ISO 45001 Risk Assessment: Beyond Traditional HIRA — A South African Methodology Guide

ISO 45001 Risk Assessment: What's Different?

ISO 45001 Clause 6.1 expands risk thinking in three ways:

1. OH&S risks — traditional hazard and risk assessment
2. Other risks to the management system — risks that could undermine the OH&S MS
3. OH&S opportunities — opportunities to improve safety performance

Tier 1: OH&S Risks (Enhanced HIRA)

Hazard identification must consider:

• How work is organised (workload, hours, culture)
• Routine and non-routine activities
• Past incidents (internal and external)
• Emergency situations
• People (visitors, contractors, vulnerable workers)
• Changes (equipment, processes, legislation)
• Human factors

Tier 2: Management System Risks

Risks that could prevent your OH&S MS from achieving its outcomes:

• Resource risk — budget cuts reducing safety funding
• Competency risk — key safety personnel leaving
• Change risk — restructuring disrupting safety systems
• Compliance risk — legislative changes not identified
• Cultural risk — merger bringing different safety cultures

Tier 3: OH&S Opportunities

• Adapting work to workers (ergonomics)
• Eliminating hazards through technology
• Improving worker participation
• Benchmarking against industry leaders
• Implementing new monitoring technology

Hierarchy of Controls

ISO 45001 explicitly requires this order:

1. Elimination — remove the hazard
2. Substitution — replace with less hazardous
3. Engineering controls — isolate people from hazard
4. Administrative controls — change how work is done
5. PPE — protect the worker

Auditors check that you've considered higher-level controls before defaulting to PPE.

South African Legislative Integration

Your risk assessment must integrate:

• OHS Act Section 8 — identify hazards, assess risks, implement controls
• Hazardous Chemical Substances Regulations — exposure assessment, OELs
• Construction Regulations 2014 — fall protection, excavation safety
• Driven Machinery Regulations — machinery guarding

Risk Assessment for Change Management

Clause 8.1.3 requires:

• Assessment before change implementation
• Both planned and unplanned changes covered
• Affected workers informed and consulted
• Post-implementation verification

Practical Template Headers

Risk Assessment Register:

1. Work area/activity
2. Hazard description
3. Who is affected
4. Existing controls
5. Risk rating before controls
6. Additional controls (hierarchy level)
7. Residual risk rating
8. Responsible person
9. Due date / Review date

Training for Effective Risk Assessment

• HIRA Training — practical hazard identification
• NEBOSH IGC — comprehensive risk assessment (GIC1 & GIC2)
• NEBOSH International Diploma — advanced risk management
• ISO 45001 Lead Implementer — integrating risk into the system

Develop your risk assessment capability or view courses.