Choosing a method: legal duties, standards and the technique toolbox

There are dozens of risk assessment techniques. IEC 31010:2019, the international companion to ISO 31000, describes more than forty, from brainstorming and checklists to Monte Carlo simulation and Bayesian networks. No organization uses them all, and choosing the wrong one wastes time or, worse, gives false confidence. A full quantitative risk assessment of an office photocopier is a waste of money; a quick checklist for a new chlorine unloading station is negligent. This lesson explains what the law and the main standards require, how to sort techniques into families, and how to match the method to the question being asked.

What the law requires

In the United States, OSHA does not have a general risk assessment standard. The General Duty Clause, section 5(a)(1) of the OSH Act, requires employers to protect workers from recognized serious hazards, and many standards require specific hazard assessments: 1910.132(d) for personal protective equipment, 1910.146 for confined spaces and 1910.147 for energy control procedures. Some states go further: California's Injury and Illness Prevention Program rule, Title 8 section 3203, requires employers to identify and evaluate workplace hazards, and Washington requires an Accident Prevention Program. Apart from process safety, the law does not name a technique; the employer chooses a method that suits the hazard.

Process safety: where methods are named

For facilities with highly hazardous chemicals above threshold quantities, OSHA's Process Safety Management standard, 1910.119, is explicit. Paragraph (e) requires a process hazard analysis (PHA) using one or more of these methods, as appropriate: what-if, checklist, what-if/checklist, hazard and operability study (HAZOP), failure mode and effects analysis (FMEA), fault tree analysis, or an appropriate equivalent. The PHA must be done by a team that includes someone experienced in the process and someone knowledgeable in the method, must be updated and revalidated at least every five years, and its recommendations must be resolved and documented. The EPA Risk Management Program rule, 40 CFR Part 68, requires similar hazard analysis for Program 3 processes. EPA's 2024 Safer Communities by Chemical Accident Prevention rule added requirements such as safer technology analysis and third-party audits; in February 2026 EPA proposed rolling back several of them, so check the current status.

The main standards

ANSI/ASSP Z10.0, the US OHS management system standard, requires a process to identify hazards and assess and prioritize risks. ANSI/ASSP Z590.3, Prevention through Design, focuses on assessing and reducing risk early, when facilities, equipment and processes are designed, and lists techniques such as preliminary hazard analysis, what-if, checklists, FMEA and fault trees. Internationally, ISO 45001 clause 6.1.2 requires organizations to identify hazards and assess OHS risks with a methodology that is proactive rather than reactive.

Two international standards apply everywhere. ISO 31000:2018 gives the overall risk management principles and process. IEC 31010:2019 is the technique catalog: for each method it describes the inputs, outputs, strengths and limitations, and it includes a table showing which techniques suit identification, analysis of consequences or likelihood, evaluation and recording. For process safety and instrumented systems, IEC 61511 (with IEC 61508 for manufacturers) adds LOPA and safety integrity levels, covered in Lesson 10.

Families of techniques

It helps to group methods into a few families. Qualitative methods describe risk in words or categories, such as high, medium and low. Semi-quantitative methods use numbers as scores or orders of magnitude, such as a 5 by 5 matrix or a LOPA that works in powers of ten. Quantitative methods estimate actual frequencies and consequences, such as individual risk of death per year or the number of people exposed to a toxic cloud. The more quantitative the method, the more data and expertise it needs, and the more its results can be misused if the inputs are weak.

How to choose

IEC 31010 suggests several questions. What is the purpose: finding hazards, ranking them, sizing a safeguard or proving a risk meets a numerical target? What stage is the project at: concept, detailed design, operation or decommissioning? What information exists: a sketch, piping and instrumentation diagrams (P&IDs), procedures, failure data? How severe could the worst outcome be? What resources, time and expertise are available? And what does the regulator or the company standard require? The answers usually point clearly to one or two methods.

A practical rule is to start simple and escalate. A team screens the activity with a checklist or what-if review and a risk matrix. Most risks fall clearly into the acceptable or clearly-needs-action categories and can be handled there. A few high-consequence scenarios, especially those involving multiple failures or relying on instrumented safeguards, are passed to a more detailed method such as LOPA or a fault tree. Only the highest-consequence, most complex cases need a full quantitative risk assessment. This approach spends effort where it matters.

Combining methods

Most mature organizations use a set of methods that feed one another. A HAZOP identifies a deviation, such as high pressure in a vessel, with a severe consequence. The matrix ranks it as high. LOPA checks whether the existing safeguards reduce its frequency enough and, if not, sets the required integrity of a new safety instrumented function. A bowtie then shows the barriers on one page for operators and managers, and the critical barriers become the subject of inspections and audits. Lesson 12 returns to how these pieces fit into a management system.

It is equally important to know what each method does not do. A HAZOP does not rank risk unless a matrix is attached. An FMEA looks at one failure at a time. A bowtie does not calculate anything. A risk matrix does not identify hazards; it only ranks the ones you have already found. Good practice is to state in the report which methods were used, why, and what their limits are, so that readers do not take more assurance from the study than it can give.

Proportionality in practice

Regulators in both countries expect the depth of an assessment to match the size of the risk. An inspector reviewing a small shop does not expect a fault tree, but will expect to see that hazards were identified with the workers, that the obvious controls are in place and that the assessment was reviewed after changes. An inspector or auditor at a major hazard facility will expect systematic methods, competent teams, documented recommendations and evidence that the critical safeguards are tested. A useful test is to ask whether a reasonable, informed person, reading the assessment after a serious incident, would agree that the effort matched the hazard.

Proportionality also applies within a single facility. A refinery may use HAZOP and LOPA for its process units, JHAs for maintenance tasks, checklists for office areas and a bowtie for each major accident hazard. Writing these choices into the company procedure, with the reasons, makes the approach consistent and defensible.