Risk assessment: The complete guide

Accidents happen, though we all wish they didn’t. However, not all accidents are made equal, and if nothing else, you can at least prevent the most serious ones to protect your employees’ health and your company’s finances.

But an ad-hoc approach won’t do you any good. You must engage in mindful and strategic processes to achieve your goals that will lead you to measurable improvements. What you need is a risk assessment.

What is a risk assessment?

Risk assessment (RA) identifies hazards and associated risks within an organization to prevent accidents. This includes health and safety issues, IT vulnerabilities, processual errors, etc.

The 3 most important keywords in Risk Assessment are:

1. Risk isthe likelihood and severity of a negative outcome stemming from a hazard.
2. Hazard issomething that can cause harm and lead to an accident.
3. Accident isan unplanned event resulting in loss or damage.

Risks, hazards, and accidents differ between industries, so risk assessments do, too. However, two aspects of RAs stay the same across the board.

1. Legality: All companies and some self-employed individuals are legally required to carry out risk assessments regularly.
2. Goal: The goal of risk assessments is to prevent loss within an organization, whether it be loss of life, reputation, or finances.

What is the difference between risk assessment, analysis, and management?

When discussing risks, these are the terms that always show up and invariably cause confusion. All three are part of the same process, the only difference being their scope. 

1. Risk management: Is the macro-level process of identifying, analyzing, and prioritizing risks to mitigate hazards and prevent accidents with strategy.
2. Risk assessment: Is the mid-level process of breaking down risks and hazards into categories and identifying their potential impacts.
3. Risk analysis: Is the micro-level process of measuring risks and their impacts.

What are the different types of risk assessments?

Various factors, including assets and activities, potential threats and outcomes, company industry, and more, can break down risk assessments. Therefore, we can’t discuss them all. But we can offer a top-down breakdown of the categories.

Starting with the 3 main types of risk assessments:

1. Large-scale assessments: Target large-scale complex hazard sites in the nuclear, gas, and oil industries. This type of assessment usually requires using an advanced form of RA, the Quantitative Risk Assessment (discussed below).
   
   
2. Required specific assessments: Refer to assessments required by specific legislation in different jurisdictions and industries, such as handling hazardous substances by COSHH or manual handling.
   
   
3. General assessments: Manage known workplace risks, health, and safety as institutions such as OSHA and HSE require.

Risk assessment categories by approach

You can use two possible types of RA, depending on the kind of data you consider and the analysis methods you use. They include:

1. Quantitative risk assessment: Uses numerical data to assess the likelihood and impact of risks. It incorporates historical data, statistical analysis, and expert opinions. It’s primarily used in complex or high-stakes situations, such as financial or engineering risk.
   
   
2. Qualitative risk assessment: Uses subjective judgment to assess the likelihood and impact of risks. It incorporates expert interviews, reviewing existing documentation, and brainstorming. It’s primarily used when data is limited or the stakes are complex to quantify, such as workplace accidents.

Risk assessment categories by subject

You can use six possible types of RA depending on the subject (i.e., activities and assets) you consider. These can include:

1. Generic risk assessments: These can be used for various activities and situations, like office safety or information safety.
   
   
2. Site-specific risk assessments: These are tailored to a specific environment or facility, like construction site or chemical plant assessments.
   
   
3. Dynamic risk assessments: Have to be updated regularly to account for frequent changes in an industry/subject, such as cyber-security or pandemic risks.
   
   
4. Asset-based risk assessments: Focus on risks for specific assets like people, property, and information. It can include data loss or intellectual property theft.
   
   
5. Vulnerability-based risk assessments: Consider vulnerabilities that threats, like network or physical security, could exploit.
   
   
6. Threat-based risk assessments: Specializes in extreme situations, such as terrorist attacks or natural disasters.

Risk assessment categories by field

As mentioned, there’s a near-infinite number of specific risk assessments for every potential threat and field. So, we’ll list out some of the most important and common examples here. These include:

• Cybersecurity risk assessments,
• IT risk assessments,
• Health and safety risk assessments,
• Healthcare risk assessments,
• Food safety risk assessments,
• Hazardous substances risk assessments,
• Workplace risk assessments,
• Project management risk assessments,
• Environmental risk assessments,
• Climate change risk assessments,
• Fire safety risk assessments.

Why are risk assessments important?

Risk assessments are often underappreciated and under-considered. However, they fulfill several vital operational needs for your company and offer many benefits. These include: 

• Crisis planning: Assessing the various risks that the company faces allows management to prepare viable risk mitigation strategies to either prevent accidents altogether or handle crises as efficiently as possible.
  
  
• Business continuity: By fortifying their operations and sites against potential hazards, companies can ensure their business continues running smoothly despite unforeseen issues or adverse effects.
  
  
• Financial stability: Instead of paying for expensive emergency maintenance while bleeding resources due to operation blackouts, companies can use risk assessments to save a lot of money by investing a little ahead of time.
  
  
• Employee health & safety: Incorporating safety measures to prevent injuries and death is vital to keeping your workforce safe and satisfied. However, it also helps save money on insurance payouts or possible litigation.
  
  
• Asset lifetime: Preventing breakdowns with planned maintenance allows companies to save money on analyses and extend their assets’ lifetimes, improving their return on investment.
  
  
• Operational efficiency: Investigating operational risks, hazards, and accidents allows businesses to uncover new, safer, and more efficient procedures to fuel effective operations and better return on investment.
  
  
• Legal compliance: As mentioned, risk assessments are a legal obligation for most companies and some self-employed individuals. Therefore, carrying them out allows you to stay compliant, prevent litigation, and save money.

Who is responsible for risk assessments?

Carrying out an RA is a complex procedure. It requires you to gather relevant data, consult experts and knowledgeable stakeholders on the specific subject, evaluate the information, and develop an actionable plan to mitigate the hazards.

As such, the process involves multiple employees across various levels of seniority. These include:

• Senior management: Is responsible for creating the impetus for the RA. Furthermore, senior managers must oversee the process, ensure it’s done correctly, evaluate the results, and drive further action.
  
  
• Risk managers: Commonly consist of middle managers appointed to oversee the RA. They are responsible for gathering a team, collecting the necessary information, arranging brainstorming sessions, evaluating data, and creating risk mitigation plans.
  
  Large enterprises often employ a Chief Risk Officer to oversee the entire process and drive continuous improvements across all facets of business.
  
  
• Subject-matter experts: Can include in-house employees or external consultants. They’re responsible for guiding the risk managers and using their extensive experience to uncover and assess potential risks and how to prevent them.
  
  
• Frontline employees: Typically include experienced and trustworthy “ground-floor” employees who can shed light on the reality of day-to-day operations and situations. Their responsibility is to align the higher-ups’ theory with practical use.

What skills are necessary for risk assessments?

Now that we know who should be involved in the process, we must understand how to choose the right stakeholders. So, here are the qualities each risk assessor should possess.

• Analytical skills: Risk assessments require the ability to collect and analyze data, identify patterns, and draw conclusions.
  
  
  • Objectivity: Risk assessors must be able to objectively assess risks without being influenced by personal biases or emotions.
    
    
• Problem-solving skills: RA’s involve identifying and solving problems. Risk assessors must be able to think creatively and develop innovative solutions to mitigate risks.
  
  
  • Attention to detail: Risk assessments require careful attention to detail to identify all potential risks.
    
    
• Communication skills: Risk assessors must communicate effectively with various stakeholders, including senior management, subject matter experts, and frontline employees. They must be able to clearly explain the risks that have been identified and the mitigation strategies that have been developed.
  
  
• Technical skills: Risk assessors may need technical skills in certain areas, depending on the nature of the risks being assessed. For example, a financial services company’s risk assessor may need to know financial markets and analysis techniques.
  
  
  • Integrity: Risk assessors must be honest and ethical in their work. They must be able to put the organization’s interests ahead of theirs.

When should you carry out a risk assessment?

One thing everyone should understand is that RA’s are not a one-off. Companies change constantly, making old processes obsolete and new risks appearing. Therefore, you should carry out risk assessments in the following situations.

• When you start a new business or activity,
• When you make changes to your existing operations or activities,
• When you introduce new equipment or technology,
• When you move to a new location,
• When you start working with new suppliers or customers,
• When there is a change in the regulatory landscape,
• When you notice a new risk, such as a cyber threat or disease outbreak.

Additionally, here are a few tips for carrying out a risk assessment.

• If you are unsure whether or not a risk assessment is needed, it is always best to carry one out to be safe. The alternative is to suffer unexpected accidents, operational breakdowns, expensive lawsuits, and business disruptions.
  
  
• If you are making multiple changes to your operations or environment, conducting a comprehensive risk assessment is often more efficient than numerous separate assessments.
  
  
• If you are unsure how to carry out a risk assessment, a number of resources are available to help you, such as templates, checklists, and guidance documents. And also a generic outline below.

How to plan for a risk assessment?

A risk assessment isn’t something you can just jump head-first into. It is a mindful process that requires due consideration and preparation. Here are the 5 necessary things you should always identify before carrying out an RA:

1. Define the scope: Be specific in the scope/area of what you want to look into. This can include the lifetime of a product, a physical area, or types of threats in an activity.
   
   
2. Identify resources needed: As you’ll see, RAs require a lot of things. Consider the team of people involved, external consultants, external research sources, and more.
   
   
3. Specify the measures: Consider how precise you want to be with your measurements and choose the best tools and strategies for the job.
   
   
4. Identify stakeholders: Next, you’ll want to find capable individuals across the entire company hierarchy, including managers, supervisors, workers, etc., to enable the process.
   
   
5. Consider regulations: Finally, you need to consider all the relevant legislation to appear in whatever area you’ll be assessing. Consider laws, regulations, codes, organizational policies, and procedures.

How to carry out a risk assessment?

The specific steps of any given RA differ based on its objective, subject matter, and industry. However, each follows the same general 5-step outline. Here’s what you need to do.

1. Identify the hazards:
   Assuming you’ve assembled a responsible team of the above employees with the correct qualities, the next step is identifying hazards within your workplace or operations. You can either consider the entire company or its specific aspect.
   
   First, speak to ground-level employees to get an accurate idea of the reality of your daily operations. Contrast their opinions against existing quantitative data if possible. After that, consult experts on the subject to get an outside perspective. 
   
   
2. Discover who or what’s at risk:
   The information you find will allow you to accurately identify all assets that could suffer from the risk of becoming a hazard and causing an accident. Knowing this lets you start brainstorming possible changes to your operations that would help prevent negative outcomes.
   
   
3. Evaluate the risk level and prepare countermeasures:
   Based on the number of at-risk assets and their potential impacts (i.e., financial, operational, or health-based losses), you can estimate a risk level and prioritize your efforts accordingly. This will be particularly helpful if you find multiple risks.
   
   At this point, a risk matrix can be incredibly helpful. The example below outlines the likelihood and severity of a risk-induced negative impact. The scale and scope of the risk matrix can be customized to your needs so it can reflect any loss necessary.
   
   Contrast all the risks you want to target and identify which to focus on first. Alternatively, if the chances are interconnected, you can develop a strategy to mitigate them simultaneously. This will be your Risk Management Framework (RMF).

4. Record your findings:
   Since the actual strategy of eliminating risks falls under Risk Management and not Risk Assessment, the next step is to collect and file your findings as clear and easily accessible documents. Include hazards, associated risks, and prevention plans.

5. Review and update the risk assessment regularly:
   As mentioned at the start of this section, risk assessments are a continuous effort. Therefore, you should set a specific timeframe and review your documentation, as well as your actual operations, regularly.
   
   Depending on the severity and likelihood of the risks, you can choose between various intervals, including monthly, quarterly, and yearly. However, we recommend you check every RA at least once a year.

How to use a risk matrix?

We’ve mentioned the risk matrix in one of the steps for carrying out a risk assessment, but we should also take the time to properly explain it.

A risk matrix is a tool often used in assessments to measure the level of risk by considering the consequence/severity and likelihood of injury for a worker after exposure to a hazard. These two values help determine the overall risk rating of a hazard.

To find the two values, you’ll have to ask the following questions:

1. Consequence: “What is the worst possible injury the hazard could cause?”
2. Likelihood: “How likely is a person to get hurt if exposed to the hazard?”

Now, let’s look at how you’re supposed to answer them.

How to assess consequences?

First, let’s look at consequences and answer, “What is the worst possible injury the hazard could cause?”. In this case, we’ll ignore the odds of an accident actually occurring and lean on Murphy’s Law to assume it is an inevitability.

When judging the severity/consequences of a hazard, we rank the outcomes like this:

1. Fatality: Causes death (immediate or eventual).
   
   
2. Major injury: Causes serious harm, which may be irreversible, and requires medical attention and ongoing treatment. 
   
   
3. Minor injury: Results in reversible damage, which may require medical attention but no limited long-term treatment. It is less likely to cause significant time off.
   
   
4. Negligible injury: Requires first aid at most with no or very little time off.

Example: Engineers have to work with high-voltage live wires. In case of malfunction, the hazard could lead to death by electrocution or serious burns.

How to assess likelihood?

When assessing likelihood, we try to answer the question, “How likely is a person to get hurt if exposed to the hazard?”. It bears to mention that this isn’t the same thing as the likelihood of an accident.

When judging the likelihood of an injury, we group the outcomes into four categories, which also serve as recommendations for the best course of preventive action:

1. Very likely: An injury is almost certain if exposed to the hazard even once.
   Recommendation: Stop the process immediately and implement controls.
   
   
2. Likely: If workers are exposed to the hazard repeatedly, they’re likely to get hurt.
   Recommendation: Investigate the process and immediately implement controls.
   
   
3. Unlikely: If workers are exposed to the hazard repeatedly, they’re unlikely to get hurt.
   Recommendation: Run the process but monitor it regularly; consider controls.
   
   
4. Highly unlikely: The worker is unlikely to get hurt even if exposed to the hazard often and for prolonged periods.
   Recommendation: Continue running the process with monitoring.

Example: If engineers working with high-voltage live wires adhere to necessary signage and follow proper working guidelines (i.e., wearing insulated gloves), the chances of injury or death are very unlikely. However, if they don’t do that, it’s very likely.

How to know if a hazard will cause harm?

Adding onto the previous two sections, let’s look at the information we can use to identify whether something actually is a hazard and how likely it is to cause harm. These include:

• Documentation from the manufacturer regarding the product.
• Historical insights gained from the experiences of workers.
• Compliance with legislated requirements and relevant standards.
• Adherence to industry codes of practice and best practices.
• Health and safety materials detailing hazards, including safety data sheets (SDSs), research studies, and other pertinent manufacturer information.
• Information sourced from reputable organizations.
• Results obtained from various tests, such as atmospheric or air sampling in the workplace, biological swabs, etc.
• Guidance from occupational health and safety professionals.
• Records of previous injuries, illnesses, near misses, and incident reports.
• Direct observation of the process or task.

Consideration of factors contributing to risk levels:

• Evaluation of the work environment, including layout and conditions.
• Analysis of the systems of work in use.
• Anticipation of a range of foreseeable conditions.
• Identification of potential harm caused by the source, such as inhalation, ingestion, etc.
• Assessment of the frequency and extent of a person’s exposure.
• Consideration of the interaction, capability, skill, and experience of workers performing the task.

How to document a risk assessment

Depending on the laws in your given jurisdiction and regulations in your industry, you may need to keep records of all your risk assessments for several years. This can depend on a number of things, including:

• Level of risk involved,
• Legislative documents,
• Requirements of management systems in place.

Here are a few guidelines to ensure your documentation stands up to scrutiny. Let the records show that:

• You conducted a good RA,
• Identified the risks of hazards,
• Implemented suitable control measures,
• Reviewed and monitored all hazards in the workplace.

What’s next?

So you’re all done with your company’s risk assessment. However, your journey’s only just beginning. Your next step is to create a mitigation strategy, create the necessary work orders, assign tasks, and drive continuous business excellence.

It’s a lot, but you don’t have to do it alone. RESCO’s Risk Management Software helps you cover the entire process from start to finish within a single centralized solution to ensure everything goes smoothly. And now you can try it completely for free!

So, don’t wait. start building better operations today. Get started here!

FAQs

What is the difference between risk assessment and job safety analysis (JSA)?

The two terms are often confused. However, there is a key distinction between them – scope. Risk assessments target safety hazards across entire workplaces and are often supplemented with risk matrixes to prioritize hazards and controls.

 Meanwhile, Job Safety Analyses (JSA) or Job Hazard Analyses (JHA) focus on job-specific risks, focusing on single tasks and assessing each step of an activity.

What are the 3 main tasks of a risk assessment?

Risk assessments can be broken down into 3 parts – identifying hazards, assessing their associated risks, and incorporating control measures to either eliminate them or at least minimize their impact.  

What are the top 5 operational risk categories?

The term operational risk refers to the probability of issues relating to people, processes, or systems negatively impacting a business’ daily operations.

Its five most common categories include people risk, process risk, systems risk, external event risk/fraud, and legal / compliance risk.

How often should risk assessments be performed?

Risk assessments should always be performed whenever you incorporate a new process into your operations or change an existing one (this applies to the equipment, tools, and employees associated with it as well).

However, as a guideline, you should carry out an RA at least once a year to ensure all your written-down procedures still apply.