Hazard identification and risk assessment at system level

The maturity check in lesson 1 had scored hazard identification as one of Harrowgate Foods Ltd.'s weakest elements. That surprised some managers, because the company did plenty of risk assessments: pre-start checks, a job hazard analysis for every new machine, and a forklift risk assessment the insurer had asked for. When Elena laid out all the existing assessments on a table in the main plant's boardroom, the problem became visible. They were uneven, used four different scoring schemes, covered machines thoroughly but hardly touched chemicals, ergonomics, heat, fatigue or harassment, and most had not been revisited since they were written. Nobody could answer a simple question: what are our ten highest risks right now, across all three sites?

This lesson covers how a management system turns scattered assessments into a single, living process for identifying hazards, assessing risks and choosing controls, and how that process connects to everything else in the system.

Hazards, risks and the purpose of the process

A hazard is a source with the potential to cause injury or ill health: a moving conveyor, a forklift, a caustic cleaning chemical, a hot oven, a heavy box, a night shift that runs twelve hours, an abusive customer on the phone. Risk combines how likely a hazardous event or exposure is with how severe the resulting harm could be. The point of the process is not to produce scores. It is to make sure the organization knows its hazards, understands which matter most, and has effective controls in place for them, with the most serious getting the most attention.

Management system standards require a process for hazard identification that is ongoing and proactive, not a one-off survey. It should take account of a long list of factors, which can be grouped as follows.

• How work is organized: workload, hours of work, shift patterns, leadership, culture and social factors, including the psychosocial hazards covered by ISO 45003.
• Routine and non-routine activities: normal production, but also cleaning, maintenance, changeovers, breakdowns, start-up and shutdown, which is where many serious injuries happen.
• Past incidents: inside the organization and in similar organizations, and their causes.
• Emergencies: fires, ammonia releases, severe weather, medical emergencies.
• People: workers, contractors, agency workers, visitors and others near the workplace, including people with different needs, such as young workers, pregnant workers, older workers and people with disabilities.
• Workplace design: layout, equipment, materials, the physical environment and how people interact with them.
• Changes: new equipment, processes, products, people or knowledge, and changes in the law (lesson 8).

The list reads like a checklist, and it can be used that way to test whether an existing process is complete. Elena compared Harrowgate Foods Ltd.'s existing assessments against it and found the biggest gaps in non-routine work, psychosocial hazards, health hazards with long latency such as noise and flour dust, and the people who were not regular employees.

A tiered approach

No organization can assess every hazard in the same depth. Harrowgate Foods Ltd. designed a three-tier process, scaled to the risk.

• Tier 1, the site hazard register. A high-level inventory of hazards by area and activity at each site, built by teams of supervisors and workers walking through every area on every shift. It answers the question: what could hurt people here, and roughly how badly?
• Tier 2, task risk assessments. Detailed assessments, often job hazard analyses, of specific high-risk tasks identified in tier 1: sanitation of the spiral conveyor, ammonia system maintenance, forklift operations in the freezer, mixing tank entry. These describe each step, the hazards and the controls.
• Tier 3, point-of-work checks. Short assessments done by the worker or crew just before starting a task, especially non-routine work, such as a field-level hazard assessment or pre-task card. HSE-230 covers these in detail.

The tiers connect. A hazard found in a point-of-work check that is not in the register goes back to tier 1. A task assessment that relies on a control which fails in the field triggers a review. Each tier feeds the others, which is what makes it a process rather than a pile of documents.

Building the register with the people who do the work

The site hazard registers were built by mixed teams: a supervisor, two or three workers from the area, a maintenance person and, for the first pass, Elena or one of the trained joint occupational health and safety committee members. Each team walked its area on each shift, including nights and weekends, when the work, the staffing and the hazards were different. They asked workers at each station the same questions Elena had asked in her first month: what could hurt you here, what makes the job harder to do safely, what goes wrong?

Nights produced the most new hazards. At the main plant, the night sanitation crew described hot water hoses at 80 °C (176 °F) whipping when couplings failed, chemical foaming units that occasionally sprayed back, and the long walk with a heavy hose reel up a narrow mezzanine stair. None of these appeared in any existing assessment, because the assessments had been done on day shift.

Assessing risk

Organizations use many methods to assess risk, from simple qualitative judgments to quantitative analysis. Whatever method is chosen must be defined, consistent and proportionate. Harrowgate Foods Ltd. replaced its four scoring schemes with one five-by-five matrix, scoring likelihood and severity from 1 to 5. The severity scale was defined in words tied to real outcomes: 1 for first aid, 3 for a lost-time injury with full recovery, 5 for a fatality or permanent disability. The likelihood scale described how often the event could happen given current controls.

Two rules made the matrix more useful than the old ones. First, any hazard with a severity of 5 was flagged for special attention regardless of its likelihood score, because rare events with fatal outcomes are exactly the ones a likelihood score tends to understate. This connects to the work on serious injury and fatality prevention in HSE-401. Second, each risk was scored twice: as it was with existing controls, and as it would be after the planned controls. The difference showed what each improvement bought.

Choosing controls: the hierarchy

Once risks are assessed, the organization decides on controls. Management system standards require controls to be chosen using the hierarchy of controls, which ranks them from most to least effective.

• Eliminate the hazard: remove it altogether, such as automating a manual cleaning task so nobody enters the conveyor.
• Substitute with something less hazardous: a less corrosive sanitizer, a lighter container.
• Engineering controls: physical changes that separate people from the hazard, such as guards, interlocks, barriers between walkways and forklift routes, local exhaust ventilation, relocated disconnects.
• Administrative controls: procedures, training, signs, scheduling, supervision, permits, job rotation.
• Personal protective equipment: gloves, hearing protection, face shields, freezer suits.

The hierarchy reflects a simple fact: controls higher up work regardless of what people do on a busy night, while controls lower down depend on people remembering, choosing and being able to follow them every time. Most real solutions combine several levels. The spiral conveyor's controls ended up as relocated disconnects (engineering), a revised sanitation schedule that removed the 5:00 a.m. restart pressure (administrative), a lockout procedure with photographs of each isolation point (administrative), and cut-resistant sleeves for the remaining reach-in tasks (PPE).

The risk register

The output of the process is a risk register: a list of hazards, their assessed risks, the controls in place, the additional controls planned, owners and dates. The register is not an end in itself. It drives objectives (lesson 4), operational controls (lesson 8), training needs (lesson 7), inspections and audits (lesson 10) and management review. Elena's test for whether the register was alive was simple: could each site manager name the five highest risks at their site without looking, and say what had changed about them in the past three months?

# Extract from the company risk register: risk before and after planned controls.
# Scores are likelihood x severity on a 5 x 5 matrix.
register = [
    ("spiral conveyor sanitation",  4, 5, 2, 5),
    ("freezer forklift traffic",    4, 4, 2, 4),
    ("mixer noise, sauces plant",   5, 3, 2, 2),
    ("hot water hose failure",      3, 3, 2, 3),
    ("night shift fatigue",         3, 4, 2, 4),
    ("abusive calls, dispatch desk", 4, 2, 2, 2),
]
def band(score):
    return "very high" if score >= 15 else "high" if score >= 10 else "medium" if score >= 5 else "low"
for name, l0, s0, l1, s1 in sorted(register, key=lambda r: -r[1] * r[2]):
    before, after = l0 * s0, l1 * s1
    flag = "  severity 5: review controls" if max(s0, s1) == 5 else ""
    print(f"{name:<29} {before:2d} {band(before):<9} -> {after:2d} {band(after)}{flag}")

spiral conveyor sanitation    20 very high -> 10 high  severity 5: review controls
freezer forklift traffic      16 very high ->  8 medium
mixer noise, sauces plant     15 very high ->  4 low
night shift fatigue           12 high      ->  8 medium
hot water hose failure         9 medium    ->  6 medium
abusive calls, dispatch desk   8 medium    ->  4 low

The spiral conveyor stays flagged even after its planned controls, because its worst outcome is still severe. That is deliberate. A severity of 5 means the controls must be verified often and treated as critical, a theme that returns in lesson 8.

Psychosocial hazards

Psychosocial hazards arise from how work is designed, organized and managed: excessive workload, long or unpredictable hours, lack of control, poor support, harassment and violence, and badly managed change. They can cause stress, anxiety, depression and physical illness, and they also raise the risk of other injuries through fatigue and distraction. ISO 45003 gives guidance on managing them within an OHS management system, and the revision of ISO 45001 expected in 2027 is likely to strengthen requirements in this area.

Harrowgate Foods Ltd. added psychosocial hazards to the site registers. At the distribution centre, the dispatch desk received abusive calls from delivery drivers and customers during peak season; at the main plant, mandatory overtime before holidays meant some workers did six twelve-hour shifts in a row. These were assessed with the same matrix and controlled with the same hierarchy: redesigning the peak-season schedule, setting overtime limits, giving dispatch staff a script and the authority to end abusive calls, and training supervisors to recognize distress. In Nova Scotia, the harassment prevention rules in Part 27 of the Workplace Health and Safety Regulations, in force since September 1, 2025, also required a written harassment prevention policy and program, which the company built into the same process.

Keeping assessments current

An assessment is only as good as its last review. Harrowgate Foods Ltd. set review triggers: every register reviewed at least once a year; any assessment reviewed after an incident or near miss involving the hazard, after a change (lesson 8), when a control fails in the field, when workers raise a concern, or when new information emerges, such as a new exposure limit. Each review was done with workers from the area, and the date and participants were recorded.

Health hazards with long latency

Some hazards cause harm slowly, years after exposure, which makes them easy to underrate in a matrix that focuses on events. Flour dust in the bakery can cause occupational asthma; noise at the sauces plant causes permanent hearing loss over years; repetitive packing tasks contribute to musculoskeletal disorders. Harrowgate Foods Ltd. assessed these hazards using exposure measurements where possible, compared with occupational exposure limits, and used the severity of the long-term outcome, not the absence of any immediate injury, when scoring. The flour dust assessment led to a monitoring program, local exhaust at the dusting stations and a health surveillance program for bakery workers, designed with an occupational health nurse.