A Step-by-Step Guide to Conducting a Risk Assessment

Risk assessments cross my desk constantly, and the ones that fall apart under an inspector’s questions fail in the same place. They name a hazard, give it a colour, and never show the decision that followed. A risk assessment is not a form you fill in. It is the written record of four steps, and Safe Work Australia has set out what each step has to contain.¹

This post is the procedure. Three other posts here answer the questions around it. The Four Types of Risk Management Strategies answers what to do once you have a rated risk: avoid it, reduce it, transfer it, or accept it. Understanding the Importance of Conducting Risk Assessments answers why the law requires one and what happens when it has not been done. The Role of a Risk Register in Effective Risk Management answers what belongs in the register itself. This one answers how you do it.

What the Law Requires Before You Start.

The process has four steps: identify hazards, assess risks if necessary, control risks, and review the control measures to check they are working as planned.¹

They sit under a duty. A person conducting a business or undertaking must eliminate risks to health and safety so far as is reasonably practicable and, where that is not possible, minimise them so far as is reasonably practicable.² Reasonably practicable is weighed on the likelihood of the risk, the degree of harm, what is known about the risk and the ways of removing it, the availability and suitability of those ways, and only then cost, which counts only where it is grossly disproportionate to the risk.¹

Five model WHS Regulations carry the shape of the whole exercise. Regulation 34 requires a duty holder to identify reasonably foreseeable hazards; 35 requires elimination first and minimisation second; 36 sets the hierarchy of control measures; 37 requires controls to be kept fit for purpose and used correctly; 38 requires them to be reviewed.³

The code of practice carries more weight than guidance usually does. It is an approved code under section 274 of the WHS Act, it is admissible in court proceedings, and a court may rely on it in deciding what was reasonably practicable.¹ Each jurisdiction approves it separately, so check the edition your own regulator has adopted; the ACT approved the current one by notifiable instrument on 11 August 2025, commencing 5 November 2025.⁴

Step 1: Identify the Hazards.

You are looking for things and situations that could cause harm, physical or psychological. The code groups them by source: the physical work environment, the equipment, materials and substances used, the work tasks and how they are performed, work design and management, and workplace interactions or behaviours.¹

Who does it. The PCBU, which in practice means whoever has management or control of the workplace. Officers, including directors, carry a separate due diligence duty to understand the hazards and to resource the process properly.¹

Who you consult. Workers who are, or are likely to be, directly affected, and their health and safety representatives. The WHS Act defines a worker broadly, and the code spells it out: contractors and subcontractors and their employees, on-hire workers, outworkers, apprentices, trainees, and volunteers.¹ On a site running prequalified contractors that is not a formality, because the code names people who do not normally work there as more likely to suffer harm.¹

What gets written down. A list of the hazards you find, including the ones already controlled, kept and updated at the next inspection.¹ Three methods produce it: walking the workplace, consulting workers, and reading what you already hold - health monitoring, incident records, workers’ compensation claims, near misses, complaints, sick leave, turnover, and earlier investigations.¹

Step 2: Assess the Risk Where the Answer Is Not Already Known.

This is the step most people think is the whole job, and the one the code says you can often skip. Where a hazard and its risk are well known and have well established, accepted control measures, formally assessing the risk is not required; you may simply put the controls in.¹

Do one when there is uncertainty about how a hazard may cause injury or illness, when an activity involves several hazards and it is not clear how they interact, or when changes may have affected whether the existing controls still work.¹

What it produces. How severe the risk is, whether existing controls are effective, what action to take, and how urgently.¹ Severity comes from asking what harm could occur, how long and how often people are exposed, how many are exposed, and whether one failure could trigger others. Likelihood comes from how often the task is done, how close people get, and whether it has happened before. The code offers a five-point scale: certain to occur, very likely, possible, unlikely, and rare.¹

How much work it is. As little as a conversation with your workers, or as much as specialist analysis. Noise and airborne contaminants carry exposure standards and may need measurement by a competent person.¹ You need not repeat the same assessment endlessly either: regulation 12 allows one assessment across a class of hazards, tasks, things, or circumstances, provided they are all the same and nobody ends up exposed to a greater, additional, or different risk.³

When a Risk Assessment Is Mandatory, Not Merely Good Practice.

This is the part worth knowing by heart. In the model WHS Regulations as at 1 July 2024:³

• Confined spaces. Regulation 66: a risk assessment by a competent person before anyone enters, recorded in writing, covering whether the work can be done without entering at all, the nature of the space, any change in oxygen or contaminant concentration, the method of working, and the rescue procedures required.
• Energised electrical work. Regulation 158: a risk assessment before the work commences, conducted by a competent person, and recorded.
• General diving work. Regulation 176: a risk assessment by a competent person, recorded in writing.
• Lead processes. Regulation 402: every lead process assessed to determine whether lead risk work is carried out in it.
• High risk construction work. Regulation 299: a safe work method statement before the work starts, identifying the work, specifying the hazards and risks, describing the control measures, and describing how they will be implemented, monitored, and reviewed. Regulation 291 defines high risk construction work across 18 categories, from a risk of falling more than 2 metres to work near powered mobile plant, near energised electrical installations, or in a trench deeper than 1.5 metres.

Worth saying plainly, because it is usually assumed the other way: for hazardous chemicals the model regulations impose a duty to manage risks under Part 3.1 and to have regard to specified matters, not a standalone written risk assessment. The code names confined spaces, diving work, and live electrical work as its mandatory examples.¹ In construction, the trigger you will meet most is the safe work method statement, not a regulation using the words risk assessment.

Step 3: Control the Risks in the Order the Regulations Set.

The hierarchy is a legal order, not a menu. Regulation 36 applies once eliminating the risk is not reasonably practicable, and then it sets the sequence.³

1. Eliminate the hazard. The most effective control and the cheapest at the design stage. The code’s own example is removing a fall risk by doing the work at ground level.¹
2. Substitute something safer. Water-based paints instead of solvent-based, or letting workers set line speed rather than having a computer pace the line.¹
3. Isolate it from people. Guardrails around exposed edges and holes in floors, remote control of machinery, chemicals in a fume cabinet, or a physical barrier between a forklift route and a walkway.¹
4. Engineer it out. Trolleys and hoists for heavy loads, guards on moving parts, residual current devices, or sound dampening.¹
5. Administrative controls. Safe work procedures, training and instruction, behavioural policies, limits on exposure time, and warning signs.¹
6. Personal protective equipment. Regulation 44 requires PPE selected to minimise risk, suitable for the work, of suitable size and fit, reasonably comfortable, maintained and replaced, with training in its use.³

Rows 2 to 4 sit at one legal level: regulation 36(3) lets you use one or more of substitution, isolation, and engineering controls. Administrative controls come next under 36(4) and PPE last under 36(5).³ The code is blunt about why the bottom two are last. They do not control the hazard at its source and they rely on human behaviour and supervision, so use them to back up a higher control, as a short-term measure until something better is available, or as a last resort.¹

Two rules about money are worth quoting to anyone who pushes back. Cost may be taken into account in deciding what is reasonably practicable, but it cannot be a reason for doing nothing, and it cannot justify a control that relies on changing people’s behaviour when substitution, isolation, or engineering is available.¹

Step 4: Review the Controls, and What Forces a Review.

Reviewing is what turns an assessment into a system. Regulation 38 sets five circumstances in which a duty holder must review and, if necessary, revise a control measure: it is not controlling the risk so far as is reasonably practicable, a change is coming that may give rise to a new or different risk the control may not handle, a new hazard or risk is identified, consultation indicates a review is needed, or a health and safety representative requests one.³

Outside those five, review on a cycle set by the level of risk; the code says controls for high risks should be reviewed more often.¹ Its own questions are worth putting straight into the form. Are the controls working in operation as well as on paper? Have they introduced new problems? Are the procedures actually being followed?¹

In ComplyFlow this is a Risk Review, scoped to one or more risk categories and the sites you want covered. Each Risk Owner receives an action for every risk they own, reviews the controls, updates the residual risk, and marks the action complete; the review closes when every owner has.⁵ That is what stops a review becoming one safety manager reading 400 rows on a Friday.

How a Risk Matrix Works, and Where It Stops Working.

A matrix crosses a likelihood rating against a consequence rating and returns a band. It is genuinely useful for one thing: deciding what to fix first. The code tells you to prioritise areas for action, focusing on the hazards with the highest level of risk.¹ Then come three limits, and they matter because the matrix is the part of an assessment most often mistaken for the assessment itself.

Safe Work Australia does not prescribe one. The code gives a five-point likelihood scale and a set of questions for estimating severity, and its own risk register template asks plain questions rather than for a score: what harm could the hazard cause, what is the likelihood, what is the level of risk, how effective are the current controls, what further controls are required, who is actioning it, and by when.¹

The rating does not change the duty. Regulation 35 requires elimination so far as is reasonably practicable whatever band a risk lands in.³ A low score is not a reason to stop looking.

And multiplying likelihood by consequence hides the code’s most important instruction about severe hazards. Where a hazard could cause death, serious injury, or illness, more emphasis should be given to controls that reduce the level of harm than to those that reduce the likelihood of harm occurring.¹ A rare event that kills people is not the same problem as a frequent one that bruises them, even when the arithmetic puts them in the same cell.

In ComplyFlow the initial risk is set on a matrix of likelihood and consequence, each control carries its own hierarchy of control level, and the residual risk is rated once the controls are applied. The Updating a Risk article in the ComplyFlow Help Centre walks through the fields.⁶ Recording the hierarchy level on the control is the part that pays off later, because it shows an auditor how much of your protection rests on a sign and a toolbox talk.

What You Write Down, and How Long You Keep It.

Records are what demonstrate you did the work. The code says to keep the identified hazards, the assessed risks, and the chosen control measures, including the checklists and worksheets used along the way; how and when the controls were implemented, monitored, and reviewed; who you consulted; the relevant training records; and any plans for changes.¹

Where the regulations make an assessment mandatory they also set how long it lives. A confined space, energised electrical work, or diving work assessment must be kept for at least 28 days after the work it relates to is completed, and at least 2 years if a notifiable incident occurs in connection with it. Over that period a copy must be available for inspection under the Act and available to any relevant worker on request.³

That last clause is the one people miss. Holding the assessment is not enough; the worker doing the job has to be able to ask for it and get it. A folder in a site office satisfies that for one site and fails for twelve, which is the argument for keeping all of it in a risk register everyone can reach.

The Assessment Is the Decision, Not the Form.

The four steps are a chain of decisions and each link has to be visible. A hazard nobody wrote down was not identified. A control nobody can trace to a level in the hierarchy is a preference, not a control. A review nobody recorded did not happen, and regulation 38 is what you will be asked about.

Do the first three steps this week on one work area, with the people who actually do the work, and put the fourth in the calendar with a named owner. That is a defensible risk assessment. The rest is formatting.