Control the hazards and risks

Applying risk controls

You've identified the hazards and assessed and prioritised the risks. Now it's time to start applying your risk controls.

By law, you must eliminate a risk so far as is reasonably practicable. If it is not reasonably practicable to eliminate a risk, you must reduce the risk. Again, you must do this so far as is reasonably practicable.

Arriving at appropriate risk controls involves the following:

• Identifying the options for controls.
• Considering the control options. A control option may be a single control or it may be multiple different controls. Together those controls provide the highest practicable protection against a risk.
• Selecting the best options to eliminate or reduce the risk in the circumstances.
• Applying the selected control options.

The Occupational Health and Safety Regulations 2017 have risk controls for a variety of hazards. You must use those controls.

Use the hierarchy of control

The hierarchy of control can help you eliminate or reduce risks so far as is reasonably practicable.

The hierarchy of control is a step-by-step approach to eliminating or reducing risks. It ranks risk controls from the highest level of protection to the lowest. Eliminating the hazard and risk is the highest level of control in the hierarchy .

How to work through the hierarchy of control

Eliminate the hazard

You can eliminate a hazard if the hazard doesn’t need to be in the workplace to start with. Redesigning work systems or the workplace itself may eliminate hazards and their risks.

Eliminate the risks

You may not be able to eliminate a hazard if doing so means you cannot deliver the end product or service. If you cannot eliminate the hazard, find out how many of its risks you can eliminate. By eliminating those risks, you may make it impossible for a particular kind or level of harm to happen. Review the pattern of events that leads to the harm occurring. Can a control measure break the pattern in such a way that the harm can never happen?

Reduce the risks

If you cannot eliminate risks, then you must reduce them so far as is reasonably practicable. You must change the risks to reduce the likelihood and level of harm. Altering risks is the most effective way to do this. It does not rely on the people performing actions perfectly.

Use the following controls in the specified order to reduce risks. Reduce risks so far as is reasonably practicable before moving to the next level of control.

Use substitution, isolation and engineering controls

The best way to reduce a risk is to control it at its source. You can do this by doing the following:

• Substituting to a lower risk. For example, making a load lighter and less awkward for a hazardous manual handling task.
• Isolating the hazard from employees and others. For example, use concrete barriers to separate people from powered mobile plant.
• Using an engineering control. For example, guarding a power press or using a mechanical device to handle a heavy or awkward object.
• Using a combination of these controls.

Use administrative controls

If it is not possible to control a risk at its source, use administrative controls. Administrative controls may help minimise exposure to hazards. They can help reduce the level of harm.

Administrative controls include, for example:

• changing work practices, such as introducing job rotation to vary repetitive work
• restricting access to work areas or tasks
• providing training, for example, training employees in particular lifting techniques
• scheduling maintenance to times when few employees are present, for example, after hours
• warning and safety signs.

Administrative controls are among the least effective risk controls. They do nothing to change the risk itself. Rather, administrative controls rely on people behaving as expected. They protect people by controlling their behaviour or skill levels.

Use personal protective equipment

PPE is the lowest level of risk control. It includes, for example:

• respirators
• hearing protection
• protective eyewear
• hard hats
• gloves
• safety footwear
• high-visibility clothing.

Remember, administrative controls and PPE do not control the hazard at the source. They rely on human behaviour and supervision. On their own, administrative controls and PPE tend to be the least effective controls.

Use administrative controls and PPE only:

• as last resorts when there are no other practical control measures available
• as a temporary measure until you introduce a more effective way to control the risk
• to increase the effectiveness of higher-level control measures.

More information about the hierarchy of control is available on the WorkSafe website.

Sources of information for risk controls

Various sources can provide information to help develop your risk control options. You can obtain information about risk controls from, for example:

• WorkSafe compliance codes and guidance material
• industry associations
• unions
• manufacturers and suppliers of plant, substances and equipment used in your workplace.

In some cases, published information will provide guidance to a whole work process. In other cases, the guidance may relate to specific items of plant or how to safely use certain substances. Use these options if they are appropriate and provide a high level of protection from the risk.

Developing specific control measures

Available information may not be relevant to what happens at your workplace. In this case, you may need to develop specific control measures for the hazards and risks.

You can do this by referring to the series of events you recorded during the risk assessment. For each of the events in the series, ask: 'What can be done to stop or change the event?'

Working through all of the events in the series will result in a list. The list will contain all of the possible control measures you can apply to eliminate or reduce the risk. There may be more than one control measure for each of the events. Check your risk control options against the hierarchy of control.

The control options you choose must:

• provide the highest level of protection that is reasonably practicable in the circumstances
• be the most reliable.

The selected control option must be available. This means the control or its parts can be bought, fabricated or put in place.

The selected control option must also be suitable for the situation in the workplace. It will work properly given the workplace conditions, work process and the people who do the work.

You might have more than one option for controls. In this case, choose controls that have the most impact on the likelihood or level of harm. High levels of harm include death, serious injury or serious illness. Your goal must always be to eliminate the risk so far as is reasonably practicable. Only use controls that reduce a risk when it is not reasonably practicable to eliminate it.

Remember, your controls must provide the highest level of protection, so far as is reasonably practicable.

Prioritise your controls

You may have many actions to include in the risk control plan. Some may require immediate action. Others will take longer to put into place. To prioritise your actions, think about the following points:

• How severe is the risk?
• How immediate is the risk?
• Who does the risk affect?
• How easily can the risk be controlled?
• What other benefits would there be from controlling the risk?

The cost of controlling risk is a factor that can be taken into account in determining what is reasonably practicable. However, cost is never a reason in itself for doing nothing. An employer’s inability to afford the cost of a particular control option is not a factor in determining what is reasonably practicable. WorkSafe expects you to pay the cost if other duty holders in your particular type of enterprise do so. You should pay for the highest level of protection unless it is unreasonable to do so in the circumstances. Cost is only a consideration when the cost far outweighs the safety benefits.

Two control strategies may have the same levels of protection and same reliability. In this case, it is appropriate to adopt the least costly option.

Cost is not a reason to only use administrative controls. If substitution, engineering or isolation controls are available and reasonably practicable, you must use them.

Cost alone is never a reason for doing nothing. There are controls available for all risks. For example, it is always possible to provide instructions to those exposed to the risk. Or you could stop the activity that creates the risk. There will normally be different control options between the two extremes. Cost is only one factor to consider when determining the best control option.

Putting controls in place

After deciding on controls, you need a process to ensure the controls are in place. To do this, follow good management practices. For example:

• develop plans
• allocate budget
• make people responsible and accountable for the various steps in the plan
• make people responsible and accountable for fixing problems and issues during the planned work
• monitor and report on the progress of the work
• test and review controls once they are in place.

Risk control outcomes

At the end of the risk control step, you should have:

• identified all reasonably practicable measures to either eliminate risk or reduce the risk
• applied all reasonably practicable measures to either eliminate risk or reduce the risk.

Make sure you keep all employees informed of any changes to work practices. This includes changes that are a result of new controls in the risk control plan. You must ensure employees receive the information, instruction and training they need to work safely. Keep a record of training and regularly review all work practices.

You must consult with employees and any health and safety representatives when:

• identifying or assessing hazards and risks
• deciding how you will control hazards and risks.