Risk Assessment
Co-Founder & GM of Operations
A risk assessment is the systematic process of identifying workplace hazards, analysing their likelihood and potential consequences, and determining control measures that eliminate the risk or, where that is not reasonably practicable, minimise it so far as is reasonably practicable.
A risk assessment is a systematic process of identifying hazards, evaluating the likelihood and severity of harm, and determining control measures that eliminate the risk or, where that is not reasonably practicable, minimise it so far as is reasonably practicable. It follows the hierarchy of controls (elimination; substitution, isolation or engineering controls; administrative controls; PPE) and produces a documented record of identified risks and the measures taken to manage them.
The four steps in the model Code
Safe Work Australia's model Code of Practice How to manage work health and safety risks (November 2024) sets out risk management as four steps: identify hazards; assess risks, if necessary; control risks; and review hazards and control measures to make sure they are working as planned.
The risk assessment is the second step. It considers what could happen if someone is exposed to a hazard and how likely that is, and helps a PCBU decide how severe a risk is, whether existing controls are effective, what action to take and how urgently.
The legal duty behind the process sits in the model WHS Act and Regulations. A duty holder must identify reasonably foreseeable hazards (regulation 34), and must eliminate risks so far as is reasonably practicable or, if that is not reasonably practicable, minimise them so far as is reasonably practicable (section 17 of the Act and regulation 35). The standard is what is reasonably practicable, weighed under section 18, rather than a fixed acceptable level of risk.
Victoria is not a model WHS state; its duties sit under the Occupational Health and Safety Act 2004. This page is general information, not legal advice: confirm the detail with your state or territory regulator.
Sources: Safe Work Australia: model Code of Practice, How to manage work health and safety risks (November 2024) · Safe Work Australia: model Work Health and Safety Bill (5 December 2025) · Safe Work Australia: model Work Health and Safety Regulations (5 December 2025)
When a risk assessment is required
A formal risk assessment is not always needed. The model Code says that where hazards and their risks are well known and have well established and accepted control measures, a PCBU can simply implement those controls. It also says a risk assessment is not required where legislation requires a hazard or risk to be controlled in a specific way, because those requirements must be complied with.
The Code says a risk assessment should be done when there is uncertainty about how a hazard may result in injury or illness, when several hazards may interact to produce new or greater risks, or when changes at the workplace may affect how well control measures work.
| Work | What the Regulations require | How long to keep it |
|---|---|---|
| Entry into a confined space | A risk assessment by a competent person, recorded in writing (regulation 66) | At least 28 days after the work is completed, or at least 2 years after a notifiable incident connected with it (regulation 77) |
| Electrical work on energised equipment | A risk assessment before the work starts (regulation 158(1)(a)) | At least 28 days after the work is completed, or at least 2 years after a notifiable incident (regulation 162) |
| Work near overhead or underground electric lines, where a safe distance is not reasonably practicable | A risk assessment, with control measures consistent with it and with any requirements of the electricity supply authority (regulation 166(2)) | Regulation 166 sets no retention period |
| Diving work | A risk assessment by a competent person, recorded in writing (regulation 176) | At least 28 days after the work is completed, or at least 2 years after a notifiable incident (regulation 182) |
Work where the model WHS Regulations (5 December 2025) require a risk assessment
The Code gives confined spaces, diving work and live electrical work as examples of this kind of work, so the list is not exhaustive. Other risks must be managed in a way the Regulations set out, such as falls from height under Part 4.4.
Sources: Safe Work Australia: model Code of Practice, How to manage work health and safety risks (November 2024) · Safe Work Australia: model Work Health and Safety Regulations (5 December 2025)
The hierarchy of control measures
If a risk can't be eliminated, regulation 36 of the model Regulations sets the order in which it must be minimised, each step applying only to the risk that remains.
| Order | Control | Regulation |
|---|---|---|
| 1 | Eliminate the risk, so far as is reasonably practicable | 35(a) |
| 2 | Minimise it by substitution, isolation or engineering controls, alone or together | 36(3) |
| 3 | Minimise any remaining risk with administrative controls | 36(4) |
| 4 | Minimise any risk still remaining by ensuring the provision and use of suitable personal protective equipment | 36(5) |
Hierarchy of control measures, regulations 35 and 36 of the model WHS Regulations (5 December 2025)
A combination of controls may be used if one is not enough. Every control must be maintained so it remains effective: fit for purpose, suitable for the nature and duration of the work, and installed, set up and used correctly (regulation 37).
The Code says the hierarchy can be applied to any risk, and that the Regulations make it mandatory to work through it when managing certain risks.
Sources: Safe Work Australia: model Work Health and Safety Regulations (5 December 2025) · Safe Work Australia: model Code of Practice, How to manage work health and safety risks (November 2024)
When controls must be reviewed
Regulation 38 requires a duty holder to review, and as necessary revise, control measures to keep the work environment without risks to health or safety so far as is reasonably practicable. It names five events that require a review.
| Trigger | When |
|---|---|
| (a) | The control measure does not control the risk it was implemented to control, for example monitoring shows it is not working, or a notifiable incident occurs because of the risk |
| (b) | Before a change at the workplace that is likely to give rise to a new or different risk the measure may not effectively control, including a change to the workplace, the work environment, a system of work, a process or a procedure |
| (c) | A new relevant hazard or risk is identified |
| (d) | The results of consultation indicate that a review is necessary |
| (e) | A health and safety representative requests a review |
Review triggers, regulation 38(2) of the model WHS Regulations (5 December 2025)
The model Regulations set no fixed review interval; the triggers are events. A health and safety representative can request a review if they reasonably believe one of triggers (a) to (d) affects their work group and the duty holder has not adequately reviewed the control (regulation 38(4)).
Consultation runs through every step: under section 49 of the model WHS Act, a PCBU must consult workers when identifying hazards and assessing risks, and when making decisions about ways to eliminate or minimise them.
Sources: Safe Work Australia: model Work Health and Safety Regulations (5 December 2025) · Safe Work Australia: model Work Health and Safety Bill (5 December 2025)
Key facts you can cite
Safe Work Australia's model Code of Practice sets out risk management as four steps: identify hazards, assess risks if necessary, control risks, and review control measures.
Source: Safe Work Australia, model Code of Practice: How to manage work health and safety risks, checked 21 September 2026
A formal risk assessment is not required where the risks and controls for a hazard are already well known, or where legislation requires the hazard to be controlled in a specific way (model Code of Practice, step 2).
Source: Safe Work Australia, model Code of Practice: How to manage work health and safety risks, checked 21 September 2026
The model WHS Regulations require a risk assessment for work including confined space entry (regulation 66), energised electrical work (regulation 158) and diving work (regulation 176).
Source: Safe Work Australia, model Work Health and Safety Regulations, checked 21 September 2026
Regulation 36 of the model WHS Regulations ranks controls after elimination: substitution, isolation or engineering controls, then administrative controls, then PPE.
Source: Safe Work Australia, model Work Health and Safety Regulations, checked 21 September 2026
Regulation 38 names five events that require control measures to be reviewed, including before a workplace change and when a health and safety representative asks.
Source: Safe Work Australia, model Work Health and Safety Regulations, checked 21 September 2026
Reuse these lines with attribution: cite the named primary source, and link this page if the summary helped.
Why it matters
Managing risks is a legal duty under Australian WHS legislation, the model Regulations require a risk assessment for specific high risk work such as confined space entry, and risk assessment forms the foundation of any safety management system. They ensure that hazards are identified before work begins, controls are proportionate to the level of risk, and there is documented evidence of due diligence. Without formal risk assessments, organisations are exposed to preventable incidents and cannot demonstrate compliance during investigations or audits.
How MapTrack helps
MapTrack provides digital risk assessment templates that teams complete on mobile devices, linking each assessment to the relevant asset, site, or project for a complete risk management audit trail.
Related on MapTrack
Related guides
Stay ahead of every inspection deadline
Automated reminders, digital checklists and audit-ready records in MapTrack.
- No credit card required
Frequently asked questions
What are the five steps of a risk assessment?
A common five-step format is: (1) identify the hazards, (2) determine who might be harmed and how, (3) evaluate the risks and decide on control measures, (4) record the findings and implement the controls, and (5) review the assessment and update as necessary. In Australia, Safe Work Australia's model Code of Practice sets out four steps instead: identify hazards, assess risks if necessary, control risks, and review control measures. This process is iterative and should be repeated whenever conditions, equipment, or procedures change.
What is the difference between a risk assessment and a SWMS?
A risk assessment is a broad process for identifying and evaluating hazards in any workplace activity. A Safe Work Method Statement (SWMS) is a specific document required under Australian WHS regulations for high-risk construction work. A SWMS includes the risk assessment findings plus detailed work steps, control measures, and responsibilities. In practice, the risk assessment feeds into the SWMS.
How often should risk assessments be reviewed?
Risk assessments should be reviewed whenever there is a change in the work activity, equipment, or environment, after an incident or near miss, when new information about a hazard becomes available, and at regular intervals (typically annually) even if no changes have occurred. Under regulation 38 of the model WHS Regulations, control measures must be reviewed when they do not control the risk, before a workplace change likely to create a new or different risk, when a new hazard or risk is identified, when consultation shows a review is needed, and when a health and safety representative asks. Dynamic risk assessments, such as Take 5s, are performed before each task.
Related terms
Pre-Start Inspection
A pre-start inspection is a systematic check performed on plant, equipment, or vehicles before each use or shift to identify defects, damage, or unsafe conditions. It typically follows a standardised checklist covering safety-critical items such as brakes, steering, lights, tyres, guards, fluid levels, and warning devices. In Australia the legal duty behind it is the requirement to inspect plant in accordance with the manufacturer's recommendations, so where an operator's manual specifies a check before each shift, that check is how the duty is met.
Compliance Management
Compliance management in asset-intensive industries is the systematic process of ensuring that equipment, operations, and personnel meet all applicable regulatory, safety, environmental, and contractual requirements. It encompasses tracking inspection due dates, certifications, licences, safety checks, environmental obligations, and industry-specific standards. Compliance management requires both proactive scheduling and thorough record-keeping.
WHS compliance software
WHS compliance software is a digital WHS management system that helps organisations meet Work Health and Safety obligations by managing inspections, incident records, risk assessments, corrective actions, contractor compliance, regulatory reporting and audit trails. It replaces paper registers, spreadsheets and email chains with a searchable system of record that shows what was checked, when it was checked, who completed it, what failed and what evidence was attached.
Lockout/Tagout (LOTO)
Lockout/Tagout (LOTO) is a safety procedure used to ensure that equipment is properly shut down, isolated from all energy sources, and cannot be restarted until maintenance or repair work is completed. Lockout involves physically locking energy isolation devices (such as circuit breakers or valves) in the off position, while tagout involves attaching a warning tag to the isolation point. LOTO protects workers from the unexpected release of hazardous energy during servicing.
Job Safety Analysis (JSA)
A Job Safety Analysis is a structured risk assessment technique that breaks a work task into its component steps, identifies the hazards present at each step, and documents the control measures required to eliminate or minimise those hazards. The JSA process typically involves observing the task, consulting with workers who perform it, listing each step in sequence, identifying what could go wrong at each step, and recording the controls that should be applied, following the hierarchy of controls from elimination through to personal protective equipment. JSAs are widely used across construction, mining, manufacturing, oil and gas, and logistics to ensure that hazards are systematically identified and addressed before work begins. They are often completed collaboratively by the work crew at the start of a shift or before a non-routine task. The completed JSA serves as both a planning tool and a communication document that every crew member reads and signs before commencing work, ensuring shared understanding of the hazards and the agreed controls.
Safe Work Method Statement (SWMS)
A Safe Work Method Statement is a documented procedure that describes the high-risk construction work to be carried out, the hazards associated with that work, and the control measures that will be implemented to manage those hazards. In Australia, a SWMS is a legal requirement for high risk construction work: regulation 291 of the model WHS Regulations lists 18 types, 19 in the ACT and Victoria, including work with a risk of a fall of more than two metres, work on or near energised electrical installations, demolition of load-bearing elements, and work in or near confined spaces. The SWMS must be prepared before the high-risk work commences, must take account of the circumstances at the workplace, and must be readily accessible to the workers carrying out the task. Workers who will do the work should be consulted on it, and many sites ask them to sign it, although the Regulations do not require a signature. A SWMS must be reviewed, and revised as necessary, whenever the relevant control measures are revised. The document typically includes the project and task description, the names and qualifications of workers, a step-by-step breakdown of the work, identified hazards at each step, risk ratings, and the specific control measures to be applied.
Working at Heights
Working at heights refers to any work performed in a location where a person could fall a distance likely to cause injury. In Australia, the model WHS Regulations set no minimum height: the duty covers any fall from one level to another that is reasonably likely to cause injury, and construction work with a risk of a fall of more than 2 metres also needs a safe work method statement. It includes work on roofs, scaffolds, ladders, elevated work platforms (EWPs), and open edges. Controls follow the hierarchy: eliminate the need for height work first, then use passive fall prevention, work positioning, and finally fall arrest systems.
Cite this definition
Writing about this topic? You’re welcome to quote this definition. Here’s the wording to use so your readers can find the original.
A risk assessment is a systematic process of identifying hazards, evaluating the likelihood and severity of harm, and determining control measures that eliminate the risk or, where that is not reasonably practicable, minimise it so far as is reasonably practicable.
- Short attribution
- MapTrack Glossary: Risk Assessment, https://www.maptrack.com/glossary/risk-assessment
- Reference list
- MapTrack. (2026). Risk Assessment [Glossary definition]. Retrieved from https://www.maptrack.com/glossary/risk-assessment
Free to reuse with credit under a Creative Commons Attribution 4.0 licence. If you’d rather link straight to it, the page is https://www.maptrack.com/glossary/risk-assessment.
See how MapTrack handles risk assessment
Ready to track every asset?
Join construction, mining and field service teams across Australia.
4.9 on G2 · 5.0 on Capterra, GetApp & Software Advice
- No credit card required