Hazard report forms and hazard reporting: what WHS law asks, and how to close the loop

01

What a hazard report is, and the WHS duties behind it

A hazard is "a situation or thing that has the potential to harm a person". That is the definition in the approved code of practice How to manage work health and safety risks, SafeWork NSW's edition of the Safe Work Australia model code. A hazard report tells someone with the authority to fix it that a hazard exists, where, and what was seen, before it causes an injury, an illness or an incident.

No Australian law prescribes a hazard report form. What the law sets is the duty the form serves. Regulation 34 of the model Work Health and Safety Regulations 2011 says: "A duty holder, in managing risks to health and safety, must identify reasonably foreseeable hazards that could give rise to risks to health and safety." Regulations 35 to 38 then require the duty holder to eliminate or minimise the risk, to follow the hierarchy of control measures, to keep control measures effective, and to review them. Hazard reporting is one of the main ways a person conducting a business or undertaking (PCBU) meets regulation 34 between inspections.

The Work Health and Safety Act 2011 adds the people side. Section 28 requires a worker to "take reasonable care for his or her own health and safety" and that of others, and to co-operate with any reasonable health and safety procedure notified to workers, which a hazard reporting procedure is. Sections 47 and 49 require the PCBU to consult workers "when identifying hazards and assessing risks to health and safety arising from the work", and the code is direct: "You should encourage your workers to report any hazards and health and safety problems immediately so that risks can be managed before an incident occurs."

Every state and territory except Victoria has adopted the model laws in its own Act and Regulations, with local variations, enforced by its own regulator. The numbers in this guide follow the model laws; check them against your jurisdiction's version.

02

What a hazard report form should hold

A hazard report form has one job: to get enough detail to the right person, quickly. Ask for what only the reporter knows, and leave the risk rating and the fix to the person who owns the area. A practical form holds:

• Where: the building, the level and the exact location, such as "level 2 east fire stair, landing between 2 and 3" rather than "the stairs". It is the field most often left vague.
• What: a short description of the hazard in the reporter's own words, and what could happen, for example "handrail bracket loose, rail moves when leaned on".
• When and who: the date and time, and the reporter's name and employer, so the reporter can be asked questions and told the outcome.
• A photo, where it is safe to take one.
• What was done straight away: area coned off, spill cleaned, equipment tagged out of service, people moved away, or nothing.
• For the person who takes it on: a risk rating, the control measure chosen, who is responsible, a date due, and the date the fix was confirmed.

The last group mirrors the risk register in Appendix D of the code of practice: the hazard, the harm, the level of risk, further controls required, who actions them, the date due and the date complete. A report that feeds straight into that register is far easier to manage than a separate pile of paper.

Typical workplace hazards reported in office buildings, schools, shopping centres and strata common property include:

• slips and trips: wet floors, lifted carpet, damaged tiles, cables across walkways, poor lighting in car parks;
• fire safety: exits obstructed, fire doors wedged open, extinguishers missing, exit signs out;
• electrical: damaged leads, exposed wiring, water near switchboards;
• plant and building fabric: faulty cleaning machines, damaged ladders, loose handrails, falling ceiling tiles, leaks;
• hazardous chemicals: unlabelled containers, spills, chemicals stored in the wrong place;
• traffic: vehicles and pedestrians sharing loading docks without separation;
• people: aggressive behaviour, working alone at night, fatigue.

Psychosocial hazards count too, though a report about a person needs a more private route.

03

Who reports, who acts, and the shared building

Anyone at the workplace can report a hazard: employees, contract cleaners, security officers, maintenance contractors, tenants and visitors. Section 29 of the WHS Act gives every person at a workplace a duty of reasonable care, and a visitor's report deserves the same attention as an employee's.

The report must reach someone who can act. In a multi-tenant office building, a shopping centre or a strata scheme, that is often not the reporter's employer. Section 20 of the Act places a duty on the PCBU with management or control of a workplace to ensure, so far as is reasonably practicable, "that the workplace, the means of entering and exiting the workplace and anything arising from the workplace are without risks to the health and safety of any person". A loose handrail in a common stair is usually the building's to fix, even when a contract cleaner found it.

Section 46 then requires every duty holder with a duty in relation to the same matter to "consult, co-operate and co-ordinate activities" with the others, so far as is reasonably practicable. The code puts it more bluntly: "Never assume that someone else is taking care of a health and safety matter." In a shared building, agree in writing:

• how a contractor's worker reports a hazard in the common areas, and to whom;
• who receives reports, including nights and weekends;
• who decides the control for each kind of hazard: building fabric, fire safety systems, cleaning equipment, tenant fit-out;
• how the contractor learns the outcome, so their workers can be told.

Under section 68, a health and safety representative may "investigate complaints from members of the work group relating to work health and safety". An HSR who can see the hazard reports for their work group can do that job; one who hears about them second-hand cannot.

04

From hazard report to control measure

A hazard report starts the risk management process. The code sets out four steps: identify hazards, assess risks, control risks, review controls. For a single report, the sequence usually runs:

1. Make it safe now. The code says that where you spot a straightforward problem, "action should be taken on these immediately, for example cleaning up a spill", and where there is "immediate or significant danger to people, move those persons to a safer location first and attend to the hazard urgently". Barricades and tags are temporary, not the fix.
2. Acknowledge the report the same day, and give it an owner.
3. Assess the risk: how badly someone could be hurt, and how likely it is. Many hazards need no formal assessment: the code says that where a hazard has "well established and accepted control measures", the step to formally assess the risk "is not required", and you may simply implement the controls.
4. Choose the control. Regulation 35 requires the duty holder to eliminate the risk so far as is reasonably practicable, and if that is not reasonably practicable, to minimise it. Regulation 36 sets the order: substitution, isolation or engineering controls first, then administrative controls, then personal protective equipment. A warning sign is an administrative control, not a permanent answer.
5. Fix it, and confirm it is fixed at the location, ideally by someone other than the person who did the work.
6. Tell the reporter. Section 48 of the Act requires that workers consulted "are advised of the outcome of the consultation in a timely manner".

A hazard report is not an incident report. A hazard report is made before anyone is hurt; an incident report, and any investigation, follows an injury, an illness or a near miss. The WHS incident report guide covers that side.

Some reports cannot wait for this sequence. Where the hazard has already caused a notifiable incident, such as a serious injury or illness, or a dangerous incident with nobody hurt, section 38 of the Act requires the PCBU to ensure the regulator "is notified immediately after becoming aware" of it, and section 39 requires the site to be left undisturbed until an inspector arrives or directs otherwise. The near miss reporting guide covers where that line falls. Section 84 also lets a worker cease or refuse work where they have a reasonable concern that it would expose them to a serious risk from "an immediate or imminent exposure to a hazard", and a hazard reporting procedure should say so.

05

Reviewing hazard reports, and the records worth keeping

Read together, hazard reports tell you about the building and the work. Regulation 38 requires a duty holder to review and as necessary revise control measures in set circumstances, including where a control "does not control the risk it was implemented to control", before a change at the workplace likely to create a new or different risk, where "a new relevant hazard or risk is identified", where consultation shows a review is needed, and where a health and safety representative requests one.

A monthly look at the reports, by the building manager, the facility manager or the WHS committee, should ask:

• Which locations keep appearing? Three reports about the same ramp in a month mean the control is not working.
• Which reports are open past their due date, and were any closed on a temporary measure?
• Who is reporting, and who is not? A contractor whose workers never report may not know how.
• Did any report reveal something the inspection checklist should cover?

The code asks: "Are they openly raising health and safety concerns and reporting problems promptly?" A falling number of hazard reports can mean the building is safer; it can equally mean people have stopped bothering.

On records, the code says that keeping records of the risk management process "demonstrates what you have done to comply with the WHS Act and WHS Regulation". It suggests keeping the hazards, risks and chosen controls, "how and when the control measures were implemented, monitored and reviewed", and who was consulted. For hazard reports, keep the report, the decision, the fix and the confirmation together, with dates and names, not a form in one place and a work order in another.

Some hazards carry their own record-keeping rules, which the code notes for hazards "such as hazardous chemicals, plant and equipment"; fire safety systems have their own state maintenance regimes. A report about a faulty exit sign starts a repair, but the maintenance record belongs in the building's fire safety records.

06

Where hazard reporting fails, and what SiteClara does about it

Hazard reporting rarely fails for want of a form. It fails because the report goes to whoever was passing: a cleaner tells the security officer at the loading dock about a leaking pipe, the officer tells the building manager at shift change, and by Friday nobody can say which pipe it was or whether a plumber came. And it fails quietly when reporters never hear back and stop reporting.

SiteClara records work and reports at the location. A printed QR poster, with an optional NFC tag behind it, sits at each place where checks are scheduled, such as a fire stair, a plant room, a car park level, a bathroom block or an end of trip facility. Staff scan or tap on their own phone, with no app to install, and can report a problem there, with a photo when one helps. The report carries the location, the time and the named person, and goes onto the team's list of open jobs until someone closes it. The same tag is where the scheduled checks at that location are marked done, or explained when something stopped them.

The supervisor sees the open jobs and the day's checks, adds a note and approves a daily report that goes to nominated management or client contacts the next morning, showing what was reported, what was completed and what is still open. That turns "I mentioned it to someone" into a dated report at a known location, and "it was sorted" into a closed job with a time and a name.

07

Questions people ask

What counts as a hazard?

The approved code of practice How to manage work health and safety risks defines a hazard as "a situation or thing that has the potential to harm a person", and gives as examples "noisy machinery, a moving forklift, chemicals, electricity, working at heights, a repetitive job, bullying and violence at the workplace". It says hazards generally arise from the physical work environment, the equipment, materials and substances used, the work tasks and how they are performed, and work design and management.

What are the common types of workplace hazards?

Table 1 of the code of practice How to manage work health and safety risks lists ten common types: manual tasks, gravity (falling objects, falls, slips and trips), psychosocial hazards such as excessive time pressure, bullying, violence and work-related fatigue, electricity, machinery and equipment, hazardous chemicals, extreme temperatures, noise, radiation, and biological hazards such as micro-organisms. The code adds that a piece of plant, a substance or a work process may have many different hazards, and each needs to be identified.

What is the correct procedure for reporting a hazard?

The law leaves the procedure to each workplace, but the code of practice How to manage work health and safety risks sets the pace: "You should encourage your workers to report any hazards and health and safety problems immediately so that risks can be managed before an incident occurs." Where there is "immediate or significant danger to people", it says to move those people to a safer location first and attend to the hazard urgently. In practice: make the area safe if you can do so safely, tell your supervisor or the person who manages the area, and record where the hazard is, what it is, when you saw it and who you are, so the report can be followed up and closed.

08

Where to read more, and a list to take away

The Work Health and Safety Regulations 2011 on the Federal Register of Legislation set out the duty to identify hazards and to manage, maintain and review control measures in Part 3.1. The Work Health and Safety Act 2011 sets out the primary duties in Part 2, notifiable incidents in Part 3, and consultation, HSRs and the right to cease unsafe work in Part 5. Each adopting state and territory publishes its own version.

For practice, read the approved code of practice How to manage work health and safety risks (SafeWork NSW edition, based on the Safe Work Australia model code dated May 2018); chapters 2, 5 and 6 cover finding hazards, review and records, and Appendix D is a blank risk register. In Victoria, start with the Occupational Health and Safety Act 2004 and WorkSafe Victoria's guidance.

Before you rely on your hazard reporting, check that:

• everyone in the building, contractors and night shifts included, can report a hazard in a minute or two, on paper, online or on a phone, where they found it;
• the form asks for the exact location, a description, the time, the reporter's name and a photo;
• it is written down who receives reports for each part of the building, including after hours, and who owns each kind of hazard;
• each report is acknowledged the same day and given an owner and a due date;
• controls follow the hierarchy, and a sign or a cone is never the final fix;
• a report is closed only when the fix is confirmed at the location, and the reporter is told;
• reports are reviewed together each month, and repeat locations lead to a review of the control measure under regulation 38;
• your HSR and WHS committee can see the reports for their work group;
• the procedure matches your jurisdiction, and Victoria's OHS Act where the site is in Victoria.