A risk assessment is the heart of every health and safety file. It’s also the document that’s most often done badly: copied from somewhere else, full of hazards that don’t apply, and missing the ones that do. This guide walks you through how to do a proper risk assessment for a South African workplace, in five steps.
Is a risk assessment a legal requirement?
Yes. Section 8(2)(d) of the Occupational Health and Safety Act requires every employer to establish what hazards to health and safety are attached to the work, and what precautions are needed. Several regulations also call for specific risk assessments, for example:
- Construction Regulations 2014 (regulation 9): risk assessments by a competent risk assessor before and during construction work.
- Regulations for Hazardous Chemical Agents 2021: assessing exposure to chemicals at work.
- Ergonomics Regulations 2019: assessing ergonomic risks such as lifting, repetitive work and workstation set-up.
- Regulations for noise, asbestos, lead and other physical and biological hazards, where these are present.
Three types of risk assessment
| Type | When | Example |
|---|---|---|
| Baseline | Once, for the whole workplace, then reviewed regularly | An office, workshop or shop’s overall risk profile |
| Issue-based (task) | Before a specific task, project or change | Working on a roof, using a new chemical, moving premises |
| Continuous | Daily or before each job | A pre-task check on site before work starts |
How to do a risk assessment in 5 steps
Step 1: Identify the hazards
Walk through the workplace and look at every activity, from arriving in the morning to locking up. Talk to the people who do the work, because they know where the near misses happen. Check incident records and manufacturers’ instructions. Typical hazards include slips and trips, electricity, working at height, manual handling, chemicals, machinery, vehicles, fire, noise, violence or robbery, and stress.
Step 2: Decide who could be harmed and how
Think about employees, contractors, visitors, customers and the public. Consider people who are more vulnerable, such as new or young workers, pregnant employees, and people working alone or at night.
Step 3: Evaluate the risk
For each hazard, rate the likelihood of harm and the severity if it happens, usually on a scale of 1 to 5. Multiply them to get a risk rating:
| Rating | Risk level | Action |
|---|---|---|
| 1–6 | Low | Manage with normal procedures |
| 8–12 | Medium | Extra controls needed within a set time |
| 15–25 | High | Act immediately; stop the work if necessary |
Do this first for the current situation (inherent risk), and then again after the new controls are in place (residual risk).
Step 4: Control the risk using the hierarchy of controls
Work from the top down, because the higher controls are more reliable:
- Eliminate the hazard: do the work at ground level instead of at height.
- Substitute: use a less hazardous chemical.
- Engineering controls: guards, ventilation, edge protection, residual current devices.
- Administrative controls: procedures, permits, training, signage, job rotation.
- Personal protective equipment (PPE): the last line of defence, never the only one.
For each control, write down who is responsible and by when.
Step 5: Record, communicate and review
Write the assessment down, sign it, and explain it to the people doing the work. Ask them to sign that they understand it. Review it at least once a year, and straight away after an incident, a change in the work or new legislation.
Common risk assessment mistakes
- Copied from another company or industry, so it’s full of hazards you don’t have
- Only PPE listed as a control
- No names or dates for actions, so nothing happens
- Done once and never reviewed
- Workers never told what’s in it
Start from a template that fits your work. Our Office & Small Business Safety File includes 16 office risk assessments (ergonomics, fire, chemicals, working from home, stress and more). The Construction system and Contractor Safety Files include task risk assessments with matching method statements.
Frequently asked questions
Who can do a risk assessment?
For general workplaces, a competent person who understands the work and the hazards, often with input from employees. On construction sites, the Construction Regulations 2014 require a risk assessor appointed in writing with the necessary competence.
How often should a risk assessment be reviewed?
At least once a year, and immediately after an incident, a change in work methods, equipment, premises or staff, or new legislation.
What is the difference between a risk assessment and a method statement?
A risk assessment identifies hazards and controls. A method statement (safe work procedure) describes step by step how the job will be done safely using those controls. On site, you usually need both for each task.
What is a HIRA?
HIRA stands for Hazard Identification and Risk Assessment. It’s another name for the same process described in this guide.
Does a small office need a risk assessment?
Yes. Every employer must assess the hazards of its work, no matter the size. For an office it’s usually short, but it must still be written down and reviewed.
