Hazard vs Risk in ISO 45001: What Is the Difference?

The terms hazard and risk are often used interchangeably in workplace health and safety discussions, but they describe different concepts. Understanding the distinction is important when implementing an ISO 45001 Occupational Health and Safety (OH&S) Management System because an organization first needs to understand what could cause injury or ill health before it can evaluate the level of risk associated with that hazard.

In practical terms, a hazard is a source or situation with the potential to cause harm, while OH&S risk considers the likelihood that a hazardous event or exposure could occur together with the severity of the resulting injury or ill health. This distinction allows organizations to move beyond simply identifying unsafe conditions and instead evaluate which situations require priority attention and what controls may be appropriate.

Effective hazard identification and risk assessment are therefore closely connected. Identifying hazards answers the question of what could cause harm, while assessing risk helps determine how significant that harm could be under the actual working conditions.

What Is a Hazard in ISO 45001?

Within an OH&S management system, a hazard is a source with the potential to cause injury or ill health. Hazards may arise from physical conditions, equipment, substances, work activities, human factors, workplace design or organizational conditions.

Common workplace hazards can include unguarded machinery, working at height, electricity, hazardous chemicals, excessive noise, moving vehicles, poor workstation design, manual handling, extreme temperatures and repetitive work. Organizations should also consider occupational health and psychosocial hazards, including excessive workload, fatigue, workplace violence and other conditions that may adversely affect worker health.

A hazard exists because there is a potential for harm. For example, an exposed electrical conductor presents a hazard because contact could result in electric shock, burns or another injury. However, identifying the electrical hazard alone does not establish the level of risk. The organization still needs to consider factors such as the likelihood of exposure, the people who may be affected, the controls already in place and the possible severity of the outcome.

This is where risk assessment becomes necessary.

What Is OH&S Risk?

OH&S risk considers the possibility that a work-related hazardous event or exposure will occur and the severity of the injury or ill health that could result. In other words, risk provides a way of evaluating the significance of a hazard under particular circumstances.

Two workplaces can contain the same hazard while presenting very different levels of risk. A hazardous chemical that is frequently handled manually in an area with inadequate ventilation may present a substantially different risk from the same chemical contained within a closed and well-controlled automated process.

The hazard itself may remain the same, but the circumstances of exposure, existing controls and possible consequences change the level of risk. For this reason, organizations should avoid assigning a fixed risk level simply because a particular hazard exists.

Hazard vs Risk: A Practical Example

A wet floor provides a simple example of the relationship between hazard and risk. The slippery surface is the hazard because it creates the potential for someone to fall. The associated risk involves the possibility that a person will actually slip and the seriousness of any resulting injury.

Several factors can influence the level of risk, including how slippery the floor is, how many people pass through the area, whether employees are aware of the condition, whether warning signs or barriers have been installed and how quickly the spill is removed.

If the wet floor is inside a locked room that nobody enters, the hazard may still exist, but exposure is limited. If exactly the same wet surface is located at the entrance to a busy warehouse where workers and visitors pass continuously, the associated risk may be considerably greater.

This illustrates an important principle of risk assessment: the presence of a hazard does not, by itself, determine the level of risk.

Practical Examples of Hazards and Risks at Work

The difference becomes easier to understand when it is applied to normal workplace activities.

The purpose of hazard identification is therefore not simply to create a long list. Organizations need to understand how identified hazards could affect workers and other relevant persons and then determine which risks require additional control.

Hazard Identification Comes Before Risk Assessment

An effective risk assessment depends on effective hazard identification. If an important hazard has not been identified, the associated risk may never be properly evaluated or controlled.

Organizations should therefore examine both routine and non-routine activities when identifying hazards. Routine production activities may be obvious, but maintenance, cleaning, equipment breakdowns, shutdowns and emergency situations can introduce hazards that are not present during normal operations.

Hazard identification should also consider contractors, visitors, new or inexperienced workers, changes in materials and equipment, human factors, workplace design, previous incidents, near misses and worker feedback. Considering these factors helps the organization understand how work actually takes place rather than relying solely on documented procedures.

Workers can provide particularly useful information because they frequently understand practical conditions, workarounds and operational difficulties that may not be obvious during a management review or desk-based risk assessment.

Once relevant hazards have been identified, the organization can evaluate the associated OH&S risks.

How Is Risk Evaluated?

Organizations may use different risk-assessment methods depending on the size, nature and complexity of their operations. A commonly used approach considers two major factors: the likelihood that a hazardous event or exposure will occur and the severity of the resulting injury or ill health.

Some organizations classify risks as low, medium or high, while others use numerical risk matrices in which likelihood and severity are combined to produce a risk rating. A simple model may therefore express the relationship as likelihood × severity = risk rating.

However, the purpose of risk assessment should not be to produce a number merely for documentation. A risk score is useful only when it supports better decisions. The organization should use the assessment to determine whether existing controls are adequate, whether the level of residual risk is acceptable and whether further measures are necessary.

This is particularly important because a numerical rating can sometimes create a false sense of precision. Management should consider actual working conditions and professional judgement rather than relying only on a calculated score.

Why the Same Hazard Can Create Different Levels of Risk

Risk depends heavily on circumstances and exposure. Consider a hazardous chemical used in two different workplaces. In the first workplace, employees may manually handle the substance several times each day in an area with limited ventilation. In the second workplace, the same substance may remain enclosed within an automated process with minimal worker exposure.

Although the chemical hazard exists in both situations, the associated risk may be substantially different.

The same principle applies to machinery. A sharp blade that an employee handles continuously may create a very different risk from an identical blade contained behind effective machine guarding and accessed only during controlled maintenance.

Organizations should therefore evaluate actual work activities rather than assuming that a particular hazard always creates the same level of risk.

Existing Controls Should Be Considered During Risk Assessment

Risk assessment should take account of the controls that are already in place. These may include machine guarding, ventilation systems, physical barriers, safe operating procedures, permit-to-work systems, training, inspections, preventive maintenance, warning systems and personal protective equipment.

In some risk-assessment methods, organizations evaluate an initial level of risk and then consider the residual risk remaining after controls have been applied. If the remaining risk is still considered unacceptable, additional measures may be required.

The purpose is not simply to demonstrate that controls exist. Organizations should consider whether those controls are effective, properly maintained and consistently applied in practice.

For example, a machine guard may appear to be an effective control, but its effectiveness can be reduced if workers routinely bypass it during production or if maintenance activities require the guard to be removed without alternative safeguards.

Hazard Identification Is an Ongoing Process

Hazard identification should not be treated as an activity completed once when an OH&S management system is initially implemented. Workplaces change continuously, and those changes can introduce new hazards or alter existing risks.

Organizations may introduce new equipment, chemicals, production technology, contractors, employees or working methods. Production volumes can increase, layouts may change, and activities that were previously uncommon may become part of routine operations.

Hazard identification and risk assessment should therefore be reviewed when relevant circumstances change. Reviews may be appropriate following workplace modifications, incidents or near misses, the introduction of new equipment or materials, significant process changes, organizational changes, new legal or other requirements, and findings from inspections or audits.

Worker consultation can also help identify changes that management systems have not yet captured formally. Employees often see how modifications affect real working conditions before those effects become visible through performance reports or incident statistics.

What Happens After OH&S Risks Are Identified?

Identifying hazards and evaluating risks is only part of the risk-management process. Once an organization understands the nature and significance of a risk, it needs to decide whether the hazard can be eliminated or whether the associated risk needs to be reduced.

Organizations should avoid automatically choosing the easiest control or relying primarily on personal protective equipment. A more structured method is provided by the hierarchy of controls, which prioritizes controls according to their effectiveness.

The hierarchy generally progresses from elimination, followed by substitution, engineering controls, administrative controls, and finally personal protective equipment. Stronger measures address the hazard closer to its source, while lower-level controls may depend more heavily on individual behavior.

For example, removing a hazardous chemical from a process altogether is generally more effective than simply issuing workers with gloves and respiratory protection while continuing to use the substance in exactly the same way.

The hierarchy of controls therefore provides a logical next step after hazard identification and risk assessment.

Common Mistakes When Identifying Hazards and Assessing Risks

One frequent mistake is treating the terms hazard and risk as interchangeable. If every hazard is automatically categorized as a high risk without considering exposure, likelihood, severity and existing controls, the organization loses an important ability to prioritize its OH&S efforts.

Another common problem is concentrating only on obvious physical safety hazards such as machinery, falls and electricity. Occupational health risks may also arise from noise, hazardous substances, poor ergonomics, fatigue, workload and psychosocial factors. A complete approach to ISO 45001 should therefore consider both injury and ill-health potential.

Organizations should also be cautious about copying generic risk assessments. A template can provide a useful starting point, but it may fail to reflect the actual equipment, workers, working conditions and operational practices at a particular site.

Non-routine activities are another area that can easily be overlooked. Maintenance, shutdowns, cleaning, temporary work and emergency situations can introduce hazards that do not exist during normal production. These activities should therefore form part of the organization's hazard-identification process.

Finally, risk assessments need to remain current. An assessment that accurately reflected the workplace several years ago may no longer be appropriate if equipment, processes, staffing, materials or working methods have changed.

Hazard and Risk Assessment Within ISO 45001

Hazard identification and the assessment of OH&S risks are fundamental components of an ISO 45001 management system. They help organizations determine where harm may occur, understand the significance of identified risks and select appropriate controls.

ISO 45001:2018 remains the current published edition of the standard, together with Amendment 1:2024. Organizations implementing or maintaining an OH&S management system should therefore base their current arrangements on the applicable published requirements while keeping informed about future revisions to the standard.

For organizations preparing for ISO 45001 certification in the UAE, hazard identification and risk assessment should reflect actual workplace conditions rather than generic documentation prepared only for an audit. The effectiveness of the process depends on how well the organization understands its activities, worker exposure, existing controls and changing working conditions.

Frequently Asked Questions

What is the main difference between a hazard and a risk?

A hazard is a source or situation with the potential to cause injury or ill health. Risk considers the likelihood that a hazardous event or exposure will occur together with the severity of the potential consequence. Identifying the hazard therefore establishes what could cause harm, while risk assessment evaluates how significant that potential harm may be under actual working conditions.

Is working at height a hazard or a risk?

Working at height presents a hazard because there is potential for a person to fall. The associated risk considers factors such as the likelihood of a fall, the height involved, the type of work being performed, the effectiveness of existing controls and the possible severity of an injury.

Is PPE a hazard-control measure?

Yes. Personal protective equipment can reduce exposure to certain hazards, but it generally appears lower in the hierarchy of controls because it does not normally eliminate the hazard at its source. Organizations should therefore consider whether stronger controls such as elimination, substitution or engineering measures are reasonably available.

Should every identified hazard be assessed for risk?

Organizations need an effective method for determining and assessing relevant OH&S risks. The level of detail used should be appropriate to the nature of the activity, the hazard, the people who may be exposed and the potential consequences.

When should hazard identification and risk assessment be reviewed?

They should be reviewed when relevant circumstances change or new information becomes available. This may include incidents or near misses, workplace modifications, new equipment or materials, changes in work activities, audit findings or significant organizational changes.

Can two workplaces have the same hazard but different levels of risk?

Yes. The same hazard can create different levels of risk depending on factors such as exposure, frequency of the activity, number of people affected, existing controls and potential severity. This is why organizations should assess actual workplace conditions rather than assigning fixed risk ratings based only on the type of hazard.