Risk assessment sits at the heart of ISO 45001, the international standard for occupational health and safety (OH&S) management. Get it right and the rest of the system, from training to emergency plans, follows logically. Get it wrong and you end up with paperwork that does not reflect the real dangers in your workplace.
Many small businesses assume an ISO 45001 risk assessment is a new, complicated exercise on top of what the law already requires. It is not. If you already carry out workplace risk assessments, you have a strong starting point. ISO 45001 asks you to make that work systematic, involve your workers, and look a little wider than individual tasks.
This guide explains what the standard requires, walks through a practical five-step method, and shows what auditors expect to see.
What ISO 45001 Requires
The core requirements sit in clause 6.1.2 of ISO 45001:2018, “hazard identification and assessment of risks and opportunities.” In plain language, the standard asks you to do four things on an ongoing basis:
- Identify hazards: anything with the potential to cause injury or ill health, including physical, chemical, biological, ergonomic and psychosocial hazards.
- Assess the risks those hazards create, taking into account the controls you already have.
- Consider other risks to the management system itself, such as losing a key competent person or failing to keep up with legal changes.
- Look for opportunities to improve health and safety, such as redesigning a task to remove a hazard altogether.
Clause 8.1.2 then requires you to reduce risks using the hierarchy of controls, and clause 8.1.3 requires you to reassess risks when something changes, such as new equipment, a new site or a new way of working. Clause 6.1.3 links risk assessment to your legal requirements.
The process must be proactive rather than reactive. Waiting for an accident before assessing a task does not meet the standard. You also need to keep documented information about the process and its results.
Legal Risk Assessment Versus ISO 45001
In many countries a risk assessment is already a legal duty. In the UK, employers must assess workplace risks under the Management of Health and Safety at Work Regulations 1999, and record the significant findings if they employ five or more people. In Ireland, the Safety, Health and Welfare at Work Act 2005 requires written risk assessments and a safety statement. In the US, OSHA’s General Duty Clause requires a workplace free from recognized serious hazards. ISO 45001 builds on these duties. It adds worker participation, a wider view of risk, and a cycle of review and improvement.
Hazards, Risks and Opportunities: Getting the Terms Right
A hazard is something that can cause harm, such as a forklift, a solvent, a wet floor or an unrealistic workload. A risk is the combination of how likely harm is and how serious it would be. An OH&S opportunity is a chance to improve health and safety performance, for example by automating a manual handling task.
Keeping these terms distinct makes your assessments clearer. A common mistake is to list “risk of slipping” as a hazard. The hazard is the wet floor. The risk is how likely a slip is and how badly someone could be hurt.
ISO 45001 also asks you to consider who could be harmed. That includes employees, temporary and agency workers, contractors, visitors and, where relevant, members of the public. Do not forget people working alone, at night, remotely or at client sites.
A Five-Step ISO 45001 Risk Assessment Method
ISO 45001 does not prescribe a method. The approach below is simple, widely used and easy to defend at audit.
Step 1: Identify Hazards
Walk through every activity, location and type of work. Use several sources: workplace inspections, conversations with workers, incident and near-miss records, safety data sheets, equipment manuals and industry guidance. Remember routine and non-routine work, such as maintenance, cleaning, breakdowns and emergencies. Include psychosocial hazards, such as excessive workload, lone working, harassment and poor job design, which ISO 45001 explicitly covers.
Step 2: Decide Who Could Be Harmed and How
For each hazard, note the groups of people at risk and the way harm could happen. Think about people who may be more vulnerable, such as new or young workers, pregnant workers, people with disabilities and anyone who does not speak the main working language.
Step 3: Evaluate the Risk
Rate the risk using a consistent method. Many SMEs use a five-by-five matrix that multiplies likelihood by severity. Rate the risk with existing controls in place, then decide whether it is acceptable or whether more action is needed. Keep the scoring method documented so different assessors reach similar results.
| Score | Likelihood | Severity | Typical Action |
|---|---|---|---|
| 1 | Rare | Minor first aid | Accept and monitor |
| 2 | Unlikely | Injury needing treatment | Review at next scheduled assessment |
| 3 | Possible | Lost-time injury | Improve controls within an agreed period |
| 4 | Likely | Serious or long-term injury | Act promptly and assign an owner |
| 5 | Almost certain | Fatality or permanent disability | Stop the activity until controls are in place |
Risk rating equals the likelihood score multiplied by the severity score, giving a range from 1 to 25. Many businesses treat 1 to 6 as low, 8 to 12 as medium and 15 to 25 as high. Set your own bands and apply them consistently.
Step 4: Apply the Hierarchy of Controls
Where risk needs reducing, ISO 45001 requires you to work down the hierarchy of controls, starting with the most effective option. Lower levels are only used when higher ones are not reasonably practicable, and often in combination.
| Level | What It Means | Example |
|---|---|---|
| Elimination | Remove the hazard entirely | Deliver goods at ground level so no one works at height |
| Substitution | Replace with something less hazardous | Switch to a water-based cleaning product |
| Engineering controls | Isolate people from the hazard | Machine guarding, local exhaust ventilation |
| Administrative controls | Change the way people work | Safe systems of work, rotas, signage, training |
| Personal protective equipment | Protect the individual | Gloves, safety glasses, hearing protection |
Step 5: Record, Communicate and Review
Record the significant findings, the controls in place and any actions with owners and dates. Share the results with the people affected, for example through toolbox talks or team briefings. Review each assessment at planned intervals, after an incident or near miss, and whenever something changes.
Common Risk Assessment Findings at ISO 45001 Audits
- Generic assessments copied from templates that do not match the actual workplace.
- No evidence that workers were consulted or took part in identifying hazards.
- Psychosocial hazards, such as workload and lone working, left out entirely.
- Controls that jump straight to PPE without considering higher levels of the hierarchy.
- Assessments not reviewed after an incident, a near miss or a change in equipment or process.
- Actions raised but never closed, with no owner or target date.
Involving Workers in Risk Assessment
Worker participation is one of the biggest differences between ISO 45001 and earlier approaches. Clause 5.4 requires you to involve non-managerial workers in identifying hazards, assessing risks and choosing controls. This is not just a box to tick. The people doing the job usually know where the real dangers are, and they are more likely to follow controls they helped design.
Practical ways to show participation include asking workers to help carry out assessments, reviewing draft assessments at team meetings, running a short hazard-spotting session during toolbox talks, and providing a simple way to report hazards and near misses without fear of blame. Keep evidence, such as attendance lists, meeting notes or signed briefings.
Keeping Assessments Current
A risk assessment is a living document. Plan reviews on a fixed cycle, often annually for low-risk activities and more frequently for high-risk ones. Also trigger a review when you introduce new equipment, substances, sites or ways of working, after any incident or near miss, when legal requirements change, and when monitoring shows controls are not working.
A risk register that lists each assessment, its rating, its owner and its next review date makes this easy to manage and is something auditors often ask to see.
A Worked Example: Clarevault
Clarevault is a 19-person B2B software company in London. In this illustrative example, Clarevault decides to pursue ISO 45001 because an enterprise customer asks for it. The team’s first thought is that an office business has few hazards worth assessing.
A workshop with staff shows otherwise. Alongside display screen equipment and slips and trips, employees raise long hours during product launches, isolation among people working mostly from home, and evening travel to client sites. Clarevault rates workload during launches as a medium risk.
Instead of relying on advice to “take breaks,” Clarevault works down the hierarchy: launches are rescheduled so they never overlap (eliminating the peak), on-call duties are rotated, and managers receive training on spotting signs of stress. The assessment is reviewed after each launch. At Stage 2, the auditor highlights the treatment of psychosocial risk as a strength.
Looking Ahead: The ISO 45001 Revision
ISO 45001 is being revised. A Draft International Standard was published in June 2026, and certification bodies expect a new edition in 2027, although the date is not yet confirmed. Reported themes include psychosocial risk and wellbeing, remote and hybrid work, and climate-related hazards such as extreme heat. A risk assessment process that already covers these areas will need little change when the new edition arrives.