Ask a small business owner whether they’ve done a risk assessment and you’ll often get a pause. Some think it means a 40-page report. Others think the safety data sheet or the induction covers it. Neither is right, and the gap between the two is where most WHS problems start.
A risk assessment is a structured way of answering four questions. What could go wrong? How badly could someone be hurt? How likely is it? And what are we going to do about it?
The way to do it is to break each task into its steps and put every step through those same four questions. A hazard often hides in one step, not in the task as a whole.
Step 1: Identify the hazards
A hazard is anything with the potential to cause harm. Walk the workplace, look at each task, and talk to the people who do the work. They know where the near misses happen. Check your incident and hazard reports too, because past events point to future ones.
Step 2: Assess the risk
For each hazard, consider how serious the harm could be and how likely it is to happen. A simple matrix of likelihood against consequence gives you a rating, such as low, medium, high or extreme. The point isn’t precision. It’s knowing what to fix first.
Step 3: Choose controls using the hierarchy of controls
Start at the top and work down. Eliminate the hazard if you can. If not, substitute something safer, isolate people from it, or use engineering controls. Administrative controls such as procedures and training come next, and PPE is the last line of defence, not the first. Relying on the bottom of the list alone is one of the most common mistakes in small business.
Step 4: Put the controls in place
Give each action an owner and a date. A control that nobody is responsible for isn’t a control.
Step 5: Review
Check that the controls work, and review the assessment when something changes: new equipment, a new process, a near miss, or an incident. Consultation with your workers is part of every step, not an extra.
What to keep on record The WHS laws don’t require a written record for every risk assessment, but some high-risk work does require one, and a written record is the best evidence of due diligence if a regulator, insurer or client ever asks. Check your own state or territory’s requirements through your regulator.
Common mistakes
Doing one assessment and never reviewing it Assessing the workplace but not the tasks Leaving workers out of the process Defaulting to PPE because it’s easy
A risk assessment doesn’t need to be complicated. It needs to be done, acted on and kept current.
SafeBase includes a risk register and risk assessment templates, so the process is the same every time. Our WHS Gap Audit looks at how risk is identified, rated and controlled across your workplace. For more WHS basics, start with our free WHS Guide at https://mxminstitute.com.au/whs-guide