CHAPTER 4: HAZARD IDENTIFICATION, RISK ASSESSMENT AND DETERMINATION OF CONTROLS (CLAUSE 4.3.1)
Summary of requirements
Clause 4.3.1 of OHSAS 18001 requires the proactive assessment of hazards, risks and controls. This requirement is, therefore, central to the establishment of a sound OH&S system.
- An organisation is required to establish, and implement, procedures for ongoing hazard identification, risk assessment and determination of controls.
- Hazard identification must include infrastructure, equipment, human behaviours, capabilities, and routine and non-routine activities of all personnel.
- The risk assessment must consider applicable legal obligations and determine the risks that may be considered unacceptable to the organisation.
- The organisation must also determine controls to eliminate, substitute, or reduce the risks that have been assessed as intolerable.
- The identified OH&S hazards, risks and controls must be recorded, and taken into account while establishing an OH&S management system.
How can these requirements be met by an organisation?
1 Begin by establishing a cross-functional OH&S hazard identification and risk assessment team. The team members must be familiar with occupational health and safety issues, organisational processes, hazardous materials and conditions, applicable OH&S laws, human behaviour, human factors, types of OH&S hazards, risk assessment techniques and hierarchy of controls.
2 Document a procedure that defines the complete initial and ongoing process for identification of hazards, assessment of risks and determination of controls. A sample procedure can be found in Appendix A.
3 Make an inventory of all locations of the organisation, in such a manner that no department or area is missed out.
4 The cross-functional team visits each location and identifies both existing and potential hazards relating to a situation, source, activity or event that could potentially cause injury or ill health.
Hazardous situations are those conditions that are typical to a location and may cause injury or ill health. These could be slippery or uneven walking surfaces, slopes, cramped working conditions, sharp bends, blind corners, badly ventilated areas, high altitudes, extreme temperatures, high traffic zones, noisy locations, poorly lit areas or confined spaces.
Hazardous sources may be any equipment, or substances, that can cause injury or ill health. Some examples are production machines, generators, boilers, sources of fumes, corrosive and toxic chemicals, dangerous gases and liquids, flammable and explosive materials, high-pressure vessels, radioactive substances, particulates, poisons, bacteria and viruses.
The activity (routine or non-routine) -related OH&S hazards are those hazards that are faced by a person while performing a specific task. An operator working on a machine, welding a piece of metal, climbing on a height, lifting weight, handling or transferring materials, mixing chemicals, performing repetitive tasks and driving a vehicle, are some examples of activities that may offer one or more types of hazards.
Hazardous events, sometimes also referred to as emergency situations, are those events that may occur as a result of a failure, or absence of a control, and may cause injury or ill health. Some examples of such potentially hazardous events include explosions, implosions, fire, collisions, poisonous gas leaks, collapse of structures, road or aircraft accidents, and uncontrolled chemical reactions.
5 Hazard identification can be made easier by asking questions, such as:
Can a body part get caught in, or between, the objects?
Do tools, machines or equipment present any hazards?
Could the way an operator acts or behaves be a source of hazard?
Can the worker make harmful contact with moving objects?
Can the worker slip, trip or fall?
Can the worker suffer strain from lifting, pushing or pulling?
Is the worker exposed to extreme heat or cold?
Is there a possibility of electrical shock or electrocution?
Is the worker exposed to excessive noise or vibration?
Is there a danger from falling objects?
Can weather conditions affect safety?
Is harmful radiation a possibility?
Can contact be made with hot, toxic or caustic substances?
Are there dusts, fumes, mists or vapours in the air?
A list of potential occupational health and safety hazards can be found in Appendix C.
6 Once the hazards have been identified, the next step is to determine the ‘risk’ value for each identified hazard. Risk rating (R) is essentially a function of ‘Likelihood’ of occurrence (L), extent of ‘Exposure’ (E) and ‘Severity’ of outcome (S). All three factors collectively represent the ‘risk’ magnitude. Often organisations consider only ‘Likelihood’ and ‘Severity’ for estimating the risk value. In such cases the ‘Exposure’ factor must be included in the estimation of ‘Likelihood’. Considering the ‘Likelihood’ of occurrence of an event and the ‘Severity’ of harm that may be caused as a result of the occurrence, the Risk (R) may be calculated by using the simple formula R = L x S. In order to achieve consistency in risk assessment, it is necessary to define a scale for various levels of likelihood and severity. (See sample procedure in Appendix A.)
Depending upon the activity and the nature of hazards and risks, an organisation may choose one of the many risk assessment techniques, such as Task Hazard Analysis (THA), Process Hazard Analysis (PHA), Hazard and Operability Study (HAZOP), What-if study, Failure Modes and Effects Analysis (FMEA), etc.
7 Risks can be better understood and managed if we consider all three stages of risk reduction, i.e. base risk, existing risk and final risk.
Base risk is the inherent risk of a source, situation or activity if there were no controls applied, or if the existing controls were to fail, decay or disappear for any reason (one typical reason could be an absence of a monitoring and inspection system). Hazards having a high base risk must be given due weightage while establishing and implementing an OH&S system, as their ‘controls’ are required to be constantly monitored and maintained.
The existing risk is the risk rating of a specific hazard at the time of carrying out the risk assessment, and takes into account all available and actively implemented controls. It is necessary for an organisation to assess if an existing risk must be tolerated, or whether additional measures should be taken to further minimise the risk. This would depend upon many factors, such as the level of an organisation’s commitment towards prevention of injury and ill health, regulatory requirements, and the views of the interested parties. While organisations must attempt to reduce any risk to ‘As Low As Reasonably Possible’ (ALARP) level, those which are above the ‘tolerable level’ (defined by the organisation) must be addressed without undue delay.
8 If the existing risk is beyond the tolerable level, it would become necessary to apply additional control measures to reduce the risk to an acceptable level. The recommended strategy for selection of additional controls is to begin with measures that would completely eliminate the hazard. If high noise is identified as a hazard, the first option should be to get rid of the source of the noise, rather than going for the ear plugs. There would be no need for further actions, if one could simply get rid of the source of the hazard.
The next best control is to substitute the hazardous substance or activity with a less hazardous one. Replacing a hazardous chemical with a less dangerous one; replacing oil-based paints with water-based paints; or replacing 40kg bags with lighter ones to reduce back and shoulder injuries, would be some examples of ‘control’ through substitution.
The next option should be to consider engineering controls. These are measures, such as electrical cut-out switches, pressure relief valves, barriers, machine guards, exhaust fans for ventilation, alarms, jammers, safety trips, interlocks, etc.
Next in the order of reliability are the administrative controls, such as establishing policies, procedures, labels, warning signs or training. These are designed to inform, or educate, workers of potential hazards, as well as to give instructions on dos and don’ts. Job rotation to reduce workers’ exposure to a risk also falls in this category.
Personal protective equipment (PPE) is normally the last option. These are also the precautions that ought to be taken over and above the first four types of controls. PPE does not prevent an accident from happening, but could diminish the impact or severity in case it does happen. Hard hats, ear plugs, masks, safety shoes, gloves, aprons and safety belts are some of the more commonly used PPE.
9 Once the additional controls have been determined and implemented, the resultant risk (final risk) must be assessed, to confirm if the risk has actually been reduced to an acceptable level.
10 The risk assessment must be documented in a manner that describes the hazards identified, the risks assessed and the controls determined. Appendix B describes one such format for a hazard and risk register. The hazard and risk inventory is required to be kept constantly updated, as new hazards are identified. Establishing a simple hazard reporting system and encouraging employees to report hazards can be a very powerful tool to identify hazards on an ongoing basis.
11 The hazards, risks and controls thus determined must be taken into consideration while establishing and implementing an OH&S management system. Hazards, risks and controls provide key inputs into processes, such as objective setting, training needs analysis, measurement and monitoring, roles and responsibilities, audits, emergency planning, communication and consultation, operational controls and management reviews.
12 The process of hazard identification, risk assessment and determination of controls must also be applied prior to changes in existing equipment, installations, processes or procedures. The new designs, operations or equipment, must also undergo a risk assessment process during the early stages of design and installation. These activities must be covered by a documented procedure, often termed as MOC or a ‘Management of Change’ procedure.