Hazard Identification and Risk Assessment

Introduction

Hazard identification and risk assessment (HIRA) are foundational activities in employee health, safety, and sanitation. They provide the evidence base for deciding which hazards require immediate action, which controls are proportionate, and how limited organizational resources should be allocated. For HR managers, HIRA is not merely a technical exercise conducted by safety specialists. It is also a management process involving job design, staffing, training, procurement, facilities, employee participation, contractor governance, and organizational culture.

A hazard is a source, situation, or act with the potential to cause harm. Risk is the combination of the likelihood that harm will occur and the severity of that harm. These concepts must be distinguished. A chemical may be hazardous by its intrinsic properties, but the risk depends on concentration, exposure route, duration, controls, and the people exposed. Risk assessment therefore requires contextual judgment rather than simple hazard listing.

This chapter develops a systematic approach to identifying physical, chemical, biological, ergonomic, psychosocial, and operational hazards. It then explains qualitative, semi-quantitative, and quantitative assessment methods; uncertainty and human variability; the hierarchy of controls; and the managerial and ethical implications of prioritizing risk.

Learning Objectives

By the end of this chapter, readers should be able to:

1. Distinguish hazards, exposure, risk, incidents, and consequences.
2. Identify major categories of workplace hazards using multiple information sources.
3. Apply qualitative and quantitative risk-assessment methods appropriately.
4. Explain uncertainty, variability, and limitations in risk estimates.
5. Prioritize interventions using the hierarchy of controls and risk-based decision criteria.
6. Evaluate a workplace case and recommend controls, monitoring, and governance arrangements.

1. Conceptual Foundations

Hazard, exposure, risk, and harm

A hazard is a potential source of injury, illness, property damage, environmental damage, or disruption. Exposure occurs when a person, asset, or process comes into contact with the hazard. Harm is the resulting adverse outcome, such as dermatitis, hearing loss, infection, musculoskeletal injury, psychological injury, or production interruption.

Risk assessment asks four connected questions:

• What can cause harm?
• Who or what can be exposed?
• How severe could the outcome be, and how likely is it?
• What controls are required, and how effective are they likely to be?

Risk is not identical to probability. A low-probability event may still demand urgent action if the consequence is catastrophic. Conversely, a frequent event with minor consequences may require systematic improvement because repeated small harms can produce substantial cumulative loss.

Risk as a decision construct

In simple settings, risk is represented as:

Here, R is a risk score, L is a likelihood rating, and S is a severity rating. The expression is a decision aid, not a physical law. It assumes that the rating scales are defined consistently and that multiplication provides a useful ordering of priorities. A score does not represent a true probability unless the scales have been explicitly calibrated.

A more formal expected-loss model is:

where E(L) is expected loss per specified period, pᵢ is the probability of outcome i, and Cᵢ is the consequence or cost of that outcome. The probabilities must refer to the same time horizon, and consequences must be expressed in comparable units. Expected loss is useful for comparing alternatives but can conceal catastrophic low-probability outcomes and ethical concerns that should not be reduced to money.

Risk, uncertainty, and variability

Uncertainty concerns incomplete knowledge: for example, insufficient exposure measurements or uncertainty about the effectiveness of a control. Variability concerns real differences among people, tasks, shifts, or conditions: for example, different body sizes, work rates, susceptibility, or pathogen prevalence. Treating uncertainty as if it were variability can lead to false precision.

A defensible assessment records assumptions, data quality, confidence, and unresolved questions. Where uncertainty is material and potential consequences are serious, precautionary action may be justified before complete information is available.

2. Hazard Classification

Physical hazards

Physical hazards arise from energy or environmental conditions. Examples include noise, vibration, heat, cold, radiation, electricity, pressure, slips and trips, moving machinery, falling objects, inadequate lighting, and fire. Identification should consider both routine operations and non-routine conditions such as maintenance, startup, shutdown, emergencies, and power failure.

Physical hazards often interact. Noise may impair communication and increase accident probability; heat may increase fatigue and dehydration; poor lighting may worsen manual-handling and trip hazards. A checklist that examines each hazard in isolation may therefore underestimate combined risk.

Chemical hazards

Chemical hazards include toxic, corrosive, irritant, sensitizing, carcinogenic, flammable, explosive, reactive, and environmentally harmful substances. Assessment requires attention to the chemical’s properties, quantity, concentration, route of entry, volatility, storage compatibility, and duration of exposure.

The principal exposure routes are inhalation, skin or eye contact, ingestion, and injection through puncture or high-pressure systems. Safety data sheets, labels, inventories, air monitoring, spill records, and worker interviews are useful sources. A label or safety data sheet is essential information, but it does not by itself demonstrate that workplace exposure is adequately controlled.

Biological hazards

Biological hazards include bacteria, viruses, fungi, parasites, allergens, toxins, contaminated body fluids, and biological materials. They are relevant in healthcare, laboratories, sanitation, food production, agriculture, education, and public-facing work, but no workplace should assume that biological risk is absent.

Assessment should examine the agent, reservoir, route of transmission, dose, susceptibility, environmental persistence, and control feasibility. Controls may include vaccination where appropriate, isolation, ventilation, hand hygiene, sharps management, cleaning and disinfection, respiratory protection, and infection-reporting systems. Biological assessments must respect confidentiality and avoid stigmatizing employees or communities.

Ergonomic hazards

Ergonomic hazards result from a mismatch between work demands and human capabilities. They include forceful exertion, repetition, awkward posture, vibration, static loading, poorly designed workstations, manual handling, and inadequate recovery time. Psychosocial conditions such as high workload may amplify musculoskeletal risk by increasing pace and reducing opportunities for recovery.

Assessment should observe actual work rather than relying solely on job titles. Relevant evidence includes force, frequency, duration, posture, reach distance, load characteristics, work organization, worker experience, symptoms, and near misses. Individual symptoms are valuable signals but should not be used to blame workers for poorly designed systems.

Psychosocial hazards

Psychosocial hazards arise from the design and management of work and from social conditions. Examples include excessive workload, low control, role ambiguity, bullying, harassment, violence, discrimination, inadequate staffing, insecure work, poor supervisory support, traumatic exposure, and persistent work–life conflict.

These hazards can produce stress, burnout, depression, anxiety, sleep disturbance, errors, absenteeism, and turnover. Assessment should combine organizational indicators—such as workload, overtime, turnover, complaints, and absence—with confidential employee participation. Individual mental-health information must be protected; the objective is to improve work conditions rather than diagnose or surveil employees.

Operational and organizational hazards

Operational hazards arise from how work systems function. They include inadequate procedures, weak maintenance, contractor interfaces, supply disruptions, poor change management, defective equipment, emergency-response gaps, lone work, unclear authority, and production pressures that conflict with safety.

An operational perspective is particularly important because incidents often result from multiple contributing conditions rather than one unsafe act. The assessment should examine safeguards, escalation routes, supervision, competence, maintenance, communication, and the possibility of simultaneous or conflicting tasks.

3. A Systematic HIRA Process

A robust assessment is iterative rather than a one-time form-filling exercise.

Step 1: Define scope and context

Specify the workplace, process, population, operating states, time period, and decision to be supported. Include employees, temporary workers, contractors, visitors, customers, and potentially affected members of the public. Define normal, abnormal, and emergency conditions.

Step 2: Collect evidence

Useful evidence includes:

• workplace inspections and task observations;
• employee interviews, focus groups, and safety representatives;
• incident, near-miss, absence, and occupational-health records;
• equipment manuals, process maps, chemical inventories, and safety data sheets;
• exposure monitoring and health-surveillance information;
• maintenance records, audit findings, complaints, and regulatory notices;
• data from similar facilities or industry experience.

No single source is complete. Incident data are valuable but are affected by under-reporting and exposure opportunity. Employee reports may reveal hidden hazards but require psychological safety and confidentiality.

Step 3: Identify exposed persons and pathways

For each hazard, identify who may be exposed, how exposure occurs, how often, and under what conditions. Consider vulnerable groups without assuming that vulnerability is an individual deficiency. Examples include pregnant workers, young or inexperienced workers, workers with disabilities, workers with limited language proficiency, and workers with medical conditions that may affect susceptibility.

Step 4: Analyze existing controls

Controls should be described specifically. “Training provided” is not equivalent to “workers understand and can perform the task safely under production conditions.” Assess design adequacy, actual use, reliability, maintenance, human factors, and dependence on memory or constant vigilance.

Step 5: Estimate and evaluate risk

Select a method suitable for the decision and the available evidence. Separate screening from detailed analysis. A low score based on weak data should not automatically close an issue.

Step 6: Select additional controls

Use the hierarchy of controls, beginning with measures that remove or isolate the hazard. Personal protective equipment is important but generally less reliable as the sole control because it depends on fit, behavior, maintenance, and continued availability.

Step 7: Implement, verify, and review

Assign owners, deadlines, resources, and verification criteria. Review controls after incidents, process changes, new substances, new equipment, organizational restructuring, or evidence that controls are ineffective.

4. Qualitative and Semi-Quantitative Assessment

Qualitative assessment uses descriptive categories such as low, medium, high, and critical. It is appropriate when data are limited, rapid screening is needed, or consequences are difficult to quantify. Its strength is transparency; its weakness is subjectivity.

A semi-quantitative matrix assigns numerical values to likelihood and severity. For example, an organization might define likelihood from 1 (rare) to 5 (almost certain) and severity from 1 (minor first aid) to 5 (fatality or multiple serious injuries). The resulting score is R = L × S. Thresholds should be established before assessment and linked to actions, such as immediate shutdown, prompt corrective action, or routine monitoring.

Worked example: a risk matrix

Suppose a maintenance task involves possible contact with an energized component. The assessment team rates likelihood as 2 because the task is infrequent and an isolation procedure exists, but the procedure is not always verified. Severity is rated 5 because an uncontrolled event could cause fatal injury.

If the organization classifies scores of 10 or more as high priority, the task requires action before continuation or before the next scheduled performance. The result does not mean that the probability of fatality is exactly 2/5. It means that, under the organization’s defined matrix, the combination warrants a specified response. Verification of isolation, interlocked equipment, or redesign should be considered before relying on warnings or PPE.

Strengths and limitations of matrices

Matrices support communication and prioritization, especially where many hazards compete for attention. However, they can produce inconsistent ratings, obscure differences between very severe outcomes, and encourage score manipulation. Multiplication also assumes that increases in likelihood and severity have a meaningful proportional relationship, which is rarely established empirically.

Good practice includes defining rating anchors with examples, documenting assumptions, involving knowledgeable workers, using conservative treatment of high-consequence uncertainty, and avoiding the claim that a matrix proves a risk is acceptable.

5. Quantitative Assessment

Quantitative methods are appropriate when decisions require numerical exposure estimates, comparison with limits, reliability analysis, or cost and resource modeling. They should be used only when the data and assumptions support the precision claimed.

Exposure averaging

For a contaminant with changing concentration, a time-weighted average over a work period can be calculated as:

Cᵢ is the measured concentration during interval i, and tᵢ is the duration of that interval. Concentration and time units must be consistent, such as milligrams per cubic metre and hours. The calculation assumes that the sampled intervals represent the exposure period and that averaging is appropriate for the relevant health criterion. Short-term peaks may remain important even when the average is low.

For example, a worker experiences 2 mg/m³ for 2 hours and 0.5 mg/m³ for 6 hours:

This average cannot by itself establish safety. The result must be compared with the applicable occupational exposure criterion, sampling strategy, substance-specific peak limits, and uncertainty of measurement.

Frequency and severity indicators

Organizations sometimes calculate incident rates to compare performance over time:

K is a chosen standardizing constant, such as 200,000 hours, and must be stated. Rates are meaningful only when the numerator and denominator are consistently defined. A declining rate may reflect improved safety, reduced reporting, lower exposure opportunity, or changes in workforce composition. Rates should therefore be interpreted alongside leading indicators such as hazard reports, corrective-action completion, training quality, and control verification.

Reliability and barrier thinking

For high-consequence operations, assessment can focus on barriers: engineering safeguards, alarms, interlocks, procedures, competence, supervision, and emergency response. The question becomes not only “What can go wrong?” but also “Which independent barriers prevent or mitigate it, and how can their failure be detected?” Independence matters. Two safeguards that depend on the same power supply or the same unverified human action are not fully independent.

6. Prioritizing Controls

The hierarchy of controls generally ranks interventions as follows:

The hierarchy is a preference for reliability, not an absolute rule that lower-level controls are never used. Complex risks often require layered controls. For example, a laboratory may substitute a less hazardous reagent, install a ventilated enclosure, establish handling procedures, train staff, and provide suitable eye protection.

Control selection should consider effectiveness, feasibility, unintended consequences, maintenance, worker acceptance, equity, and lifecycle cost. A control that reduces one hazard but creates another requires reassessment. Automation can reduce exposure but may introduce cybersecurity, maintenance, or emergency-intervention risks.

7. Governance, Ethics, and the Role of HR

Risk assessment involves power. Employees may hesitate to report hazards if they fear discipline, lost overtime, stigma, or retaliation. Ethical assessment therefore requires participation, confidentiality where appropriate, accessible reporting, and visible follow-through.

HR managers contribute by embedding safety in recruitment, induction, competency systems, performance management, return-to-work processes, procurement, contractor management, and organizational change. Safety must not be converted into an individual performance target that encourages under-reporting. Incentive schemes based solely on zero incidents can create perverse incentives.

Legal requirements differ across jurisdictions. Organizations must consult applicable occupational-safety, public-health, environmental, employment, disability, privacy, and data-protection requirements. Professional judgment does not replace legal compliance, and legal compliance alone may not represent good practice.

Digital tools and artificial intelligence can support inspection scheduling, trend analysis, sensor monitoring, natural-language analysis of reports, and predictive maintenance. They also create risks involving privacy, biased data, false alerts, automation bias, cybersecurity, and opaque decisions. AI should assist—not replace—worker consultation, competent professional judgment, and accountability. Data governance should specify purpose, access, retention, validation, and human review.

8. Illustrative Case: Distribution Centre Battery-Charging Area

Background

A fictional distribution centre uses electric forklifts. Employees charge batteries in a designated room. The area contains charging equipment, pedestrian traffic, manual handling of battery components, and occasional hydrogen accumulation during charging. The facility has experienced eye irritation, a minor acid splash, and repeated near misses involving pedestrians and forklifts.

Problem

Management initially classified the area as medium risk because no serious injury had occurred. Workers reported that ventilation alarms were sometimes ignored, the pedestrian route crossed the charging area, and production pressure encouraged rapid battery changes. Temporary workers had received abbreviated induction.

Analysis

The assessment team mapped tasks and identified interacting hazards:

• chemical: sulfuric-acid electrolyte and corrosive splash;
• physical: electrical energy, arc flash, vehicle movement, slips, and noise;
• biological and sanitation: contaminated surfaces and inadequate hand-washing supplies;
• ergonomic: forceful battery movement and awkward posture;
• operational: inadequate segregation, alarm normalization, and weak contractor induction.

The team reviewed observations, maintenance records, interviews, ventilation tests, incident reports, and the charging procedure. It found that the alarm was functional but the response procedure was unclear. The ventilation system was designed for ordinary charging conditions but had not been assessed after equipment expansion.

Approach and solution

The team applied the hierarchy of controls. First, battery-charging capacity was reorganized to eliminate unnecessary movement through the room. Pedestrian access was removed from the vehicle route, and physical barriers were installed. A less corrosive battery technology was considered for future procurement, subject to lifecycle evaluation. Engineering controls included verified ventilation performance, splash-resistant charging stations, emergency eyewash facilities, and improved guarding.

Administrative controls included a battery-change procedure, authorization for trained workers, a clear alarm-response protocol, preventive maintenance, contractor induction, and a stop-work rule when ventilation alarms activate. PPE was specified for residual splash and electrical hazards, with fit, inspection, replacement, and storage requirements.

Outcome

In the first review period, near misses involving pedestrians declined and alarm responses became more consistent. Management did not treat the improvement as proof that risk had been eliminated. It scheduled follow-up exposure and ventilation verification, reviewed worker feedback, and established quarterly control audits.

Learning points

The case demonstrates that incident history alone can underestimate risk. Multiple moderate hazards may combine into a serious scenario. Effective controls addressed layout, equipment, procedures, competence, and organizational pressure. It also illustrates why risk assessment must be repeated after changes in capacity, technology, staffing, or workflow.

9. Challenges and Best Practices

Common weaknesses include copying old assessments, treating checklists as complete evidence, ignoring non-routine work, rating risk before identifying existing controls, relying on incident statistics alone, and assigning responsibility without resources or verification.

Best practice is characterized by:

• competent multidisciplinary teams;
• meaningful worker participation;
• explicit treatment of vulnerable groups and contractors;
• clear distinction between hazard and risk;
• evidence proportionate to consequence;
• conservative handling of high-consequence uncertainty;
• preference for elimination, substitution, and engineering controls;
• documented owners, deadlines, and verification measures;
• review after change, incident, or new evidence;
• transparent communication of assumptions and limitations.

Chapter Summary

Hazard identification and risk assessment are systematic processes for understanding what can cause harm, who may be exposed, how severe the consequences may be, and which controls are justified. Hazards may be physical, chemical, biological, ergonomic, psychosocial, or operational, and they frequently interact. Effective assessment combines observation, worker participation, records, technical information, monitoring, and professional judgment.

Qualitative methods are useful for screening and communication, while semi-quantitative matrices support prioritization but should not be mistaken for measured probabilities. Quantitative methods can estimate exposure, expected loss, incident rates, or barrier reliability when their assumptions and data are defensible. Uncertainty and variability must be distinguished, documented, and managed prudently.

The hierarchy of controls places elimination, substitution, and engineering controls above administrative controls and PPE, while recognizing that layered controls are often necessary. HR professionals have important responsibilities in governance, participation, competency, reporting culture, privacy, change management, and ethical decision-making. Risk assessment is complete only when controls are implemented, verified, communicated, and reviewed as conditions change.

Key Terms

Hazard: A source, situation, or act with potential to cause harm.

Exposure: Contact between a person or asset and a hazard.

Risk: The combination of likelihood and consequence of harm.

Consequence: The severity or magnitude of an adverse outcome.

Likelihood: The chance that an event or exposure will occur.

HIRA: Hazard identification and risk assessment.

Inherent risk: Risk before specified controls are applied.

Residual risk: Risk remaining after controls are implemented.

Uncertainty: Incomplete knowledge about conditions, probabilities, or effects.

Variability: Real differences among people, tasks, or operating conditions.

Hierarchy of controls: A prioritized framework for selecting risk controls.

Engineering control: A physical or technical measure that isolates people from hazards.

Administrative control: A rule, procedure, schedule, or organizational measure.

Personal protective equipment: Equipment worn to reduce exposure to residual hazards.

Time-weighted average: An exposure average weighted by duration.

Barrier: A safeguard that prevents or mitigates an unwanted event.

Psychosocial hazard: A work-design or social condition that can harm psychological or physical health.

Leading indicator: A measure of preventive activity or control performance.

Review Questions

5 Short Answer Questions

1. Distinguish a hazard from risk and exposure.
2. Why can incident records alone provide an incomplete picture of workplace risk?
3. Name the five levels of the hierarchy of controls.
4. Explain the difference between uncertainty and variability.
5. Why should PPE generally not be the only control for a serious hazard?

5 Long Answer Questions

1. Explain a systematic HIRA process from defining scope through reviewing controls.
2. Compare qualitative, semi-quantitative, and quantitative risk-assessment methods, including their strengths and limitations.
3. Discuss how psychosocial hazards can be identified without violating employee privacy.
4. Explain how HR managers can integrate risk assessment into recruitment, training, performance management, and organizational change.
5. Evaluate the ethical and governance challenges of using AI for workplace safety monitoring.

3 Analytical / Application Questions

1. A laboratory reports occasional solvent odors but has no recorded illness. Develop an assessment plan that identifies evidence required, possible exposure pathways, and controls in hierarchy order.
2. A manufacturing task has a likelihood rating of 4 and a severity rating of 3 on a five-by-five matrix. Calculate the score using R = L × S, then explain why the score should not be interpreted as an actual probability.
3. Analyze the distribution-centre case. Identify at least three interacting hazards, evaluate the original management judgment, and propose indicators that would verify whether the new controls remain effective.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a hazard from risk?

A. A hazard is a potential source of harm; risk considers likelihood and consequence in context.

B. A hazard is always more serious than risk.

C. Risk exists only when an injury has already occurred.

D. A hazard is a numerical probability of an incident.

Correct Answer: A. A hazard is a potential source of harm; risk considers likelihood and consequence in context.

Question 2

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Elimination

D. Worker training

Correct Answer: C. Elimination

Question 3

A task has likelihood rating 3 and severity rating 4. Using R = L × S, what is the risk score?

A. 7

B. 12

C. 16

D. 34

Correct Answer: B. 12

Question 4

Which is an example of a psychosocial hazard?

A. Excessive workload combined with low worker control

B. A corrosive cleaning chemical

C. An unguarded rotating shaft

D. An elevated noise level

Correct Answer: A. Excessive workload combined with low worker control

Question 5

What does a time-weighted average exposure calculation weight?

A. The color of the substance

B. The severity rating only

C. Concentration by the duration of exposure

D. The number of workers by their job titles

Correct Answer: C. Concentration by the duration of exposure

Question 6

Why can a risk matrix be misleading if used carelessly?

A. It can make numerical scores appear more precise than the evidence supports.

B. It cannot include severity.

C. It always produces a probability between zero and one.

D. It eliminates the need for worker participation.

Correct Answer: A. It can make numerical scores appear more precise than the evidence supports.

Question 7

Which information source is especially useful for identifying hidden or under-reported hazards?

A. Employee interviews and task observations

B. Only records of lost-time injuries

C. Only annual financial statements

D. Only equipment purchase invoices

Correct Answer: A. Employee interviews and task observations

Question 8

What is the principal reason for reviewing an assessment after a process change?

A. Risk conditions, exposures, and control effectiveness may have changed.

B. All previous assessments become legally invalid automatically.

C. The hierarchy of controls changes after every modification.

D. Incident rates must always increase after a change.

Correct Answer: A. Risk conditions, exposures, and control effectiveness may have changed.

Question 9

Which statement about uncertainty is correct?

A. It means that all workers have identical exposure.

B. It concerns incomplete knowledge about conditions, probabilities, or effects.

C. It proves that no control is feasible.

D. It is the same as variability.

Correct Answer: B. It concerns incomplete knowledge about conditions, probabilities, or effects.

Question 10

In the distribution-centre case, which intervention most directly applied engineering control principles?

A. Giving workers a reminder poster

B. Installing physical barriers to separate pedestrians and vehicles

C. Adding a disciplinary rule for late reporting

D. Conducting a motivational lecture

Correct Answer: B. Installing physical barriers to separate pedestrians and vehicles