
Darren Tang
Director
Hazard Identification, Risk Assessment and Risk Control (HIRARC) have become fundamental to the practice of planning, management and the operation of a business as a basic of risk management.
– 3 mins read
In the subset of social criteria in Environmental, Social and Governance (ESG), organizations are required to ensure health and safety of workers are protected. In this newsletter, let’s take a look at a tool which we can use to protect the health and safety of workers, the Hazard Identification, Risk Assessment and Risk Control, or commonly known as HIRARC.
HIRARC is used to identify hazards, assess risks and prioritize the risks at the organization, where if the risks are significant, then necessary control measures would need to be implemented.
Hazard Identification
Hazard means the source with a potential to cause injury and ill health. First thing an organization has to do is to identify the hazards that exist in the organization’s workplace. Areas that an organization should consider during hazard identification includes:
- Routine activities example daily operation processes and non-routine activities example repairing of broken machine.
- How work is organized, social factors and the culture in the organization, example if there are long working hours, whether there are any breaks in between, work standing or sitting, any harassment or bullying at the workplace etc.
- People at the workplace and their activities, example internal workers, contractors, suppliers, visitors.
- The design of work areas, processes, installations, machinery/ equipment, operating procedures and work organization, example if machine is automated or manual, is there any fencing to rotating parts of the machine, etc.
- Past incident or accident which occurred before.
- Potential emergency situations, example potential fire, flood etc.
Risk Assessment
Upon identifying the hazards, assess the risks by working out how likely the hazards will harm workers and how serious the harm could be. Risk is the combination of the likelihood of occurrence of a work-related hazardous event and the severity of injury and ill health that can be caused by the event.
For each hazard identified, assess the risk by asking two questions:
- how likely is it that the hazard could harm the worker? Example if workers were to do welding, the hazard is sparks which may most likely hit their eyes.
- how badly could the workers be harmed? Example workers may get blinded from the sparks during the welding activity.
In assessing the risk, take into consideration of the current control method used to reduce or eliminate the potential hazards, example wearing face mask during welding works to prevent sparks from getting into the eyes.
Risk can then be categorised as low risk, moderate risk or high risk. A common method in determining whether the risk low, moderate or high is through the combination of the likelihood of an occurrence (example rare, unlikely, moderate, likely or very likely) and the severity (negligible, minor, serious, fatal or catastrophic) that can be caused by the hazard. Risk = Likelihood x Severity.
Risk Control
Every significant risk should be brought under control. The following Risk Control Hierarchy can be used when considering the risk controls at the workplace:
- Elimination: Some hazardous job, tools, process or machine can be eliminated entirely, example instead of climbing a building to do painting works and risking a fatal fall, it can be climbing can be eliminated by installing building cradle as a working platform.
- Substitution: Employing alternative methods if practicable or usage of alternative materials, example substituting toxic glue with non-toxic glue.
- Engineering Control: Separating the hazards from people, example by marking the hazardous area, installing or putting up safety barriers/ fence like fencing of rotating parts.
- Administration Control: Instructing workers to carry out works safely, example developing, training and enforcing safe work procedures.
- Personal protective equipment (PPE): Using PPE if risks remain after the above risk controls method have been considered. PPE such as safety glasses, gloves, helmets and ear muffs can protect workers from hazards associated with jobs such as handling chemicals or working in a noisy environment.
The key to ensuring health and safety of workers are protected is to carry out Hazard Identification, Risk Assessment and Risk Control before work commence. All significant risks should be mitigated or eliminated. Maintain a register of the Hazard Identification, Risk Assessment and Risk Control, and periodically review when there are changes to new process, new development or modified activities, new product, new location of activity or when incident or accident occurred at the workplace.
Feel free to contact us to learn more about ESG
More Article
FSSC 22000 Version 7 Update: What Food Businesses Should Prepare Before Transition
How Food Businesses Should Plan for the Upcoming Transition The Foundation FSSC has indicated that FSSC 22000 Version 7 is expected to be published in May 2026, followed by an approximately 12-month transition period for certified organisations and certification...
ISO 9001:2026 Revision Update: What Organisations Should Prepare Before Publication
Preparing for the Upcoming ISO 9001 Revision ISO 9001, the international standard for Quality Management Systems (QMS), is currently undergoing revision, with the updated edition ISO 9001:2026 expected to be published in the second half of 2026, replacing ISO...
ISO 14001:2026 Revision: Key Changes Expected in Environmental Management Systems
What Organisations Should Prepare Before the Expected 2026 Publication ISO 14001, the international standard for Environmental Management Systems (EMS), is currently undergoing revision. The updated edition ISO 14001:2026 is expected to be published around April 2026,...
CIDB ISO 37001 Requirement for G7 Contractors
Source: CIDB Malaysia announcement on mandatory ISO 37001 Anti-Bribery Management System certification for G7 contractors effective January 2027. What Construction Companies Should Prepare Before 2027 CIDB Malaysia has announced that ISO 37001 Anti-Bribery Management...



