Risk Management Including Dynamic Risk Assessment

Protecting the health and safety of people in the workplace is quite rightly, a community expectation that also makes good business sense. It is a legal requirement to provide a safe and healthy workplace so far as is reasonably practicable. A safe and healthy workplace and compliance with the law, does not happen by chance or guesswork. It happens due to consultation, planning and a sound methodology for managing health and safety risk.

The method does not require elaborate systems or large amounts of paper to support it. How the method is put into action depends on the complexity of the hazards or risks, the nature of the organisation and how business is conducted.

In straightforward situations, the method is no more than a way of thinking through a problem and taking the necessary action. In complex situations or in large organisations, robust systems and procedures to support the method may be needed to ensure good health and safety outcomes and compliance.

Risk management should be based on the results of consultation on the following

• Identifying hazards in the workplace
• Assessing the level of risk
• Controlling the hazard and associated risks to prevent harm
• Reviewing the controls and revising if necessary

What is consultation?

Consultation is sharing information with directly affected employees and giving those employees a reasonable opportunity to express their views and contribute to the decision-making process. These views must be taken into account. Where there are elected Health and Safety Representatives (HSRs) they must be involved in the consultation process. It is recommended that employees are advised of the outcomes in a timely manner.

Note - it is a legal requirement that consultation must take place when identifying or assessing hazards or risks that may harm people and when making decisions on how to control risks that may cause harm.

What is a hazard?

A hazard is something currently, or may in future be, in the work environment that has the potential to cause harm to people.

What is a risk?

A risk is the chance (or likelihood) that a hazard will cause harm to people.

What do we mean by harm?

Harm is death, injury, illness (including psychological illness) or disease that may be suffered by a person from a hazard or risk.

What is a risk control?

A risk control is a thing, work process or system of work that eliminates a hazard or risk or, if this is not reasonably practicable, reduces the risk so far as reasonably practicable.

What does reasonably practicable mean?

The test for what is reasonably practicable is an objective test that commits to the highest level of protection for people against risks to their health and safety and is proactive in taking measures to protect the health and safety of people. In applying the concept of reasonably practicable, careful consideration must be given to the following

• The likelihood of the hazard or risk concerned eventuating
• The degree of harm that would result if the hazard or risk eventuated
•  What the person (duty holder) concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk

Note - this is sometimes referred to as the state of knowledge

• The availability and suitability of ways to eliminate or reduce the hazard or risk
• The cost of eliminating or reducing the hazard or risk

Note – there must be a clear presumption in favour of safety.

Identifying hazards in the workplace

When identifying hazards, consider inspecting the workplace, finding and applying available information to your workplace, testing and measuring and conducting surveys of employees (including contractors).

Hazard identification outcomes (such as a hazard register) provide a complete knowledge of the hazards for the part of the workplace assessed and provide a list of what the hazards were and where they were identified.

Assessing the level of risk

Risk assessment is a process for developing knowledge and understanding about hazards and risks so that sound decisions can be taken about control.

Note - A formal risk assessment is unnecessary if the knowledge and understanding already exist. However, there will be many times when a risk assessment is the best way of building knowledge and understanding.

A risk assessment will provide knowledge to make informed decisions about controlling hazards and risks. The risk assessment needs to be tailored to the situation and to the organisation in which it is conducted; it can be as simple as structured discussion during consultation or it can be more elaborate and formal.

When should a risk assessment be done?

• There is only limited knowledge about a hazard or risk, or about how the risk may result in injury or illness
• There is uncertainty about whether all of the things that can go wrong have been found
• The situation involves a number of different hazards that are part of the same work process or piece of plant and there is a lack of understanding about how the hazards may impact upon each other to produce new or greater risks

When is a risk assessment not necessary?

• Health and safety laws require some hazards or risks to be controlled in a specific way - these requirements must be complied with
• Other laws require specific risk controls to be implemented, eg gas and electrical safety and dangerous goods laws - these requirements must also be complied with
• A WorkSafe Compliance Code or other WorkSafe guidance sets out a way of controlling a hazard or risk and the guidance is applicable to the situation – this guidance can simply be followed
• There are well known and accepted controls that are in widespread use in the particular industry, that are suited to the circumstances in the workplace and provide acceptable control of the hazards or risks - these controls can simply be implemented

Dynamic risk assessment

A dynamic risk assessment is the process of continually observing and assessing the hazards and risks in a high risk, changing and challenging environment. This allows employees to quickly identify new hazards and risks and control them.

Note – formal risk assessments are prepared in advance, recorded and monitored on a regular basis. Dynamic risk assessment, by its very nature, is likely to evolve in an ever changing manner and is usually carried out by an individual when they enter a new environment or a changing environment eg when responding to an emergency situation.

Dynamic risk control

• Evaluate – what is the task, what is happening or could happen and what are the hazards?
• Select – What do I plan to do and how do I plan to do it?
• Assess – What risks are associated with what I plan to do?
• Decide – Is the plan safe? Do the benefits outweigh the consequences? What action is required?
• Modify if necessary – Can I make the task safer?
• Proceed – If safe to do so, note what may be changing and re-evaluate

Note – responder safety is paramount

Controlling hazards and risks to prevent harm

Duty-holders are required to ensure health and safety by controlling risks. Risks must be controlled by eliminating them so far as reasonably practicable or, if this is not possible, reducing the risks that remain so far as reasonably practicable.

Use the hierarchy of control and for each level determine if it is ‘reasonably practicable’ to implement

• Eliminate the hazards or eliminate the risks
• Change the risks to reduce them by substituting the risks with lesser risks or reduce the risks through engineering changes or changes to systems of work or isolating people from the risks
• Change people to reduce the risks by reducing the level of harm using administrative actions or using personal protective equipment to protect people from harm

According to the above ranking:

The most effective protection measure is to eliminate the risk, which can be done by eliminating the hazard. If the hazard cannot be eliminated, then eliminate as many of the risks associated with the hazard as possible.

The second most effective measure is to reduce the risks that remain by changing the risk to reduce the likelihood and/or level of harm. These measures are more effective than those that rely on controlling the behaviour of people.

The least effective measure is to change the way people expose themselves to the risk or their behaviour. This does nothing to change the risk itself but relies on protecting people by controlling the behaviour or skill levels of people, limiting the chance of human failure, limiting exposure time or by providing personal protective equipment for people to use.

Note – all risk controls are important, a combination of controls is likely in most cases. The OHS regulations contain requirements concerning the order in which the controls referred to above must be considered. These regulations must be complied with.

Reviewing the controls and revising if necessary (checking and maintaining)

Controls that are put in place to protect the health and safety of people need to be monitored to ensure that they are effective. This requires checking them and ensuring that processes are put in place to identify and quickly fix any problems.

The same processes used to identify hazards in the first place (such as workplace inspections and testing and measuring) can be used to monitor effectiveness.

There are certain situations where the OHS Regulations require hazard and risk control measures to be reviewed and, if necessary, revised. These situations generally arise when

• The hazard or risk changes. This can occur if there is a change to the thing, work process or system of work that gives rise to the hazard or risk.
• The current control measures do not adequately control the hazard or risk.
• An HSR requests a review on reasonable grounds.Risk 

Consider the following to maintain effective risk controls over time

• Clear allocation of health and safety responsibility to ensure procedures are current and followed
• Regular consultation with employees and HSRs
• Effective communication – appropriate language, signs and symbols are used
• Employees have up to date training, competency, hazard information and risk assessments

The whole process need to be managed. Hence – risk management!

Internal and/or external audits may assist in identifying the effectiveness of risk management processes.

It may well be worth considering formalizing your management system for managing health and safety against an Australia/ New Zealand Standard (AS/NZS 4801:2001 - Occupational health and safety management systems - Specification with guidance for use) or

International Standard AS/NZS ISO 45001:2018 (Occupational health and safety management systems - Requirements with guidance for use)

Some helpful links are provided below

Consultation checklist https://content.api.worksafe.vic.gov.au/sites/default/files/2018-06/ISBN-Checklist-for-health-and-safety-consultation-2012-10.pdf

Controlling OHS hazards and risks – a handbook https://content.api.worksafe.vic.gov.au/sites/default/files/2018-06/ISBN-Controlling-OHS-hazards-and-risks-handbook-2017-06.pdf

AS/NZS 4801:2001 - - Occupational health and safety management systems - Specification with guidance for use

 https://www.standards.org.au/standards-catalogue/sa-snz/publicsafety/sf-001/as-slash-nzs--4801-2001

AS/NZS ISO:2018 - Occupational health and safety management systems - Requirements with guidance for use

https://infostore.saiglobal.com/en-us/standards/as-nzs-iso-45001-2018-1134148_saig_as_as_2678690/