Skip to main content
    QHSEtech
    All templatesOil & Gas · 4 pages · Updated 20 October 2026

    Process Hazard Analysis (PHA) Worksheet Template

    PDF ExcelFree, no email

    Four-page A4 landscape worksheet for ONE process hazard analysis study session in the HAZOP style: study details with design intent and drawing revision, the team with who led and who recorded, guideword and parameter prompts to adapt, a worksheet of deviations with causes, consequences, existing safeguards, your own risk rating, recommendations, owner, due date and tracking reference, a recommendation tracking log and a team sign-off. It prints no risk matrix, scale or number, and it does not make a study meet any law or standard.

    What's inside

    Page 1: what was studied and who was there

    1. Study details: facility or unit, study ID, study dates, method used (HAZOP, what-if, checklist, what-if / checklist, other), the node or section studied with its boundaries, the design intent in words, drawings and their revision, other process information used, the name and version of your own risk scale, the revalidation interval your rule sets, where the records are kept, and tick boxes for the topics the study also looked at
    2. Team, roles, who led and who recorded: name, role or discipline, whether each person knows the process and the study method, who led, who recorded and which sessions each attended

    Page 2: prompts to adapt

    1. Guideword and parameter prompts: the seven main guidewords with a paraphrased meaning, example deviation wording and where each tends to fit, the extra words some studies add for time, position and elevation, and a parameter table (flow, pressure, temperature, level, composition, time or sequence, position or destination) with a blank column for the design value or limit of your node and its source

    Page 3: the worksheet

    1. Worksheet: number, parameter, guideword, deviation, causes, consequences, existing safeguards, risk rating (your scale), recommendation, owner and due date, tracking reference; nine rows and one invented example row, to copy as often as the study needs

    Page 4: follow-up and sign-off

    1. Recommendation tracking: tracking reference, recommendation, owner, due date, the decision (accept, reject with the reason, or defer), the rating after, when operating and maintenance staff were told, and status
    2. Team sign-off: study leader, recorder, an operator who knows the process, process or design engineer, instrument or electrical engineer, maintenance lead, HSE representative, site manager and one more team member, and who was absent for part of the study

    The form prints no risk matrix, scale or number. The section titles, the example prompts and the roles are ours, to change.

    What requires or shapes this record

    A process hazard analysis is a named requirement in two US rules for processes within their scope: OSHA's process safety management standard and the EPA Risk Management Program rule. Both list HAZOP as one of several accepted methods, require a team with specific kinds of knowledge, ask for the team's recommendations to be resolved and documented, set a maximum interval for revalidation and ask for the records to be kept for the life of the process. OSHA's standard says it does not apply to oil or gas well drilling or servicing operations or to normally unoccupied remote facilities, so an oil and gas operator has to check whether a given facility is inside the scope. None of the rules prescribes a form, a guideword list or a risk matrix, and no source opened for this page says that a completed worksheet shows compliance with any law or standard. The guideword table is paraphrased from a free ILO publication, which reproduces a hazard and operability study guide; IEC 61882 and the CCPS books on hazard evaluation are paywalled, were not opened and their text is not reproduced. HSE (Great Britain) and CCOHS (Canada) describe the method and its limits in general terms. The risk rating is deliberately left to your own scale. This page is general information, not legal advice.

    • 29 CFR 1910.119(a), (c)(2), (d), (e) and nonmandatory Appendix C paragraph 4 (US OSHA); text read through the eCFR (version dated 16 October 2026) on 20 October 2026

      A US rule that applies only to processes within its scope. Paragraph (a)(1) covers a process involving a listed chemical at or above a threshold quantity, and a process involving a Category 1 flammable gas or a flammable liquid with a flashpoint below 100 °F in one location in a quantity of 10,000 pounds or more, with exceptions; (a)(2) says it does not apply to retail facilities, oil or gas well drilling or servicing operations, or normally unoccupied remote facilities. Paragraph (e)(1) requires an initial process hazard analysis appropriate to the complexity of the process that identifies, evaluates and controls the hazards, with a documented priority order. (e)(2) requires one or more of what-if, checklist, what-if/checklist, hazard and operability study (HAZOP), failure mode and effects analysis, fault tree analysis or an appropriate equivalent: HAZOP is one named option, not the only one. (e)(3) says the analysis shall address the hazards of the process, any previous incident with likely potential for catastrophic consequences, engineering and administrative controls and detection, the consequences of failure of those controls, facility siting, human factors and a qualitative evaluation of a range of the possible safety and health effects of failure of controls on employees in the workplace. (e)(4) requires a team with expertise in engineering and process operations, including at least one employee with experience and knowledge specific to the process and one member knowledgeable in the analysis method used. (e)(5) requires a system to address the team's findings and recommendations promptly, to resolve them in a timely manner with the resolution documented, to document the actions and a written schedule, and to communicate the actions to the operating, maintenance and other employees affected. (e)(6) requires the analysis to be updated and revalidated at least every five years after completion of the initial analysis, by a team meeting (e)(4); (e)(7) requires the analyses, updates and the documented resolution of recommendations to be retained for the life of the process. (c)(2) requires consultation with employees and their representatives on the conduct and development of the analyses. Paragraph (d) requires the written process safety information, including safe upper and lower limits for items such as temperatures, pressures, flows or compositions and the piping and instrument diagrams, to be compiled before any analysis. Appendix C is a nonmandatory guideline, not a requirement: paragraph 4 says the team leader needs to be fully knowledgeable in the method and should be impartial, and that the assumptions made during a study need to be documented and understood and kept for a future analysis. The rule prescribes no worksheet, no guideword list and no risk matrix. The standard's own text is not reproduced here.

    • 40 CFR 68.67 (US EPA, Risk Management Program); text read through the eCFR (version dated 16 October 2026) on 20 October 2026

      The EPA rule has near-identical wording to the OSHA paragraphs for covered processes under part 68, with "owner or operator" in place of "employer": the same list of methods in paragraph (b), including HAZOP; the same team requirement in (d); the same system for recommendations in (e); the same five-year update and revalidation in (f); and retention for the life of the process in (g). Paragraph (a) says analyses completed to comply with 29 CFR 1910.119(e) are acceptable as initial analyses. Its list of what the analysis shall address in paragraph (c) goes beyond OSHA's: it adds natural hazards that could cause or exacerbate an accidental release (c)(8), safer technology and alternative risk management measures for certain processes in NAICS codes 324 and 325 (c)(9), and gaps in safety between the codes the process was built to and the most current applicable codes (c)(10). The section text as returned carries amendments up to 89 FR 17688 (11 March 2024) in its source note; whether any later change is pending was not checked. Whether a facility is a covered process under part 68 is not decided by this page. The rule's own text is not reproduced here.

    • ILO, Major hazard control: A practical manual (Geneva, 1988; third impression 1993), the chapter Hazard and operability studies, sections 2.1 to 2.4, Table 1 and sections 3.2 to 3.6; and ILO, Prevention of major industrial accidents: an ILO code of practice (Geneva, 1991), paragraph 5.3

      The ILO manual reproduces an older guide to hazard and operability studies and is guidance, not law; it is dated, and its method is described here only in the terms it uses. It says the examination takes a description of the process, questions every part of it to discover how deviations from the design intention can occur, and decides whether the deviations give rise to hazards. It defines intention, deviation, cause, consequence, hazard and guide word, and in Table 1 lists seven guide words: NO or NOT, MORE, LESS, AS WELL AS, PART OF, REVERSE and OTHER THAN. Section 2.3 explains how each is read. Section 2.4 says all the guide words are applicable to broadly expressed intentions but that restrictions and modifications may be needed when they are applied to intentions in fine detail, using a temperature intention as its example, where only MORE and LESS are left; that REVERSE is mostly applicable to activities (Table 1) and, applied to substances, is the one guide word that may not be intelligible (2.4); and that for time, position and elevation the words SOONER and LATER, WHERE ELSE, and HIGHER and LOWER can be more useful. It says a deviation with a conceivable cause is treated as meaningful, that success depends in part on the accuracy of the drawings, and that until every team member knows what a part is supposed to do, deviations cannot be generated. On the team (3.2): a multidisciplinary team, ideally three to five technical members, a study leader who controls the discussion, should not be the main technical contributor and ideally was not closely associated with the subject, and sometimes a separate secretary or scribe. On follow-up (3.5): decisions communicated to those responsible, progress-chasing, actions of four kinds (process, process conditions, physical design, operating method), removing the cause preferred to reducing the consequence, and follow-up not complete until the agreed actions are implemented. Section 3.6 describes a hazard file as the record. The ILO code of practice, paragraph 5.3, says a HAZOP study should be done by a multidisciplinary expert group always including workers familiar with the installation, headed by an experienced specialist. IEC 61882 and the CCPS guidelines on hazard evaluation are paywalled, were not opened and their text is not reproduced.

    • HSE (Great Britain), COMAH safety report assessment guidance, Plant modification / Change procedures (read 20 October 2026); and CCOHS (Canada), OSH Answers fact sheet Process Safety Management (first published and last revised 13 December 2023)

      The HSE page is guidance for assessors of COMAH safety reports in Great Britain, not a requirement placed on a duty holder. It summarises the stages of hazard and operability study generally undertaken (identify major hazards; a coarse study on the flowsheet; a full study on the frozen piping and instrument diagram; a check that all intended actions have been implemented, including hardware and software; a pre-commissioning check; and a safety audit after a few months of operation). It says written procedures should decide what level of HAZOP, if any, a plant modification needs, taking account of the degree of hazard and extent of the change, the worst-case accident, previous HAZOPs and a competent person other than the HAZOP chairman deciding the requirements. It says a conventional hazard and operability study identifies potential hazards but gives no likelihood of an incident or the loss suffered, and that where hazards are not eliminated by actions placed during the study, hazard analysis should be employed to decide whether the risk is acceptable. The CCOHS fact sheet (the second source, https://www.ccohs.ca/oshanswers/hsprograms/processsafety-management.html) is Canadian general guidance, not a statement of any jurisdiction's legal duties. It lists process hazard analysis, failure mode and effects analysis, hazard and operability study (spelt "HAZAOP" on the page), fault tree analysis and customised checklists as examples of methods, and names a CSA standard on process safety management by title only. It says risk assessment takes into account the severity of the consequences and the probability or likelihood of their occurring, that engineers and workers both need to be consulted, and that when a process changes the hazards and risks need to be identified and assessed again.

    Each source checked on 20 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    Every field below is a printed label on the form. Mapped to the US process safety paragraphs: the topics tick list in section 1 follows paragraph (e)(3); the team table is for (e)(4); the recommendation tracking log is for (e)(5) and (e)(7); the revalidation line in section 1 is for (e)(6); and the design intent, drawings and other information used are where the process safety information of paragraph (d) is named. The guideword table, the n/m marking, the tracking reference, the decision column, who led and who recorded, and the sign-off wording are this form's own conventions, built on the ILO guide, and are marked as examples to adapt. The form prints no risk matrix, scale, interval or limit: the boxes for them are blank for your own procedure to fill.

    Facility or unit
    Why: Ties the record to a place so a later team, an auditor or a revalidation can find the right study. The US process safety rules ask for each covered process's analyses to be retained for the life of the process, so the unit has to be identifiable.
    Common mistake: Naming only the site, so two studies of different units look the same years later.
    Node or section studied
    Why: A HAZOP-style study takes the process one part at a time, for example a line or a vessel, and the ILO guide has the leader mark each part as examined so that coverage is complete. The boundaries say where the study starts and stops.
    Common mistake: Describing the node as "the unit", so nobody can tell afterwards which lines and vessels were actually examined.
    Design intent
    Why: In the ILO guide a deviation is a departure from the intention, and until everyone knows what a part is meant to do deviations cannot be generated. The US rule requires process safety information, including safe upper and lower limits for temperatures, pressures, flows or compositions, to exist before an analysis. The form asks where the figures come from and supplies none.
    Common mistake: Copying the design intent from the previous study without checking it against the current drawings.
    Drawings and revision
    Why: The US rule lists piping and instrument diagrams among the process safety information, and the ILO guide names the accuracy of the drawings as one of four things a study's success depends on. The revision shows what the team looked at, and a revalidation compares it with the current revision.
    Common mistake: Writing the drawing number without the revision, so nobody can tell whether the plant has changed since.
    Study date
    Why: Dates show when the analysis was done. The US rules set a maximum interval for updating and revalidating (at least every five years after completion of the initial analysis); the form prefills no interval, so your own rule's figure goes in section 1, and the sessions-attended column in section 2 shows who was there on which date.
    Common mistake: Recording only the date the report was issued, so the revalidation clock and the attendance cannot be checked.
    Team, roles, who led and who recorded
    Why: The US rules require a team with expertise in engineering and process operations that includes at least one employee with experience and knowledge specific to the process and one member knowledgeable in the analysis method used. The ILO guide describes a study leader who controls the discussion and, sometimes, a separate scribe. The Y/N columns and the two tick columns make those facts visible.
    Common mistake: Listing names without roles, or ticking nobody as leader or recorder, so it is not clear who knew the method, who knew the process or who wrote the record.
    Guideword and parameter prompts
    Why: The ILO guide lists seven guide words and says that when intentions are expressed in fine detail some pairings drop out: its example is a temperature intention, where only more and less remain. The table is a set of examples to adapt, and the team writes n/m for a pairing with no meaning rather than forcing it.
    Common mistake: Filling every cell of a guideword by parameter grid ("reverse temperature"), or treating the example list as complete and missing time, sequence and position deviations.
    Deviation
    Why: A deviation is a guideword applied to a parameter and written as a departure from the design intent. It is the heading under which causes, consequences and safeguards are recorded.
    Common mistake: Writing the outcome in the deviation column ("tank ruptures"), which skips the question of how the plant got there.
    Causes
    Why: In the ILO guide a deviation counts as meaningful once it has a conceivable cause. Naming each cause also shows which safeguard answers which cause.
    Common mistake: One cause per deviation, usually an equipment failure, and none for a closed valve or a human action.
    Consequences
    Why: The US rule asks the analysis to address the consequences of failure of engineering and administrative controls and to give a qualitative evaluation of a range of the possible safety and health effects of that failure on employees in the workplace.
    Common mistake: Writing "shutdown" and leaving out what could happen to people nearby.
    Existing safeguards
    Why: The US rule asks the analysis to address the engineering and administrative controls applicable to the hazards, including detection that gives early warning of releases. Listing what exists today separates it from what the team recommends.
    Common mistake: Listing a safeguard that is only planned, or a procedure step that nobody follows, as if it were in place.
    Risk rating (your scale)
    Why: HSE says a conventional hazard and operability study identifies hazards but gives no likelihood of an incident or the loss, and CCOHS describes risk assessment as severity of consequences with likelihood. The form prints no matrix: your own scale decides what a rating means, so its name and version go in section 1.
    Common mistake: Not saying whether the rating counts the existing safeguards, so two rows with the same number mean different things.
    Recommendation
    Why: The US rules ask for a system to address the team's findings and recommendations promptly. The ILO guide groups actions as a change in the process, in process conditions, in the physical design or in the operating method, and says it is better to remove the cause than to reduce the consequence.
    Common mistake: Writing "review the procedure" with no deliverable, or answering every hazard with a physical modification when a change of operating method would remove the cause.
    Owner and due date
    Why: The US rules ask for the actions to be documented, completed as soon as possible and scheduled in writing. An action with no named person and no date cannot be followed up.
    Common mistake: A department as owner ("maintenance") and a due date of "ongoing".
    Tracking reference
    Why: One number for each recommendation, used on the worksheet, in the tracking log and on any change record or work order it produces. The ILO guide says follow-up is not complete until every acknowledged hazard has been dealt with by the agreed actions, and calls for progress-chasing.
    Common mistake: Starting again at R-1 in every study, so two studies' recommendations cannot be told apart.
    Recommendation tracking
    Why: The US rules ask for recommendations to be resolved in a timely manner with the resolution documented, for the actions to be communicated to the operating, maintenance and other employees affected, and for the documented resolutions to be retained for the life of the process. The decision column records a rejection and its reason.
    Common mistake: Closing a recommendation on the owner's word, with no record of the decision or of who was told.
    Team sign-off
    Why: Shows who took part and that they accept the record as what the team found and decided. The wording on the form says only that, and says the signature is not a statement that the study meets any law or standard. The ILO guide asks that decisions are communicated to those responsible.
    Common mistake: Signing for a colleague who was not at the study, or having the site manager sign in place of the study leader.

    Worked example

    IllustrativeTransfer line from a solvent day tank to a reactor (invented plant and invented risk scale)

    DeviationCausesConsequencesExisting safeguardsRating (invented scale)Recommendation, owner, due
    Flow, NO: no flow to the reactorDay tank empty; pump trips; discharge valve left closedReactor gets no solvent while the second feed carries on, so the mix is off ratioLow-level alarm on the day tank; pump running signal in the control roomS3 x L2 = 6R-1: stop the second feed when solvent flow is lost. Process engineer, 15 Dec
    Flow, MORE: more flow than intendedControl valve fails open; pump runs at the end of its curveReactor overfills and overflows to the bundHigh-level switch on the reactor stops the pump; bunded areaS2 x L1 = 2None required under the invented rule (rating below 4). R-2: note the last test date of the high-level switch. Maintenance lead, 15 Dec
    Flow, REVERSE: flow from reactor back to day tankPump stops while the reactor is pressurised; no check valveReactor contents contaminate the day tankCheck valve on the pump discharge; operating procedure stepS2 x L2 = 4R-3: test the check valve and add it to the test plan. Maintenance lead, 15 Dec
    Composition, AS WELL AS: water in the solventWet delivery; day tank breather draws in moist airUnwanted side reaction and an off-specification batchWater content check on receiptS2 x L3 = 6R-4: record the receipt check result on the delivery note and inspect the breather. Operations lead, 22 Dec
    Temperature, REVERSEn/mn/mn/mn/mThe team wrote n/m and why: the reverse of a temperature has no meaning at this node, so no row was forced

    Everything here is invented, including the plant, the figures and the scale. The invented scale rates severity (S) 1 to 3 and likelihood (L) 1 to 3 and multiplies them, and the invented rule is to write a recommendation at a rating of 4 or more; the ratings add up on that scale (3 x 2 = 6, 2 x 1 = 2, 2 x 2 = 4, 2 x 3 = 6). The form itself prints no scale: write the one your own procedure uses. The example shows a deviation carrying a recommendation, one carrying none, and a pairing marked n/m.

    When a spreadsheet stops being enough

    A spreadsheet or a printed worksheet copes with one node and one study. It stops being enough when a site has dozens of nodes, studies that have to be revalidated on a schedule, and recommendations that arrive from several studies, audits and incident investigations and all need one owner, one date and one status.

    A software record can keep each study's design intent, drawing revisions, team and deviations together, compare a revalidation with the previous study, hold every recommendation in one list with its decision and who was told, and show which are overdue. It can also link a recommendation to the change record or work order it produces.

    In a demo, ask to see a deviation marked as not meaningful, a recommendation rejected with a reason, a drawing revision change flagged against the study that used the old one, and how the risk scale is set: ask whether it is your own scale or a built-in one, and whether ratings change if the scale is edited later.

    Same rule for every product: tagged “Process Safety”, “Barrier Management”, “Risk Management”, “Risk Assessment”, “Control of Work”, “Permit to Work” or “Asset Integrity”, with a sourced process safety (PHA, barrier or management-of-change) capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 23 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.