Hazard Identification and Risk Assessment in ISO 45001

A forklift moving through an aisle shared with pedestrians, an operator handling a chemical without knowing its safety data sheet, an external contractor unaware of site rules: in each of these situations, a hazard exists and a risk is created. Knowing how to distinguish them, identify them systematically and decide on the measures to take is exactly what clause 6.1.2 of ISO 45001:2018 requires. Hazard identification and risk assessment, commonly referred to as HIRA, is the beating heart of any occupational health and safety management system. This article details the logic, the method and the pitfalls to avoid.

Hazard and risk: two notions never to confuse

The first requirement, often the most poorly mastered in the field, lies in a distinction of vocabulary. A hazard is a source, situation or act with a potential for harm in terms of injury or ill health. A hazard is an intrinsic property: electricity is hazardous, height is hazardous, a solvent is hazardous, in itself and independently of any exposure.

Risk, on the other hand, is the combination of the likelihood of a hazardous event occurring and the severity of the injury or ill health that can result from it. Risk arises from the encounter between a hazard and an exposure. A gas cylinder stored correctly, ventilated, kept away from any heat source, still presents the same hazard but a low risk. The same cylinder near a welding station presents a high risk. The whole HIRA approach consists of acting on risk, since the hazard itself can rarely be removed by simple decision.

This clarification is not theoretical: it determines the quality of your analysis. A team that confuses the two lists consequences instead of sources, overlooks real hazards and overestimates or underestimates the controls in place. It fits into the overall logic of an OHS management system structured according to ISO 45001.

What clause 6.1.2 of ISO 45001 requires

Clause 6.1.2 requires the organization to establish, implement and maintain ongoing and proactive hazard identification processes. The word proactive is essential: the standard wants anticipation, not reaction after the accident. Sub-clause 6.1.2.1 specifies the elements that hazard identification must take into account, in particular:

• work organization, social factors, leadership and the culture of the organization;
• routine and non-routine activities and situations, including those related to infrastructure, equipment, materials and the physical conditions of the workplace;
• past incidents, internal or external, and their causes;
• potential emergency situations;
• people concerned: workers, contractors, visitors, as well as those located near the workplace;
• human factors: ergonomics, workload, behavior, capabilities and limitations of people;
• actual or proposed changes to the organization, processes, activities or the management system.

Sub-clause 6.1.2.2 then addresses the assessment of OHS risks and other risks related to the management system, while 6.1.2.3 introduces OHS opportunities, meaning the possibilities for improving safety performance. Finally, 6.1.2.4 connects all of this to determining the measures to implement. The structure is therefore: identify, assess, seize opportunities, decide on measures.

The standard does not impose any particular assessment method. It requires a documented, consistent and applied process, which leaves each organization free to choose its method provided it is robust and suited to its activities.

The HIRA method step by step

1. Break down activities and situations

Start by mapping the scope: workstations, processes, areas, tasks. For each one, routine operations (normal production) must be distinguished from non-routine ones (maintenance, cleaning, shutdowns, start-ups, one-off interventions), since it is often non-routine tasks that concentrate serious accidents. Start-up and shutdown phases, as well as degraded situations, must not be overlooked.

2. Identify the hazards

For each activity, hazards are identified: mechanical, electrical, chemical, physical (noise, vibration, heat), biological, related to handling and posture, psychosocial, related to traffic, heights and confined spaces. Field observation, incident analysis, safety data sheets and above all the input of workers feed this inventory. The consultation and participation of workers required under clause 5.4 is not a formality: it is the operators who know the gaps between prescribed work and actual work.

3. Assess and prioritize the risks

For each hazard-exposure pair, risk is assessed. The most common method combines potential severity and likelihood of occurrence, sometimes weighted by exposure frequency and the controls already in place. The product or combination of these criteria produces a risk level that allows prioritization: the highest risks are addressed first. What matters is not the sophistication of the grid, but the consistency of its application from one workstation to another and the traceability of the ratings.

4. Determine control measures

For each risk judged unacceptable, measures are defined according to the hierarchy of controls detailed below, then the residual risk is reassessed. The process ends with an action plan with owners and deadlines, and a periodic review. HIRA is never fixed: it is updated with every change, after every incident, and at a defined frequency.

The hierarchy of control measures

Clause 6.1.2.4 requires respecting an order of priority when choosing measures. This hierarchy of controls goes from most effective to least effective, and a mature system always favors the top of the ladder before moving down:

• Elimination: remove the hazard at the source. Design a process that no longer uses the hazardous product, automate an exposing task, remove an obsolete machine. This is the most effective measure because it makes the risk disappear.
• Substitution: replace the hazard with a less hazardous element. Substitute a harmful solvent with a water-based product, a noisy process with a quieter one.
• Engineering controls: isolate people from the hazard. Machine guards, enclosures, source extraction, guardrails, emergency stop devices, ventilation.
• Administrative controls: organize, inform, train. Instructions, work permits, traffic plans, job rotation, signage, procedures, training and awareness.
• Personal protective equipment (PPE): helmet, gloves, hearing protection, respiratory protection devices. They constitute the last barrier, never the first response, because they protect an individual without reducing the hazard and depend entirely on actual use.

The classic mistake is jumping straight to PPE because it is inexpensive and quick to deploy. The standard instead requires justifying why higher levels are not applicable before falling back on it. In practice, good control combines several levels: an engineering control backed by an instruction and PPE.

OHS opportunities, the other side of clause 6.1

Clause 6.1 is too often reduced to risks alone. Yet the standard also requires identifying opportunities for OHS: improving the ergonomics of a workstation, integrating safety from the design stage of a new workshop, adapting work organization to reduce fatigue, developing a safety culture. Seizing these opportunities means moving from a defensive logic to one of continual improvement of OHS performance. It is also what distinguishes a living system from a compliance binder.

The Moroccan regulatory framework

In Morocco, the HIRA approach fits within the obligations of the Labor Code (Law 65-99), whose Title IV is devoted to the health and safety of employees. The employer is required to preserve the health and safety of workers and to take the necessary preventive measures. For companies that reach the workforce threshold set by regulation, the Code notably provides for the establishment of a health and safety committee, a body where risk analysis and prevention are discussed, as well as recourse to occupational health services. The HIRA required by ISO 45001 provides a methodical framework to meet these legal obligations and to feed the work of the committee. Certification never exempts an organization from complying with regulations: it organizes compliance.

Common mistakes to avoid

• Confusing hazard and risk, and therefore listing consequences instead of hazard sources, which distorts the entire assessment.
• Overlooking non-routine tasks: maintenance, cleaning, contractor interventions, degraded situations, where many serious accidents occur.
• Neglecting human factors required by 6.1.2.1: ergonomics, mental workload, behavior, actual capabilities of people.
• Carrying out HIRA from a desk, without going out into the field or consulting the workers concerned.
• Stopping at PPE without first seeking elimination, substitution or engineering controls.
• Freezing the document: a HIRA that is not updated after a change, an incident or a new activity loses all value. It must connect with the incident investigation and corrective action process of clause 10.2, which feeds field lessons back into risk analysis.
• Rating without consistency: applying the grid differently depending on the assessor makes prioritization uninterpretable.

Done well, HIRA is not a documentation exercise but the engine of prevention: it guides investments, structures the action plan and feeds the safety culture. To check where you stand before a certification audit, HEMC provides an ISO 45001 audit preparation checklist that covers, clause by clause, the requirements to demonstrate, including those of 6.1.2. A good starting point to turn your risk analysis into a genuinely operational system.