Risk assessment and the hierarchy of control

Safety on a project is not mainly about being careful. Careful people get hurt on badly organised sites, and the organisation is what a risk assessment is really examining.

Hazard and risk are different words

A hazard is something with the potential to cause harm. A risk is the likelihood of that harm happening, and how bad it would be.

A drum of solvent in a locked store and the same drum open beside a welder are the same hazard and utterly different risks. Nothing about the drum changed.

That distinction is why controls work on the circumstances rather than on the substance — you rarely get to remove the solvent, but you can nearly always change where it is.

The hierarchy of control

Level	What it does	Example	Depends on
1. Elimination	Removes the hazard entirely	Prefabricate at ground level so nobody works at height	Nothing, once done — which is what makes it the strongest
2. Substitution	Replaces it with something less hazardous	A water-based solvent in place of a flammable one	The substitute genuinely being less hazardous, not just differently so
3. Engineering controls	Separates people from the hazard physically	A machine guard, local exhaust ventilation, a fixed edge barrier	The control staying fitted and functional
4. Administrative controls	Changes how people work	A permit, a procedure, training, rotation to limit exposure	People knowing, remembering and choosing to follow it
5. PPE	Protects one person, if worn correctly	Respirator, harness, gloves, hearing protection	Correct selection, correct fit, and being worn every time

The order is not a menu. Each level is considered and rejected with a reason before dropping to the next, and the reason gets recorded. A risk assessment whose controls are all PPE has usually skipped the first four levels without examining them.

The ordering is by how much the control depends on human behaviour, and that is the whole logic of it.

Elimination depends on nothing once done. Engineering controls depend on staying fitted. Administrative controls depend on somebody knowing, remembering and choosing. PPE depends on selection, fit and being worn every single time.

Doing the assessment

Five steps, and the last is the one that gets skipped:

1. Identify the hazards — by walking the job, not by reading last year’s document.
2. Decide who might be harmed, and how. Including people not doing the work: passers-by, the crew below, the night shift who will meet what you leave behind.
3. Evaluate the risk and decide the controls, working down the hierarchy.
4. Record it, and make sure the people doing the work actually see it.
5. Review it — when the job changes, when something goes wrong, and periodically.

The job safety analysis

A site risk assessment works at the level of an activity. A job safety analysis works at the level of a task, broken into steps, with hazards and controls for each.

It is the document the crew reads before starting, so it is written for them and reviewed with them.

Conditions change while the job runs

A dynamic risk assessment is the continuous reassessment as the work proceeds. Weather turns, another crew starts work overhead, the plant state changes, a tool breaks and is replaced with a different one.

The assessment was written for conditions that no longer hold, and noticing that is a skill worth teaching explicitly rather than assuming.

Toolbox talks

Short, specific and about today’s work. What is happening, what the hazards are, what the controls are, and who to tell if something is wrong.

A generic talk repeated weekly stops being heard within a month. A talk that names the actual lift happening this morning, and the actual exclusion zone, gets listened to.

Leading and lagging indicators

Lagging indicators count harm that has already happened — lost time injuries, recordable cases. They are real, they are comparable, and they tell you about last quarter.

Leading indicators count activity intended to prevent harm — inspections completed, JSAs reviewed, near misses reported, actions closed. They are the only ones you can act on before somebody is hurt.

Reporting, and what a rising near-miss rate means

A near miss had the potential to cause harm and did not, on this occasion. The distinction between it and an injury is frequently luck.

Near misses are the cheapest information a site will ever get, and they are only available if people report them.

Stop work authority

Any person may stop work they believe to be unsafe, without penalty. That is the policy, and it is worth nothing until it is tested.

Who is responsible

The safety officer advises and monitors. The line manager or supervisor owns the safety of the work, exactly as they own its quality and its progress.

What to take away

• A hazard has the potential to harm; a risk is the chance and severity of it doing so.
• The hierarchy of control is ordered by how much each level depends on human behaviour. PPE is last because it depends on it entirely.
• An assessment whose controls are all PPE has skipped four levels. Record why they were rejected.
• A JSA works at the level of the task and is reviewed with the crew.
• Leading indicators are the ones you can act on. A good injury record says nothing about major hazard control.
• A rising near-miss rate usually means improving culture, not a more dangerous site.
• Stop work authority is established or destroyed the first time somebody uses it.
• The safety officer advises; the supervisor owns the risk.