How to identify, assess and control workplace risk under the HSWA
Under the HSWA you must eliminate risks so far as is reasonably practicable, and if you can't, minimise them using the hierarchy of controls. A risk assessment is how you work that out; a hazard register is how you record it. Together they are the backbone of a compliant health and safety system.
A hazard is a source of harm. A risk is the chance that the hazard actually harms someone, combined with how serious that harm could be.
For example, a chemical is a hazard; the risk is the likelihood and severity of someone being harmed by it — which depends on how it is stored, handled and controlled. Getting this distinction right matters, because the law is about managing risk, not just listing hazards. Your job is to find the hazards, judge the risk, and put controls in place that bring the risk down as far as is reasonably practicable.
Under section 30 of the HSWA, you must first try to eliminate risks so far as is reasonably practicable. If a risk can't be eliminated, you must minimise it so far as is reasonably practicable.
“Reasonably practicable” means what a reasonable business would do, weighing up the likelihood of harm and how serious it could be, what you know (or ought to know) about the hazard and the ways to control it, and the availability and cost of those controls. Cost only excuses you when it is grossly disproportionate to the risk — you cannot skip an obvious, affordable control just because it is inconvenient.
When you can't eliminate a risk, you minimise it by working down the hierarchy of controls — from the most reliable (engineering out the risk) to the least (relying on people and PPE).
| Rank | Control type | Examples |
|---|---|---|
| 1. Eliminate | Remove the hazard entirely. | Stop doing the task, remove faulty equipment, design the hazard out. |
| 2. Substitute / isolate / engineer | Minimise the risk — these three sit at the same level. | Swap for a safer material; separate people from the hazard; guard, extract or automate. |
| 3. Administrative controls | Change the way people work. | Safe procedures, training, signage, job rotation, permits. |
| 4. PPE | The last line of defence, used with higher controls — not instead of them. | Gloves, hearing protection, respirators, eye protection. |
Based on regulation 6 of the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016. PPE alone is rarely enough — WorkSafe expects higher-order controls to be considered first.
A risk assessment follows a simple loop: identify, assess, control, record, review.
You must engage with your workers when identifying hazards and deciding controls — they often see risks and practical fixes that management misses.
A hazard register is a living record of your hazards, the risks they create, the controls in place, who is responsible, and when each will be reviewed.
The HSWA does not use the words “hazard register”, but it does require you to identify hazards, manage risks so far as is reasonably practicable, and be able to show how — and a register is the standard, practical way to do that. A useful register captures, for each hazard:
The key word is “living” — a register that is written once and never updated is worse than useless. Review it on a regular cycle and whenever you bring in new work, new equipment, or after an incident.
Book a demo and we'll show you how it works — free 30-day trial included.
A hazard is a source of harm (for example, a chemical or a moving machine). A risk is the chance that the hazard actually harms someone, together with how serious that harm could be. Health and safety law is about managing the risk, not just identifying the hazard.
The hierarchy of controls ranks ways of managing risk from most to least reliable: eliminate the hazard first; if you can't, minimise the risk by substituting, isolating or engineering it out (these sit at the same level), then administrative controls, then PPE as a last resort. It comes from regulation 6 of the General Risk and Workplace Management Regulations 2016.
The HSWA does not name a “hazard register”, but it requires every business to identify hazards, manage risks so far as is reasonably practicable, and be able to demonstrate how. A hazard register is the standard, practical way to meet and prove those duties.
Review them on a regular cycle and whenever something changes — new work or equipment, a change in how work is done, or after an incident or near miss. A register that is never updated does not reflect your actual risks and offers little protection.
No. PPE is the lowest-ranked control and the least reliable. You must first consider eliminating the risk, then higher-order controls such as substitution, isolation, engineering and administrative controls. PPE is used alongside those higher controls, not instead of them.
