ISO 45001’s Planning requirements (clause 6.1) mandate a systematic approach to Occupational Health & Safety (OH&S) hazards, risks, and opportunities. In planning the OH&S management system, organizations must explicitly consider hazards, OH&S risks, and OH&S opportunities. Clause 6.1.1 instructs that organizations take into account internal/external issues, interested parties, and scope, and “determine the risks and opportunities that need to be addressed,” including:
- Hazards (see clause 6.1.2.1)
- OH&S risks and other risks (clause 6.1.2.2)
- OH&S opportunities and other opportunities (clause 6.1.2.3)
- Legal and other requirements (clause 6.1.3).
This means ISO 45001 is inherently risk-based: first identify hazards in processes, assess the associated safety risks, and then seek opportunities to improve OH&S performance or the management system. The Planning clause then requires action plans to mitigate significant risks and to pursue those opportunities (clause 6.1.4). In practice, this aligns with a Plan-Do-Check-Act cycle: understand context (clause 4), identify hazards (6.1.2.1), assess risks (6.1.2.2), identify opportunities (6.1.2.3), then implement controls and improvements through the OH&S system.
Definitions: Hazards, Risks, and Opportunities
Understanding key definitions is essential. ISO 45001 defines:
- Hazard: “a source with a potential to cause injury and ill health”. In other words, any condition, material, or situation that could lead to harm. This includes physical hazards (e.g. unguarded machinery, wet floors), chemical/biological hazards (toxic substances, pathogens), ergonomic hazards (repetitive motions, poor workstation design), psychosocial hazards (stress, harassment), etc. For example, a live electrical panel is a hazard: the source of potential harm.
- OH&S Risk: ISO 45001 (clause 3.20) incorporates the ISO definition of risk as the “effect of uncertainty,” but in OH&S terms it is generally taken to mean the combination of the likelihood and severity of harm from a hazard. In practice, we assess each hazard for how likely an incident is and how serious the outcome could be. A given hazard (like the live panel) has an associated risk: e.g. the probability of an electric shock and the severity of injury if it happens. Thus, hazard is the potential source of harm, while risk is the chance that harm will occur and how bad it would be.
- OH&S Opportunity: An opportunity in ISO 45001 is a circumstance that can improve OH&S performance or strengthen the OH&S management system. Unlike hazards, opportunities are positive prospects. Clause 6.1.2.3 requires identifying OH&S opportunities directly related to enhancing OH&S performance (e.g. redesigning a process to eliminate a hazard) and “other opportunities” that improve the system (e.g. new safety technology, improved training). For instance, replacing manual lifting with a mechanical hoist is an OH&S opportunity that eliminates a strain hazard. Other opportunities might come from top-level planning: for example, benchmarking against industry best practices or integrating new safety innovation into processes.
Click HERE for ISO Management Systems (iso 9001, 45001, 14001, 50001, 22000, etc.), Process Safety (HAZOP Study, LOPA, QRA, HIRA, SIS), Quality Management, Engineering, , Project Management, Lean Six Sigma & Process Improvement Self-paced Training Courses
Hazard Identification (Clause 6.1.2.1)
Hazard identification is the cornerstone of ISO 45001. Clause 6.1.2.1 requires an ongoing, proactive process to find all sources of potential injury or ill health in the workplace. Typical steps include:
- Walk the work areas: Inspect each process, task and facility. Observe operations, materials, equipment and workstations. Look for physical hazards (e.g. wet/slippery floors, machine pinch-points), chemical/biological hazards (toxic fumes, bloodborne pathogens), ergonomic issues (awkward postures, repetitive tasks) and human factors (fatigue, stress).
- Consult stakeholders: Talk with workers, supervisors and safety committees. Workers often know about hidden hazards (e.g. a near-miss or recurring unsafe practice) that management might miss. Use hazard checklists, Job Safety Analyses (JSA/JHA), or previous incident reports to jog memories.
- Consider scope of activities: Include normal operations (daily manufacturing, patient care, etc.), non-routine work (maintenance, infrequent tasks), emergencies and changes (planned modifications, downtime, new equipment). ISO 45001 explicitly calls for covering “normal and non-normal activities” so nothing is overlooked. For example, work during holidays or unplanned overtime can introduce hazards (e.g. inexperienced cover staff).
- Document the hazards: Use a hazard register or risk assessment form. Record where and how each hazard exists. Group similar hazards and note any existing controls.
A systematic Hazard Identification and Risk Assessment (HIRA) process typically follows these core steps:
- Hazard Identification: List all sources of potential harm (as above).
- Risk Evaluation: For each hazard, assess the likelihood and severity of an adverse event if the hazard were realized (e.g. use a risk matrix or scoring).
- Risk Ranking: Classify risks (e.g. High/Medium/Low) to prioritize controls.
- Control Implementation: Apply the hierarchy of controls – aim to eliminate the hazard first, or substitute, engineer controls, administrative measures, and finally PPE – until risks are reduced to an acceptable level.
- Review & Communication: Document findings and controls, communicate them to affected employees, and schedule periodic reviews. HIRA is not one-time; it should be repeated after incidents or when processes change (e.g. new machines, new chemicals).
Throughout this process, ISO 45001 stresses worker participation and competency. A cross-functional team including safety specialists, production personnel and management ensures comprehensive hazard recognition. Leadership must visibly support the process, allocating time and resources for inspections and employee training.
OH&S Risk Assessment (Clause 6.1.2.2)
Once hazards are identified, the next step (clause 6.1.2.2) is to assess the OH&S risks they pose. This means analyzing each hazard to determine:
- Who might be harmed, and how (operators, bystanders, contractors, etc.);
- Likelihood of occurrence (e.g. rarely vs. frequently);
- Severity of consequences (e.g. minor injury vs. fatality).
Common methods include qualitative or quantitative risk matrices or scoring systems. For example, an ungarded machine (hazard) might be assigned a high likelihood (frequent operation) and high severity (amputation), yielding a high risk that demands immediate control. In contrast, a minor spill in a low-traffic area might be low risk.
Key elements of an effective risk assessment include:
- Use of Criteria: Define what risk levels require action. An organization typically sets risk acceptance criteria (e.g. all “high” risks must be eliminated or controlled immediately).
- Consultation: Engage workers and experts during assessment – their input ensures practical controls. Legal and other requirements must be considered (e.g. exposure limits, safety standards).
- Documentation: Record the risk rating and chosen controls for each hazard. This is important evidence for audits.
- Hierarchy of Controls: Prioritize eliminating the hazard entirely. If not possible, apply engineering safeguards (e.g. machine guards, ventilation) before relying on training or PPE.
Organizations have flexibility in how they conduct risk assessments (ISO 45001 does not prescribe a single metho), but the process must be systematic and maintain documented information. The outcome is a ranked list of OH&S risks and a plan of mitigations.
Click HERE for ISO Management Systems (iso 9001, 45001, 14001, 50001, 22000, etc.), Process Safety (HAZOP Study, LOPA, QRA, HIRA, SIS), Quality Management, Engineering, , Project Management, Lean Six Sigma & Process Improvement Self-paced Training Courses
Identifying OH&S Opportunities (Clause 6.1.2.3)
ISO 45001 goes beyond risk avoidance by requiring identification of opportunities. These are chances to improve health and safety performance or the OH&S system itself. Opportunities fall into two categories (as per the standard and guidance):
- OH&S Performance Opportunities: Ways to directly improve safety. For example, redesigning a process to remove a hazard, adopting safer technology, or enhancing training. If machinery with pinch-points is identified, an OH&S opportunity might be to upgrade to a safer machine or automate the task. Such opportunities are “directly related to enhancing your OH&S performance”.
- OH&S Management Opportunities: Improvements to the system or culture that indirectly boost safety. Examples include better safety communications, improved hazard reporting processes, stronger worker participation, or benchmarking against best practices. A new software for tracking incidents or an executive safety leadership program would fit here.
Systematic approaches to find opportunities include:
- Process Redesign Reviews: During hazard analysis or safety audits, ask “how can we eliminate this hazard?” For instance, eliminating unnecessary work at height by performing tasks on the ground.
- SWOT or Strategic Analysis: Senior management can use tools like SWOT (Strengths, Weaknesses, Opportunities, Threats) or strategic planning to identify high-level improvement areas (e.g. emerging safety technologies, changes in regulations).
- Benchmarking and Audits: Learning from incidents (internal or industry) can highlight areas for improvement. Auditing the OH&S management system itself often reveals “opportunities” for stronger procedures or training.
Opportunities should also be documented and pursued much like risks: ISO 45001 expects action plans for them (clause 6.1.4). In practice, once opportunities are identified, organizations treat them like objectives or improvements, assigning resources and timelines. For example, if an opportunity is recognized to improve ergonomics, a plan might be made to introduce adjustable workstations and train employees on proper lifting techniques.
Click HERE for ISO Management Systems (iso 9001, 45001, 14001, 50001, 22000, etc.), Process Safety (HAZOP Study, LOPA, QRA, HIRA, SIS), Quality Management, Engineering, , Project Management, Lean Six Sigma & Process Improvement Self-paced Training Courses
Industry Examples
The general principles above apply in all sectors. Here are some industry-specific illustrations of hazard/risk/opportunity identification in action:
- Manufacturing: A factory may have physical hazards like moving machine parts, heavy loads, noise and poor lighting, as well as chemical hazards (solvents, cutting fluids) and ergonomic hazards (repetitive assembly tasks). Risk assessment might rank machine entanglement and chemical exposures as high risks. Opportunities here include automating repetitive lifts, enclosing noisy equipment, or substituting less-toxic materials. For example, a major automotive plant using ISO 45001 might systematically identify material-handling hazards and then install improved machine guards and mechanical lifts. Worker suggestions often reveal near-miss scenarios that become new controls (e.g. adding floor markings to prevent forklift collisions).
- Construction: Hazards abound in construction: falls from height, falling objects, electrical contact, heavy equipment, and exposure to dust or asbestos. A comprehensive hazard ID covers each project phase (site prep, framing, finishing). For instance, excavations pose cave-in risks, while roofing work poses fall risks. Risk assessments then specify controls like fall arrest systems, scaffolding standards and frequent equipment inspections. The ISO framework encourages planning these for each project and change – one construction firm using ISO 45001 treated each new site plan as an opportunity to identify site-specific hazards (e.g. overhead power lines) and train crews accordingly. It also highlighted opportunities like using prefabricated components to reduce on-site labor. As a guidance example, some companies develop detailed risk assessments for working at heights, heavy equipment operation, and electrical safety, then implement measures (enhanced fall protection, lockout/tagout, emergency procedures).
- Healthcare: Hospitals and clinics face unique hazards: biological (infectious diseases, needlesticks), chemical (disinfectants, chemotherapy agents), ergonomic (patient lifting), and psychosocial (stress, violence). ISO 45001 drives these organizations to map patient-care processes for hidden hazards (e.g. poor needle disposal leading to needlestick risk) and staffing patterns that cause fatigue. Risk controls might include mechanical lift devices, sharps safety training, and strict infection-control protocols. Opportunities here often focus on improving safety culture: for example, implementing a zero-harm objective for bloodborne exposures, or introducing a hospital-wide safety incident reporting system. As one healthcare network found, ISO 45001 helped identify critical risks in patient handling and needle protocols; addressing these opportunities involved adopting lifting equipment and stricter infection controls. Similarly, enhancing campus security and staff training were opportunities to reduce workplace violence risk.
Challenges and Best Practices
Implementing ISO 45001’s hazard–risk–opportunity approach can be challenging. Common issues include:
- Confusion over definitions: Practitioners often conflate hazard and risk. Remember: a hazard is a potential source of harm; a risk is the likelihood/severity of that harm. Training staff on the ISO definitions helps. Walking through “hazard → risk → opportunity” in order simplifies understanding.
- Comprehensiveness: Ensuring all hazard types are considered – including psychosocial and human factors – requires discipline. ISO 45001 explicitly calls out hazards like stress, bullying and violence, which organizations often overlook. A best practice is to use broad hazard checklists or brainstorms (covering physical, chemical, biological, ergonomic, and psychosocial hazards).
- Leadership and participation: Top management support is vital. ISO 45001 raises employee involvement to a requirement: workers must be consulted in hazard/risk identification. Visible leadership (walk-arounds, safety committees) strengthens the process. In practice, organizations find that mobilizing “safety champions” on the floor and ensuring management attends safety meetings uncovers hazards early.
- Maintaining momentum: Hazard identification and risk assessment must be ongoing. Establish triggers for re-assessment (new equipment, incidents, staffing changes). Embedding HIRA into management of change processes (clause 8.1.3) is a best practice so that planned changes are risk-assessed before implementation.
- Using the hierarchy of controls: A key ISO 45001 principle is to prefer hazard elimination/substitution. As one guidance notes, applying controls in order of effectiveness is crucial. For example, if a chemical hazard is identified, first seek a safer substitute before relying on PPE.
Best practices to address these challenges include documenting procedures (so hazard ID is systematic and repeatable), training assessors in risk methodology, and setting clear risk criteria. Leveraging tools (checklists, software, or even simple spreadsheets) and reviewing them in regular safety meetings keeps the process alive. Finally, make use of continuous improvement: use audit findings and incident investigations to feed back into hazard identification and opportunity review.In summary, ISO 45001 provides a robust framework: identify hazards, assess related risks, and spot opportunities for improvement. By following its clauses (particularly 6.1.2.1–6.1.2.3) and engaging across the organization, safety managers and auditors can systematically reduce threats and raise safety performance across industries.
Click HERE for ISO Management Systems (iso 9001, 45001, 14001, 50001, 22000, etc.), Process Safety (HAZOP Study, LOPA, QRA, HIRA, SIS), Quality Management, Engineering, , Project Management, Lean Six Sigma & Process Improvement Self-paced Training Courses