Identifying hazards and assessing risks for ISO 45001
Identifying hazards and assessing risks is the heart of ISO 45001 . The Netherlands Labour Authority (Nederlandse Arbeidsinspectie) supervises compliance with the Dutch Working Conditions Act (Arbowet) . Without a good understanding of what could go wrong, you cannot take effective measures. On this page, we explain how to approach this systematically.
The difference between hazards and risks
These terms are often used interchangeably, but they mean different things.
A hazard is a source, situation or action that could potentially lead to injury or ill health. It is the cause. A machine with moving parts is a hazard. A wet floor is a hazard. Work pressure is a hazard.
A risk is the combination of the likelihood that a hazard leads to harm and the severity of that harm. It is the estimate. How likely is it that someone gets caught in the machine? And what would the consequences be?
By identifying hazards, you understand what could go wrong. By assessing risks, you decide where to set priorities.
Step 1: Map your activities for ISO 45001
Start with an overview of all activities in your organisation. Think broadly, not only about core tasks but also about supporting work.
For a manufacturing company, this includes receiving and storing materials, operating machines, assembly and packaging, internal transport with forklift trucks, maintenance and cleaning, and office work.
Do not forget non-routine activities. What happens during breakdowns? During maintenance shutdowns? During emergencies? These situations often bring different hazards than everyday work.
Step 2: Identify the hazards
For each activity, ask: what could go wrong here? Which sources of injury or ill health are present?
Categories of hazards
The standard names several categories that you need to consider.
Physical hazards are the most visible. Think of machines with moving parts, work at height, electrical installations, noise and vibration, extreme temperatures, and the risk of tripping and falling.
Chemical hazards arise from exposure to substances. These can be hazardous substances such as solvents and acids, but also dust, fumes and gases. Check the safety data sheets of the substances you use.
Biological hazards are relevant in specific sectors. Think of pathogens in healthcare, moulds when there are moisture problems, or the risk of infection in waste processing.
Ergonomic hazards concern the strain on the body. Lifting, pushing and pulling, standing or sitting for long periods, screen work, and repetitive movements can lead to musculoskeletal complaints.
Psychosocial hazards are often forgotten but are just as real. Work pressure, aggression and violence, bullying, unwanted behaviour, and a lack of autonomy can lead to stress and burnout. Read more about psychosocial risks and work pressure under ISO 45001, including what the standard and the Dutch Working Conditions Act require and which measures work.
ISO 45001 explicitly requires you to include psychosocial risks. This is broader than many traditional safety approaches, which focus mainly on physical hazards.
Sources for identification
You can identify hazards in several ways. Walk around the workplace and observe. Talk to employees, as they know the risks of their work best. Analyse past incidents and near misses. Look at sector information and sector guidelines (arbocatalogi). Consult supplier information and manuals.
Worker participation is crucial here. The people who do the work know where the problem spots are. Involve them actively in the identification.
Step 3: Assess the risks
Not all hazards are equally urgent. For each hazard, you assess how large the risk is so that you can set priorities.
Risk matrix
A common method is the risk matrix. You score each hazard for likelihood and severity, and multiply these scores.
Likelihood: how often could this go wrong?
- 1 = Very unlikely (less than once every 10 years)
- 2 = Unlikely (once every 1-10 years)
- 3 = Possible (once a year)
- 4 = Likely (monthly)
- 5 = Very likely (weekly or more often)
Severity: what are the consequences if it goes wrong?
- 1 = Negligible (no injury or slight discomfort)
- 2 = Minor (first aid injury, short absence)
- 3 = Moderate (medical treatment needed, weeks of absence)
- 4 = Serious (permanent injury, months of absence)
- 5 = Very serious (death or permanent disability)
Risk score = likelihood × severity
| Score | Risk level | Action |
|---|---|---|
| 1-4 | Low | Acceptable, but monitor |
| 5-9 | Medium | Plan measures |
| 10-14 | High | Measures in the short term |
| 15-25 | Very high | Immediate action required |
Example risk assessment
| Hazard | L | S | Score | Level |
|---|---|---|---|---|
| Working at height without fall protection | 3 | 5 | 15 | Very high |
| Crushing by a machine | 2 | 4 | 8 | Medium |
| Slipping on a wet floor | 4 | 2 | 8 | Medium |
| Screen work without breaks | 4 | 2 | 8 | Medium |
| High work pressure | 3 | 3 | 9 | Medium |
Step 4: Determine control measures
For risks that are not acceptable, you determine measures. ISO 45001 prescribes a hierarchy of control measures. You start at the top and only move down when higher levels are not feasible.
The hierarchy of control measures
1. Elimination. Remove the hazard completely. Scrap a dangerous machine. Stop using a hazardous substance. This is the most effective measure.
2. Substitution. Replace with something less dangerous. Use a less toxic substance. Replace manual lifting with a lifting device.
3. Technical measures. Isolate people from the hazard. Fit guards around machines. Install extraction. Add handrails to stairs.
4. Administrative measures. Change how the work is done. Rotate tasks to prevent one-sided strain. Limit the duration of exposure. Provide training and instructions.
5. Personal protective equipment (PPE). Protect the individual worker. Safety goggles, hearing protection, safety shoes. This is the last line of defence, not the first.
A common mistake is to go straight to PPE. PPE is the least effective measure and should only be used when higher measures are not possible or not sufficient.
Step 5: Document in a register
You record the hazards, risks and measures in a register. For each hazard, this register contains the description, the location or activity where it occurs, the risk assessment with scores, the control measures taken, and the residual risks after measures.
The register is not a static document. You update it when something changes: new machines, different work processes, incidents that give new insight.
Examples of hazards per workplace
Production hall
Typical hazards in a production environment are crushing and cutting injuries from machines, collisions with internal transport, exposure to noise from loud processes, physical strain from lifting and carrying, and exposure to substances during welding or gluing.
The focus is on machine guarding, separation of traffic, hearing protection and ergonomic aids.
Office
An office also has hazards, although they are less visible. Screen work can lead to RSI and eye complaints. Long periods of sitting lead to back complaints. Work pressure and a lack of autonomy can cause stress. Tripping over cables or loose items also occurs.
The focus is on ergonomic workstations, sufficient breaks and attention to psychosocial workload.
Construction site
On a construction site, the risks are varied and changeable. Falls from height are among the biggest risks. In addition, there are hazards from falling objects, excavation work, power tools, weather and climate, and traffic from machines and vehicles.
The focus is on fall protection, helmets, coordination between parties and good instructions.
Identifying opportunities under ISO 45001
ISO 45001 requires not only risks but also opportunities. Opportunities are possibilities to improve occupational health and safety.
Examples of opportunities are new technology that can automate dangerous work, redesigning the workplace to reduce risks, better communication about safety, and cooperation with other organisations to learn from each other.
By actively looking for opportunities, you go beyond only controlling risks. You work on real improvement.
Periodic review of hazards and risks
Identifying hazards and assessing risks is not a one-off exercise. You review it periodically, for example every year, and after specific events.
Review after incidents or near misses, when processes or machines change, with new work activities or locations, when legislation changes, and when employees report new risks.
The standard asks for an up-to-date overview. Plan periodic reviews and respond to changes.
The relationship between ISO 45001 and the RI&E
Identifying hazards and assessing risks for ISO 45001 is similar to the legally required RI&E (risk inventory and evaluation). There is a lot of overlap, but ISO 45001 goes further on some points.
You can use your existing RI&E as a basis for ISO 45001. Make sure you follow the method of the standard and that employees are actively involved in the process.
Next step
Read more about worker participation in identifying hazards, see how to prepare for emergencies as a specific category within the hazard inventory, or go back to the requirements of the standard.