Risk management is a proactive process that helps you respond to change and facilitate continuous improvement in your business. It should be planned, systematic and cover all reasonably foreseeable hazards and associated risks.
A risk assessment involves considering what could happen if someone is exposed to a hazard (for example, COVID-19) and the likelihood of it happening. A risk assessment can help you to determine:
- how severe a risk is
- whether any existing control measures are effective
- what action you should take to control the risk, and
- how urgently the action needs to be taken.
The exposure of your workers and/or customers/clients to COVID-19 is a foreseeable risk that must be assessed and managed in the context of your operating environment.
A risk assessment will assist to:
- identify which workers are at risk of exposure
- determine what sources and processes are causing the risk
- identify if and what kind of control measures should be implemented, and
- check the effectiveness of existing control measures.
A risk assessment can be undertaken with varying degrees of detail depending on the type of hazard and the information, data and resources that you have available. It can be as simple as a discussion with your workers or involve specific risk analysis tools and techniques developed for specific risks or recommended by safety professionals. For some complex situations, expert or specialist advice may be useful when conducting a risk assessment.
When should I do a risk assessment?
Managing work health and safety risks is an ongoing process that needs attention over time, but particularly when any changes affect your work activities.
All currently operating businesses must assess the risks associated with exposure to COVID-19 and implement control measures to manage those risks. They must also assess any other new or changed risks arising from COVID-19, for example, customer aggression, high work demand or working in isolation.
You must also undertake a risk assessment with response to risks to any vulnerable workers working in your business. Risk needs to be assessed and mitigated with consideration of the characteristics of the worker, the workplace and the work. This includes ensuring vulnerable people are redeployed to roles that don’t involve physical contact with customers, where possible. Where risk cannot be appropriately mitigated, employers and workers should consider alternate arrangements to accommodate a workplace absence. For more, go the Vulnerable workers information.
Other examples of when businesses must undertake a risk assessment with respect to COVID-19, include where a business:
- changes work practices, procedures or the work environment
- recommences operations following a shut down
- increases operations following a period of reduced operations
- introduces workers back into the workplace following the cessation of working from home or stand-down arrangements
- is responding to workplace incidents (e.g. where a worker has tested positive to COVID-19)
- is responding to concerns raised by workers, health and safety representatives, or others at the workplace
Risk assessments should be reviewed periodically as the operating environment changes (for example, in response to changes in COVID-19 cases or changes to public health orders) or when new information on workplace risks becomes available. This should include the periodic review of control measures implemented to ensure their ongoing appropriateness and effectiveness based on the latest information.
How do I do a risk assessment?
The model Code of Practice: How to manage work health and safety risks provides practical guidance about how to manage WHS risks through a risk assessment process. See also our information on key considerations for businesses to take into account when assessing the risks associated with COVID-19, as well as an example risk register.
A safe and healthy workplace does not happen by chance or guesswork. You have to think about what could go wrong at your workplace and what the consequences could be. Then you must do whatever you can (in other words, whatever is ‘reasonably practicable’) to eliminate or minimise health and safety risks arising from your business or undertaking.
This process is known as risk management and involves the four steps (see Figure 1 below):
- Identify hazards—find out what could cause harm.
- Assess risks, if necessary—understand the nature of the harm that could be caused by the hazard, how serious the harm could be and the likelihood of it happening. This step may not be necessary if you are dealing with a known risk with known controls.
- Control risks – implement the most effective control measure that is reasonably practicable in the circumstances and ensure it remains effective over time.
- Review hazards and control measures to ensure they are working as planned.
This process will be implemented in different ways depending on the size and nature of your business. Larger businesses and those in sectors where workers are exposed to more or higher risks are likely to need more complex, sophisticated risk management processes.
Consultation with workers and their health and safety representatives is required at each step of the risk management process. By drawing on the experience, knowledge and ideas of your workers, you are more likely to identify all hazards and choose effective control measures.
Where do I go to find information about risks and control measures?
General risks - Safe Work Australia’s website has information on known risks for some industries and activities. Your industry association, jurisdictional WHS regulator and health department are also good sources of information.
Business specific risks - You and your workers know your business better than anyone. Working in consultation with your workers you can identify risks specific to your business and ways these can be addressed. If you need help with this you can call your WHS regulator for advice. For example, the Italian deli owner who knows they have a queue for their specialty bread every Saturday morning could allow customers to call ahead and have a loaf put aside for them to avoid the early morning queue.
The unexpected - Some risks you might not be able to predict but you can pick them up by monitoring the work environment and checking in with your workers. For example, the local café offering home delivery during COVID-19 might suddenly find the demand is much higher than before but keeping up with this demand gives the chef a sore back. The café in consultation with their staff might put in anti-fatigue mats or re-task staff who used to wait tables to assist the chef.
How do I know what is ‘reasonably practicable’?
Deciding what is reasonably practicable to protect workers or other persons from harm requires taking into account and weighing up all relevant matters, including (but not limited to):
- Likelihood of the hazard or risk occurring – the greater the likelihood of a risk occurring, the greater the significance of this factor when weighing up all matters and determining what is reasonably practicable
- Degree of harm that might result from the hazard or risk – the greater the degree of harm that might result from the hazard, the more significant this factor will be when weighing up all matters to determine what is reasonably practicable. Where the degree of harm that might result from the risk or hazard is high, a control measure may be reasonably practicable even if the likelihood of the hazard or risk occurring is low.
- Knowledge about the hazard or risk, and ways of minimising or eliminating the risk – this must take into account what the duty holder actually knows and what a reasonable person in the duty holder’s position would reasonably be expected to know
- Availability and suitability of ways to eliminate or minimise the risk – requires consideration of what is available and suitable for the elimination or minimisation of risk, and
- Costs associated with the available ways of eliminating or minimising the risk - after assessing the extent of the risk and the available ways of eliminating or minimising the risk, consideration can be given to whether the cost of implementing a control measure is grossly disproportionate to the risk.
The highest level of protection that is reasonably practicable in the circumstances should be provided to eliminate or minimise the hazard or risk.
See also our Guide: How to determine what is reasonably practicable to meet a health and safety duty and the model Code of Practice: Work health and safety consultation, cooperation and coordination.
What do the ‘costs’ associated with eliminating or minimising a risk include?
The costs of implementing a particular control measure may include (but are not limited to) matters such as:
- costs of purchase, installation, maintenance and operation of the control measure
- any impact on productivity as a result of the introduction of the control measure, such as reductions in output and or increases in work hours.
When considering costs you should also take account of any savings that may result from reductions in incidents, injuries, illnesses and staff turnover, as well as improvements in staff productivity.
How do I determine whether the costs of eliminating or minimising a particular risk are ‘reasonably practicable’?
To determine whether expenditure to eliminate or minimise a risk is ‘reasonably practicable’ in the circumstances, you must consider:
- the likelihood and degree of harm of the hazard or risk,
- the reduction in the likelihood and/or degree of harm that will result if the control measure is adopted, and
- the available ways of eliminating or minimising the risk.
The more likely the hazard or risk, or the greater the harm that may result from it, the less weight should be given to the costs of eliminating the hazard or risk.
Where there are several options for eliminating or minimising a risk and they would achieve the same level or reduction in the likelihood or degree of harm, a duty holder may choose to apply one or more of the less costly options. However, choosing a low-cost option that provides less protection, simply because it is cheaper, is unlikely to be considered ‘reasonably practicable’.
Importantly, the question of what is reasonably practicable in a particular circumstance is determined objectively, not by reference to your capacity to pay or other individual circumstances.
If you cannot afford to implement a control measure that, based on the risk assessment and weighing up of the factors listed above, is necessary to eliminate or minimise the risk, you should not engage in the activity that gives rise to that risk.
How do I know if the costs of eliminating or minimising a risk are ‘grossly disproportionate’?
To determine whether the costs of eliminating or minimising a risk are ‘grossly disproportionate’ you must balance the likelihood of the risk occurring and degree of harm that might result, with the cost of the control measure.
It may not be necessary to implement costly control measures to eliminate or minimise a risk that has a low likelihood of occurring and would cause minor harm. However, it may be reasonable to apply less expensive controls to further lower the likelihood of the risk.
What do I do if I find the costs associated with eliminating or minimising a risk are ‘grossly disproportionate’?
Where the cost of implementing control measures is grossly disproportionate to the risk, implementation may not be reasonably practicable and is therefore not required. The duty holder must then use a less expensive way to minimise the likelihood or degree of harm.
Resources
- Checklist – Key considerations when undertaking a COVID-19 risk assessment
- Template and Example COVID-19 risk register
- Workplace checklist - What can I do to keep my workers safe at the workplace and limit the spread of COVID-19?
Risk management is a proactive process that helps you respond to change and facilitate continuous improvement in your business. It should be planned, systematic and cover all reasonably foreseeable hazards and associated risks.
A risk assessment involves considering what could happen if someone is exposed to a hazard (for example, COVID-19) and the likelihood of it happening. A risk assessment can help you to determine:
- how severe a risk is
- whether any existing control measures are effective
- what action you should take to control the risk, and
- how urgently the action needs to be taken.
The exposure of your workers and/or customers/clients to COVID-19 is a foreseeable risk that must be assessed and managed in the context of your operating environment.
A risk assessment will assist to:
- identify which workers are at risk of exposure
- determine what sources and processes are causing the risk
- identify if and what kind of control measures should be implemented, and
- check the effectiveness of existing control measures.
A risk assessment can be undertaken with varying degrees of detail depending on the type of hazard and the information, data and resources that you have available. It can be as simple as a discussion with your workers or involve specific risk analysis tools and techniques developed for specific risks or recommended by safety professionals. For some complex situations, expert or specialist advice may be useful when conducting a risk assessment.
When should I do a risk assessment?
Managing work health and safety risks is an ongoing process that needs attention over time, but particularly when any changes affect your work activities.
All currently operating businesses must assess the risks associated with exposure to COVID-19 and implement control measures to manage those risks. They must also assess any other new or changed risks arising from COVID-19, for example, customer aggression, high work demand or working in isolation.
You must also undertake a risk assessment with response to risks to any vulnerable workers working in your business. Risk needs to be assessed and mitigated with consideration of the characteristics of the worker, the workplace and the work. This includes ensuring vulnerable people are redeployed to roles that don’t involve physical contact with customers, where possible. Where risk cannot be appropriately mitigated, employers and workers should consider alternate arrangements to accommodate a workplace absence. For more, go the Vulnerable workers information.
Other examples of when businesses must undertake a risk assessment with respect to COVID-19, include where a business:
- changes work practices, procedures or the work environment
- recommences operations following a shut down
- increases operations following a period of reduced operations
- introduces workers back into the workplace following the cessation of working from home or stand-down arrangements
- is responding to workplace incidents (e.g. where a worker has tested positive to COVID-19)
- is responding to concerns raised by workers, health and safety representatives, or others at the workplace
Risk assessments should be reviewed periodically as the operating environment changes (for example, in response to changes in COVID-19 cases or changes to public health orders) or when new information on workplace risks becomes available. This should include the periodic review of control measures implemented to ensure their ongoing appropriateness and effectiveness based on the latest information.
How do I do a risk assessment?
The model Code of Practice: How to manage work health and safety risks provides practical guidance about how to manage WHS risks through a risk assessment process. See also our information on key considerations for businesses to take into account when assessing the risks associated with COVID-19, as well as an example risk register.
A safe and healthy workplace does not happen by chance or guesswork. You have to think about what could go wrong at your workplace and what the consequences could be. Then you must do whatever you can (in other words, whatever is ‘reasonably practicable’) to eliminate or minimise health and safety risks arising from your business or undertaking.
This process is known as risk management and involves the four steps (see Figure 1 below):
- Identify hazards—find out what could cause harm.
- Assess risks, if necessary—understand the nature of the harm that could be caused by the hazard, how serious the harm could be and the likelihood of it happening. This step may not be necessary if you are dealing with a known risk with known controls.
- Control risks – implement the most effective control measure that is reasonably practicable in the circumstances and ensure it remains effective over time.
- Review hazards and control measures to ensure they are working as planned.
This process will be implemented in different ways depending on the size and nature of your business. Larger businesses and those in sectors where workers are exposed to more or higher risks are likely to need more complex, sophisticated risk management processes.
Consultation with workers and their health and safety representatives is required at each step of the risk management process. By drawing on the experience, knowledge and ideas of your workers, you are more likely to identify all hazards and choose effective control measures.
Where do I go to find information about risks and control measures?
General risks - Safe Work Australia’s website has information on known risks for some industries and activities. Your industry association, jurisdictional WHS regulator and health department are also good sources of information.
Business specific risks - You and your workers know your business better than anyone. Working in consultation with your workers you can identify risks specific to your business and ways these can be addressed. If you need help with this you can call your WHS regulator for advice. For example, the Italian deli owner who knows they have a queue for their specialty bread every Saturday morning could allow customers to call ahead and have a loaf put aside for them to avoid the early morning queue.
The unexpected - Some risks you might not be able to predict but you can pick them up by monitoring the work environment and checking in with your workers. For example, the local café offering home delivery during COVID-19 might suddenly find the demand is much higher than before but keeping up with this demand gives the chef a sore back. The café in consultation with their staff might put in anti-fatigue mats or re-task staff who used to wait tables to assist the chef.
How do I know what is ‘reasonably practicable’?
Deciding what is reasonably practicable to protect workers or other persons from harm requires taking into account and weighing up all relevant matters, including (but not limited to):
- Likelihood of the hazard or risk occurring – the greater the likelihood of a risk occurring, the greater the significance of this factor when weighing up all matters and determining what is reasonably practicable
- Degree of harm that might result from the hazard or risk – the greater the degree of harm that might result from the hazard, the more significant this factor will be when weighing up all matters to determine what is reasonably practicable. Where the degree of harm that might result from the risk or hazard is high, a control measure may be reasonably practicable even if the likelihood of the hazard or risk occurring is low.
- Knowledge about the hazard or risk, and ways of minimising or eliminating the risk – this must take into account what the duty holder actually knows and what a reasonable person in the duty holder’s position would reasonably be expected to know
- Availability and suitability of ways to eliminate or minimise the risk – requires consideration of what is available and suitable for the elimination or minimisation of risk, and
- Costs associated with the available ways of eliminating or minimising the risk - after assessing the extent of the risk and the available ways of eliminating or minimising the risk, consideration can be given to whether the cost of implementing a control measure is grossly disproportionate to the risk.
The highest level of protection that is reasonably practicable in the circumstances should be provided to eliminate or minimise the hazard or risk.
See also our Guide: How to determine what is reasonably practicable to meet a health and safety duty and the model Code of Practice: Work health and safety consultation, cooperation and coordination.
What do the ‘costs’ associated with eliminating or minimising a risk include?
The costs of implementing a particular control measure may include (but are not limited to) matters such as:
- costs of purchase, installation, maintenance and operation of the control measure
- any impact on productivity as a result of the introduction of the control measure, such as reductions in output and or increases in work hours.
When considering costs you should also take account of any savings that may result from reductions in incidents, injuries, illnesses and staff turnover, as well as improvements in staff productivity.
How do I determine whether the costs of eliminating or minimising a particular risk are ‘reasonably practicable’?
To determine whether expenditure to eliminate or minimise a risk is ‘reasonably practicable’ in the circumstances, you must consider:
- the likelihood and degree of harm of the hazard or risk,
- the reduction in the likelihood and/or degree of harm that will result if the control measure is adopted, and
- the available ways of eliminating or minimising the risk.
The more likely the hazard or risk, or the greater the harm that may result from it, the less weight should be given to the costs of eliminating the hazard or risk.
Where there are several options for eliminating or minimising a risk and they would achieve the same level or reduction in the likelihood or degree of harm, a duty holder may choose to apply one or more of the less costly options. However, choosing a low-cost option that provides less protection, simply because it is cheaper, is unlikely to be considered ‘reasonably practicable’.
Importantly, the question of what is reasonably practicable in a particular circumstance is determined objectively, not by reference to your capacity to pay or other individual circumstances.
If you cannot afford to implement a control measure that, based on the risk assessment and weighing up of the factors listed above, is necessary to eliminate or minimise the risk, you should not engage in the activity that gives rise to that risk.
How do I know if the costs of eliminating or minimising a risk are ‘grossly disproportionate’?
To determine whether the costs of eliminating or minimising a risk are ‘grossly disproportionate’ you must balance the likelihood of the risk occurring and degree of harm that might result, with the cost of the control measure.
It may not be necessary to implement costly control measures to eliminate or minimise a risk that has a low likelihood of occurring and would cause minor harm. However, it may be reasonable to apply less expensive controls to further lower the likelihood of the risk.
What do I do if I find the costs associated with eliminating or minimising a risk are ‘grossly disproportionate’?
Where the cost of implementing control measures is grossly disproportionate to the risk, implementation may not be reasonably practicable and is therefore not required. The duty holder must then use a less expensive way to minimise the likelihood or degree of harm.
Resources
- Checklist – Key considerations when undertaking a COVID-19 risk assessment
- Template and Example COVID-19 risk register
- Workplace checklist - What can I do to keep my workers safe at the workplace and limit the spread of COVID-19?
Your employer must take a planned and systematic approach to identify and manage health and safety risks to meet their WHS duties and keep you healthy and safe at work.
To do this, your employer will need to undertake a risk assessment that involves considering what could happen if someone is exposed to a hazard (for example, COVID-19) and the likelihood of it happening. As part of the process, your employer must consult with you and other workers to determine what control measures should be put in place in your workplace.
A risk assessment will help your employer to determine:
- how severe a risk is
- whether any existing control measures are effective
- what action they should take to control the risk, and
- how urgently the action needs to be taken.
A risk assessment will also assist your employer to:
- identify which workers are at risk of exposure to COVID-19
- determine what sources and processes are causing the risk
- identify if and what kind of control measures should be implemented, and
- check the effectiveness of existing control measures.
What are the steps to doing a risk assessment?
This risk management process is illustrated by the four steps in the diagram below. For information on how your employer should undertake a risk assessment, see the content under the employer tab. You can also read more about the risk assessment process in the model Code of Practice: How to manage work health and safety risks. The model Code provides practical guidance about how to manage WHS risks through a risk assessment process.
I have some health issues. Will my employer have to take my personal situation into account when doing a risk assessment?
Yes. Some workers are at greater risk of more serious illness with COVID-19 and your employer must take this into account as part of the risk assessment process. See also our information on vulnerable workers.
Does my employer have to consult me when they do a risk assessment?
Yes. Your employer must consult with you and any health and safety representatives at each step of the risk management process. Your experience, knowledge and ideas will assist your employer to identify all hazards and choose effective control measures. See also our information on Consultation.