HIRA Explained: Hazard Identification and Risk Assessment Without the Jargon

Every safety system I have ever reviewed had the same weak spot, and it was never the certificate on the wall. It was the hazard register. Either it listed five hazards for a whole factory, or it listed two hundred hazards nobody had scored, or it had been copied from another company's file and still mentioned machines this site never owned. HIRA is the work that stops that happening. It is the method behind the register: find the hazard, judge the risk, pick the control, and write down why.

Short answer: HIRA — hazard identification and risk assessment — is the systematic process of finding what can hurt people at work, scoring each hazard by likelihood and severity, and applying controls in a fixed order until the remaining risk is acceptable. Under ISO 45001:2018 it sits in clause 6.1.2.

What is HIRA, exactly?

HIRA has two halves, and keeping them separate matters. Hazard identification is the hunt: walking the floor, watching the work, reading incident and near-miss records, and asking the people who do the job what nearly went wrong last month. Risk assessment is the judgement that follows: for each hazard, how likely is harm, and how serious would it be? A hazard is a source of potential harm — a moving forklift, an unguarded blade, a solvent, a night shift worked alone. Risk is the combination of likelihood and severity. Confuse the two and you end up with a register full of hazards and no decisions.

Think of it the way a doctor thinks about a patient. The hazard is the condition. The risk assessment is the diagnosis: how likely is it to get worse, and how bad would that be? The controls are the treatment. And the residual risk — the risk left after treatment — is what the patient lives with and keeps under review. A HIRA that stops at diagnosis, with no treatment and no follow-up, has done half the job. Auditors notice that gap fast.

What counts as a hazard?

More than the obvious. Clause 6.1.2.1 asks for an ongoing, proactive process that covers routine work and non-routine work, emergencies, and everyone who could be harmed — your workers, contractors, visitors, and people passing nearby. It also asks you to consider human factors (fatigue, rushing, a new starter on day one), how work is organised, and what past incidents in your own site and in similar organisations have already shown. That last point is the one most registers miss. Your near-miss log is not paperwork. It is the cheapest hazard list you will ever get.

Walk a site with categories in mind, or you will only see what you expected to see. Physical hazards: moving vehicles, falls from height, falling objects, noise, heat. Chemical: solvents, dusts, fumes, cleaning agents. Biological: mould, waste handling, food preparation. Ergonomic: repeated lifting, awkward postures, long hours at one screen. Psychosocial: excessive workload, lone working, harassment. Electrical: damaged cables, overloaded boards, wet areas near live parts. A small factory rarely has all of these, but it almost always has more than the three its register names.

How do you actually run a HIRA? Six steps

Step 1: Define the scope. One activity at a time, one area at a time. "The whole factory" is not a scope; it is an excuse to write something vague. Pick the activity — say, loading trucks at the dock — and list its tasks in order.

Step 2: Identify the hazards. Watch the work, do not just read the procedure. The procedure says the driver chocks the wheels. Watch whether anyone actually does it when the truck is late. Talk to the workers doing the task. They know where the shortcut lives.

Step 3: Say who could be harmed, and how. The driver, the loader, the pedestrian crossing behind the truck, the agency hand on his first shift. Name them. A hazard with no named person attached tends to get a control nobody owns.

Step 4: Score the risk. Give likelihood a number from 1 to 5 and severity a number from 1 to 5, then multiply. Risk score = likelihood × severity. A score of 1 to 4 is low, 5 to 9 is medium, 10 to 16 is high, and 17 to 25 is extreme. This 5×5 grid is a common convention, not a rule the standard dictates — ISO 45001 requires a defined method and defined criteria, but it does not prescribe one matrix format. Your criteria are what make the numbers honest: write down what a likelihood of 4 means in your site (for example, "has happened here in the last year") and what a severity of 5 means ("could kill or permanently disable"). Without those definitions, two assessors score the same hazard differently and the whole register drifts.

Step 5: Apply controls, in order. Clause 8.1.2 sets the hierarchy, and the order is not a suggestion. Elimination first: remove the hazard entirely. Substitution: replace it with something less harmful. Engineering controls: isolate people from it — guards, barriers, ventilation, interlocks. Administrative controls: change how the work is done — procedures, rotation, training, supervision. Personal protective equipment last, as the final line of defence. A HIRA that answers every hazard with gloves and a helmet has worked the hierarchy backwards, and an auditor will say so.

Step 6: Record it, assign it, review it. Every row gets an owner and a review date. Review is triggered by an incident, a near miss, a change in equipment or layout, a new contractor, or new information about a hazard — and on a regular cycle even when nothing has gone wrong. A HIRA with no review date is a photograph of last year's workplace.

A worked example you can check

Take manual handling in a packing bay. Cartons of 20 to 25 kg are lifted from a pallet to a bench, about two hundred times a shift, by a team of four. The hazard is repeated heavy lifting with twisting. Before controls, likelihood is 4 (happens daily, strain injuries already reported) and severity is 3 (lost-time back injury, not life-threatening). Risk score: 4 × 3 = 12, high.

Now apply the hierarchy properly. Elimination is not possible — the cartons still have to move. Substitution helps a little: the supplier agrees to 12 kg cartons. Engineering does the heavy work: a scissor-lift table brings the pallet to bench height, so nobody lifts from floor level. Administrative controls finish it: rotation every two hours, and training on the new table. Gloves stay, but they were never the control that mattered. Score it again. Likelihood drops to 2, severity to 2. Residual risk: 2 × 2 = 4, low. That before-and-after pair is the whole point of the exercise. If your register shows only the first score, it proves you found the problem. If it shows both, it proves you fixed it.

One more, because it shows why severity refuses to fall. A pedestrian crossing a forklift aisle: likelihood 3, severity 5 — a struck pedestrian can be killed. Score: 15, high. Marked lanes, barriers, a convex mirror at the blind corner, and a site speed limit bring likelihood to 1. Residual risk: 1 × 5 = 5, medium. The severity never drops, because the physics never changes. That is honest scoring, and it tells you the crossing still needs supervision and refresher training. A register that claims a residual score of 1 for a forklift crossing has fudged the numbers.

What a good HIRA register looks like

One row per hazard, with these columns: activity, hazard, who could be harmed and how, likelihood, severity, risk score, controls in hierarchy order, residual score, owner, review date. That is it. If your register has a column nobody can explain, delete it. If it has no residual score column, add one — it is the column that proves the controls did something.

Keep the register where the work happens, not only in a head-office file. A supervisor who cannot open it on the floor will not consult it before a non-routine job, and non-routine jobs are exactly where the surprises live: maintenance shutdowns, a contractor cutting into a wall, a monsoon leak over a panel board. Clause 6.1.2.1 names non-routine activities for a reason. The everyday job is usually the safest part of your site, because everyone knows it. The job done twice a year is the dangerous one.

What auditors actually check

An ISO 45001 auditor does not read your register like a novel. They test it. They pick a hazard and ask how you found it, who scored it, and what criteria they used. They pick a high residual score and ask what you are doing about it. They ask workers whether they were consulted — the standard expects worker participation in hazard identification, not a register written in an office and emailed out. They check review dates against incidents: if a forklift clipped a rack in March and the racking row still shows last year's date, the system is not ongoing, whatever the policy says. And they look for the copy-paste tell: hazards your site does not have, controls for machines you do not own, a register dated the week before the audit with every row scored on the same day.

That last failure is the most common one I see in small companies. A consultant hands over a register, the company files it, and nobody on site can explain a single row. It fails the audit and, worse, it teaches everyone that safety paperwork is theatre. A shorter register your own team wrote and understands beats a longer one they cannot defend.

Five mistakes that sink a HIRA

PPE first. Gloves, helmets and goggles are the last control in the hierarchy, not the first answer to every row. If more than a handful of your rows end at PPE, rework them.

Scores without criteria. A 4 from one assessor and a 2 from another for the same hazard means your criteria were never written down. Define each number before you score anything.

One-off document. A HIRA written for certification and never opened again is worse than useless — it gives false comfort. Tie reviews to incidents, changes, and a calendar date.

Routine work only. If your register covers daily production and nothing else, it misses maintenance, shutdowns, contractors, and emergencies. Those are the rows auditors ask for first.

No residual risk. A register that only scores risk before controls cannot show whether the controls worked. Always score twice: before, and after.

What does HIRA cost, and how long does it take?

HIRA is not bought separately. It is one part of building an ISO 45001 system, alongside the safety policy, the legal register, and the internal audit. Our ISO 45001 certification consultancy starts at ₹9,999 for up to 25 employees and ₹19,999 for 26 to 100 employees, with certification-body audit fees extra at actuals. Most companies reach certification in two to four months from a standing start, and the HIRA is usually the longest single piece of work in that period — not because it is complicated, but because doing it properly means walking every activity with the people who do it. If a provider promises you a finished HIRA in a day without visiting your site, you now know what to ask them.

Frequently asked questions

Is HIRA mandatory for ISO 45001 certification?

Yes, in substance. Clause 6.1.2 requires an ongoing, proactive process for hazard identification and risk assessment, with a defined method and criteria. You can call the document whatever you like, but without that process there is no system to certify.

Does ISO 45001 prescribe the 5×5 risk matrix?

No. The standard requires a defined methodology and criteria, but it does not fix a matrix format, a scale, or a tool. The 5×5 grid is a widely used convention. What matters is that your criteria are written down, applied consistently, and understood by the people scoring.

How often should a HIRA be reviewed?

On a regular cycle your system defines, and immediately after an incident, a near miss, a change in equipment, layout, materials, or contractors, or new information about a hazard. A review date that never arrives is the clearest sign the process has stalled.

Who should carry out the HIRA?

People competent for the work under clause 7.2 — which means they understand the activity, the hazards, and the scoring criteria — with the workers who do the job involved in identifying hazards. An external consultant can guide it, but a register your own team cannot explain will not survive an audit.

Can one HIRA cover the whole site?

One system can, but one document rarely should. Break it by activity or area: production, warehouse, maintenance, office, contractors. A single register for a whole site either goes vague or grows unreadable. Activity-wise registers stay usable, and usability is what keeps them alive between audits.

HIRA is not a form to complete before the audit. It is the moment your company stops guessing about safety and starts deciding — hazard by hazard, score by score, control by control. Do it with the people who do the work, score it twice, and review it when something changes. That register, kept honestly, is worth more than any certificate it supports. And if you are building the wider system around it, our guides on the ISO 45001 documents checklist, ISO 45001 for warehouses and logistics, and ISO 45001 for construction companies show where the HIRA fits — and our compliance fee calculator can help you plan the cost of the work around it.