Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    HIRAHazard Identification and Risk Assessment

    Definition

    Hazard Identification and Risk Assessment — finding hazards, judging the risk each presents, choosing controls and recording the reasoning for later review.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/hira

    Scope: The method, scales and records depend on the law, standard and activity concerned. A register of hazards alone is not an assessment.

    Example for your evaluation: Follow one hazard from identification through scoring, controls, residual risk and review date.

    What HSE, OSHA and ISO say about hazards and risk

    HIRA is shorthand for one process in two parts: find the hazards, then judge the risk each presents and decide what to do. HSE lays it out as five steps: identify hazards, assess the risks (who might be harmed and how, and how serious it could be), control the risks, record the findings, and review the controls. HSE says recording is required if you employ five or more people, and that controls should be reviewed when changes in the workplace could lead to new risks.

    OSHA's Recommended Practices describe hazard identification and assessment as a proactive, ongoing process. They suggest collecting existing information, inspecting regularly, investigating incidents and close calls to find the underlying hazards and causes, and grouping similar incidents to see trends. For each hazard they suggest considering the severity of the potential outcomes, the likelihood of an event or exposure and the number of workers who might be exposed, and prioritising so that the greatest risks are addressed first. OSHA adds that risk is the product of hazard and exposure, so it can be reduced either by controlling the hazard or by reducing exposure, and that employers keep an ongoing obligation to control all serious recognised hazards, not only those at the head of the priority list.

    ISO's explainer on ISO 45001 lists identification of hazards and assessment of occupational health and safety risks among the standard's key requirements, alongside determination of legal and other requirements, operational controls and performance evaluation. ISO lists ISO 45001:2018 as published and due to be revised, so a checklist or template built on it is worth dating. The pages cited here do not prescribe a scoring method: scales, matrices and risk ratings are the organisation's own choice, which is why the way a score was reached belongs in the record.

    Sources opened :

    What a HIRA record holds in software

    • A hazard entry: the activity or location, the hazard, and who could be harmed (employees, contractors, visitors, the public) and how.
    • The risk assessment: severity, likelihood and, where the organisation uses it, the number exposed, with the scale and version used so that a score can be explained later.
    • Existing controls and added controls, ordered by the hierarchy of controls, with an owner and a due date for each.
    • The residual risk after controls, and the reason it is accepted or the action planned.
    • Links to the incidents, inspections, audits and legal requirements that fed or followed the entry.
    • Review dates and triggers, with the history of earlier assessments kept.

    HIRA, JSA, bow tie and HAZOP

    These are different tools at different scales. HIRA is the general process for an activity, area or operation; a JSA examines the steps of one task; a bow tie maps the pathways around one serious event; and HAZOP is a structured study of a process design. A risk register can hold the results of any of them, so a product that stores a HIRA does not necessarily support the others' formats. When someone asks for a HIRA, ask which form of hazard and risk record, at what level of detail, is expected.

    A hypothetical example: adding a night shift to a logistics yard

    This case is invented and describes no real site. A logistics yard that works days only decides to add a night shift. The safety adviser walks the yard in the evening with two drivers and a marshaller and lists hazards: pedestrians crossing between trailers in poor light, reversing vehicles with limited visibility, fatigue on the drive home, and a loading bay with no lighting over the edge. Each is recorded with who is exposed, such as marshallers, drivers and agency loaders.

    The adviser rates each hazard on the site's own scale for severity and likelihood and notes the number of people exposed. Pedestrian and vehicle interaction scores highest. The lighting fault is cheap to fix and is fixed that week. Interim controls are a pedestrian exclusion rule at the bay and a speed limit, with segregation and better lighting planned as permanent controls with owners and dates. The register records the scale used and who took part, and sets a review for after the first month of night working. When a near miss occurs in week three, the entry is revisited and the likelihood score is raised, and the history shows the earlier value.

    Common misunderstandings about HIRA

    • A risk matrix is not a measurement. A grid turns judgement into a number, and two competent people can score the same hazard differently; the value lies in the discussion and in recording why.
    • A rating is not a control. A score that ends in 'medium' controls nothing, so the record needs actions, owners and checks, and OSHA notes that serious recognised hazards must be controlled whatever their rank.
    • A register is not an assessment. A list of hazards shows they were thought of; the assessment is the reasoning about who is exposed, how often and which controls exist.
    • Copying last year's HIRA is not a review. Review is prompted by changes, incidents and new information, and a copy dated this year with nothing altered suggests the prompts are missing.

    How HIRA relates to other glossary terms

    HIRA is the general process, so most neighbouring terms are narrower methods or the systems that depend on its output.

    • JSA: a task-level analysis whose steps and controls can feed the wider hazard register.
    • Bowtie analysis: a way of mapping the controls around one serious event identified in a risk assessment.
    • ISO 45001: the management system standard in which hazard identification and risk assessment are core requirements.
    • Management of change: the route by which a new process, material or layout is assessed before it starts.

    Records and evidence that usually exist for HIRA

    • The procedure that sets how hazards are identified, how risk is scored and who may accept it.
    • The risk scale or matrix, with its version and the date it changed.
    • Hazard registers or assessments by activity, area or task, with the people who took part and their roles.
    • Control actions with owners, dates and completion evidence, and verification that controls work.
    • Review records showing when and why each assessment was revisited.

    What a software tool needs to capture for HIRA

    • A hazard register that separates hazard, exposure, controls and residual risk instead of offering one comment field.
    • Configurable severity and likelihood scales stored with each score, so earlier results stay explainable after a scale changes.
    • Controls recorded as actions with owners, due dates and verification, ordered by the hierarchy of controls.
    • Review dates and triggers tied to incident, change and audit records, with history kept.
    • Filters and export by site, activity and risk level, so that a review can start from the highest risks and an auditor can read the history.

    Catalog profiles documenting risk assessment records

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is HIRA a legal requirement?

    Requirements to assess risk come from the law and standards that apply to the organisation and the hazards. HSE and OSHA both describe the process, so check which rules apply to your jurisdiction and activity rather than assuming from the abbreviation.

    Which risk matrix should be used?

    Use scales the organisation can explain and apply consistently. The sources cited on this page do not prescribe one, so record the scale and version beside each score.

    How often should a HIRA be reviewed?

    When changes, incidents or new information could affect the risks, and on a schedule set by procedure. HSE advises reviewing controls when changes in the workplace could lead to new risks.

    How does HIRA differ from JSA?

    A HIRA covers an activity, area or operation, while a JSA examines the steps of a single task. The two can feed each other.

    More safety terms

    Related guides