Risk assessments (HIRA) explained, with a free template

A risk assessment answers three questions about a piece of work: what could hurt someone, how likely and how bad is it, and what are we doing about it. In South Africa it is often called a HIRA, short for hazard identification and risk assessment. This guide explains where the duty comes from, walks through a simple method, and gives you a printable template.

Where the duty comes from

The OHS Act does not use the word "HIRA", but it requires the thinking behind one. Under section 8(2), an employer’s duties include:^[1]

• taking reasonably practicable steps to eliminate or mitigate any hazard before resorting to personal protective equipment (8(2)(b))
• establishing, as far as is reasonably practicable, what hazards are attached to the work, the substances and the machinery in the business, and what precautionary measures should be taken, and providing the means to apply them (8(2)(d))
• not permitting anyone to do the work until those precautionary measures have been taken (8(2)(f))

Section 13 then requires employees to be made conversant with the hazards of their work and the precautions to take.^[1] A risk assessment is how you work out what to tell them.

On construction sites

The Construction Regulations, 2014 are more specific. Under regulation 9(1), a contractor must, before construction work starts and while it continues, have risk assessments performed by a competent person appointed in writing. The risk assessments form part of the site’s health and safety plan and must include:^[2]

• the identification of the risks and hazards to which people may be exposed
• an analysis and evaluation of those risks and hazards, based on a documented method
• a documented plan and safe work procedures to mitigate, reduce or control them
• a monitoring plan
• a review plan

Regulation 9(2) adds that ergonomic hazards must be analysed, evaluated and addressed as far as is reasonably practicable.^[2]

A simple way to run a HIRA

The law asks for a documented method, not a particular one. The steps below are a common approach and match the headings in our template.

1. Break the work into tasks. Assess the work as it is actually done: "lifting roof trusses with the crane", not just "roofing".

2. List the hazards for each task. Think about falls, moving machinery, vehicles, electricity, falling objects, manual handling, chemicals, noise, heat and the conditions on that particular site.

3. Say who could be harmed and how. Workers doing the task, others nearby, visitors, the public.

4. Note the controls already in place. Edge protection, permits, guards, trained operators, barricades, personal protective equipment.

5. Rate the risk. A common method scores likelihood and consequence from 1 to 5 each and multiplies them, giving a risk score from 1 to 25. Whatever method you use, write it down so others apply it the same way.

6. Decide further controls. Work through them in order of effectiveness: remove the hazard, substitute something less hazardous, engineer it out, change the way the work is done, and only then rely on personal protective equipment. That order reflects section 8(2)(b), which puts protective equipment last.^[1]

7. Give each action an owner and a date, and re rate the risk. A control nobody owns tends not to happen.

8. Set a review date. Review when the work, the site, the equipment or the people change, after an incident or near miss, and on a regular date.

Using the template

The HIRA template is a printable A4 landscape PDF with:

• a header for the site, the task or activity, the assessor, the date and the review date
• a worked rating guide for likelihood and consequence
• a table with columns for the hazard, who could be harmed, existing controls, likelihood, consequence, risk score, further controls, the person responsible, the due date and the residual risk
• a sign off block for the assessor and the person approving it

Print it, complete it with the team on site, and keep the signed copy with the site’s records.

Keeping risk assessments current

The hardest part of a risk assessment is keeping it current as the work changes. ProComply’s risk assessments register keeps each assessment with the task, site, assessor and document, marks it as current, review due or overdue, and reminds you 90 and 30 days before the review date.