Workplace Risk Assessments: A Practical Guide to Managing WHS Risks

Every business has hazards. A risk assessment is how you decide which ones matter most and what to do about them. Done well, it doesn’t have to be complicated or buried in paperwork. This guide covers the four-step risk management process, how to use a risk matrix, the hierarchy of controls, common mistakes, and practical strategies to keep risk management working day to day.

What WHS law expects

Under the model Work Health and Safety laws, a business must remove risks to health and safety so far as is reasonably practicable, and where that isn’t possible, minimise them. The WHS Regulations set out how to do this, including using the hierarchy of controls and reviewing control measures in certain situations, such as when a control isn’t working, before a change at the workplace, when a new hazard is identified, or when a health and safety representative asks for a review.

Safe Work Australia’s Code of Practice on how to manage work health and safety risks describes a four-step process. Some hazards, such as hazardous chemicals, plant and falls, also have their own specific requirements.

The four-step risk management process

1. Identify hazards. Walk the workplace, talk to workers, review incidents and near misses, and check manufacturer information and safety data sheets to find what could cause harm.
2. Assess the risks. For each hazard, consider what could happen, how likely it is and how serious the harm could be. Where a hazard and its controls are well known, you may not need a detailed assessment.
3. Control the risks. Choose the most effective controls that are reasonably practicable, working down the hierarchy of controls, and put them in place.
4. Review the controls. Check that controls are working as planned, and review them when things change, when an incident happens or when workers raise concerns.

Using a risk matrix

A risk matrix combines likelihood and consequence to give a risk rating, so you can prioritise. A simple example:

Agree what each rating means in practice, such as extreme risks stopping work until controlled, and use the same matrix across the business so ratings are consistent.

The hierarchy of controls

Controls are ranked from most to least effective. Work down the list and use a combination where needed:

1. Remove the hazard altogether, for example by stopping a task or removing a chemical.
2. Substitute something safer, such as a less hazardous chemical or a smaller load.
3. Isolate people from the hazard, for example with barriers or exclusion zones.
4. Use engineering controls, such as guards, ventilation or lifting aids.
5. Use administrative controls, such as procedures, training, signage and rosters.
6. Use personal protective equipment, such as gloves, hearing protection and hard hats.

Administrative controls and PPE rely on people doing the right thing every time, so they should support higher-level controls rather than replace them.

Common risk assessment mistakes

• Desk-based assessments written without looking at the work or talking to the people who do it.
• Jumping to PPE without considering higher-level controls.
• Set and forget: assessments that are never reviewed after changes or incidents.
• Too generic: copied templates that don’t reflect your site, equipment or people.
• No follow-through: controls identified but never put in place or checked.

Strategies that keep risk management working

• Lead from the top: managers who ask about risks, fund controls and follow up on actions set the tone.
• Consult genuinely: involve workers and health and safety representatives in identifying hazards and choosing controls.
• Check controls in the field: use regular workplace inspections and pre-start checks to confirm controls are in place and working.
• Make reporting easy: hazards, near misses and incidents should be simple to report, and reports should lead to action.
• Train for the risks: make sure people understand the hazards of their work and the controls that protect them.
• Learn from incidents: investigate to find root causes, then update risk assessments. See our 5 Whys guide.

With DIGI CLIP, Safety Tracker hazard assessments use a risk matrix (likelihood × consequence) with standardised templates, control measures and risk ratings. Checks and assessments are completed on a phone or tablet, each form is location- and time-stamped, and actions flow into the Action Log to be assigned, tracked and closed out with evidence.

Illustrative scenario: a new loading bay layout

Before changing the layout of a loading bay, a warehouse team reviews the risk assessment together. They identify a new blind corner where forklifts and pedestrians would meet, rate it high risk and choose to isolate the walkway with barriers rather than rely on signage alone. The barrier installation is raised as an action and closed out with a photo before the new layout goes live.

This scenario is illustrative. It shows how a business could use DIGI CLIP and is not an account of a specific customer.

See also our guides to workplace safety hazards and risk assessments in construction.