8 October 2026 by ASC Team
A HIRA register holds up when every line names the task, the hazard, the source in clause 6.1.2.1 that found it, everyone exposed, the existing controls as they really perform, a risk rating made with a defined method, added controls chosen from the top of the hierarchy in clause 8.1.2 with the reason you stopped where you did, an owner, a review date and the workers who took part. Inspectors look for the assessments the regulations demand, done at the intervals they set. Auditors look for hazard identification that is ongoing and proactive. A consultant’s register from five years ago satisfies neither.
What does ISO 45001 require for hazard identification and risk assessment?
Clause 6.1.2.1 of ISO 45001:2018 requires a process for hazard identification that is “ongoing and proactive”. It must take into account, but is not limited to, eight sources:
| 6.1.2.1 | What it covers | A food site example |
|---|---|---|
| a) | How work is organised, social factors including workload, work hours, victimisation, harassment and bullying, leadership and culture | Fatigue on a twelve hour night shift |
| b) | Routine and non-routine activities and situations: infrastructure, equipment, materials, substances, physical conditions; design, production, construction, maintenance and disposal; human factors; how the work is performed | Kettle cleaning by entry at 02h00; a breakdown repair on the spiral freezer |
| c) | Past relevant incidents, internal or external, including emergencies, and their causes | The forklift strike in the shared aisle |
| d) | Potential emergency situations | An ammonia release in the plant room |
| e) | People: those with access, including workers, contractors and visitors; those in the vicinity; workers at locations not under the organisation’s direct control | Refrigeration technicians walking through the aisle; delivery drivers |
| f) | Other issues: the design of work areas, processes, machinery and procedures, including adapting them to workers; situations in the vicinity caused by or affecting the work | A packing line set at one height for every worker |
| g) | Actual or proposed changes in organisation, operations, processes, activities and the system | The new cold store construction project |
| h) | Changes in knowledge of, and information about, hazards | A noise survey that shows 86 dB(A) at the flow wrappers |
Clause 6.1.2.2 then requires a process to assess OH&S risks from the identified hazards “while taking into account the effectiveness of existing controls”, and to assess the other risks to the system itself. The methodology and criteria must be defined with respect to scope, nature and timing so that they are proactive rather than reactive and used in a systematic way, and documented information on them must be maintained and retained. Clause 6.1.2.3 adds the assessment of opportunities, including opportunities to adapt work to workers and to eliminate hazards.
What is the difference between a hazard and a risk?
Clause 3.19 defines a hazard as a “source with a potential to cause injury and ill health”. Clause 3.21 defines OH&S risk as a combination of the likelihood of a work-related hazardous event or exposure and the severity of injury and ill health it can cause. The kettle full of hot caustic is a hazard. The chance that a cleaner is scalded during entry, and how badly, is the risk. You identify hazards; you rate risks. Registers that rate the hazard (“steam: high”) are rating nothing.
Baseline, issue based or task based: what do inspectors expect?
The terms are South African practice rather than ISO 45001 wording, and they help. A baseline assessment covers the whole site and its activities. An issue based assessment looks at one change or problem: a new machine, a project, an incident. A task based assessment looks at one job, step by step, with the people who do it.
The regulations are what the inspector checks, and several demand their own assessments at set intervals:
| Regulations | Assessment required |
|---|---|
| General Safety Regulations, 1986, regulation 2 | Assess the risks before deciding on personal safety equipment; reduce them as far as practicable where they cannot be removed |
| Regulations for Hazardous Chemical Agents (GN R280 of 2021), regulation 5 | Done immediately, then at intervals not exceeding two years, after consulting the representative or committee, and reviewed at once when processes change |
| Ergonomics Regulations, 2019, regulation 6 | By a competent person before the work, repeated at intervals not exceeding two years |
| Regulations for Hazardous Biological Agents, 2022, regulation 6 | Documented, by a competent person, reviewed at intervals of no more than 24 months, where the work involves such agents |
| Noise Exposure Regulations, 2024, regulation 7 | A noise exposure risk assessment |
| Construction Regulations, 2014, regulation 5 | A client baseline risk assessment for building work the site commissions |
On the Kempton Park ready meals plant we use as a case in our courses, the HIRA was a 2021 baseline by a consultant: 212 generic lines, never reviewed, no task based assessments, nothing for the cold store project, and no hazardous chemical agents assessment since 2021. That case is a training scenario built from real audit patterns; no real company is named. Every one of those gaps would show at an inspection and at a certification audit.
What should a HIRA register line contain?
- Activity and task, routine or non-routine.
- The hazard, and the 6.1.2.1 source that found it.
- Who is exposed: employees, agency staff (your employees for the OHS Act, which excludes the labour broker as employer), contractors, visitors, people nearby.
- Existing controls, as they actually perform.
- Risk rating with those controls, using the defined method.
- Added controls, each labelled a) to e) by its level in 8.1.2, with the reason the higher levels were not reasonably practicable.
- Residual rating, owner, review date.
- Who took part, by role.
- The legal requirement that applies, linked to the legal register line.
Here are four lines from the case, built the way the course builds them:
| Task | Hazard and source | Existing controls | Added control and level |
|---|---|---|---|
| Cook area: kettle cleaning by entry | Confined space, steam, caustic residue; b) | Engineering permit only; the hygiene team enters without one | Spray balls so the kettles clean in place: a) eliminate. Until fitted: drive, steam and chemical lines isolated and locked out, atmosphere tested under General Safety Regulation 5, a standby person with a rescue plan, and a permit: d) |
| Warehouse: picking in the shared aisle | Struck by forklift; c), the 2025 injury | Painted lines, speed rule, vests | Barrier rail and gated crossings: c) engineering control |
| Chemical store: decanting caustic | Splash to face and eyes; c), the 2025 injury | Gloves; face shield kept in the office | Closed transfer pump: c). Face shield at the point of use with a use check: e) |
| Night shift assembly | Fatigue and workload; a) | None | Shift pattern and breaks reviewed with the night shift representatives: c) reorganisation of work |
How do you rate risk so that the rating holds up?
The standard does not prescribe a method. It requires the methodology and criteria to be defined and used systematically. Most sites use a likelihood and severity matrix. That works if three things are true.
- The words are defined. “Likely” and “major” mean the same thing to the cook area manager and the warehouse manager, written down with examples.
- Existing controls are tested before they count. A guard that is off half the time is not an existing control. Leak detection that has never been tested is not either. Clause 6.1.2.2 a) says effectiveness, not presence.
- The rating drives action. Your criteria say what level of residual risk needs what response and who may accept it.
How does the hierarchy turn the assessment into a decision?
Clause 8.1.2 sets the order: eliminate the hazard; substitute with less hazardous processes, operations, materials or equipment; use engineering controls and reorganisation of work; use administrative controls, including training; use adequate personal protective equipment. Clause 6.1.4 requires you to take the hierarchy into account when planning action. Section 8(2)(b) of the OHS Act requires the employer to eliminate or reduce a hazard before resorting to PPE.
Work down from the top on every line and write why you stopped. The test of “reasonably practicable” in section 1(1) of the Act gives you the language: how severe and widespread the risk is, what is known about it and how to remove it, whether the means are available and suitable, and the cost against the benefit. A toolbox talk recorded as the added control on the forklift aisle line, with no reason why a barrier was not used, fails that test on paper.
Who has to take part?
Clause 5.4 e) emphasises the participation of non-managerial workers in identifying hazards and assessing risks and opportunities, and in determining actions to eliminate hazards and reduce risks. The Hazardous Chemical Agents Regulations require the risk assessment to be done after consulting the health and safety representative or committee. A register where every line reads “assessed by SHEQ officer” fails both. Put the cleaner who does the job and the representative for the area on the line.
When must the HIRA be reviewed?
Whenever its inputs change. Clause 6.1.2.1 c), g) and h) bring in incidents, changes and new knowledge. Clause 10.2 c) requires existing risk assessments to be reviewed after an incident or nonconformity. Clause 6.1.1 requires changes to be assessed before they are implemented. And the regulations set maximum intervals, two years for hazardous chemical agents and ergonomics. The most common break I find in an audit is an incident that changed the hazard, and a HIRA line that still carries the old rating.
Frequently asked questions
Is HIRA an ISO 45001 term?
No. ISO 45001 says hazard identification and assessment of risks and opportunities, in clause 6.1.2. HIRA is common South African shorthand for the same work.
Do we need a separate assessment for each regulation?
You need to meet each regulation’s requirements, including who does it and how often. Many sites keep one HIRA register with linked specialist assessments for chemicals, noise, ergonomics and biological agents.
Who may do a risk assessment?
ISO 45001 requires workers to be competent, including the ability to identify hazards, under clause 7.2. Some regulations require a competent person, for example the Ergonomics Regulations and the Regulations for Hazardous Biological Agents.
Does a risk matrix have to be five by five?
No. The standard requires a defined method and criteria used systematically. Choose a matrix your managers can apply consistently.
Is PPE ever the right answer?
Often as the last layer, rarely as the only one. Clause 8.1.2 puts adequate PPE last, and section 8(2)(b) of the OHS Act asks for the hazard to be eliminated or reduced first.
Do we include psychosocial hazards?
Yes. Clause 6.1.2.1 a) names workload, work hours, victimisation, harassment and bullying, leadership and culture.
Which ASC course teaches you to build a HIRA register?
This guide is drawn from Module 3 of ISO 45001:2018 Understanding and Implementation, FS62, where the HIRA Register tool is built line by line on the cook area and checked in a clinic lesson.
R3 950, prices in rand with no VAT added. About 20 hours, self paced, lifetime access.
- Hazard identification across 6.1.2.1 a) to h), risk assessment with criteria that hold up, and the hierarchy as the conclusion of every line.
- The OH&S legal register built from the South African instruments, and the regulations’ own assessment duties.
- Eight tools loaded with the ready meals plant, two workshop variants and a timed workshop with practical stages set on register lines.
Enrol now and start building your system today. See all eight courses at ISO 45001 training, or ask a question on WhatsApp ASC.
Related guides: How to implement ISO 45001: a step by step plan for South African sites and ISO 45001 internal audit checklist.
Sources
- ISO 45001:2018, Occupational health and safety management systems: Requirements with guidance for use (ISO)
- Occupational Health and Safety Act 85 of 1993
- General Safety Regulations, 1986; Regulations for Hazardous Chemical Agents (GN R280 of 2021); Ergonomics Regulations, 2019; Regulations for Hazardous Biological Agents, 2022; Noise Exposure Regulations, 2024; Construction Regulations, 2014
ISO 45001 is copyright and is not reproduced here. ASC is not affiliated with ISO. Last updated 8 October 2026.