How to Build an ISO 45001 Hazard Identification and Risk Assessment Process in 6 Steps

Key Takeaways

• Clause 6.1.2 of ISO 45001:2018 asks for a process that is ongoing and proactive, not a one-time survey of the plant.
• Workers are consultation partners in hazard identification, so their input has to be visible in the records.
• A consistent scoring method matters more than a sophisticated one, because auditors look for repeatable decisions.
• Controls are chosen in the order set by the hierarchy of controls, starting with elimination and ending with personal protective equipment.
• A risk register only works when it feeds operational controls, objectives and management review.

Many plants already walk the floor looking for hazards, but an ISO 45001 hazard identification and risk assessment process asks for something more structured: a method that finds hazards before they hurt someone, ranks them the same way every time, and leaves a trail an auditor can follow. The requirement sits in clause 6.1.2 of ISO 45001:2018, and it covers routine and non-routine work, people on site who are not employees, and situations that change.

The six steps below turn that requirement into a working routine for a manufacturing plant. Each step covers what to do, what you need, and the mistake that most often shows up in audits.

Step 1: Map Plant Operations, Routine Work, and Emergency Scenarios

Start with a map of the work, not a list of hazards. Break the plant into areas, processes and tasks: receiving, press operation, welding, maintenance, shipping, cleaning, and the jobs that happen only during shutdowns or changeovers. The standard expects both routine and non-routine activities to be considered, along with emergency situations.

You need your process maps or work instructions, a site layout, a list of contractors and visitors who enter the floor, and the maintenance schedule. Include night shifts and weekend crews, since their conditions often differ from the day shift.

The common mistake is mapping only what the work instructions say. Real work includes shortcuts, workarounds and tasks nobody wrote down, such as clearing a jam or changing a coolant filter. Ask supervisors what operators actually do between the documented steps.

Two checks keep the map honest:

• Walk each area with the map in hand and mark any task that is missing or described differently than it happens.
• List every emergency the plant could face, such as fire, chemical release, power loss and serious injury, and note who responds to each.

Step 2: Collect Hazard Data Through Worker Consultation and Gemba Walks

Hazard identification works only when the people doing the job are asked. ISO 45001:2018 requires consultation with non-managerial workers and their participation in hazard identification. In an Ontario plant, the joint health and safety committee is a natural place to begin, and the provincial guide to health and safety committees explains how those committees and worker representatives fit into the workplace.

Combine that consultation with gemba walks, which are short, structured visits to the place where the work happens. Bring a simple prompt sheet and ask operators what could hurt them, what almost did, and what they have stopped doing because it felt unsafe.

You need incident and near-miss records, first-aid logs, inspection reports, equipment manuals, safety data sheets, and a channel for workers to report concerns without blame. Hazards are not limited to machinery. Noise, dust, heat, manual handling, repetitive motion, forklift traffic and stress from workload all belong on the list.

The frequent mistake is treating the walk as a management exercise. If the only voices in the record are the safety coordinator and the plant manager, an auditor has little evidence of genuine participation. Record who was consulted, when, and what changed because of it.

Important: Worker participation is a requirement of ISO 45001:2018, not a courtesy. Records of consultation, such as committee minutes, walk notes and reported concerns, are the evidence an auditor will ask to see.

Step 3: Evaluate OH&S Risks Using a Standardized Probability-Severity Matrix

A hazard is a source of potential harm; a risk is the combination of how likely that harm is and how serious it would be. Once hazards are listed, they need to be ranked, and the ranking has to be consistent between assessors. The CCOHS guidance on risk assessment describes common ways of ranking risks and is a practical reference when designing a method.

A probability-severity matrix is the most common approach in manufacturing. Define each level in plain terms so two people scoring the same task reach the same answer.

You need the hazard list from Step 2, the definitions above, and a team of at least a supervisor, an operator who does the task and someone from maintenance or engineering. Score the risk as it exists today, with current controls in place, and then record what the score would be after proposed controls.

The common mistake is a matrix with undefined words. If "likely" means one thing to the safety lead and another to the press operator, the scores become opinions. Calibrate the team by scoring three or four known hazards together before starting the full assessment.

Step 4: Apply the Hierarchy of Controls to Determine Action Priorities

Controls are chosen in a set order. ISO 45001:2018 requires the organization to consider the hierarchy of controls when planning how to reduce risk. The order runs from the most effective to the least:

1. Eliminate the hazard, for example by removing a manual lift through redesigned material flow.
2. Substitute a less hazardous process, material or piece of equipment.
3. Use engineering controls, such as guarding, interlocks, ventilation or lift assists.
4. Apply administrative controls, such as procedures, training, signage and job rotation.
5. Provide personal protective equipment as the last layer, not the first answer.

You need the scored risk register, input from engineering and maintenance on what is feasible, and a realistic view of cost and downtime. The aim is to reach for the highest level of the hierarchy that is practical, then add lower levels where a residual risk remains.

The common mistake is leaning on training and PPE because they are quick to buy and easy to document. A plant that answers every high-scoring risk with a toolbox talk and a pair of gloves has not applied the hierarchy, and a registrar will see the pattern in the register.

Key Consideration: Record why a higher-level control was rejected. A short note such as "guarding not feasible during setup, procedure and lockout used instead" shows the hierarchy was considered, which is what the standard asks for.

Step 5: Document Findings in a Dynamic Occupational Health and Safety Risk Register

The risk register is the working record of the whole process. Each row should carry the area or task, the hazard, who could be harmed, the current controls, the initial score, the planned controls, the residual score, an owner and a review date. Keep it in a format that people can actually update, whether a controlled spreadsheet or a module in a QMS platform.

ISO 45001:2018 requires documented information on the process and on the risks and opportunities it identifies, so the register doubles as audit evidence. It also needs to be reachable: a register locked in the safety manager's folder does not support consultation.

You need a controlled template, a rule for who may edit it, and a version history. Link each action to a due date so the register drives work rather than recording it.

A useful register has these qualities:

• Every high-scoring row has a named owner and a due date, so nothing sits as "ongoing".
• Closed actions show evidence of completion, such as a work order, a photo of the new guard or a revised procedure.
• Opportunities to improve safety, not only threats, are recorded alongside the hazards.

The common mistake is a register that is written for the audit and never opened again. If the last edit was the week before the certification visit, the process is not dynamic, and clause 6.1.2 specifically calls for ongoing and proactive identification.

Step 6: Integrate Assessment Outcomes into Operational Controls and Periodic Reviews

Assessment results have to change how the plant operates. The output of clause 6.1.2 feeds the planning of actions in clause 6.1.4, the operational controls in clause 8.1, the OH&S objectives, training needs and emergency preparedness. If a new risk is scored but no work instruction, lockout procedure or training record moves, the loop is open.

You need a link between the register and the change management process, so that new equipment, new materials, layout changes and new contractors trigger a fresh look at the hazards. The same goes for incidents: an injury or near miss should send someone back to the register to ask whether the risk was scored correctly.

Set a review rhythm that matches the plant. Many plants review the register at least once a year during management review and again whenever something changes. The official ISO explanation of ISO 45001 describes the standard's focus on continual improvement, and the register is where that improvement becomes visible.

Illustrative example: A regional fabricator adds a robotic welding cell. Before commissioning, the change process triggers a hazard review of the cell, the register gains new rows for arc flash, fume exposure and maintenance access, and the controls feed into updated lockout steps and operator training. The cell starts up with its risks already scored and owned.

The common mistake is separating safety from the rest of operations. When the assessment lives only in the safety office, production changes outrun it, and the first sign of the gap is an injury.