The WHS legislation requires persons who conduct a business or undertaking (PCBUs) to manage all work health and safety risks, so that the health and safety of workers and other people are not affected by an organisation's conduct.
Explaining 'hazards' and 'risks'
Hazard: A hazard is a situation or thing that has the potential to harm a person.
Risk: A risk is the possibility that the harm (i.e. death, an injury or an illness) might occur when exposed to a hazard.
For example, a worker is using a petrol-operated pump in a confined space, such as a well. In this situation, carbon monoxide is a hazard. The associated risk is the likelihood that the worker might suffer carbon monoxide poisoning while working in the confined space because of the operating pump.
The four step process for managing risks
1. Identify hazards
Some hazards may be more obvious than others because they are common and well known in a particular industry. Others may be more difficult to identify. It is important to work closely with workers and look at every task in the workplace to help identify all potential hazards.
Workplace records on incidents, near misses, health monitoring and the results of inspections can also help identify hazards. If someone has been injured during a particular task, then a hazard exists that could hurt someone else. Workplace incidents need to be investigated to identify any hazards involved and to control the corresponding risks.
2. Assess the risk
A risk assessment can help determine:
- the severity of a risk
- whether any existing control measures are effective
- what actions should be taken to control the risk
- how urgently those actions should be completed.
A risk assessment is mandatory for certain high risk activities such as entry into confined spaces, diving work, live electrical work and high risk construction work.
In other situations, some hazards and their associated risks are well known and have well established and accepted control measures. In these situations, the second step of formally assessing the risk is not required. If after identifying the hazard, you already know the risk and how to control it effectively, you may simply implement the control.
However, a risk assessment should be done when:
- there is uncertainty about how the hazard may result in an injury or illness
- the work activity involves a number of different hazards and there is a lack of understanding about how the hazards may interact with each other to produce new or greater risks
- there are changes at the workplace that may impact on the effectiveness of control measure.
3. Control the risks
This is the most important step in managing risks – eliminating the identified hazard so far as is reasonably practicable, or if that is not possible, minimising risks as far as reasonably practicable.
The ways of controlling risks can be ranked from the highest level of protection and reliability to the lowest. This is called the hierarchy of control.
The WHS legislation requires the PCBU to work through the hierarchy of control when managing risks. This means the PCBU must always aim to eliminate the hazard, which is the most effective control.
If elimination is not reasonably practicable, the PCBU must minimise the risk so far as is reasonably practicable by doing one or more of the following:
- substituting (wholly or partly) the hazard creating the risk with something that creates a lesser risk
- isolating the hazard from any person exposed to it
- implementing engineering controls.
If a risk still remains, that remaining risk must be further minimised, so far as is reasonably practicable, by implementing administrative controls or through the use of personal protective equipment (PPE).
Administrative controls are work methods or procedures that are designed to minimise exposure to a hazard (e.g. the use of signs to warn people of a hazard). Examples of PPE include ear muffs, respirators, face masks and protective eyewear. It is important to remember that PPE limits exposure to the harmful effects of a hazard, but only if it is worn and used correctly.
Administrative controls and PPE should only be used:
- when there is no other practical control measure available (as a last resort)
- as an interim measure until a more effective way of controlling the risk can be used
- to supplement higher level control measures (as a back up).
4. Reviewing risk controls
Controlling health and safety risks is an ongoing process that needs to take into account any changes which occur at the workplace. This is why procedures and risk controls must be reviewed regularly to ensure they are still effective.
The WHS Regulation requires a review of control measures in certain situations. A review, and if necessary, a revision is required:
- when the control measure does not control the risk it was implemented to control
- before a change at the workplace which is likely to give rise to a new or different health and safety risk that the control measure may not effectively control
- if a new hazard or risk is identified
- if the results of consultation indicate that a review is necessary
- if a health and safety representative requests a review and they reasonably believe that a circumstance referred to above affects or may affect the health and safety of a member of the work group they represent.
If problems are found, go back through the risk management steps, review the relevant information and make further decisions about risk control.
Control measures for serious risks should be reviewed more frequently.
Note: The information provided by this page should be read together with the How to Manage Work Health and Safety Risks Code of Practice 2011 (PDF, 1048.03 KB) . This code provides detailed information and practical examples.
- Last updated
- 30 April 2018