Why Risk Assessments Are Required, and What Happens Without One

The failure I see most is not a business that never assessed its risks. It is one that did, properly, and then could not find the assessment when it mattered.

So this post is the legal side, not the method: where the obligation comes from, when it becomes a requirement rather than good practice, who holds it when contractors are on site, and what happens when it has not been done. For the procedure, A Step-by-Step Guide to Conducting a Risk Assessment walks the four steps; The Four Types of Risk Management Strategies covers how to treat a risk once you have found it; and The Role of a Risk Register in Effective Risk Management covers what you keep it all in. None of this is legal advice.

Where the Duty Actually Comes From.

The primary duty sits in section 19 of the model Work Health and Safety Act. A business must ensure, so far as is reasonably practicable, the health and safety of workers “engaged, or caused to be engaged by the person”, and of workers whose activities in carrying out work are influenced or directed by the person.¹

That phrase is the one most people read past. The Act’s own definition of a worker covers an employee, a contractor or subcontractor, an employee of a contractor or subcontractor, an employee of a labour hire company assigned to your business, an apprentice, a student on work experience, and a volunteer.¹ The duty is not limited to your payroll. If you caused them to be engaged, they are yours.

Section 19 then names what that covers, including a work environment without risks to health and safety, and safe systems of work. Section 17 requires you to eliminate risks so far as is reasonably practicable and, where you cannot, to minimise them.¹

Section 18 is what a court applies. “Reasonably practicable” weighs the likelihood of the hazard occurring, the degree of harm, what the person knows or ought reasonably to know about the hazard and about ways of eliminating or minimising it, the availability of those ways, and only then the cost, including whether it is grossly disproportionate to the risk.¹ Three of those five limbs are about knowledge. The Act never uses the words “risk assessment”, and it does not need to: an assessment is how a safety manager shows the business knew what it ought reasonably to have known.

When a Risk Assessment Is Mandatory, Not Merely Good Practice.

Sometimes the regulations skip the argument. Safe Work Australia’s code of practice on managing work health and safety risks, November 2024 edition, says a risk assessment is mandatory under the WHS Regulations for certain high-risk activities, “such as, but not limited to, entry into confined spaces, diving work and live electrical work”.²

The regulations are specific about what mandatory buys you. A confined space assessment must be by a competent person, recorded in writing, and reviewed whenever the controls are. Before work on energised electrical equipment, the assessment must likewise be by a competent person and recorded. High risk construction work needs a safe work method statement before work starts, naming the hazards, the risks, the controls, and how those controls will be implemented, monitored, and reviewed. Processing a crystalline silica substance requires an assessment of whether that processing is high risk, and you are forbidden from counting personal protective equipment or administrative controls when you decide.³

The same code is equally clear about when you do not need one. No assessment is required where legislation already requires a hazard to be controlled in a specific way, and a detailed one may not be needed where a code of practice sets out how to control the hazard, or where well-known industry controls suit your circumstances.² For a construction business drowning in paperwork that matters: the requirement is to control the risk, not to generate a document per task.

Who Carries the Duty When Contractors Are on the Job.

This is the section to read twice if you are a principal contractor.

Section 14 says a duty cannot be transferred to another person. Section 16 says more than one person can concurrently have the same duty, each must comply to the standard the Act requires even if another duty holder has the same duty, and each retains responsibility for their own.¹

Then comes the clause that does the real work. Each duty holder must discharge the duty “to the extent to which the person has the capacity to influence and control the matter or would have had that capacity but for an agreement or arrangement purporting to limit or remove that capacity”.¹ A contract handing risk assessments to the subcontractor does not shrink your duty. If the arrangement is the reason you had no control, the Act gives the control back for the purpose of judging you.

Section 46 closes the loop: where more than one person has a duty for the same matter, each must, so far as is reasonably practicable, consult, co-operate, and co-ordinate activities with all the others who hold it.¹ That carries its own penalty, at tier C, a maximum of AU$33,000 for an individual and AU$165,000 for a body corporate for the year from 1 July 2026.⁴

So anyone running a workforce of contractors needs to know which assessments exist across every party on the site, and to be able to show the consultation happened. A shared risk register is the cheapest way to answer that in one place.

What Officers Must Do, All the Way to the Board.

Section 27 reaches past the safety team. If the business has a duty, an officer must exercise due diligence to ensure the business complies with it, and that takes in the chief executive, the chief financial officer, and the board.¹

The Act spells due diligence out as reasonable steps to acquire and keep up to date knowledge of work health and safety matters; to understand the operations and the hazards in them; to ensure the business has and uses appropriate resources and processes to eliminate or minimise risks; to ensure it has processes for receiving information about incidents, hazards, and risks and responding in a timely way; to ensure it has and implements processes for complying with its duties; and to verify the provision and use of all of that.¹

The last one is where boards come unstuck. Verification is not a briefing. A chief executive who has been told the assessments are current has verified nothing; one who has pulled three at random and read the review dates has. An officer can also be convicted whether or not the business itself has been.¹ That is personal exposure, which is why it belongs on a compliance and legal agenda as much as a safety one.

What Happens When It Has Not Been Done.

The enforcement ladder has more rungs than most people expect, and it starts well below a courtroom.

An inspector who reasonably believes a provision is being contravened, or has been contravened in circumstances that make a repeat likely, may issue an improvement notice requiring it to be remedied by a stated day.¹ SafeWork NSW describes the practical effect: the workplace can generally keep operating while the notice is being actioned.⁵

A prohibition notice is a different animal. It applies where an inspector reasonably believes an activity involves, or will involve, a serious risk to health or safety from immediate or imminent exposure to a hazard. It can be given orally and confirmed in writing afterwards, and the activity stops until an inspector is satisfied the matter has been remedied.¹ Unsafe scaffolding is SafeWork NSW’s own example.⁵ No fine is attached, and it is still the most expensive thing that will happen to you that month.

Two routes sit below prosecution. A regulator may issue a penalty notice instead of going to court, set in legislation and much lower than a court maximum, which you can pay or elect to have heard.⁵ Or it may accept a written work health and safety undertaking, which is not an admission of guilt, and which cannot be accepted at all for a Category 1 offence or for industrial manslaughter.¹

Prosecution runs in three categories: gross negligence or recklessness exposing an individual to a risk of death or serious injury; a failure to comply that exposes a person to such a risk; and a failure to comply. For the year from 1 July 2026 the model maximums are AU$2,464,000 for an individual as a business owner or officer and AU$12,321,000 for a body corporate at Category 1; AU$494,000 and AU$2,470,000 at Category 2; and AU$165,000 and AU$827,000 at Category 3.⁴ Jurisdictions set their own amounts and they differ.

Every Australian work health and safety jurisdiction now carries an industrial or workplace manslaughter offence. Safe Work Australia’s comparison table, current at 1 August 2026, puts the maximum for a body corporate at AU$20,000,000 in New South Wales; AU$18,000,000 for the Commonwealth, South Australia, Tasmania, and the Australian Capital Territory; AU$12,610,000 in the Northern Territory; and AU$10,000,000 in Queensland and Western Australia. Victoria’s workplace manslaughter offence, under its own Occupational Health and Safety Act 2004, reaches AU$20,910,000. Western Australia is the only one with a monetary maximum for an individual, at AU$5,000,000; elsewhere the individual penalty is imprisonment with no monetary ceiling.⁶ The prison terms differ, and I have left them out rather than risk one being wrong. Two are worth knowing: the model maximum is 20 years⁴, and the Commonwealth offence carries 25 years with no limitation period on bringing proceedings.¹ Check your own Act, and take advice.

Why an Assessment You Cannot Produce Is an Assessment You Did Not Do.

Here is what turns all of that into a systems problem rather than a legal one.

An inspector in a workplace may require a person to say who has custody of a document and require them to produce it, and where circumstances require immediate access the request need not be in writing at all. Within 30 days of the visit, an inspector can also issue a written notice for specified documents or written answers.¹ The regulations assume you can still lay hands on the record after the job: a confined space risk assessment must be kept for at least 28 days after the work it relates to is completed, and at least 2 years if a notifiable incident occurs in connection with it, and the assessment for energised electrical work carries the same periods.³

The standard you are measured against is a published one. An approved code of practice is admissible in proceedings as evidence of whether a duty has been complied with, and a court may rely on it in deciding what was reasonably practicable.¹ So the question is rarely whether the hazard was knowable. It is what you did about it, on paper, on the day. An insurer assessing a claim and a principal in a contractual dispute ask that same question on a shorter timetable, and neither will wait while somebody checks a site laptop.

That is where a register beats a folder. In ComplyFlow each risk sits against a hazard with an initial score from your own matrix, the controls that mitigate it, an owner, and a residual score the owner or assessor sets; a consolidated view shows each risk once with the highest residual across every site it exists at, so the worst site is the one you see first.⁷ Reviews are scheduled rather than remembered: one-off or repeating every 1, 3, 6, or 12 months, with an action going to every risk owner, and images, comments, and any external audit attaching to the review.⁸ The point is not the scoring. It is that by the time somebody asks, the review history is already written down, with a date and a name on it.

The Three Things to Check This Week.

Pick one high-risk task and time how long it takes to produce the assessment covering it, its controls, and the date it was last reviewed. An hour is fine. A day is a finding, and it is the same finding an inspector would make.

Pick one contractor working on your site and establish who else holds a duty for the same matter you do, and whether you could show you consulted, co-operated, and co-ordinated with them. That is a duty in its own right, with its own penalty, and it is the one most often missed entirely.

Then ask your officers what they last verified, rather than what they were last told. If the honest answer is nothing, you have found the gap section 27 was written for, and you have found it before anybody else did.