What Clause 6.1.2.2 Actually Requires
Clause 6.1.2.2 of ISO 45001:2018 sits inside a sequence of planning requirements that begins with hazard identification and ends with determining what actions to take. Once your organisation has identified its hazards under Clause 6.1.2.1, the standard requires you to assess the OH&S risks associated with those hazards, along with any other risks relevant to the management system. That is the job of Clause 6.1.2.2.
On this page
The clause requires organisations to establish, implement, and maintain a process to assess OH&S risks. It does not prescribe a specific method. What it does prescribe is that the methodology and criteria for assessment must be defined in scope, nature, and timing, and that the approach must be proactive rather than reactive. The assessment must also take into account existing controls when determining the level of risk.
This last point matters more than most people realise. You are not assessing risk in a vacuum. You are assessing the residual risk that remains after your existing controls are factored in. If your organisation uses machine guarding, permits to work, or engineering controls, those must be considered when you rate the likelihood and consequence of harm.
The Difference Between Hazard Identification and Risk Assessment
These two steps are often confused, and the confusion leads to weak risk registers that do not serve their purpose. Hazard identification, covered under Clause 6.1.2.1, is about finding what could cause harm. Risk assessment, under Clause 6.1.2.2, is about evaluating how likely that harm is and how severe it could be.
A practical way to think about it: identifying a forklift operating in a pedestrian area is hazard identification. Assessing the probability that a pedestrian will be struck, given the current traffic management controls, and the severity of injury that would result, is risk assessment.
If your organisation is treating these two steps as one activity, you are likely missing the analytical depth that the standard expects. Auditors will look at whether the assessment process genuinely evaluates risk, not just lists hazards.
Exemplar Global Certified Training ProviderRTP No. 310970
Building a Methodology That Satisfies the Standard
Defining Scope, Nature, and Timing
The standard is explicit that your methodology must define scope, nature, and timing. Scope refers to what is covered by the assessment process. Nature refers to the type of assessment being used, whether that is a risk matrix, bow tie analysis, job safety analysis, or another recognised method. Timing refers to when assessments are conducted and how often they are reviewed.
Organisations that struggle here typically have a risk register that was created during implementation and has not been meaningfully updated since. That is a red flag for auditors. The timing element requires you to demonstrate that risk assessments are reviewed when changes occur, after incidents, and at planned intervals.
Choosing an Assessment Method
ISO 45001 does not mandate a particular risk assessment tool. In practice, most Australian organisations use a likelihood and consequence matrix, often a 5x5 or 3x3 grid, to rate risks. This is acceptable provided the criteria for each rating are clearly defined and applied consistently.
The problem with poorly designed matrices is that they produce subjective results. Two people assessing the same hazard can reach completely different risk ratings if the criteria are vague. Your methodology needs to define what constitutes a low, medium, or high likelihood, and what constitutes minor, moderate, major, or catastrophic consequences.
For organisations dealing with high hazard work, a simple likelihood and consequence matrix may not be sufficient. Bow tie analysis, quantitative risk assessment, or layer of protection analysis may be more appropriate. The method should match the nature of the hazard.
If you want to understand how risk matrices are built and used in practice, the article on OHS risk matrices goes through the construction process in detail.
Accounting for Existing Controls
This is where many risk registers fall down. The assessment must consider the controls already in place. If your organisation has eliminated a hazard through substitution or engineering controls, the residual risk after those controls should be what is rated, not the inherent risk before any controls.
At the same time, you cannot simply assume that existing controls are fully effective. Part of the assessment process is considering whether the controls are reliable, whether they are consistently applied, and whether they could fail. A control that exists on paper but is not used in practice provides no real risk reduction.
What the Risk Assessment Must Consider
The standard provides a list of factors that must be taken into account during OH&S risk assessment. These are not optional. They include:
- The way work is organised, social factors, leadership, and the culture of the organisation
- Routine and non-routine activities and situations, including hazards arising from infrastructure, equipment, materials, substances, and the physical conditions of the workplace
- Past relevant incidents, whether internal or external to the organisation
- Potential emergency situations
- People, including consideration of those with particular vulnerability, such as new or inexperienced workers, workers with disabilities, or those under additional stress
- Changes in the workplace, including temporary changes and their impacts on operations, processes, and the OH&S management system
The inclusion of social factors and organisational culture is significant. ISO 45001 was designed to address the systemic causes of workplace harm, not just physical hazards. A risk assessment that only looks at machinery and chemicals but ignores workload, fatigue, shift patterns, and management behaviour is incomplete.
Psychosocial hazards fall within the scope of ISO 45001, and the risk assessment process must be capable of capturing them. This is an area where many organisations still have gaps, and it is an area that auditors are increasingly examining. The article on psychosocial hazards in the workplace covers this in more depth.
Documented Information Requirements
Clause 6.1.2.2 requires organisations to retain documented information on OH&S risks. This means you need records of the assessment process, not just the results. Auditors will want to see:
- The methodology or procedure that defines how assessments are conducted
- The risk register or equivalent document showing identified hazards and their assessed risk levels
- Evidence that existing controls have been considered in the assessment
- Records of reviews and updates to the risk register
- Linkage between risk assessments and the actions determined under Clause 6.1.4
The linkage to Clause 6.1.4 is critical. The purpose of assessing risks is to determine what actions are needed to address them. If your risk register has high-rated risks with no corresponding actions, that is a nonconformity waiting to be raised. The assessment process must feed into the planning of controls.
Common Nonconformities Auditors Find Against Clause 6.1.2.2
The Risk Register Is Static
The most common finding is a risk register that was created at implementation and has not been updated since. ISO 45001 requires the process to be maintained, which means the register must be reviewed and updated when circumstances change. New equipment, new processes, changes in personnel, incidents, and near misses should all trigger a review.
Auditors will ask when the risk register was last reviewed and what triggered that review. If the answer is that it was last reviewed three years ago and nothing has changed it since, expect a nonconformity.
Existing Controls Are Not Reflected
Risk registers that show inherent risk ratings without accounting for existing controls are common. This tells the auditor that the organisation has not genuinely assessed residual risk. The register should show what controls are in place and how those controls affect the risk rating.
The Methodology Is Not Defined
Some organisations have a risk register but no documented procedure explaining how risks are assessed. The standard requires the methodology to be defined. Without a procedure, there is no way to demonstrate consistency or to train new staff in how to conduct assessments.
Psychosocial and Organisational Risks Are Absent
A risk register that only addresses physical hazards is incomplete. Auditors will look for evidence that the organisation has considered fatigue, workload, shift patterns, workplace violence, and other psychosocial factors. The absence of any psychosocial risk assessment is a recurring finding, particularly in industries with demanding work schedules.
No Link to Actions
Risk assessments that exist in isolation from the planning process are of limited value. The standard expects that assessed risks will drive the determination of controls and actions. If there is no visible connection between the risk register and the actions taken, the assessment process is not functioning as intended.
How Auditors Assess Clause 6.1.2.2 in Practice
When auditing this clause, a competent auditor will not simply read the risk register and tick a box. The audit approach involves tracing the assessment process from end to end. This means:
- Reviewing the documented methodology to confirm it defines scope, nature, and timing
- Selecting a sample of hazards from the risk register and examining how they were assessed
- Checking that existing controls are reflected in the risk rating
- Verifying that the register has been reviewed and updated at appropriate intervals
- Tracing high-rated risks through to planned actions under Clause 6.1.4
- Interviewing workers and supervisors to test whether the risk assessment reflects actual workplace conditions
The interview component is important. A risk register can look complete on paper while failing to reflect what actually happens on the floor. Talking to workers about how risks are assessed and whether they are involved in the process reveals whether the system is genuine or performative.
Worker consultation is a requirement of ISO 45001, and the risk assessment process is one of the areas where that consultation should be evident. If workers have had no input into how their own work tasks are assessed for risk, that is a gap in both the risk assessment and the consultation requirements.
For a broader view of how auditors approach the hazard identification side of this process, the article on auditing hazard identification in ISO 45001 covers the audit trail in detail.
Integrating Risk Assessment With the Broader OH&S System
Clause 6.1.2.2 does not operate in isolation. The risk assessment process feeds into multiple other parts of the management system. Effective integration means that risk assessment outputs are visible in:
- The selection and design of operational controls under Clause 8.1
- The hierarchy of controls applied under Clause 8.1.2
- Training and competence requirements under Clause 7.2
- Communication and awareness activities under Clauses 7.3 and 7.4
- Emergency preparedness planning under Clause 8.2
- Incident investigation and corrective action under Clause 10.2
An organisation that has a sound risk assessment process but fails to connect it to these downstream activities has a system that looks good on paper but does not function as intended. Auditors will follow these connections during the audit to test whether the system is integrated or compartmentalised.
Exemplar Global Certified Training ProviderRTP No. 310970Practical Tips for Quality and Safety Managers
If you are responsible for maintaining the OH&S management system, here are the most important things to focus on to ensure your risk assessment process is audit-ready:
- Document your methodology clearly, including the criteria for likelihood and consequence ratings, and make sure it is accessible to everyone involved in conducting assessments
- Schedule regular reviews of the risk register and record when those reviews occurred and what triggered them
- Ensure that existing controls are captured in the register and that the risk rating reflects residual risk, not inherent risk
- Involve workers in the assessment process and document that involvement
- Include psychosocial and organisational factors in your assessment scope
- Trace high and medium rated risks through to planned actions and verify that those actions are implemented and effective
- After incidents and near misses, review the relevant sections of the risk register to determine whether the assessment was accurate and whether controls need to be strengthened
These steps will not only satisfy an auditor. They will make your risk assessment process genuinely useful for protecting workers.
Training for OH&S Auditors and Safety Managers
Understanding Clause 6.1.2.2 in depth requires more than reading the standard. It requires the ability to assess whether a risk assessment process is genuinely effective, not just technically present. That is a skill that comes from structured training and practice.
At Audit Workshop, the ISO 45001 Internal Auditor and Lead Auditor courses cover the full planning clause sequence, including hazard identification, risk assessment, and the determination of controls. Courses are delivered by a lead auditor with over 14 years of compliance experience and more than 500 external certification audits across Australia and internationally. Training is available in live virtual and self-paced formats, so you can build your skills without disrupting your work schedule.
If you are preparing to audit an OH&S management system, or if you want to strengthen your organisation's risk assessment process before the next certification audit, structured training in ISO 45001 auditing will give you the practical skills to do it properly.
