Hazard identification and risk assessment: how a HIRA is done, and how it stays true

01

What a HIRA is, and where the duty comes from

The general duty sits in the Occupational Health and Safety Act 85 of 1993. Section 8(1) requires every employer to provide and maintain, as far as is reasonably practicable, a working environment "that is safe and without risk to the health of his employees". Section 8(2)(d) is a hazard identification and risk assessment in all but name: the employer must establish "what hazards to the health or safety of persons are attached to any work which is performed", and to the articles, substances, plant and machinery it uses, "further establish what precautionary measures should be taken" and "provide the necessary means to apply such precautionary measures".

The Act's own definitions keep the two halves of the phrase apart. A hazard is "a source of or exposure to danger"; risk is "the probability that injury or damage will occur"; and safe means "free from any hazard". Hazard identification finds the sources of danger; risk assessment judges how likely harm is and how bad it would be. Reasonably practicable weighs the severity of the risk and what is known about it against the means and cost of removing it (section 1).

The Act does not use the letters HIRA, and for most workplaces it prescribes no form. Several regulations made under it do say what an assessment must contain:

• Construction work: regulation 9(1) of the Construction Regulations, 2014 requires a contractor to have risk assessments performed by a competent person appointed in writing, before and during the work, including "the identification of the risks and hazards to which persons may be exposed to", "an analysis and evaluation of the risks and hazards identified based on a documented method", a documented plan and safe work procedures, "a monitoring plan" and "a review plan". The client prepares a baseline risk assessment for the project under regulation 5(1)(a).
• Ergonomic risks: regulation 6 of the Ergonomics Regulations, 2019 requires an ergonomic risk assessment by a competent person before work that may expose employees to ergonomic risks, at intervals not exceeding two years, including "a complete hazard identification".
• Hazardous chemical agents: regulation 5 of the Regulations for Hazardous Chemical Agents, 2021 requires an assessment of exposure "immediately, and thereafter at intervals not exceeding two years", with a record kept. The hazardous chemical agents guide covers the cleaning chemicals and the store.

So in South Africa a HIRA is how an employer shows it has done what section 8(2)(d) asks and, where a regulation applies, the assessment that meets that regulation's specific requirements. It usually sits in the safety file beside the 16.2 appointment.

02

What a HIRA covers on an occupied site

This guide is about the HIRA for work in buildings already in use: office parks, shopping centres, schools, hospitals, sectional title schemes, warehouses. The hazards are rarely exotic: they come from ordinary work, such as slips, falls from ladders, chemical splashes and lifting. What matters is that the assessment names them for this site, this work and these people. Go through the site by kind of hazard:

• Physical: wet floors after mopping, worn stair nosings, uneven paving, poor lighting on a night patrol route.
• Work at height: ladders for high dusting and lamp changes, gutters, the top of a jojo tank.
• Chemical: cleaning products, decanting, mixing bleach with acids, pool chemicals, generator diesel.
• Electrical and mechanical: floor machines and their cables, open distribution boards, generator and UPS rooms, gate motors, electric fences.
• Fire and emergency: blocked escape routes, wedged fire doors, discharged extinguishers, and what changes when load shedding takes out lighting and alarms.
• Biological: ablutions and sanitary bins, sharps, droppings, spills of body fluids.
• Ergonomic: repetitive mopping, lifting refuse bags, long hours standing at a guard post.
• Personal safety: lone work at night, robbery at a guard house, aggressive members of the public, fatigue on long shifts.

Section 9(1) of the Act widens the circle: the undertaking must be run so that "persons other than those in his employment who may be directly affected by his activities are not thereby exposed to hazards to their health or safety". A cleaning contractor's HIRA covers the office workers who cross the wet floor; a security company's covers the visitor at the boom gate. A HIRA is also not a security survey of the property: it is about harm to people at work, security officers included.

03

How to do a HIRA, step by step

Regulation 9(1) of the Construction Regulations gives the clearest outline in South African law, and it works for any site:

1. Identify the hazards. Walk the site with the people who do the work, at the times they do it, night shift included. Read the safety data sheets, the incident register, near misses and the last inspection reports. Ask staff: under section 14(d) they must report unsafe situations anyway, and they usually know where the hazards are.
2. Identify who could be harmed, and how. Employees, contractors, tenants, visitors, learners, patients, the public. The Ergonomics Regulations make this explicit: "the identification of all persons who may be affected" and "how employees may be affected".
3. Analyse and evaluate each risk using a documented method. The regulations require a documented method but prescribe none. A common one is a risk matrix: rate likelihood and severity on short scales and combine them into a low, medium or high rating. Write the scales down, use them the same way every time, and rate each risk before and after controls.
4. Decide the controls, best first. Section 8(2)(b) requires steps "to eliminate or mitigate any hazard or potential hazard ... before resorting to personal protective equipment", and regulation 7(2) of the Ergonomics Regulations requires control measures "in accordance with the hierarchy of controls". The regulations do not spell the hierarchy out; the usual order is eliminate, substitute, engineering controls, change the way the work is done, and only then PPE. The chemical agents regulations put PPE last in the same way: regulation 10 requires exposure to be prevented or, where that is not reasonably practicable, adequately controlled by limiting the amount, the people and the time, substitution, engineering controls and work procedures, and regulation 11 turns to protective equipment only where exposure cannot be adequately controlled that way.
5. Write the safe work procedure for each significant task and train people in it. Section 13(a) requires every employee to be made "conversant with the hazards" of their work and the precautions.
6. Set a monitoring plan and a review plan: which controls are checked, by whom, how often and where the result is recorded, and when the assessment is reviewed.

In practice, a HIRA is usually built in layers as part of the site's health and safety management: a baseline assessment of the whole site and its routine work; an issue-based assessment for a particular job or change, such as a new generator; and continuous identification, the hazard spotted on a round, reported, dealt with and, when it shows a gap, fed back into the baseline.

04

Who does the HIRA, and who must be involved

The duty is the employer's. Under section 16(1) the chief executive officer must ensure the employer's duties are "properly discharged", and may assign them under section 16(2), the 16.2 appointment, without giving up their own responsibility. On a contract, client and contractor each keep their duties for their own work, which is why they sign a section 37(2) agreement and share assessments.

On construction work and for ergonomic risks the assessor must be a competent person: someone with the required knowledge, training and experience for the task, and qualifications where applicable, who is familiar with the Act and its regulations. For the general section 8 duty the Act names no one, but the assessor has to know the work and the site.

Consultation is built into the law:

• Health and safety representatives may, under section 18(1)(b), "identify potential hazards and potential major incidents at the workplace", and under section 18(1)(g) inspect the workplace at intervals agreed with the employer. See the guide to the health and safety representative.
• Health and safety committees make recommendations to the employer under section 20(1)(a) and must discuss every incident in which someone was injured, became ill or died, under section 20(1)(b).
• Chemical and ergonomic assessments are made after consulting the representative or committee (regulation 5(1) and (2) of the chemical agents regulations, regulation 6(1)(b) of the Ergonomics Regulations); on construction work, regulation 9(5) requires consultation on monitoring and review.
• Employees are told about the hazards and trained (sections 8(2)(e) and 13(a)); section 14 requires them to follow the procedures, report unsafe situations as soon as practicable, and report an incident involving them by the end of the shift.

Where several employers share a building, the assessments have to meet. In an office park the cleaning, security and maintenance contractors each hold a HIRA for their own work, and the managing agent holds one for the common property; a hazard between them, such as a wet floor the guard must cross, belongs in both. On construction work regulation 9(4) makes the principal contractor tell every contractor of the hazards before work starts.

05

Monitoring, review and keeping the HIRA current

A HIRA is not finished when it is signed. The regulations set out when it must be looked at again:

• At fixed intervals: the ergonomic risk assessment and the assessment of exposure to hazardous chemical agents at intervals not exceeding two years (Ergonomics Regulations, regulation 6(2)(a); chemical agents regulations, regulation 5(1)).
• When something changes: on construction work, changes that alter the risk profile (regulation 9(7)(a)); for chemicals, a change in a process or in the methods, equipment or procedures (regulation 5(5)(b)); for ergonomic risks, a change in work methods, type of work or equipment (regulation 6(3)(d)).
• When controls stop working: the ergonomic assessment is reviewed if "control measures are no longer effective" or the assessment is no longer valid (regulation 6(3)); the chemical assessment if "there is reason to suspect that the previous assessment is no longer valid" (regulation 5(5)(a)).
• After an incident: regulation 9(7)(b) of the Construction Regulations requires a review "when an incident has occurred", as do the Ergonomics Regulations where ergonomic risks contributed. See the incident reporting and investigation guide.

Between reviews, the monitoring plan does the work: the chemical store locked and labelled, wet-floor signs out during mopping, ladders inspected before use, escape routes clear, emergency lights working after an outage. Each check is a small test of the HIRA. A check that keeps finding the same problem says a control is not working; a hazard nobody predicted says the identification missed something. Both are reasons to review, and a near-miss report is often the first sign.

On construction work regulation 9(6) requires the risk assessments to be available on site to an inspector, the client, any contractor or employee, a representative trade union, a health and safety representative or a committee member. On any site, a workplace safety inspection checklist is how the monitoring plan becomes a walk-round.

06

Where the record fails, and what SiteClara does about it

Most HIRAs fail in the same place. The document is good: site-specific, rated, signed. Its monitoring plan says the chemical store is inspected weekly and the escape routes walked each shift. The evidence is a register behind a door, initialled for the month in one sitting, and the hazard someone noticed on Tuesday was mentioned to whoever was at reception. At the review, or when an inspector asks after an incident, nobody can show what was checked, when, or what was found.

SiteClara records routine checks at the place they happen. A printed QR poster, with an optional NFC tag behind it, sits at each location where a check is scheduled: the chemical store, an ablution block, a fire escape, a generator room, a guard post. Staff scan or tap with their own phone, with no app to install, see the checks due there, and mark each one done or say what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A hazard reported at a location goes onto a list of open jobs until someone closes it.

A supervisor sees what is due, done and missed, gives the reason when a check was missed, and each day reviews and approves a short report that goes to the client's nominated contacts the next morning. For whoever reviews the HIRA, that is the monitoring plan's evidence, made at the time: which controls were checked, where problems keep coming back, and which hazards turned up that the assessment did not name.

07

Questions people ask

What is hazard identification and risk assessment?

It is the process of finding what at work could cause harm and judging how likely and how serious that harm is, so that controls can be chosen. The Occupational Health and Safety Act 85 of 1993 defines a hazard as "a source of or exposure to danger" and risk as "the probability that injury or damage will occur", and section 8(2)(d) requires every employer to establish, as far as is reasonably practicable, what hazards are attached to the work and what precautionary measures should be taken.

What are 5 ways to identify workplace hazards?

The Occupational Health and Safety Act 85 of 1993 points to several: examine the work performed, the substances used and stored, and the plant and machinery (section 8(2)(d)); act on employees' reports of unsafe or unhealthy situations (section 14(d)); use the health and safety representatives, who may identify potential hazards and inspect the workplace (section 18(1)(b) and (g)); and learn from incidents, which the representatives examine with the employer and the committee must discuss (sections 18(1)(c) and 20(1)(b)).

What are examples of hazard identification?

Section 8(2)(d) of the Occupational Health and Safety Act 85 of 1993 names what to look at: the work performed, any article or substance used, handled or stored, and any plant or machinery. On an occupied site that means, for example, noticing a wet floor with no warning sign, an unlabelled chemical bottle in the store, a damaged cable on a floor machine or a ladder with a cracked stile, and recording where it was and who could be hurt.

How often must a hazardous chemical assessment be reviewed?

Regulation 5 of the Regulations for Hazardous Chemical Agents, 2021 requires the assessment to be made "immediately, and thereafter at intervals not exceeding two years", after consulting the health and safety representative or committee, and an immediate review if the previous assessment may no longer be valid or a process, method, equipment or procedure changes.

08

Where to read the official text, and a list to take away

The Department of Employment and Labour publishes the Occupational Health and Safety Act 85 of 1993 (sections 1, 8, 9, 13, 14 and 16 to 20); regulation 9 of the Construction Regulations, 2014, the clearest statement of what an assessment must include; regulation 6 of the Ergonomics Regulations, 2019; and regulation 5 of the Regulations for Hazardous Chemical Agents, 2021. The OHS Act guide puts these duties in context.

Before you sign off or accept a HIRA, check that:

• it names this site, its areas and the work done there, night work and load shedding included;
• every task has its hazards and the people who could be harmed;
• risks are rated with a written method used the same way by everyone;
• controls follow the hierarchy, PPE last, with a safe work procedure for each significant task;
• a competent person, where a regulation requires one, is appointed in writing;
• representatives or the committee were consulted, and staff trained in the result;
• review dates and triggers (change, incident, failed controls) are written in;
• the monitoring checks are recorded when they are done, by the person who did them, not filled in afterwards.