Evotix Guide

Frameworks for EHS Risk Management

Risk is everywhere.

Almost all aspects of a business are subject to unexpected, consequential risk. Organizations who want to better manage risk shouldn’t just account for the worst-case scenario; they should actively plan for it.

This guide outlines an overview of risk management principles, teaches safety professionals how to plan for the unexpected and offers a look at where risk management frameworks are headed.

What you’ll find in this guide:

Overview of risk management fundamentals

Understand how risk can be defined.

ISO 31000 frameworks

See the guidance laid out by ISO 31000.

Spotlight on EHS risks

See how not managing EHS risk can cost you.

Best EHS risk management tools

Learn about the risk matrix, bowtie and register.

Rethinking risk management

See why it’s important to rethink the approach to risk management.

Where risk management is headed

Get the latest insights from industry research.

Overview of Risk Management Fundamentals

Risk management centers around assessing, controlling and monitoring the consequences of any given workplace risk. These risks can take many forms, including cultural, environmental, health, production loss, organizational, process safety, psychosocial, reputational, safety and strategic risks.

Risk itself can be broken down and defined in a few important ways:

Inherent risk is the level of danger a hazard presents before any controls are applied. It’s risk in its rawest form, unadjusted by anything your organization has done about it yet.

Residual risk is what’s left after controls are in place. No control removes risk completely, so there’s almost always some residual risk remaining, even around a hazard that’s well managed.

Target risk is the level your organization is aiming to bring residual risk down to. It’s typically set using As Low As Reasonably Practicable (ASARP), and it reflects what’s considered acceptable to both the organization and its regulators. If residual risk sits above target risk, that’s a sign more effective controls are needed.

Risk appetite is the level of risk an organization is willing to accept in pursuit of its objectives. It’s what determines where target risk gets set for any given hazard, and it shifts depending on the severity of what could go wrong.

Risk tolerance is the trigger for when a risk requires attention and corrective action. It is an acceptable deviation for risk and is a specific, measurable signal.

In practice, risk management comes down to keeping residual risk at or below target risk, through consistent application of controls and regular verification that those controls are working.

To help organizations better manage risk across their wider operations, the International Organization for Standardization (ISO) has defined a standardized framework for risk management: ISO 31000.

ISO 31000

ISO 31000 defines a universal risk management principle, framework and process that applies across almost any type of industry, sector and risk profile. It serves as the backbone that many occupational health, environmental, and safety risk management programs are built on, including ISO 45001 for occupational health risks and ISO 14001 for environmental risks, both of which are certifiable.

This standard is built around three elements:

Principles establish the characteristics of effective risk management. These principles emphasize creating and protecting value, integrating risk management into decision-making, considering human and cultural factors and continuously improving over time.
Framework provides the organizational structure needed to embed risk management into governance, strategy, planning and daily operations. This helps ensure that risk management is treated as part of how the organization operates.
Process outlines the activities organizations use to manage risk, including identifying, analyzing, evaluating, treating, monitoring and communicating risk.

Many EHS professionals apply the principles, frameworks and processes outlined in ISO 31000 to environmental, health and safety risk management. In practice, this means identifying, assessing, controlling and monitoring the EHS risks that have the greatest potential to cause harm.

Spotlight on EHS Risk Management

Unlike some business risks that primarily affect revenue, reputation or strategy, environmental, health and safety risks can have immediate and irreversible consequences. Serious injuries, fatalities, occupational illnesses and environmental incidents have direct impacts on workers, families, communities and organizations alike.

This is why EHS risk management remains a critical business function. In fact, EHS risks have an impact on four important organizational drivers:

Moral: All organizations have an obligation to provide a duty of care to workers, the community and the environment. This incorporates an ethical responsibility to manage all risks that could result from an organization.
Financial: The sum of fines, penalties, insurance premiums and indirect costs add up over time; it is estimated that for every $1 spent on direct incident costs, an additional $3 is spent on indirect costs. A reactive approach to workplace injuries and incidents often costs organizations significantly more over time than preventing them in the first place.
Commercial: Committing to a strong, proactive risk management program communicates a positive reputation to investors, clients and the community. This can lead to increased business opportunities and provide a stronger competitive advantage.
Operational: Incidents that occur as a result of improper risk management can negatively impact an organization’s production, downtime, stability and efficiency.

“Health and safety is just one piece of risk management. But an organization could also lose headcount, there could be reputational loss, they might experience extreme weather, and so on. That is all risk. So health and safety is a tiny, tiny slice of risk management, but it’s not the whole piece.”

David Lemon, EHS Specialist at Evotix

Best Risk Management Tools For EHS Professionals

To help manage health and safety risks, EHS professionals rely on a series of risk management tools to measure, identify, assess and control workplace risk:

Risk Matrix

A risk matrix provides a framework for scoring the overall consequence of a risk, combining the severity and likelihood of a risk to produce a “Low,” “Medium” or “High” rating. This tool helps EHS professionals prioritize which workplace risks require the more urgent and strict controls.

Risk Assessment

A risk assessment analyzes and evaluates the risks associated with workplace hazards and produces suitable controls to eliminate or reduce risks to acceptable levels. There are several types of risk assessments useful for health and safety professionals, and many of the tools on this list help feed into the effectiveness of an assessment.

Risk Bowtie

The risk bowtie is a diagram built to illustrate the causes of, preventative barriers, consequences and mitigation controls of a hazard.

Risk Register

A risk register is a documented log of identified risks. This register is a central record that ties together risk description location, date, responsible owner or department, controls and treatment plan.

Download our free risk register template

Get a practical framework you can adapt to your organization’s EHS needs.

Many organizations begin managing risk with manual versions of these tools. As operations grow, managing assessments, registers, critical controls and corrective actions becomes increasingly difficult without dedicated risk management software.

Why It's Time to Rethink Risk Management

Even with an abundance of incident data, technology and progress, the number of injuries and fatalities tied to unaddressed workplace risk has stayed stubbornly high. The UK’s Health and Safety Executive reported 126 workplace fatalities in 2025/26, only two fewer than the 128 recorded the previous year. Any reduction is worth recognizing, but a plateau this gradual suggests risk management has reached a point where a new approach is needed to make real progress again.

The takeaway for EHS professionals is not that risk management isn’t effective. It’s that the frameworks that produced steady improvement over the past few decades may have reached their limit. Closing the remaining gap requires more than adding another checklist. It requires a proactive approach to identifying and controlling risk, one that catches failure points before an incident does.

“We all make mistakes daily. Most of the mistakes don’t result in something going wrong, but no work is perfect. That’s why we’ve got to manage the risks and limit the consequence. That’s all we can do. Striving for perfect will just be imperfect.”

David Lemon, EHS Specialist at Evotix

Where Risk Management Is Headed: Breaking Down Silos

The next evolution in workplace risk control looks beyond physical hazards alone. Insights from recent industry research by Evotix and the What Works Institute point to a growing push to make safety programs more human-centric, factoring in psychological safety, cognitive load and worker wellbeing alongside traditional physical controls. Participants pointed out that stress, fatigue and neurodiversity all shape frontline decision-making in ways that safety systems often fail to account for.

The gap between recognizing this and acting on it remains wide. The vast majority of organizations surveyed acknowledge that human factors such as fatigue, mental health strain and emotional trauma play a role in workplace risk, yet “only 3% report these factors are fully integrated into the EHS management system, 8% mostly, and 89% say they are not or only partially embedded.”

More broadly, organizations should avoid viewing EHS risk in isolation. The same event can simultaneously impact worker safety, production, organizational culture, reputation and long-term business strategy. This is where the principles of ISO 31000 become especially valuable. The standard encourages organizations to take an integrated view of risk, recognizing how cultural, environmental, health, operational, psychosocial, reputational and strategic risks influence one another. As risk management programs mature, leading organizations are building stronger connections between safety, HR, operations, finance and leadership teams to better understand the downstream effects of risk across the business.

The future of risk management is not simply identifying more hazards or collecting more data. It is understanding the relationships between different types of risk and using that knowledge to make better decisions. Organizations that can connect EHS risk to wider business outcomes will be better positioned to protect their people, strengthen operational resilience and support long-term success.

Want to learn more about risk management?

Get the guide to standardize processes and improve visibility across your organization.

Explore Deeper - Risk Management Resources from Evotix

Below are some helpful resources for improving EHS risk management within your organization:

How To Use the Bowtie Method To Manage Risk and Prioritize Actions

How To Track and Close Health and Safety Action Items

What is Risk Management Software?

Tagged Risk Management