OHSAS 18001 - (Section 4.3. - Planning)

4.3.1. Planning for Hazard Identification, Risk Assessment & Control

Section 3.1.1 Hazard Identification and Risk Assessment - Written Procedure

Is there a written procedure describing how the organisation will identify hazards and assess risks?


Guidance: Effective hazard identification and risk assessment are essential if OH&S management is to be successful. Organisations must decide how they will carry out these activities and record their decisions in a written procedure. This procedure must meet certain requirements and these requirements are dealt with in this section of the evaluation.

Verification guidance: Answer "Yes" to this question if there is a document which purports to be the organisation's hazard identification and risk assessment procedure. The adequacy of the procedure is tested by the other questions in this section of the evaluation.


Question 3.1.1.1

Is the scope of the organisation's hazard identification and risk assessment dealt with adequately in the written procedure on hazard identification and risk assessment?


Guidance: Organisationsmust identify all of their OH&S hazards and assess any OH&S risks associated with these hazards. This will require organisations to identify and record all possible sources of OH&S hazards including, as a minimum, the following.…

  • Routine and non-routine activities.
  • The activities of employees who have access to the workplace.
  • The activities of others who have access to the workplace, for example, contractors and visitors.
  • Workplace facilities provided by the organisation.
  • Workplace facilities provided by others.
  • However, where necessary, consideration may also have to be given to hazards arising from

  • abnormal conditions
  • emergency conditions, and
  • the effects of degradation over time on materials, plant and equipment.

Verification guidance: Answer "Yes" to this question only if the written statement on scope deals adequately with all relevant sources of hazards. A "Yes" answer can be given for a global statement, for example "we will identify all sources of OH&S hazards".


Question 3.1.1.8

Are the uses of hazard identification and risk assessment results dealt with adequately in the written procedure on hazard identification and risk assessment?


Guidance: It is important that the various elements of the OH&S management system are interlinked and the results from hazard identification and risk assessment should be used elsewhere in the OH&S management system. As a minimum, these uses should include the following.…

  • The setting of OH&S objectives.
  • Determination of facility requirements.
  • Identification of training needs.
  • Development of operational controls.
  • As an input to the management reviews.

Organisationsshould decide how these uses of hazard identification and risk assessment results will be implemented and record the relevant mechanisms in writing.

Verification guidance: Answer "No" to this question if the use of results is not dealt with, OR the range of uses dealt with does not include all of those listed in the guidance to this question, OR one or more of the uses is dealt with inadequately, OR the description is inadequate in any other way.

Section 3.1.2 Risk Control Measures - Written Procedure

Is there a written procedure describing how the organisation will deal with risk control measures?


Guidance: OHSAS 18001 requires that organisations have in place arrangements for such matters as the specification, implementation and monitoring of risk control measures and that these arrangements are documented. This question tests whether the organisation has a written risk control measures procedure. The adequacy of this procedure is tested by the rest of the questions in this section.

Verification guidance: Answer "Yes" to this question if there is a document which purports to be the organisation's risk control measures procedure. The adequacy of the procedure is tested by the other questions in this section of the evaluation.


Question 3.1.2.1

Is the specification of risk control measures dealt with adequately in the written procedure on risk control measures?


Guidance: For any given risk, there are usually a number of alternative risk control measures which could be used. However, when factors such as risk reduction, cost and reliability are taken into account, there is normally an optimum measure. Selecting optimum measures will require certain competences and organisations should specify how these competences will be provided.

Verification guidance: Answer "No" to this question if the written procedure on risk control measures does not deal with the specification of risk control measures, OR the selection of optimum risk control measures is not dealt with, OR the provision of relevant competences is not dealt with, OR the specification of risk control measures is dealt with inadequately in any other way.


Question 3.1.2.2

Is the specification of monitoring requirements for risk control measures dealt with adequately in the written procedure on risk control measures?


Guidance: Risk control measures will only remain effective if they remain in place and this will require that they are monitored and corrective action taken when failures to maintain the risk control measure are identified. However, different types of risk control measure have different monitoring requirements and the correct specification of these requirement will require certain competences and organisations should specify how these competences will be provided.

Verification guidance: Answer "No" to this question if the written procedure on risk control measures does not deal with the monitoring requirements for risk control measures, OR the selection of appropriate monitoring requirements for risk control measures is not dealt with, OR the provision of relevant competences is not dealt with, OR the specification of monitoring requirements is dealt with inadequately in any other way.