ISO 45001 Hazard Identification and Risk Assessment

A workplace can look controlled and still contain risks that have never been properly examined. Maintenance work performed once every six months, contractor activities, fatigue during long shifts, chemical exposure, vehicle movements and an apparently minor process change can all create hazards that routine safety checks fail to capture.

That is why ISO 45001 hazard identification and risk assessment is not intended to be a one-time checklist. ISO 45001 requires organisations to use an ongoing, proactive process to identify hazards, assess occupational health and safety risks and determine how those risks will be eliminated or reduced. For organisations in Oman, that process should also reflect applicable national occupational safety requirements and the real conditions in which employees and contractors work.

What Is Hazard Identification and Risk Assessment Under ISO 45001?

Hazard identification finds sources and situations that can cause injury or ill health, while risk assessment determines how significant the resulting occupational health and safety risk is. The two processes are connected, but they are not the same.

ISO 45001:2018 addresses this primarily under Clause 6.1.2. The standard requires hazard identification to be ongoing and proactive and requires organisations to assess OH&S risks arising from those identified hazards. The outcome then feeds into operational controls, objectives, emergency planning and continual improvement.

What Is the Difference Between a Hazard and a Risk?

A hazard is the source or situation with the potential to cause harm; risk considers the likelihood and potential severity of that harm occurring. Confusing the two often leads to weak risk registers.

For example, an exposed rotating part on a machine is the hazard. The risk depends on matters such as how often employees are exposed to it, whether guarding exists, the work being performed and how serious an injury could be.

Which ISO 45001 Clause Covers Hazard Identification?

Clause 6.1.2 covers hazard identification and assessment of OH&S risks and opportunities, with Clause 6.1.2.1 focusing specifically on hazard identification. It is one of the most important planning requirements within an ISO 45001 management system.

The standard expects the process to consider more than normal day-to-day operations. Work organisation, social factors, routine and non-routine activities, previous incidents, emergency situations, people with access to the workplace, workplace design, external situations and organisational changes can all be relevant.

What Hazards Should an ISO 45001 Assessment Cover?

A good hazard assessment considers every credible source of work-related injury or ill health, rather than limiting the review to visible physical dangers. The hazard categories will vary considerably between an office, construction site, factory, warehouse and oil and gas operation.

• Physical hazards: Noise, vibration, temperature extremes, poor lighting, radiation and slips or falls
• Mechanical hazards: Moving machinery, rotating equipment, crushing points, stored energy and equipment failure
• Electrical hazards: Exposed conductors, damaged equipment, temporary electrical systems and inadequate isolation
• Chemical hazards: Solvents, fuels, cleaning chemicals, gases, fumes, dust and hazardous substances
• Biological hazards: Bacteria, viruses, contaminated waste, biological materials and exposure through specific work processes
• Ergonomic hazards: Manual handling, repetitive movements, poor workstation design, awkward postures and excessive physical strain
• Psychosocial hazards: Excessive workload, fatigue, long working hours, harassment, workplace violence and organisational stress
• Fire and explosion hazards: Flammable materials, ignition sources, combustible dust, gas leaks and hot work
• Vehicle and transport hazards: Forklifts, mobile plant, reversing vehicles, delivery traffic and pedestrian interaction
• Environmental conditions: Heat exposure, outdoor work, storms, dust and other local conditions that affect worker safety

Why Routine and Non-Routine Work Must Both Be Assessed

ISO 45001 requires organisations to look beyond normal operations because serious incidents frequently arise during work that is unusual, temporary or performed under changed conditions. A risk assessment based only on normal production can leave significant gaps.

Routine work may include standard machine operation, warehouse movements or normal office activities. Non-routine work can include shutdowns, cleaning inside equipment, maintenance, commissioning, equipment modification or emergency repairs.

Routine Activities

Routine tasks are performed regularly and are usually easier to observe, but familiarity can cause hazards to become normalised. Assessments should examine how employees actually complete the task rather than relying only on written procedures.

Controls should also be checked for effectiveness. A guard, procedure or PPE requirement that exists on paper but is bypassed during normal work should not be treated as an effective control.

Non-Routine Activities

Non-routine activities often involve unusual access, different personnel, temporary arrangements or equipment isolation. Workers may also have less experience with the particular task.

These activities require specific attention because the normal controls designed around everyday operations may not adequately address shutdown, maintenance or exceptional working conditions.

Does ISO 45001 Require Worker Participation in Hazard Identification?

Yes. Worker consultation and participation are central to ISO 45001, and non-managerial workers should be involved in identifying hazards and assessing risks and opportunities. Employees doing the work often understand exposure points that are not visible from procedures or management reviews.

Worker involvement can reveal shortcuts, difficult operating conditions, equipment issues, fatigue, near misses and practical problems with existing controls. It also helps test whether a proposed safety measure can realistically be followed during normal operations.

How to Carry Out an ISO 45001 Hazard Identification and Risk Assessment

A useful HIRA process moves systematically from understanding the activity to identifying hazards, evaluating risk, selecting controls and confirming whether the remaining risk is acceptable. The assessment method can be simple or detailed depending on the organisation’s risk profile.

• Define the activity: Break the operation into understandable tasks, locations, people and operating conditions
• Identify who may be affected: Consider employees, contractors, visitors, temporary workers and others exposed to the activity
• Identify hazards: Examine what can cause injury or ill health during both routine and non-routine conditions
• Review existing controls: Record measures already in place and determine whether they are actually effective
• Evaluate risk: Assess likelihood and consequence using a consistent methodology appropriate to the organisation
• Prioritise significant risks: Identify risks requiring immediate or higher-level action rather than treating every entry equally
• Select additional controls: Apply stronger preventive measures where the existing risk level is unacceptable
• Assign responsibility: Identify who will implement each required action and establish a realistic completion date
• Reassess residual risk: Evaluate the risk that remains after additional controls are implemented
• Review the assessment: Update the HIRA when conditions change, incidents occur or new information becomes available

Does ISO 45001 Require a Specific Risk Matrix?

No. ISO 45001 requires risks to be assessed systematically, but it does not prescribe one mandatory numerical risk matrix or scoring formula. Organisations can select a method appropriate to their size, activities and risk complexity.

A conventional likelihood-by-severity matrix can work well for many workplaces, but the scoring method should support sound decisions rather than create false precision. A risk rated “9” is not automatically well controlled simply because the organisation has assigned it a colour.

What Should a Risk Matrix Consider?

A risk matrix normally compares how likely a hazardous event or exposure is with the potential severity of the resulting injury or ill health. Additional factors can be built into the method where necessary.

What Is the Hierarchy of Controls in ISO 45001?

ISO 45001 expects hazards to be eliminated where possible and OH&S risks to be reduced using a hierarchy that gives preference to stronger controls over reliance on worker behaviour or PPE. This principle is addressed in Clause 8.1.2.

• Elimination: Remove the hazard completely
• Substitution: Replace the hazard with a less dangerous process, material or method
• Engineering controls: Isolate people from the hazard through design, guarding, ventilation or physical protection
• Administrative controls: Reduce exposure through procedures, permits, supervision, training or scheduling
• Personal protective equipment: Use suitable PPE to protect workers from remaining exposure

Why PPE Should Not Be the First Control

PPE is important, but it normally sits at the lower end of the hierarchy because the hazard remains present and protection depends heavily on correct selection and worker use.

For example, replacing a harmful chemical with a safer alternative addresses risk more reliably than simply requiring gloves and respirators while continuing to use the original substance. The same principle applies to engineering out a fall exposure instead of relying only on worker instructions.

What Is Residual Risk?

Residual risk is the level of risk that remains after controls have been applied. Assessing it helps determine whether further action is required or whether the remaining risk can be managed through established controls.

A common weakness is reducing the risk score on paper immediately after proposing an action. Residual risk should reflect controls that are actually implemented and effective, not controls that are still waiting for approval, purchase or installation.

When Should a Hazard Identification and Risk Assessment Be Reviewed?

A HIRA should be reviewed whenever the information on which it was based may no longer reflect actual working conditions. ISO 45001 treats hazard identification as an ongoing process, not an annual document update.

• After an incident or near miss: New information may show that a hazard or control was misunderstood
• Before a significant change: New equipment, processes, substances or organisational arrangements can introduce different risks
• When the workplace changes: Layout changes, new work areas or altered traffic routes can change exposure
• When legislation changes: New legal obligations can affect controls or assessment criteria
• When new hazard information appears: Manufacturer information, occupational-health evidence or industry learning may change the assessment
• When controls fail: Inspection, monitoring or audit findings may show that existing controls are ineffective
• When workers identify new hazards: Worker observations should trigger appropriate investigation and reassessment

How Does Management of Change Affect Risk Assessment?

Planned changes should be assessed before implementation because a seemingly positive change can create new occupational health and safety risks. ISO 45001 specifically links changes in organisation, operations, processes and activities with its risk-based planning requirements.

Replacing machinery, changing shift arrangements, introducing new chemicals or outsourcing a process can change both hazards and worker exposure. Risk assessment should therefore form part of change approval rather than being completed after the new arrangement is already operating.

What Are the Oman Requirements for Workplace Risk Control?

Omani occupational safety rules require employers to take measures to ensure that workplace materials, factors and conditions do not create hazards to workers’ health. Ministerial Decision 286/2008 remains an important part of the national occupational safety framework referenced in current OSH practice.

ILO’s summary of the Omani rules also notes requirements for OSH programmes in establishments with 10 or more workers and for a qualified OSH supervisor in establishments employing 50 or more workers, with duties that include workplace inspections, hazard-related assessment and preventive measures.

How Does ISO 45001 Support Oman Legal Compliance?

ISO 45001 does not replace Omani occupational safety law; it provides a management-system framework for identifying applicable obligations and incorporating them into workplace controls.

An ISO 45001 risk assessment should therefore not be built solely from generic international hazard lists. Legal requirements, sector rules, client requirements and actual conditions in the Omani workplace need to be considered together.

What Should an ISO 45001 Risk Register Contain?

A risk register should provide enough information to understand the activity, identified hazard, affected people, current risk level, controls and required action without becoming unnecessarily complicated.

A practical register usually records the activity, hazard, possible consequence, people exposed, existing controls, initial risk level, required additional measures, responsible person, target date and residual risk after controls have been implemented.

Common ISO 45001 HIRA Mistakes

Weak HIRA systems usually fail because the assessment becomes a documentation exercise rather than an accurate picture of how work is carried out. A technically complete-looking register can still fail to control real risk.

• Using generic hazards: Copying standard hazard lists without examining the actual workplace
• Ignoring non-routine work: Assessing normal production but missing shutdowns, maintenance and abnormal operations
• Leaving workers out: Completing assessments only through managers or HSE personnel
• Treating PPE as the main answer: Selecting personal protection without considering stronger controls
• Assessing proposed controls as completed: Reducing risk scores before corrective actions are actually implemented
• Missing contractors: Failing to assess contractor and multi-employer workplace interactions
• Ignoring health hazards: Focusing on accidents while overlooking noise, chemicals, ergonomics, stress and long-term exposure
• Using one assessment indefinitely: Failing to review hazards after incidents, changes or new information
• Overcomplicating scoring: Creating detailed mathematical scores that do not improve decision-making
• Failing to verify controls: Recording safeguards without checking whether they continue to work in practice

What Evidence Can an ISO 45001 Auditor Check?

An auditor is likely to look for evidence that hazard identification is systematic, current and connected to operational controls rather than simply checking whether a risk register exists.

• Current HIRA records: Assessments should correspond with actual work and current activities
• Worker involvement: Interviews and records should demonstrate meaningful consultation and participation
• Change assessments: New processes, equipment and activities should show evidence of pre-change risk review
• Control implementation: Actions listed in assessments should be visible and functioning at the workplace
• Incident learning: Risk assessments should reflect relevant findings from incidents and near misses
• Legal requirements: Applicable Omani occupational safety obligations should be reflected in the management system
• Review records: Assessments should show evidence of review where work or hazard information has changed

Final Takeaway

Effective ISO 45001 hazard identification and risk assessment is not about producing the longest possible risk register. It is about understanding how people can actually be harmed, deciding which risks require priority action and ensuring that controls remain effective as operations change.

For organisations reviewing ISO 45001 implementation and occupational health and safety requirements in Oman, ISO Consultancy Oman can be used as an additional reference alongside the current ISO 45001 standard, applicable Omani occupational safety requirements and guidance from the relevant authorities.

Frequently Asked Questions About ISO 45001 Hazard Identification and Risk Assessment

Is HIRA Mandatory for ISO 45001 Certification?

Yes. Hazard identification and assessment of OH&S risks are core requirements of ISO 45001:2018, particularly under Clause 6.1.2. An organisation seeking conformity cannot rely only on general safety procedures without demonstrating a systematic process for identifying hazards and assessing the risks they create.

How Often Should an ISO 45001 Risk Assessment Be Updated?

ISO 45001 does not prescribe one universal annual frequency for every risk assessment. Reviews should be driven by changes, incidents, new hazard information, control failures and other circumstances that could make the existing assessment inaccurate, while organisations may also set scheduled periodic reviews.

Does ISO 45001 Require a 5×5 Risk Matrix?

No. ISO 45001 does not require a 5×5 matrix or any other specific scoring model. The organisation needs a defined and systematic method that accurately evaluates OH&S risks and supports prioritisation and control decisions appropriate to its workplace.

Should Contractors Be Included in ISO 45001 Risk Assessments?

Yes, where contractors can be affected by the organisation’s activities or can introduce hazards into the workplace. Contractor interfaces are especially important in construction, maintenance, industrial shutdowns and multi-employer sites, where one party’s activity can create risk for another.

What Is the Biggest Difference Between Hazard Identification and Risk Assessment?

Hazard identification asks what can cause injury or ill health, while risk assessment asks how significant the resulting risk is under the actual conditions of exposure and control. Keeping these stages separate makes it easier to identify the right preventive measures and to demonstrate a logical ISO 45001 risk-management process.