Safety Risk Management Procedures - Guidance Note

UWA Safety and Health wishes to acknowledge CCH Australia 'The Hands on Guide (OHS Manager)' for information provided in this guideline.

Introduction

This guide has been prepared to assist people who are responsible for safety and health at the University with detailed procedures to follow to identify hazards, assess their risks and implement suitable measures to prevent or reduce the likelihood of their occurrence.

These guidelines will:

1. investigate what hazards are and how to identify them;
2. explain what safety and health risks are and how to quantify them; and
3. detail strategies for implementing risk controls.

What are hazards?

A hazard is anything with the potential to harm life, health or property. Hazard identification is the process of identifying all hazards in the workplace. In order to understand what hazard identification involves, it is first necessary to understand the nature of hazards. Hazards are the main cause of occupational health and safety problems. Therefore, finding ways of eliminating hazards or controlling the associated risks is the best way to reduce workplace injury and illness

Examples of hazards include:

• an unguarded gear wheel on a workshop grinding machine which has the potential to draw a worker's clothing and limbs into the drive of the machine and cause serious bodily injury
• handling of flammable liquids in the presence of ignition sources
• an unlabelled container of caustic soda which has the potential to cause severe skin burns if handled incorrectly
• driving of motor vehicles on the inner campus
• loose asbestos released during demolition work which has the potential to cause lung cancer
• noise from an uninsulated chainsaw which can reach levels of up to 110 dB with the potential to seriously damage hearing
• badly designed shovel (for example, with a short handle and very large blade) which has the potential to cause back injury
• waste oil from an engine which has the potential to damage workers' health through skin absorption, due to its carcinogenic properties
• blood in a syringe at a hospital, which has the potential to infect a medical worker with a disease if the needle punctures the worker's skin.

How do hazards arise?

Hazards may arise from the workplace environment, the use of plant or substances and from work practices. Hazards can arise in many different ways and can take various forms. In order to be in a position to properly undertake hazard identification, it is important to understand the sources of hazards and the forms in which they may arise.

It is worth noting that there are many forms of hazard which may go unnoticed in a workplace (ergonomic hazards such as the discomfort from a badly designed seat, for example), but which, in the long run, may result in unnecessary costs and human suffering.

What does hazard identification involves?

Hazard identification involves the systematic investigation of all potential hazard sources and the recording of hazards identified. In simple terms, it means identifying all of the possible ways in which people may be harmed through work-related activities. A co-ordinated, systematic approach to the process is required given that many workplaces have a range of plant, chemicals and potentially hazardous work processes.

Implementing Hazard Identification

Dividing hazard identification into manageable portions

As identifying every hazard throughout the workplace can be an extremely large and complex job, the first step is to break this job down into 'bite-sized chunks'. This can be done by using the following techniques:

• breaking the workplace into work sectors or areas (and, if necessary, breaking down further into zones);
• breaking each sector down into tasks;
• developing a list of likely hazards for the work sector; and
• analysing the components of each task to identify the individual hazards present.

Developing an inventory of tasks

Once the workplace has been divided logically into work sectors (such as the laboratories or the administration centre) and, if necessary, into zones (such as the photocopying room, the laboratories fume cupboard and the chemical store), a complete inspection of all workplace tasks should be carried out. This will develop an inventory of all of the tasks conducted throughout the workplace.

Examples of types of tasks

The task identified may be as diverse as: grinding metal samples; changing the toner in a photocopier; transporting material from one area to another; transferring biological samples into test tubes; decanting and mixing paints and solvents; operating machinery such as cranes, hoists and fork lift trucks; undertaking repair work inside confined spaces (such as holding tanks); undertaking cleaning and housekeeping work; spraying chemicals such as lacquer and pesticides.

It is also necessary to consider future tasks or situations that involve a change to the existing premises or process, or those which are non-routine or 'one-off'.

Analysing tasks

Once the task inventory is completed (or possibly, simultaneously with developing the inventory), each activity must be analysed to prepare for identifying all of the hazards involved.

In order to later analyse the risks associated with the hazards, a manageable level of detail is required and this means that some tasks must be broken down further into component elements. Each of these elements is then examined in terms of its activities, use of plant and equipment, use of substances and materials, processes, and the place where it is carried out.

The component elements of a task may include:

• individual activities;
• substances and materials;
• plant, tools and equipment involved;
• processes; and/or
• characteristics of the place where the task is carried out.

The easiest method of breaking tasks down into elements is usually to consider how the task is undertaken step by step. For example, the task of diluting concentrated acid (e.g. hydrochloric acid) in a laboratory involves:

1. preparing the work area;
2. putting on personal protective equipment (lab coat, glasses and gloves);
3. collecting the concentrated acid container ;
4. pouring the acid;
5. labelling the container; and
6. clearing and cleaning up the work area.

After breaking down the task into its component elements, the next stage is to identify the hazards involved.

Identifying the hazards

In undertaking the hazard identification task, there are many different factors to consider those related to specific hazards, individual tasks, workplace conditions, particular people involved and unique circumstances.

Considering the people factor

An important factor to consider is the people who may be exposed to risks from hazards, and how any individual characteristics may impact on exposure. Gathering this information at the hazard identification stage will assist with later risk assessment efforts. In most cases, those affected will be the people involved in the tasks.

During hazard identification, try to take note of 'people issues' such as:

• any special characteristics which should be taken into account for example, inexperience, chemical susceptibility and ergonomic issues (such as height or prior injuries)
• whether people other than operatives could be affected
• how these groups of people are affected by the circumstances surrounding the task, such as normal operation, peak production, environmental factors, maintenance activities and working alone.

Aids to hazard identification

There are a number of activities, which can be undertaken as an aid to identifying the hazards present in the workplace. These activities may be conducted simultaneously with other risk management processes such as task inventory development and risk assessment activities.

Activities, which will assist in the hazard identification process, include:

• undertaking a workplace walkthrough;
• analysing available information;
• conducting workplace inspections; and/or
• using checklists.

Workplace walkthroughs - Walking through the area, which the hazard identification is targeting, is an essential information-gathering exercise even if the team or individual involved is familiar with the task. Observing how work is carried out will reveal valuable clues about the hazards involved. It is important not to rely on the organisation's standard operating procedures for detail on how specific tasks are undertaken as workplace practice may vary greatly from the standard rules.

Analysing available information - Another important aid to identify hazards is to check all available information. In the current context, this may assist in identifying potential hazards from the types of plant, substances and work procedures at your workplace.

Amongst the key sources of information, which may assist in indicating how hazards have arisen in the past, and are likely to happen again, are:

• incident and first aid records;
• plant maintenance and breakdown records (such as service books);
• work systems and procedures documentation;
• safety and health policies both general and specific;
• employee training records;
• operators' manuals and equipment instruction booklets, which often point out safety ``dos and don'ts'';
• injury/incident data, workers compensation statistics and guidance material from WorkSafe WA and peak industry organisations;
• codes of practice produced by WorkSafe Australia and WorkSafe WA and industry organisations; and/or
• Australian standards which provide specifications for issues such as design, manufacturing, inspection, testing, use and work methods.

While reading and analysing these resources, take note of hazards and conditions, which may be relevant to your workplace. Developing a list of potential hazards may prove valuable as a prompt in identifying hazards at your workplace.

Undertaking a workplace inspection - One of the most important aids to hazard identification is the workplace inspection this may be conducted as part, or independently, of the workplace walkthrough. Inspections can focus on specific tasks, locations or hazards. Essentially, the inspection should be regarded as a fact-finding mission to detect potential hazards. Before undertaking the inspection, it is vital that those assigned to the task are fully briefed on their role. Activities undertaken during the inspection may include:

• taking notes;
• interacting with employees/students;
• observing work being done;
• taking measurements (such as noise level readings);
• taking photos;

Using checklists - Checklists are an invaluable aid in any safety exercise. They assist in ensuring that:

• important issues are not overlooked;
• consistency is achieved if the required activity is being undertaken by several different people; and
• there is a formal record of efforts made.

To gain maximum benefit, any checklists used should be specifically developed for the individual workplace. This will ensure that circumstances unique to that workplace are taken into account. Examples of checklists can be obtained from the Safety and Health’s web page at http://www.safety.uwa.edu.au. These may be used as a basis from which a customised checklist can be developed.

Ongoing process of hazard identification

Hazard identification does not end with the initial investigation. Hazard identification should be regarded as an ongoing, integral part of workplace operations. In general, the legal requirement is for hazard identification to be undertaken:

• before and during the introduction of new work systems, plant and chemicals to the workplace
• before and during alterations or changes to the use or location of work systems, plant and chemicals
• where new information on hazards or control measures becomes available.

In order to fully comply with this requirement, a hazard monitoring system should be put in place. This will form part of the monitoring and review element of your safety program for further details, see the section on 'Undertaking monitoring and review' below.

Recording hazard identification data

Once gathered, the hazard identification data must be recorded so that it can be used for risk assessment activities and in determining appropriate control measures. A hazard identification record form is provided as Appendix One.

In practice, the same form may be used to record the hazard identification information, risk assessment details and details of control measures to be implemented.

Undertaking Risk Assessment

Risk assessment is the process of assessing all of the risks associated with each of the hazards identified during the hazard identification process. In assessing the risks, three essential steps are taken:

• The probability or likelihood of an accident occurring is evaluated;
• The potential consequences are calculated or estimated; and
• Based on these two factors, the risks are assigned priority for risk control through the use of a risk rating.

In order to undertake risk assessment, it is first necessary to understand the nature of risk.

What is risk?

Risk is the potential outcome of a hazard. It is the possibility of injury, illness, damage or loss occurring as a result of a hazard.

What is risk assessment?

Risk assessment involves examining and evaluating the likelihood and possible consequence(s) (severity) of the potential outcomes of hazards in order to prioritise risks for control.

The assessment of a hazard’s risk can be performed by the use of quantitative or qualitative methods. Risk can be quantified by determining the likelihood and consequence of a hazard against known standards. The effect and potential consequences of carbon monoxide poisoning in confined space (e.g. sewer or large tank) are known and can be quantified before entering a confined space by taking air samples.

The most common way of assessing risk by using qualitative methods such as a person’s experience and the information provided in the Identification of Hazards Section above (e.g. experience and incident records).

The Risk Management Matrix

A risk management matrix is a simple tool that can be used to assess a risk by evaluating a hazard’s likelihood of occurring and its potential consequences. Thus enabling the user to identify the appropriate response and prioritise the implementation of controls.

Below is an example of a risk matrix that has been adopted for the University to identify the risk a hazard poses to people. This matrix is attached as Appendix Two. The risk assessment matrix is broken into the following steps:

1. Measurement of the potential consequences;
2. Measurement of the likelihood of the hazard occurring;
3. Quantifying of the risk of the hazard by combining 1. and 2.; and
4. Identification of the risk of the hazard and the appropriate action required.

Consequence

The first step is to measure the potential consequence should a hazard be realised and its effect on exposed people. As shown below, consequence has been split into five descriptors varying from a hazard resulting in 'Negligible' injuries for the most minor instances to 'Fatality' should one or more people be killed. The severity of the injury may be rated as 'major injury' if the potential result is permanent disability of the worker or a 'first aid injury' if the result of the injury at most would be minor cuts and scratches.

Measure of consequence

Likelihood

The next step is to determine the likelihood of the hazard occurring. As shown on the table below, the measure of likelihood is split into five descriptors ranging from hazards that are considered 'Very Likely' to hazards that would be considered 'Highly Unlikely'. It may be determined that someone would be very likely to trip over raised paving slabs of a frequently used path and 'Highly Unlikely' for some-one to trip over a lifted floor tile in a rarely used store room. The 'Likelihood' of a hazard occurring is covered in more detail in the Evaluating Likelihood section below.

Measure of risk

The third step in assessing a hazards risk is to combine the perceived likelihood and consequences determined above to identify the appropriate action. For example, you notice that a storm has resulted in a power line coming down across a footpath. The determination of the potential risk of such a hazard would be a combination of the likelihood of a person being exposed, 'Likely' and the potential consequences, 'Fatality'. By connecting 'Likely' and 'Fatality' on the matrix shown below it can be seen that this hazard is designated as an 'E' or 'Extreme' risk. Immediate action is required to prevent the likelihood of a 'Fatality'. If the hazard is identified as 'Extreme' and as seen from the table below immediate action is required, your supervisor and Head of School should be notified. UWA Safety and Health should also be notified.

Recording results of risk assessment

It is most important that the conclusions reached about risks are documented and that any supporting information on how that decision was made is included in associated records. This is not only a legal requirement of the Occupational Safety and Health Act 1984 but is also important for corporate knowledge and demonstrates how a decision was achieved with regard to investigating a hazard.

Evaluating likelihood

The method of determining the likelihood that injury, illness, damages or loss will occur as a result of hazards may vary according to the type of workplace and operations involved. Determining likelihood is often more difficult than deciding on the consequence of the potential harm. Many assessors consistently underestimate the likelihood of hazards causing harm. This is often because their experience of real accidents is somewhat limited. A basic system of evaluating likelihood is outlined below.

Review information

In considering likelihood, it is important to review any information, which was gathered during the hazard identification stage. This may include, for example:

• hazard identification checklists (which will indicate the factors taken into consideration);
• hazard identification record forms (which will provide valuable information on circumstances surrounding the hazard together with comments of the identification team or individual);
• incident and first aid records (which should reveal trends or frequencies of injury;
• incident investigation reports;
• plant maintenance and breakdown records (such as service books);
• work systems and procedures documentation;
• safety and health policies both general and specific;
• employee training records; and
• Operators’ manuals and equipment instruction booklets.

Other important sources of data include national incident, injury and workers compensation statistics, which provide information on the numbers and frequencies of accidents, related to type, activity and industry sector.

Consider current controls

A further important factor to take into account is the effectiveness of any control measures already provided. It is also necessary to consider the possibility of current control measures not being used due to issues such as:

• lack of training or supervision;
• failure to replace controls following cleaning, maintenance or repair work;
• difficulty or awkwardness in using or working with controls; and
• complexity of controls.

Once the likelihood and consequence of the potential harm have been rated, it is now possible to prioritise the risks based on these two criteria. Prioritising risk is the final step in the risk assessment process.

Acting on the risk assessment results

The risk ratings determined during risk assessment enable decisions to be taken on the amount of effort to be expended in controlling risks associated with particular hazards. However, any hazard that is 'highly likely' or 'certain/imminent' to cause harm must be attended to and the risk reduced even if the severity is low.

Those hazards identified as not adequately controlled can now be itemised in a prioritised list for action using the risk rating as a guide to those which will require urgent attention (and possibly suspension of operations), and those which can be listed for action some time in the future.

Setting times scales for action

One method of dealing with risk is to put time limit bands against the risk rating score, such as:

• L (low) must be attended to preferably within 1 month but issues such as funding may make it more appropriate to rectify the hazard up to 12 months later.
• M (Moderate) should be attended to with five working days and interim controls to be put in place immediately.
• H (High) risks should be attended to within one working day and interim controls to be put in place immediately.
• E (extreme) risks must be attended to immediately. It is preferable that activities are suspended until controls are in place.

In setting these timescales, it must be remembered that the control measures for risks associated with individual hazards will vary enormously as far as time, cost and other resources are concerned. It is essential for realistic time limits to be set for the various items to be dealt with in the same way that other management objectives are given deadlines. The issue of setting deadlines for individual control measures will be discussed again at 'Undertaking Risk Control' below.

Continual improvement through ongoing risk assessment

Once the risks associated with all of the hazards identified have been assessed and control measures have been introduced, the risk assessment exercise can be repeated to decide if the residual risk has been reduced to trivial or adequately controlled levels. Continual assessment forms part of the monitoring and review phase of risk management. For further information, see the section later entitled 'Undertaking Monitoring and Review' below.

Risk assessment records

Once the risk assessment process has been completed, the results should be recorded in a systematic manner. This means itemising the:

• work sector, division or department involved;
• name of the person heading up the risk assessment;
• date on which the assessment was completed;
• work zone or location of the hazard involved;
• task, activity or work process involved;
• hazard involved;
• people who may be exposed to risks from the hazard;
• likelihood ranking of the risk (such as 'Very Likely');
• severity ranking of the risk ( such as 'Fatality);
• risk rating assigned (the numerical value together with the conclusion reached about priority such as 'Extreme') time-scale for risk control (for example, 'Immediate activity to cease until control is effective').

Risk Control

Introduction

Risk control is the process by which the risks associated with each of the hazards present in the workplace are controlled. This is done having regard to the priorities (and any related time scales) determined during the risk assessment phase.

The primary aim of risk control is to eliminate the hazard giving rise to the risk(s), thereby eliminating the risk(s). Where this is not possible, risk control seeks to minimise risks by modifying or controlling the hazard and/or the associated work systems.

What is involved in risk control?

Risk control provides a means by which risks can be systematically evaluated against a set of control options (the hierarchy of controls) to determine the most effective control method(s) for the risk(s) associated with each hazard. This process involves analysing the data collected during the hazard identification and risk assessment processes, and developing a strategic plan to control the risks identified. A risk control schedule form is provided as Appendix Three, which can assist in the allocation of tasks to relevant people and the prioritisation of controls.

The risk control process starts by considering the highest ranked risks, working down to the least significant. Each risk should be examined having regard to the 'hierarchy of controls'. This provides a method of systematically evaluating each risk to determine, firstly, if the causal hazard can be eliminated, and otherwise, to find the most effective control method for each risk.

Hierarchy of controls

The hierarchy of controls is as follows:

• Eliminate the hazard.
• Substitute with a lesser hazard.
• Use engineering controls to reduce the hazard
• Administrative controls such as workplace procedures
• Personal Protective Equipment.

In many cases, it will be necessary to use more than one control method. Back-up controls (such as personal protective equipment and administrative controls) should only be used as a last resort or as a support to other control measures.

Control worst first

While the risk control process concentrates on controlling the highest ranked risks first, this does not mean that lower priority risks, which can be controlled quickly and easily, should not be controlled simultaneously. The best available control measures should be put in place as soon as possible.

In some cases it may be necessary to put temporary controls in place until such time as the proper controls can be instituted. Wherever there is a high risk and the control measures are not immediately available, temporary controls, which reduce the risk(s), must be put in place or the activity must cease until adequate controls are implemented.

Using the hierarchy of controls

The hierarchy of controls was developed by WorkSafe Australia to assist employers in finding the most effective control measures for hazards in their workplaces. When examined in greater detail, the controls hierarchy may be divided into three levels, the second two levels involving several elements:

1. Level 1: Eliminate the hazard.
2. Level 2: Minimise the risk.
   1. Substitute with a lesser hazard.
   2. Modify the work system or process.
   3. Isolate the hazard.
   4. Introduce engineering controls.
3. Level 3: Institute back-up controls.
   1. Implement administrative controls and safe work practices.
   2. Require personal protective equipment to be used.

Sequence of risk control

A schedule should then be drawn up outlining the deadlines by which each control must be implemented, and the people responsible. During the process of determining appropriate control measures, and scheduling and implementing these controls, records should be made. An example of a Risk Control Schedule is provided as Appendix Three.

Deciding on controls

To determine the best control measure, consider each of the 'hierarchy of control' options starting at the top and working down. The higher on the list the control you choose, the better the results should be. Unless you completely eliminate the hazard, which is the first control option, you may need to consider using more than one control simultaneously.

Both elimination and substitution control the hazard itself. They are, therefore, more effective in reducing risk than controls which reduce exposure and which therefore do not reduce the hazard itself (such as modification or isolation).

Controlling exposure does not generally reduce the consequence, or severity, factor of the risk although it can reduce the likelihood of harm occurring. Another limitation is that controls on exposure can be more easily removed or defeated. Therefore, there will be a need to set up higher standards of supervision, maintenance, checking, training and other administrative measures.

Engineering controls consider the question: 'Is it possible to use engineering controls such as lockout procedures, process changes, presence-sensing systems, ventilation or machine guarding to reduce the risk?'.

Back-up controls may take the form of administrative controls or provision of personal protective equipment.

Administrative controls involve the use of management systems to minimise risks and promote workplace safety. At any workplace, the primary administrative control, which should be in place at all times, is the use of safe work practices. This should include the use of written procedures to indicate:

• how tasks are to be undertaken;
• who is permitted in the work area;
• what the requirements for operating different types of equipment are;
• operator competencies; and
• any training and supervision needed.

Other examples of administrative controls, which may be used, include the following:

• providing worker rotation so that the same workers are not exposed all the time;
• rescheduling operations to times when there are fewer workers around;
• providing one-way traffic flow to minimise traffic hazards;
• instituting purchasing controls where a hazard has been eliminated to ensure that, for example, a solvent-based adhesive is not purchased by someone in the organisation who is unaware of the decision to use only the water-based alternative; and
• providing adequate information, instruction, training and supervision to ensure that employees undertake their work safely.

Personal protective equipment (PPE) involves some form of equipment being worn by workers who may be exposed to hazards, to shield their bodies from harm. For the most part, PPE should not be used as a primary means of protection, but only as a back-up to support other control measures.

Documenting risk control

The risk control process should be fully documented and these records kept with other relevant risk management records. Controls can be documented on the Risk Management Matrix, provided as Appendix Two or as part of a Risk Control Record Form that is provided as Appendix Four

Undertaking Monitoring and Review

Monitoring and review is the final stage in the process. It is the means by which risk management is kept current and effective, as new hazards and those overlooked in the original process are identified and controlled.

Monitoring and review involves:

• the systematic re-implementation of the original steps of:
  • hazard identification
  • risk assessment
  • risk control

This is to ensure that the process was undertaken properly and that, in hindsight, the conclusions were correct

• ongoing monitoring of existing risk control measures to assess their effectiveness in light of changes and fluctuations in the workplace
• collection of data on any new hazards which may have arisen and the formulation of new control measures
• reviewing the risk management process to ensure that all new hazards identified are controlled.

Aids to monitoring and review

In repeating the original elements of your safety program, other related activities should be undertaken periodically as part of the monitoring and review system. These include:

• scheduled inspections;
• ongoing measurement and testing;
• workplace monitoring where necessary (for hazards such as noise and air contaminants); and
• periodic incident analysis.

Appendix One – Hazard Identification Report Form

Appendix Two – Risk Management Matrix

Appendix Three – Risk Control Schedule

Appendix Four – Risk Control Record Form