Hazard Identification and Risk Assessment

Introduction

Industrial energy systems, manufacturing plants, laboratories and maintenance operations contain hazards arising from stored energy, moving equipment, pressure, temperature, electricity, chemicals, human factors and organizational weaknesses. Accidents rarely result from a single unsafe act. They usually develop through a combination of hazardous conditions, failed safeguards, unsuitable procedures and inadequate supervision. Hazard identification and risk assessment (HIRA) provide a systematic basis for recognizing these conditions, estimating risk and selecting proportionate controls.

HIRA is not a one-time paperwork exercise. It is a decision-making process applied during design, commissioning, operation, maintenance, modification and decommissioning. Its purpose is to prevent injury, ill health, environmental harm, asset damage, production loss and business interruption while supporting legal compliance and continual improvement.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Distinguish hazards, hazardous events, consequences, controls and risk.
2. Conduct workplace inspections and job safety analyses.
3. Select and apply HAZID, HAZOP, what-if, checklist, FMEA, fault-tree and event-tree methods.
4. Use qualitative and semiquantitative risk matrices responsibly.
5. Apply the hierarchy of controls and the ALARP principle.
6. Evaluate residual risk after controls are introduced.
7. Communicate assumptions, uncertainty and responsibilities in a professional risk assessment.

1. Fundamental Concepts

A hazard is a source or situation with the potential to cause harm. Examples include an exposed rotating shaft, high-pressure steam, flammable vapour, an energized conductor or an unstable load. A hazardous event is an event that releases or exposes people or assets to the hazard, such as shaft entanglement, pipe rupture or ignition of vapour. A consequence is the resulting harm, such as fatality, burn, toxic exposure, equipment damage or environmental release.

Risk combines the likelihood of an unwanted event with the severity of its consequences. In a simple qualitative representation:

Likelihood may describe frequency, probability of occurrence or a band such as rare, possible or frequent. Consequence may describe the credible severity of harm. The expression is a screening model, not a universal physical law. Multiplying ordinal scores does not produce a true probability and should not be interpreted with false precision.

A more explicit event-risk model is:

where R is risk, f is the frequency of the hazardous event, normally expressed in events per year, and C is the consequence measure. If C is expressed as monetary loss, R has units of monetary loss per year. If consequence is a severity category, R is a comparative index rather than a dimensioned quantity. The model assumes that frequency and consequence can be meaningfully estimated and that the assessment period and system boundaries are defined.

Risk assessment normally contains five linked questions:

• What can cause harm?
• Who or what can be affected, and how?
• How can the event occur?
• How severe and how likely is it?
• What additional controls are required?

A sound assessment distinguishes inherent risk, which exists before safeguards, from residual risk, which remains after safeguards are implemented and verified. It also distinguishes a hazard from an unsafe act. A worker bypassing a guard is a behavior; the underlying hazard may be access to moving machinery, and the hazardous event may be contact with the rotating component.

2. Risk Assessment Process

A practical HIRA process comprises the following stages:

1. Define the scope, system boundaries, operating modes and assumptions.
2. Assemble competent personnel with operational, engineering, maintenance and safety knowledge.
3. Identify hazards and credible initiating events.
4. Identify people, equipment, environment and business functions exposed.
5. Analyze initiating causes, existing safeguards and consequences.
6. Estimate likelihood and severity using a defined method.
7. Compare the result with organizational or legal acceptance criteria.
8. Select additional controls using the hierarchy of controls.
9. Reassess residual risk and assign actions, owners and deadlines.
10. Verify implementation and review the assessment after changes, incidents or new information.

The scope should state whether the assessment covers normal operation, start-up, shutdown, cleaning, maintenance, emergency response, abnormal conditions, contractors and simultaneous operations. Many serious incidents occur outside steady-state production.

People at risk

The assessment should consider operators, maintenance staff, contractors, visitors, cleaners, transport personnel, emergency responders, nearby communities and future workers. Vulnerability may differ because of experience, language, disability, pregnancy, age, temporary status or exposure duration. Inclusion is both a technical and ethical requirement.

Evidence and uncertainty

Evidence may include drawings, equipment manuals, safety data sheets, incident records, inspection findings, energy-isolation procedures, alarm histories, interviews and measurements. Where data are weak, the assessor should state uncertainty and avoid presenting a low score as proof of safety. Conservative assumptions may be justified for high-consequence events.

3. Workplace Inspections

A workplace inspection is a structured examination of physical conditions and work practices. It is particularly valuable for discovering conditions that formal design studies may miss: damaged guards, blocked exits, poor housekeeping, incompatible storage, leaking valves, missing labels, noise, awkward access and unauthorized modifications.

An effective inspection includes preparation, observation, discussion, recording and follow-up. Inspectors should review previous findings, obtain drawings or process information, and use a route that covers production areas, utilities, warehouses, workshops, roofs, confined spaces and emergency equipment. They should observe work without creating additional risk and ask workers how tasks are actually performed.

Inspection findings should state:

• the exact location;
• the observed condition or behavior;
• the hazard and possible event;
• people exposed;
• immediate controls required;
• recommended permanent action;
• responsible person and completion date.

Photographs can support evidence but do not replace a technical description. Findings should be prioritized according to risk rather than convenience. A broken emergency-stop device may require immediate isolation, whereas repainting a faded line may be scheduled.

4. Job Safety Analysis

Job safety analysis (JSA), also called job hazard analysis, examines a specific task by dividing it into logical steps. For each step, the team identifies hazards, possible consequences and controls. A JSA is most useful for non-routine work, maintenance, lifting, hot work, confined-space entry and tasks involving multiple organizations.

The steps should be neither excessively broad nor unnecessarily detailed. “Repair pump” is too broad; “remove coupling guard after isolation and verification” is more useful. Controls should address the actual sequence, including preparation, tools, access, isolation, testing, restoration and emergency response.

A JSA should not become a substitute for engineering design. If a task is intrinsically dangerous, the preferred response is to redesign or eliminate the task rather than rely only on worker attention or personal protective equipment.

5. Structured Hazard-Identification Methods

HAZID

HAZID is a broad, early-stage hazard identification study. A multidisciplinary team examines a process, facility or project using categories such as fire, explosion, toxic release, pressure, mechanical energy, electrical energy, environmental conditions, human error, transport and external events. HAZID is useful during concept and design stages because hazards can still be eliminated or engineered out.

A HAZID worksheet commonly records the hazard, cause, consequence, existing safeguards, risk ranking, recommendation, responsible owner and due date. HAZID is broad but may not examine detailed deviations from process intent.

HAZOP

Hazard and operability study (HAZOP) uses a systematic examination of process deviations. A team defines a design intent for each node, such as a pipe segment or vessel, and combines guidewords with process parameters.

For each deviation, the team asks: What causes it? What are the consequences? Which safeguards exist? Is the safeguard independent and reliable? What recommendations are needed? HAZOP is especially effective for continuous and batch processes represented by process flow diagrams and piping and instrumentation diagrams. It is resource-intensive and depends on accurate design information and experienced participants.

What-if analysis

What-if analysis uses questions such as “What if cooling water is lost?”, “What if the valve is installed backward?” or “What if the operator receives a false level indication?” It is flexible and efficient for smaller systems, modifications and operational reviews. Its quality depends strongly on the knowledge of the team and the completeness of the questions.

Checklists

Checklists provide consistent coverage of known hazards. They are useful for inspections, audits, pre-start reviews and recurring work. Their limitation is that they may encourage confirmation of familiar items while missing novel interactions. A checklist should therefore support, not replace, professional questioning.

6. Failure-Oriented Methods

Failure Mode and Effects Analysis

FMEA starts with components or functions and asks how each can fail, what causes the failure, what effect it produces and how the failure can be detected or controlled. Typical entries include a pump seal leaking, a temperature sensor failing low or a relief valve failing to open.

Some organizations use a priority number such as:

where S is severity, O is occurrence likelihood and D is detectability, each assigned an ordinal score. This number is only a prioritization aid. It is not a probability, and a high-severity failure should not be dismissed merely because its numerical product is lower. FMEA is strongest for component-level reliability and maintenance planning.

Fault-tree analysis

Fault-tree analysis (FTA) is a deductive, top-down method. The analyst begins with a top event, such as “boiler overpressure,” and works backward through combinations of causes using logical AND and OR gates. An OR gate means any input can produce the output; an AND gate means all required inputs must occur.

If two independent basic events A and B must both occur, the probability of their joint occurrence is:

This equation assumes statistical independence and a common reference period. If either event is not independent, common-cause failures must be modeled explicitly. For an OR combination of independent events:

FTA can reveal common causes, inadequate independence and single-point failures. Quantitative results are only as credible as the failure data, model boundaries and independence assumptions.

Event-tree analysis

Event-tree analysis (ETA) is inductive. It begins with an initiating event and follows the success or failure of protective functions, such as detection, isolation, suppression and evacuation. Each branch represents a possible sequence and consequence. ETA is valuable for analyzing escalation and demonstrating the benefit of independent protection layers.

FTA asks, “How can the top event occur?” ETA asks, “What can happen after the initiating event?” Used together, they provide complementary views of accident development.

7. Risk Matrices and Decision Criteria

A risk matrix classifies risk by crossing likelihood categories with consequence categories. A typical five-by-five matrix may classify results as low, moderate, high and intolerable. Categories must be defined in organizational terms; for example, “frequent” might mean expected several times during a year, while “rare” might mean not expected during the facility life. Definitions must not be copied without considering the operating context.

Matrices are useful for prioritization and communication, but they have limitations. Different combinations can receive the same category; boundaries may be subjective; and people may interpret colors differently. High-consequence, low-frequency events deserve special attention because historical absence of accidents does not prove adequate protection.

8. Hierarchy of Controls

Controls should be selected in the following order:

1. Elimination: remove the hazardous activity or energy source.
2. Substitution: replace it with a less hazardous material, process or condition.
3. Engineering controls: guard, enclose, isolate, interlock, ventilate or automate.
4. Administrative controls: procedures, training, permits, scheduling, supervision and signs.
5. Personal protective equipment (PPE): gloves, eye protection, respirators, hearing protection and protective clothing.

Higher-level controls generally depend less on continuous human behavior. PPE remains important but is the last line of defense and may fail through incorrect selection, poor fit, damage or non-use. Controls should also be evaluated for new hazards: an interlock can create a false sense of security, and substitution may introduce a different toxic or environmental risk.

9. ALARP and Residual Risk

ALARP means reducing risk “as low as reasonably practicable.” It requires implementation of further risk reduction unless the sacrifice in time, cost or effort is grossly disproportionate to the risk reduction achieved. ALARP is not equivalent to “as low as cheaply possible,” and economic considerations do not justify violating mandatory legal requirements or accepted good practice.

A residual-risk review should ask:

• Were the proposed controls actually installed?
• Do they perform as intended under normal and abnormal conditions?
• Are safeguards independent, available and maintained?
• Have new hazards been introduced?
• Are procedures, training and emergency arrangements adequate?
• Is the remaining risk accepted by the competent authority?
• Are inspection, testing and monitoring requirements defined?

Risk acceptance must be authorized at an appropriate level. Workers should not be expected to accept risks created by management decisions without information, consultation and effective controls.

10. Worked Example: Solvent Transfer System

Consider an illustrative solvent-transfer station in which a flammable solvent is pumped from a storage tank to a blending vessel. The pump is electrically driven, the transfer hose is flexible, and operators connect and disconnect the hose during each batch.

Hazard identification

The HAZID team identifies flammable vapour, static electricity, hose rupture, overfilling, pump dead-heading, incorrect connection and exposure during sampling. A JSA shows that operators sometimes place the hose across a vehicle route and occasionally begin transfer before confirming the receiving vessel identity.

What-if questions

• What if the receiving vessel is already full?
• What if the hose coupling is not locked?
• What if the pump runs with the discharge valve closed?
• What if bonding is absent?
• What if vapour reaches an ignition source?

Risk analysis

The credible major scenario is solvent release followed by ignition, causing flash fire and serious burns. Existing controls include a manual level check, a grounding lead, a fire extinguisher and operator training. These controls are vulnerable to omission and do not provide strong prevention.

Control design

Elimination is considered by using a fixed, closed transfer line instead of repeated hose connection. Substitution is considered by evaluating a solvent with a higher flash point, subject to product-quality requirements. Engineering controls include a keyed connection, overfill detection with automatic pump shutdown, bonding interlock, breakaway coupling, guarded hose routing and emergency isolation. Administrative controls include a transfer permit, line-up checklist, inspection and preventive maintenance. PPE includes chemical-resistant gloves, goggles, antistatic clothing and suitable footwear.

Residual-risk evaluation

After implementation, the team verifies that the overfill trip is tested, the bonding interlock prevents pumping when disconnected, the emergency stop is accessible and operators can demonstrate the procedure. The residual risk is then reassessed. If the matrix still indicates high risk, further engineering or process redesign is required; merely adding another warning sign is not an adequate response.

Learning points

The example demonstrates that risk reduction is strongest when the hazardous exposure is removed or automatically prevented. It also shows why operating practice, maintenance and verification must be included. A control that exists only on a drawing is not a functioning safeguard.

11. Management, Ethics and Governance

Risk assessment is a professional activity involving duty of care. Assessors must be competent, impartial and transparent about uncertainty. Records should identify assumptions, evidence, participants, decisions and unresolved actions. Management should provide resources and should not pressure assessors to lower ratings for production convenience.

Legal requirements vary by jurisdiction, but common obligations include providing a safe workplace, controlling hazardous substances, guarding machinery, managing electrical and pressure systems, consulting workers, investigating incidents and maintaining emergency arrangements. Industry standards and regulator guidance may establish accepted practice, but compliance does not automatically prove that risk is acceptable.

Management of change is essential. A change in material, software, staffing, production rate, control logic, layout or maintenance interval can invalidate an earlier assessment. Assessments should be reviewed after incidents, near misses, abnormal trends, process modifications and new scientific information.

12. Digital Tools and Contemporary Practice

Computerized maintenance systems, sensor data, digital permits, location tracking and process historians can improve evidence quality. Machine-learning tools may identify patterns in inspection findings or predict equipment failure, but they do not replace hazard analysis. Training data can be incomplete, algorithms can miss rare events and automated recommendations require competent review. Cybersecurity is increasingly part of industrial safety because unauthorized access to control systems can create physical hazards.

Contemporary best practice combines process safety analysis, occupational hygiene, human-factors engineering, reliability analysis and emergency planning. It also considers climate-related hazards such as extreme heat, flooding, wildfire and power instability. Resilience requires assessing not only prevention but also detection, response, recovery and learning.

Challenges and Limitations

The principal limitations of HIRA are incomplete knowledge, optimistic assumptions, poor-quality data, groupthink, inadequate worker participation and confusion between paperwork completion and risk reduction. Quantitative methods may create an appearance of accuracy when probabilities are uncertain. Qualitative methods may hide disagreement behind a single color.

To reduce these weaknesses, use multidisciplinary teams, independent review, clear definitions, credible scenarios, conservative treatment of uncertainty, field verification and action tracking. Consider simultaneous operations, common-cause failures, human factors, degraded modes and emergency conditions. Reassess controls after installation rather than assuming that recommendations have been implemented effectively.

Chapter Summary

Hazard identification and risk assessment provide a structured foundation for preventing industrial incidents. Hazards must be distinguished from initiating events, consequences and controls. Workplace inspections reveal physical and behavioral conditions; JSAs analyze task steps; HAZID provides broad early-stage coverage; HAZOP examines process deviations; what-if studies encourage flexible questioning; checklists promote consistency; FMEA examines component failures; FTA traces causes of a top event; and ETA follows consequences after an initiating event.

Risk matrices support prioritization but should not create false precision. Control selection must follow elimination, substitution, engineering controls, administrative controls and PPE. ALARP requires further reduction unless the sacrifice is grossly disproportionate, while residual-risk evaluation verifies that controls function in practice. Effective HIRA is multidisciplinary, evidence-based, worker-inclusive, ethically governed and continuously updated.

Key Terms

Hazard: A source or situation with potential to cause harm.

Hazardous event: An event that exposes people or assets to a hazard.

Consequence: The harm resulting from an event.

Risk: A combination of likelihood and consequence.

Inherent risk: Risk before additional safeguards are applied.

Residual risk: Risk remaining after controls are implemented and verified.

HIRA: A systematic process for identifying hazards and evaluating risk.

JSA: Task-based analysis of steps, hazards and controls.

HAZID: Broad, multidisciplinary hazard-identification study.

HAZOP: Structured analysis of process deviations using guidewords.

What-if analysis: Question-based examination of possible failures.

Checklist: A structured list used to promote consistent examination.

FMEA: Component or function-based analysis of failure modes and effects.

Fault-tree analysis: Deductive analysis from a top event to its causes.

Event-tree analysis: Inductive analysis of outcomes after an initiating event.

Risk matrix: A grid relating likelihood categories to consequence categories.

Hierarchy of controls: Ordered preference for eliminating or controlling hazards.

ALARP: Reduction of risk as low as reasonably practicable.

Independent protection layer: A safeguard that is sufficiently independent and reliable to reduce risk.

Management of change: Formal review of risks created by organizational, technical or process changes.

Review Questions

5 Short Answer Questions

1. Define hazard, hazardous event and consequence, and distinguish among them.
2. What are the main purposes of a job safety analysis?
3. State the five levels of the hierarchy of controls.
4. What is the difference between fault-tree and event-tree analysis?
5. Why should residual risk be evaluated after controls are installed?

5 Long Answer Questions

1. Explain the complete HIRA process from scope definition to verification of controls.
2. Compare HAZID, HAZOP, what-if analysis and checklists, including suitable applications and limitations.
3. Explain how risk matrices are constructed and discuss their principal weaknesses.
4. Discuss ALARP, legal compliance and ethical responsibilities in risk acceptance.
5. Explain how human factors, management of change and worker participation influence assessment quality.

3 Analytical / Application Questions

1. Develop a JSA for replacing a motor in a manufacturing plant. Identify at least six steps, hazards and controls, and justify the control hierarchy.
2. Construct a qualitative fault tree for “flammable vapour ignites during solvent transfer.” Identify at least three basic events and discuss possible common-cause failures.
3. A plant introduces an automatic shutdown, but the shutdown sensor is not tested and operators are not trained in reset procedures. Evaluate the residual-risk implications and recommend verification actions.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a hazard?

A. The numerical product of likelihood and consequence

B. A source or situation with potential to cause harm

C. The injury resulting from an accident

D. A completed corrective-action record

Correct Answer: B. A source or situation with potential to cause harm

Question 2

Which method systematically examines process deviations using guidewords such as “no,” “more,” and “reverse”?

A. HAZOP

B. FMEA

C. JSA

D. Event-tree analysis

Correct Answer: A. HAZOP

Question 3

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Elimination

D. Warning sign

Correct Answer: C. Elimination

Question 4

Fault-tree analysis normally begins with which item?

A. A top event and works backward toward causes

B. A checklist and works toward inspection findings

C. A consequence and works toward PPE selection

D. A maintenance schedule and works toward training

Correct Answer: A. A top event and works backward toward causes

Question 5

Event-tree analysis is primarily used to:

A. Identify process parameters and guidewords

B. Follow possible outcomes after an initiating event

C. Rank workers according to competence

D. Calculate equipment purchase cost

Correct Answer: B. Follow possible outcomes after an initiating event

Question 6

If likelihood is classified as “possible” and consequence as “major,” what is the direct purpose of using a risk matrix?

A. To prove the exact accident probability

B. To prioritize the risk for decision-making

C. To eliminate the hazard automatically

D. To replace field verification

Correct Answer: B. To prioritize the risk for decision-making

Question 7

In an FMEA, a failure mode describes:

A. The way a component or function can fail

B. The cost of a corrective action

C. The color assigned to a risk matrix cell

D. The legal status of a facility

Correct Answer: A. The way a component or function can fail

Question 8

The ALARP principle requires further risk reduction unless:

A. Workers have received PPE training

B. The risk matrix is colored green

C. The sacrifice is grossly disproportionate to the reduction achieved

D. An incident has not yet occurred

Correct Answer: C. The sacrifice is grossly disproportionate to the reduction achieved

Question 9

Which example is an engineering control?

A. A warning poster

B. A written operating procedure

C. A rotating-shaft guard with an interlock

D. A toolbox talk

Correct Answer: C. A rotating-shaft guard with an interlock

Question 10

A residual-risk assessment should primarily verify that:

A. The original risk rating has been deleted

B. Controls were implemented and perform as intended

C. Only PPE is available

D. Production targets were increased

Correct Answer: B. Controls were implemented and perform as intended