Hazard Identification and Risk Assessment
The toolkit
Hazard identification is proactive; incident investigation is reactive. Know when each tool fits. A JHA/JSA breaks a task into steps and identifies hazards and controls at each step - best for routine, procedural work. HAZOP uses guide words (more, less, none, reverse, part of, other than) against process parameters and suits continuous chemical processes. FMEA scores Severity × Occurrence × Detection to produce a risk priority number. Fault tree is deductive and top-down from a defined failure. Event tree is inductive and forward from an initiating event. Bowtie maps preventive barriers on the left and mitigating barriers on the right of a top event.
Risk is conventionally modeled as probability (likelihood) × severity (consequence). A risk matrix maps the product to a band and an action timeline. ALARP - as low as reasonably practicable - asks whether the cost of further reduction is grossly disproportionate to the benefit, not whether risk has been reduced to zero.
The control hierarchy
Elimination → substitution → engineering controls → administrative controls (including training and procedures) → PPE. PPE is the last line of defense because it protects one person, depends on human behavior, and fails silently.
Traps
- Treating a risk score as an absolute truth; matrices are subjective and must be calibrated with defined criteria for each severity and likelihood level.
- Assuming a low residual score means no further action when the hazard is high-severity.
- Forgetting to assess non-routine work (startup, shutdown, maintenance, upset conditions).
- Confusing hazard (a condition) with risk (the likelihood and severity of harm).
Worked example
On a 5×5 matrix, severity 4 (permanent disability) × likelihood 3 (likely sometime in the year) = 12, landing in the high band requiring action within 30 days and management approval. Reduce likelihood to 1 via an engineering interlock and the same severity yields 4 - medium, monitor. Severity rarely changes; controls mostly work on likelihood.
Rule of thumb
Assess initial risk, apply controls, then re-assess residual risk - and record both numbers.