See how teams reduce incidents and manage risk faster See It in Action →
A defined risk control process brings consistency to how risks are identified, prioritized and managed across an organization, helping ensure that controls are selected and maintained in a way that reduces the likelihood of harm.
The four-step process outlined below draws inspiration from the risk management principles found in international guidance ISO 31000 and the Safe Work Australia Code of Practice. While every organization’s approach to this risk control process will vary based on operations, industry requirements and risk profile, this process provides a strong foundation for what a continuous, proactive management cycle should incorporate.
The risk management cycle begins with identifying the risks that exist in the workplace. This task doesn’t belong to just one person or title; supervisors, safety committees and workers all have a role in recognizing and identifying unsafe working conditions.
While the specific hazards and risks will vary from organization to organization, common hazards include:
| Hazard Category | Examples of Hazards |
| General |
|
| Biological |
|
| Chemical |
|
| Electrical |
|
| Gravity |
|
| Mechanical |
|
| Pressure |
|
Ready to put this into practice? Download our General Hazard Identification Checklist to start working through your facility.
Besides the controls themselves, one key line of defense a workforce has against workplace risks is the knowledge to identify, mitigate and manage the unsafe work outlined above. If employees don’t know what unsafe work looks like, they won’t be able to act on or report it.
For a holistic identification of potential risks, train your workforce to ask the following questions to examine and assess the workplace:
How you deliver this training matters almost as much as the content. Use a mix of in-person, online and in-the-flow-of-work refreshers: in-person for job-specific risks, online for standardized baseline training and refreshers delivered while the work is occurring. Don’t wait for a hazard to reveal whether an employee is competent or not; build in hands-on demonstrations or assessments that measure training effectiveness directly.
Risk assessments can take different forms, but they all serve the same general purpose: evaluate the likelihood and severity of a risk so the highest-risk situations get addressed first.
A general risk assessment should assess:
This feeds directly into the following stage, because the most serious risks demand the strictest and most urgent controls.
The risk controls themselves are what actually stand between your workforce and a potential injury or fatality. To protect workers effectively, it’s first essential to understand the hierarchy of controls.
The Hierarchy of Controls (HOC) ranks the most effective ways to control risks, starting with the most effective control and working down to the least effective. This prioritizes eliminating a risk wherever reasonably practicable and minimizing what can’t be eliminated:
To choose the most effective controls, EHS professionals should rely on guidance from:
A critical control is one where, if it fails or is absent, there’s little or nothing standing between a hazard and a serious outcome, and where no other control can realistically compensate for that failure. The result of a critical control failure is often a direct or immediate pathway to a fatality or serious injury.
Any control identified as “critical” should be routinely verified, maintained and kept working. Some industries require organizations to identify and record critical controls for audit purposes, so keeping this information well maintained is crucial for smooth operations.
Want a deeper framework for prioritizing your highest-risk exposures? Visit our Serious Injury and Fatality (SIF) Prevention Hub for tools built specifically around preventing life-altering incidents.
Never assume a control is working just because it was implemented. As operations, equipment, staffing and conditions change, controls may be weakened. Ongoing control verification is therefore necessary to proactively ensure the effectiveness of controls. Verification can take several forms:
The frequency of verification will vary based on severity of the risk and type of control needed. Critical controls, for example, should be reviewed much more frequently than controls for a less severe hazard.
Control verification can be started by the following questions:
The 4-step cycle above should simultaneously be operated on a set schedule as well as triggered by any organizational change that may affect, alter or introduce new risks to a workplace, such as:
This turns the risk control process back into stage one, identify, and keeps the cycle moving continuously.
By following a structured cycle of identification, assessment, control and review, organizations can make better risk-based decisions and direct resources where they will have the greatest impact.
Want to learn more? For more information, consult our risk management resource hub.
Share
