ISO 45001 Risk Assessment Example: From Hazard to Verified Control

What the assessment should achieve

A useful ISO 45001 risk assessment explains a decision: what could harm people, what controls exist, what needs to change and how the organisation will know the change works. A completed spreadsheet is only one part of that decision. The working conditions behind its entries matter more than the colour of a risk cell.

ISO identifies worker participation, hazard identification and risk assessment as elements of an OH&S management system. HSE guidance also connects identifying hazards with assessing, controlling and reviewing risk. The record below applies those broad ideas to an original fictional situation. It illustrates documentation, not a safe system of work for an actual warehouse.

HSE is Great Britain's workplace safety regulator, and NIOSH is a US research agency. Their guidance supplies practical background here; identify the legal duties that apply at your own location rather than treating either source as worldwide law.

Define the work with workers

Fictional example: North Quay Components stores small packaged parts. Its team assesses picking and replenishment in aisle B following two reports that pedestrians and replenishment vehicles reached the aisle entrance together. No injury is reported. The assessment covers normal picking, replenishment and clearing returned stock; vehicle maintenance and other aisles require their own assessment.

The assessor walks the area with a picker, a vehicle operator, a worker representative and the shift supervisor. An agency worker explains that the route shown at induction becomes obstructed by returns. The night supervisor describes an additional replenishment period missing from the daytime schedule. These contributions change the scope before anyone assigns a priority.

Record who participated, which shifts were observed and which questions remain open. Give people a way to contribute outside a meeting and check understanding across languages and employment arrangements. A signature records attendance; the assessment should also show what worker knowledge changed.

A filled risk assessment example

This shortened record, NQC-RA-014 revision 1, dated 11 May 2026, uses locally defined descriptive priorities. It intentionally includes no numerical matrix. Its decisions and dates belong only to the fictional organisation; they are not ISO-prescribed thresholds or deadlines.

Under North Quay's method, a credible vehicle–pedestrian interaction capable of serious harm requires priority action when the existing arrangements are not shown to control it reliably. The two reports and walkthrough establish a plausible exposure route; they do not measure the probability of a future injury.

Notice the distinction between the hazard and its cause of exposure. “Forklift” is too broad to explain the problem. The interaction at a particular entrance, including the obstructed route and missing shift coverage, tells the reviewer what to investigate. The full assessment would examine other hazards and foreseeable abnormal conditions.

Explain the control decision

Work through the hierarchy of controls: eliminating the hazard, substituting a less hazardous arrangement, engineering controls, administrative controls and appropriate personal protective equipment. Document why stronger options are selected or found unsuitable. A warning sign or another briefing should not end the discussion when a practical change to the work could remove the interaction.

In this example, the team first explores removing the shared activity from the aisle. It then considers layout changes and separation. The manager requests assessment of visibility, emergency access, accessibility and any new hazards the proposed design might create. Those questions require site-specific competent evaluation; this article supplies no barrier specification, route dimensions or operating instructions.

HSE's transport guidance provides questions about shared routes, crossings, visibility and communication. Use those questions to examine the proposed design with workers, then retain the local justification for the arrangement selected.

The ISO 45001 template kit includes risk assessment and worker participation records for organising this reasoning. Adapt the fields to the work and applicable obligations so the form supports the assessment.

Verify controls before changing the rating

A purchase order proves an item was ordered. It does not prove exposure has changed. In the fictional follow-up, the reviewer asks workers from both shifts to walk through the revised arrangements and compares observations with the intended design. The team checks returned stock handling as well as routine picking, because the original gap emerged during the less tidy part of the process.

Keep the implementation date, evidence references, unresolved issues and approval decision together. Reassess remaining risk using the same defined method, explaining the evidence behind any change. Record assumptions and conditions that would trigger another review. “No incidents this month” is weak evidence on its own when exposure is infrequent or reporting is incomplete.

A practical assessment checklist

• Define the task, location, people, shifts and boundaries of the assessment.
• Include worker experience, non-routine activities and people with differing needs.
• Describe each hazard, potential harm and evidence about existing controls.
• Apply a documented assessment method and check relevant legal and other obligations.
• Consider the control hierarchy and record decisions, owners and required resources.
• Distinguish proposed controls from implemented and verified controls.
• Record residual risk, approval, communication and change-driven review triggers.

For a subsequent internal review, the ISO 45001 audit checklist provides prompts for sampling OH&S arrangements and evidence. Trace one real assessment from worker input to an observed control; that trail reveals much more than counting completed forms.

The free audit evidence pack includes an evidence log for documenting that trail. Keep sensitive worker and incident details in the appropriate restricted records and reference them from the audit log.