations clearly states that the hazard must either be eliminated or, if elimination is not possible, minimised. When controlling hazards and their associated risks, the organisation's primary aim is to eliminate the hazards as soon as reasonably possible. The usual control method set out for each type of hazard can be found in the WHS Regulations. The methods used are determined by the extent of the hazard and the ability of your organisation to control the hazard.

The hierarchy of control measures

What is the hierarchy of control measures? The hierarchy of control measures is a system designed to control risks in the workplace. It ranks the different risk controls from the highest level of protection and reliability (elimination) to the lowest and least reliable protection (PPE). The WHS Act requires businesses and organisations to apply the hierarchy of control measures for certain risk management situations. Study the hierarchy of control measures in the following infographic. It is based on the Model Code of Practice: How to manage work health and safety risks.

There are six levels in the hierarchy of controls. The hierarchy works from highest (or most effective) to lowest (or least effective).

Based on content from Model Code of Practice: How to manage work health and safety risks, used under CC BY 4.0. Safe Work Australia.

When a hazard is identified, a means of controlling that hazard (determined by the hierarchy of control measures) must be enacted quickly and effectively. While the organisation should always aim to eliminate existing hazards and risks in the work environment, it is not always reasonably practicable. In that case, the next best response is to minimise the risk by changing the hazard. Remember that changing the hazard does not eliminate risks; the only way to eliminate risks is by eliminating the dangers (hazards).

It is important to note that the level of health and safety protection reduces the further down you move through the hierarchy of control. In contrast, the reliability of control measures reduces the further down the hierarchy of control you move.

Control measures

What are control measures? Control measures are the means that an organisation uses to address risks such as plans, equipment, procedures, and policies. They are put in place based on the information that the organisation has on the risk and the legislative requirements for controlling it. We will briefly discuss the control measures.

Elimination

This is the most effective control measure. This process eliminates the risk by not introducing the risk into the workplace or removing an existing hazard from the workplace. If you have the option to eliminate the hazard, you must always choose that option. The most cost-effective way to eliminate hazards is by considering them during the development stage of a product or process in the workplace. If you can eliminate hazards before they even develop, you will save on the resources you would have used to eliminate the danger.

Substitution, isolation, and engineering controls

This level in the hierarchy of controls is only applicable when the hazard cannot be eliminated. If elimination is not possible, your next best approach would be to consider one of the following alternative control measures, select each heading to learn more.

Administrative controls

These are work procedures that minimise the possibility of being exposed to a hazard. This control is performed by implementing work methods or procedures designed to minimise exposure to hazards. For example, it provides information, training, and instructions to ensure that workers can work safely and/or offer policies that support workplace health and safety.

Personal Protective Equipment (PPE)

Personal protective equipment (PPE) refers to any equipment which limits one’s exposure to the harmful effects of hazards. This can only be achieved if used and worn correctly. Examples of PPE include items such as gloves, helmets, protective eyewear, and face masks. It is important to note that using administrative controls and using personal protective equipment (PPE) are the least effective options when determining suitable control measures. They do not address the hazard, which is the root of the risks. They instead rely on the behaviour of the workers. These measures are only applicable as:

• additional supports for higher-level control measures
• temporary measures until a better control measure becomes available
• last resort measures when no other options are available.

The risk controls in your workplace are implemented to ensure the safety of you and your work team, along with others such as clients, contractors, visitors, apprentices, and volunteers working in your workplace. To effectively ensure safety, you must identify and report inadequacies in existing control measures using the hierarchy of controls and WHS legislative requirements.

Reviewing control measures

Reviewing control measures applies to both existing and new controls and allows you to identify any shortcomings or possible room for improvements. A review of existing control measures is required when:

• an existing control measure cannot manage a risk
• a change in the work environment can develop a new health and safety risk that existing control measures do not address
• a new hazard or risk is identified
• results of consultation with workers show that there is a need for a review
• a health and safety representative requests a review.

Aside from these events, an organisation’s control measures should be regularly reviewed to allow you to develop a contingency plan and prevent potential risks. It is always easier to put in preventive measures before problems arise than to come up with ways to fix them.

To identify inadequacies in your organisation’s control measures, you should:

• consult with the workers that use the controls
• consult management that administers controls
• check the control measure itself if possible
• review incident reports evaluating existing control measures.

Priority for a review depends on the risk level. Higher risk level hazards must have their control measures reviewed more frequently than lower risk level hazards.

Reporting inadequacies in control measures

To obtain organised data about your existing risk controls, you must create a report. When making a report about your existing control measures, make sure to answer these questions:

• Are the control measures working effectively?
• Have existing control measures introduced new potential hazards and risks?
• Have all hazards been identified?
• Are members of the organisation following safety procedures?
• Have the training procedures and instruction provided to workers been effective?
• Are workers identifying and reporting health and safety risks and concerns?
• Have the frequency and severity of health incidents lessened over time?
• Has new legislation indicated that the current control measures are no longer the most effective?

Organisations will usually develop an internal reporting template that must subscribe to relevant WHS standards and requirements. Remember to consult with the appropriate individuals regarding your organisation’s template. The form below serves as an example reporting document that contains all relevant risk information, the control measures used to manage it, and how those control measures can be improved.

Details	Response
Name of Business:
Work area:
Form completed by:
Date form was completed:
Review
Scheduled review date:
Description of Risk: What is the harm that the hazard could cause? What is the level of risk?
Current control measure: What is the current control measure in place?
Inadequacies: What is the current control measure lacking?

Refer to both the hierarchy of control measures and WHS legislation when completing the report. You must repeat the form-filling process for every risk in your work area, prioritising the hazards with the highest risk level. When documenting observations, be as detailed as possible, factual and accurate, avoiding emotive language. Your report will be accessed by other workers in your workplace and your supervisors and WHS regulators when requested. 

After the inadequacies in a control measure have been identified, documented, and reported, the next step is to monitor the outcomes of reports to make sure that they are addressed as soon as possible. Prompt response from the organisation is necessary to prevent incidents from occurring as the longer a hazard remains unaddressed, the greater the risk of it causing harm. When determining the significance of a control measure inadequacy, the process is similar to assessing the significance of a hazard. If an inadequacy has a higher level of risk, it must be addressed first before those with lower levels. Two factors typically determine the urgency of response:

1. The likelihood that the inadequacy can cause harm
2. The severity of the harm caused by the inadequacy.

The more dangerous issues must be addressed first because they pose a more significant threat to workers. Inadequacies that are less severe and less likely to cause harm should still be managed but not before more hazardous ones.

Key points

• Hazards in the work area must be identified and reported per WHS policies and procedures.
• Hazard reports should be actioned promptly, following organisational procedures.
• Your organisation should have procedures to control risks using the hierarchy of controls to follow organisational requirements.
• If you find any inadequacies in existing risk control measures, these should be reported in accordance with the hierarchy of controls.
• The outcomes of reported inadequacies should be monitored to ensure a prompt organisational response.

The final activity for this topic is a set of questions that will help you prepare for your formal assessment.