Gain ISO 45001 confidence, understand modern safety management principles, and help create safer, more resilient workplaces.
A damaged electrical cable, an unguarded machine or a wet floor may be easy to recognise as a hazard. But identifying the hazard does not tell you how serious the risk is or what should be controlled first. This is where many organisations get stuck: they spot the danger but stop short of understanding how likely it is to cause harm and what to do about it. Understanding hazard identification vs risk assessment is essential for building a genuinely effective approach to workplace safety, and it's a core requirement under ISO 45001 hazard identification and ISO 45001 risk assessment processes.
What is the difference between hazard identification and risk assessment? Hazard identification finds what could cause harm. Risk assessment evaluates the risk associated with that hazard, considering factors such as possible consequences and likelihood or exposure, so the organisation can prioritise controls. In short: identification tells you what could go wrong; assessment tells you how bad it could be and what to fix first.
Hazard identification is the process of finding sources, activities, conditions or situations in the workplace that have the potential to cause injury or ill health. It is the essential first step before any meaningful evaluation can take place — without a clear picture of what hazards exist, there is nothing concrete to assess.
Hazards can take many forms, including moving machinery, electricity, hazardous substances, working at height, manual handling, noise, biological exposure, and psychosocial hazards such as excessive workload or workplace violence. A thorough workplace hazard identification process looks beyond the obvious and considers how work is actually carried out day to day. This is the foundation of occupational hazard identification and underpins every subsequent step in an organisation's OH&S management system.
Want to understand how hazard identification fits into an OH&S management system? Explore our [ISO 45001 Occupational Health & Safety Management System Awareness] course.
Once a hazard is identified, risk assessment examines what could happen, who might be affected, and how the risk should be prioritised relative to other risks in the workplace. This is where hazard identification and risk assessment start to work together as a continuous process rather than two isolated activities.
Workplace risk assessment typically follows a logical sequence: risk analysis, where the potential severity and likelihood of harm are considered; risk evaluation, where that analysis is weighed against acceptable levels of risk; and finally, the selection of appropriate controls. This structured occupational safety risk assessment process ensures that organisations don't just react to hazards as they appear, but actively manage OH&S risk assessment as an ongoing discipline. OSHA's guidance likewise recommends considering potential severity and likelihood when prioritising corrective action, reinforcing that risk evaluation should always drive decisions about where to act first.
|
Hazard Identification |
Risk Assessment |
|
|
Main question |
What can cause harm? |
How significant is the risk? |
|
Focus |
Source or situation |
Consequence and probability/exposure |
|
Stage |
First |
Follows identification |
|
Result |
Hazard list/register |
Risk rating/priorities |
|
Next action |
Assess |
Control and review |
Hazard ≠ risk. A simple example makes the difference between hazard and risk clear: a moving forklift is the hazard. The potential harm is a collision. The actual risk depends on factors like pedestrian exposure, the layout of traffic routes, vehicle speed, and whatever controls are already in place. Two workplaces with the same forklift hazard could have very different risk levels depending on these conditions — which is exactly why the hazard identification and risk assessment difference matters in practice, not just on paper.
ISO 45001's planning framework, set out in Clause 6, requires organisations to address hazards, OH&S risks, other relevant risks and opportunities, applicable legal and other obligations, and the actions needed to plan for them. ISO's technical committee explains that the risk-assessment methodology and criteria should be established in advance so that assessment is proactive and systematically applied, rather than carried out inconsistently or only after something goes wrong.
Under ISO 45001, hazard identification should not focus only on obvious, everyday hazards. Organisations are expected to consider a much broader scope, including routine and non-routine activities, workers and others who may be affected by the work (such as visitors or contractors), changes within the organisation, emergency situations, past incidents, human factors, and how work is organised. ISO/TC 283 specifically notes that both routine and non-routine activities need consideration, since many serious incidents arise from unusual or infrequent tasks rather than day-to-day operations.
For further detail, see the ISO 45001 official standard information and the ISO/TC 283 ISO 45001 FAQ.
Identifying and evaluating risk is only useful if the results lead to effective action. That is where risk controls enter the ISO 45001 process.
Turning hazard identification into meaningful action requires a clear, repeatable sequence. The ISO 45001 risk assessment process and ISO 45001 hazard identification process typically follow these steps:
These risk assessment steps and hazard identification steps aren't a one-off exercise — they form a continuous loop that feeds back into planning. Understanding how to conduct workplace risk assessment or how to identify workplace hazards means recognising the distinct role each stage plays: hazard identification tells you what can cause harm; risk assessment tells you what needs the greatest attention; risk control determines what you do about it.
Once risks are evaluated and prioritised, the next step is selecting appropriate risk controls. The ISO 45001 hierarchy of controls provides a structured approach: Elimination → Substitution → Engineering Controls → Administrative Controls → PPE.
Controls higher in the hierarchy — elimination and substitution in particular — generally reduce dependence on individual worker behaviour, making them more reliable over time than measures that rely on people remembering to follow a procedure or wear equipment correctly. OSHA recommends selecting controls using a hierarchy and prioritising elimination, substitution and engineering approaches before relying mainly on administrative measures or PPE. This principle underpins ISO 45001 hazard control and ISO 45001 risk controls, and is central to any meaningful risk reduction or preventive safety measures strategy.
See OSHA Hazard Prevention and Control for further guidance.
Example: Unguarded Machinery
The same logic applies across other settings: construction falls call for edge protection and fall-arrest systems ahead of training alone; forklifts require segregated traffic routes before relying on horns and warning signs; hazardous chemicals call for substitution or containment before PPE; electrical maintenance depends on isolation procedures before protective equipment; and healthcare exposure risks are best reduced through engineering controls and safe systems of work before administrative measures.
This ISO 45001 risk assessment checklist and hazard identification checklist can serve as a quick workplace risk assessment checklist during audits or internal reviews.
Professionals responsible for workplace safety need to understand how hazard identification, risk assessment, controls, worker participation and continual improvement fit together within an OHSMS. Build a practical understanding of these principles with our [ISO 45001 Occupational Health & Safety Management System Awareness] course.
Hazard identification and risk assessment are connected, but they perform different jobs. Hazard identification determines what can cause harm. Risk assessment evaluates the significance of that risk. ISO 45001 then connects both activities with planning, risk controls, worker participation and continual improvement to support safer workplaces — which is why understanding hazard identification vs risk assessment matters for anyone responsible for workplace safety.
