Hazard Identification: Methods and Process

Most organisations spend the majority of their safety effort on the parts of risk management that produce paperwork: scoring, matrices, review cycles, sign-off. Very little of it goes on the step that decides whether any of that work means anything. Hazard identification is the front end of the whole discipline, it is cheap, it is largely unglamorous, and it is where the quality of a risk assessment is actually set. Get it right and an ordinary assessment process produces useful output. Get it wrong and the most sophisticated risk matrix in the world will rate a list of hazards that was never the real list.

The message up front: a risk assessment can only ever be as good as the hazard list it starts from, and a hazard nobody identified receives a rating of zero by default. It is not scored low, it is not deferred, it is not accepted. It is simply absent, and absence looks exactly like safety on a completed form. That is why identification is the highest-leverage and least-invested-in step in the process, and why its failure mode is silent: you cannot see what is missing from a list.

1. Why identification sets the ceiling on everything downstream

The standard sequence is identify, then assess, then control. The sequence is drawn as a loop, which makes it look as though a weakness at one stage can be recovered at another. It cannot, and the reason is worth stating plainly. Rating operates only on what identification handed it. Control selection operates only on what rating prioritised. A hazard that never entered the list at step one is invisible at every step after it, and no amount of rigour later in the chain will recover it.

That is what makes the failure silent. An under-rated hazard is at least visible: someone can disagree with the severity and argue. A missing hazard offers nothing to argue with. The document looks complete, the review signs it off, and the audit finds a populated register, because the only evidence of the gap is something that is not there. There is a related asymmetry in effort: rating is easy to formalise, template and audit, so it attracts attention and software, while identification depends on judgement, access, time on the floor and a willingness to hear uncomfortable things, none of which templates well. If you can only improve one thing in a risk assessment programme, improve this rather than the matrix. For the definitional groundwork see hazard vs risk, and for the assessment process that follows on, the risk assessment guide.

The duty to assess is generally framed as a duty to identify first. In Great Britain the general risk assessment duty sits at Regulation 3 of the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), and an assessment cannot be suitable and sufficient if the hazards were never found. In the United States, federal OSHA has no standard requiring a written job hazard analysis; its guidance is OSHA 3071 "Job Hazard Analysis", 2002 revision. Where US general industry does require documented assessment it is narrower: 29 CFR 1910.132(d) requires a written certification of the workplace hazard assessment for PPE selection. None of those binds a reader in the UAE, where the framework is Federal Decree-Law No. 33 of 2021 administered by MOHRE plus the emirate-level frameworks.

2. Hazard categories as a prompt structure

The default method in most organisations is to walk round and look. It is better than nothing, and it reliably finds one class of hazard: the visible, physical, present-at-the-moment-of-the-walk kind. Trip hazards, missing guards, blocked exits, damaged cables. These matter, but they are the easiest hazards on site, and an exercise that finds only these has found the surface.

What turns an unstructured walk into a systematic one is a prompt structure, and the most durable one is a set of hazard categories used as a checklist of thinking rather than a checklist of items. You take each category and ask whether anything in it applies to this area, task or process. The categories do not tell you what the hazard is. They stop you skipping a whole family of them.

• Physical: noise, vibration, heat and cold, radiation, lighting, pressure, confined spaces, work at height, slips and trips, falling objects.
• Mechanical: moving and rotating parts, entanglement, crushing, shearing, stored energy, vehicles and mobile plant, lifting operations.
• Electrical: contact with live conductors, arc flash, static, inadequate isolation, damaged equipment, temporary supplies.
• Chemical: substances used, substances generated by the process such as fume and dust, incompatible storage, reaction products, decomposition on heating.
• Biological: water systems, drainage and wastewater, contaminated materials, sharps, animal and insect contact.
• Ergonomic: manual handling, repetitive work, awkward postures, sustained force, workstation layout, tool design, task visibility.
• Psychosocial: workload and pace, lack of control, role ambiguity, poor support, bullying and harassment, fatigue, shift patterns, traumatic events.
• Environmental: weather and heat stress, ground conditions, lone and remote working, congested workplaces, traffic interaction, discharge and emission.
• Organisational and systemic: competence gaps, unclear responsibility, weak supervision, procedures that do not match the work, handover communication failure, contractor interface, change managed informally, production pressure.

Three honest observations. First, the last three categories are the ones most often skipped, always the same way: the walk-round finds the physical and mechanical hazards because they are visible, and stops. Psychosocial, environmental and organisational hazards have no physical referent to point at, so they fall out of an exercise structured around looking. Second, psychosocial hazards are now explicitly within scope in mainstream occupational health and safety thinking rather than an optional extra: ISO 45003:2021 provides guidelines on psychosocial risk within an occupational health and safety management system, and while it is guidance and not certifiable, its existence settles whether these belong in a hazard identification exercise. They do.

Third, the one I raise most often on site: "housekeeping" is where genuine hazards get filed and forgotten. A finding recorded as "housekeeping in the plant room" has almost certainly replaced something specific. Stored material blocking access to an isolation point is not housekeeping. A drum of waste oil next to hot work is not housekeeping. Cabling across a walkway because there is no outlet where the work happens is a layout problem with an electrical hazard attached. The word acts as a bin, and once a hazard is in it, it gets closed out by sweeping rather than assessed.

3. Looking, watching and asking: the three observational methods

The three cheapest methods are also the three most productive, and they are genuinely different from each other. Conflating them is why many organisations believe they have covered identification when they have used only the first.

Workplace inspection and observation is a structured examination of the physical workplace: plant condition, guarding, access, storage, surfaces, services, signage. It is good at physical and mechanical conditions, accumulated deterioration, and anything visible to a competent eye at the moment of the inspection. It is poor at anything intermittent, because it sees one point in time, and poor at latent conditions, because a correctly assembled but wrongly specified component looks fine. An inspection on a Tuesday morning with the plant at steady state will not find the hazard that exists only during start-up.

Task observation and task analysis is watching the work being done, breaking it into steps, and asking what could cause harm at each one. That is a different exercise from inspecting the place where the work happens, and it is the most consistently underrated method I encounter. Its distinctive value is that it surfaces the gap between the procedure and the practice: the work as written against the work as actually done. People take the shortcut because the sanctioned route is blocked, slower, or designed for a layout that has since changed. That gap holds a large share of real hazards, and it is invisible to both document review and inspection. You only see it by watching, and you only see the honest version if the person being watched does not feel they are being caught out. At individual-task level with formal step-by-step documentation this becomes job safety analysis, covered in the JSA guide.

Talking to the people who do the work is the cheapest high-yield method there is. The people on the tools know which valve sticks, which access route everyone actually uses, which job needs three people but gets two, which alarm has been sounding for months, and which task everybody quietly dreads. None of it is written down. Asking costs an hour.

The honest qualification is that it only works where people believe reporting is safe. If raising a problem has historically produced either nothing or blame, you will get the sanctioned answer, delivered politely, and conclude the workforce has no concerns. What you hear is a readout of the reporting culture, not of the hazards present. See near miss reporting and, on the distinction between behaviour and condition, unsafe act vs unsafe condition.

4. Reviewing history: incidents, ill health and maintenance records

Identification does not start from a blank sheet. The organisation already holds a record of hazards that have demonstrated themselves, and it is usually under-read.

• Incidents and injuries: proven hazards with proven consequences. Read the narrative, not the classification code, which compresses the mechanism out of the record.
• Near misses: the same hazards without the outcome, so a larger and less biased sample.
• Ill health data: absence patterns, occupational health referrals, health surveillance results. These point to exposure hazards no walk-round finds, because the harm is slow.
• Maintenance and failure history: work orders, breakdown records, repeat repairs, defect reports, failure codes.

The last one deserves more emphasis than it gets, and it is the source I would push hardest with a maintenance audience. Maintenance records are an under-used hazard source because repeat work signals a condition nobody has assessed. If the same actuator has been replaced four times in eighteen months, something is driving that, and whatever is driving it is very likely a hazard too, either directly or through the exposure created by going in to fix it four times. If a pump is packed out every few weeks, the leak is a hazard and so is the repeated intervention. A maintenance backlog read as a hazard list rather than a workload list is one of the most productive hours available to a safety adviser. Structured failure coding makes this readable at scale; see failure codes: problem, cause, action and failure modes and how to analyse them.

Causal analysis of past events also feeds the forward hazard list, and it has an international standard behind it: IEC 62740:2015 "Root cause analysis (RCA)", voluntary and law in no jurisdiction, which sets out principles and process and describes named techniques including the "Why" method and the Fishbone or Ishikawa diagram.

5. Checklists and prompt lists

Checklists are the workhorse of routine identification and they earn their place: coverage, consistency between assessors, and a defensible record that a defined set of questions was asked. For repetitive environments with a stable hazard profile they are the right tool, and they appear as a listed technique in the recognised technique catalogue, which answers anyone who dismisses them as unsophisticated.

Their weakness is structural rather than a matter of quality. A checklist encodes the known, so it cannot contain the hazard nobody had thought of when it was written, and a novel hazard produces no ticked box and no blank box either. The real failure mode is the checklist becoming the ceiling rather than the floor: the assessor works through forty items, finds them addressed, and stops, because the instrument signalled completion. A closing item reading "what hazards exist here that are not on this list?" costs nothing and changes the posture of the exercise.

6. Structured team techniques

Above the observational methods sits a family of formal group techniques, for situations where hazards arise from the interaction of a process, its design and its deviations rather than from anything visible on a walk. The authoritative catalogue is IEC 31010:2019 "Risk management - Risk assessment techniques", which describes the techniques and where each applies. Note the designation: it is IEC 31010, not ISO 31010. Only the withdrawn 2009 edition carried a dual prefix. The companion document, ISO 31000:2018 "Risk management - Guidelines", is guidance and is not certifiable, so there is no accredited organisational certification to it whatever a training provider implies.

At recognition depth, the ones worth knowing by name:

• HAZID: a broad structured hazard identification workshop. A multidisciplinary team works through a facility, process or project using prompt lists of hazard categories and sources, capturing hazards and potential consequences without yet resolving them. Deliberately wide rather than deep, which suits early project stages and whole-facility reviews. It is recognised industry practice rather than a specified procedure.
• HAZOP: a systematic, deviation-based examination of a process design. A team takes the design intent for each part of the process and applies guide words, expressing deviations such as more, less, none, reverse and other than, to draw out what could go wrong and what would follow. Exhaustive within its scope and very good at finding hazards created by combinations no single-point inspection reveals, at a real cost: accurate design documentation, a skilled facilitator, days of senior technical time.
• What-if analysis: a lighter structured brainstorm posing "what if" questions through a process or task. Less rigorous and less repeatable than HAZOP, far cheaper, and effective where design documentation is thin or the process is not continuous.
• FMEA: the bottom-up, equipment-focused method, working from component level upward, asking how each item can fail, what the effect is, and what it means for the system. Suited to equipment and design reviews and maintenance strategy work. The international standard is IEC 60812:2018 (Edition 3) "Failure modes and effects analysis (FMEA and FMECA)", again voluntary rather than legal.

Where each belongs matters more than the list. HAZOP and FMEA suit process and design contexts and are the wrong instrument for a routine task assessment in a facilities environment, where the effort will not be repaid. HAZID and what-if sit usefully in the middle. In the United States, 29 CFR 1910.119(e) requires a process hazard analysis for covered processes and names methodologies including what-if, HAZOP and FMEA: a US federal duty for covered processes only, not a general requirement anywhere else. One naming correction: bowtie analysis comes from a 2018 CCPS and Energy Institute concept book, and while it is a listed technique in IEC 31010:2019 there is no "bowtie standard".

7. The methods compared

No single row on that table is sufficient alone, and the "what it misses" column is the argument for combining at least three. A sound exercise for an operating facility is history review, then inspection, then task observation with the people who do the work, with a prompt structure running through all three. Anything heavier should be proportionate to the consequence of getting it wrong.

8. Change-triggered and design-stage identification

Identification is usually treated as a periodic activity on a review cycle. The cycle is necessary but it is not where hazards arrive. Hazards arrive with change, and the review cycle finds them whenever it next comes round, which may be months later. The triggers that should prompt identification regardless of the calendar: new equipment, a modified process or method, a new or substituted substance, new people including new starters, transfers, young workers, agency staff and contractors, a changed layout or occupancy, a change in volume or pace, and any temporary arrangement.

Temporary arrangements deserve their own paragraph, because temporary arrangements are where hazards accumulate unassessed. A temporary supply, a temporary access route, a hired unit standing in for one under repair, a scaffold left an extra fortnight, a barrier moved for a delivery. Each is individually minor, each sits outside the assessed baseline because everyone knows it is going away, and each outlives the intention by longer than anybody expects. Nothing in the assessment regime is designed to catch them: too small for management of change, too short-lived for the review cycle, too obviously provisional to feel like they need assessing. I would have a standing instruction that any arrangement described as temporary gets a named owner, a date, and identification against the same categories as anything permanent.

The other timing point runs the other way: the cheapest hazard to eliminate is one identified before it is built. At design stage a hazard can be removed by drawing it differently, at the cost of a drawing revision. Once installed, the same hazard can usually only be engineered around, guarded, proceduralised or lived with under PPE, at permanently higher cost and lower reliability. That is the logic of the hierarchy of controls, where elimination sits at the top because it is the only level that removes the hazard rather than managing exposure to it. The hierarchy is a principle rather than a standalone standard: it is required by ISO 45001:2018 at clause 8.1.2, ISO 45001 being certifiable and cited as amended by Amd 1:2024, and by ANSI/ASSP Z10.0-2019 at section 8.4 in the United States, and described by NIOSH , a research body with no regulatory power. Federal US OSHA does not define the hierarchy in any regulation. Full treatment in the hierarchy of controls guide.

9. The hazards that resist identification

This is the section that matters most, because these are the hazards that survive competent, well-intentioned identification exercises. Each resists for a specific structural reason, and each therefore needs a specific method to find it. Generic diligence will not do it.

Intermittent hazards exist only during certain operations: start-up and shutdown, changeover, purging, testing, back-up equipment running, a specific weather condition or product. Any method that samples the workplace at a point in time misses them by design, and the more unusual the operating mode the less likely an inspection coincides with it. Found by enumerating operating modes on paper first, identifying against each mode separately, and asking the operators which modes feel different.

Interaction hazards are created by two activities that are each entirely safe alone. Hot work in one area and solvent decanting in the next. A lifting operation over a walkway that is fine when the walkway is closed. Pressure testing beside a task that needs someone alongside the line. Task-based identification misses these because it looks at one task at a time; inspection misses them because the interaction is temporal, not physical. Found by looking at what else is happening in the same place at the same time, which is exactly what a permit to work system does when it is used to coordinate rather than only to authorise. See permit to work integration.

Maintenance-and-cleaning-only hazards are the large and chronically missed category, and if you work in maintenance this is the one to take away. A great deal of plant is assessed in its normal operating state, by people thinking about the people who operate it. In normal operation the machine is guarded, enclosed, running steady and touched by nobody. The profile during maintenance and cleaning is a different one, frequently much worse, because that is when every protective feature designed into normal operation is deliberately defeated. Guards come off. Interlocks get bypassed to test. Enclosures are opened. Someone reaches inside. Stored energy that is safely contained during operation, in accumulators, springs, capacitors, suspended loads, pressurised lines, residual chemical and thermal mass, becomes reachable. Cleaning adds its own layer: substances used only by the cleaning contractor, hot water and steam, access at height to surfaces nobody else touches, and work at times when nobody else is on site to notice a problem.

The reasons this gets missed are organisational rather than technical. Maintenance work is non-routine, so it does not fit a task list built from routine operations. It is often out of hours, so a daytime identification exercise never sees it. It is frequently contracted out, so the people doing it were never consulted. And supplier documentation describes operation thoroughly and maintenance access thinly. The fix is direct: identify hazards separately for each operating state of the asset, treating maintenance, cleaning, inspection, fault-finding and decommissioning as distinct states with their own hazard lists, and put the maintenance technicians and the cleaning contractor in the exercise rather than assessing on their behalf.

Latent and long-latency health hazards separate the harm from the exposure by years. Dust, fume, noise, vibration, solvents, sensitisers, ergonomic loading and psychosocial exposure all work this way. Nothing at the moment of exposure signals harm, no incident occurs, no near miss is reported, and the affected person may have left before the effect appears, so every feedback mechanism that catches acute hazards is blind to them. Found by working from the substances, energies and loadings present rather than from observed events, by treating health surveillance and occupational health data as identification inputs, and by taking the chemical, biological, ergonomic and psychosocial categories seriously in their own right.

Normalised hazards are the ones everyone has stopped seeing. The step everyone knows to step over. The door that has to be held. The gauge that has read zero for two years. The smell in the corner. Familiarity converts a hazard into a feature of the environment, and the people best placed to describe the work are the least able to see these. Found only by bringing in someone who has not been there before, and by phrasing the question to bypass the normalisation: not "are there any hazards here" but "what would you warn a new starter about on their first morning?" That reliably produces a list the first question does not.

10. Who should do it

Identification is a team exercise, and the composition matters in a specific way: the best pairing mixes someone who knows the work intimately with someone who does not know it at all, because familiarity produces both insight and blindness and the two arrive together.

The person who knows the work brings what is not written down: which step is awkward, which tool everyone substitutes, what happens when the line backs up, why nobody uses the designated route. Without them you identify the work as documented rather than as done. The person who does not know the work can see what has been normalised, and has permission to ask the question that sounds naive. Exercises run entirely by insiders and entirely by outsiders fail in opposite and equally predictable directions.

Practically, the team should include the people who do the task, their supervisor, someone technically competent on the plant, and where relevant the maintenance and cleaning people whose hazard profile differs from the operators'. A safety adviser facilitates and brings method rather than supplying content; an exercise conducted by the safety function alone reliably produces a document everyone signs and nobody recognises. Where the work is contracted, the contractor's people belong in the room rather than being sent the output afterwards. For where this sits in the wider function, see what HSE actually covers.

11. Recording a hazard usefully

A hazard identified but recorded badly is only marginally better than one that was missed, because the record is what the next step operates on. The common failure is the one-word label. "Electricity." "Manual handling." "Chemicals." "Working at height." These are categories, not hazards, and a category cannot be assessed: no mechanism of harm to judge severity against, nobody identified as exposed, no circumstance to attach a control to. A usefully recorded hazard names three things: the hazard, the mechanism by which it causes harm, and who could be harmed. Compare two versions of the same finding.

The second version can be rated, because severity and likelihood have something to attach to, and it can be controlled, because the entry point is visible in the wording: the shared isolation point is the actual problem, and the answer is an engineering change rather than an instruction to be careful. It also survives staff turnover, because the next reader does not need the context that was in the first assessor's head. The test: could someone who was not present rate this hazard and propose a control from the text alone? If not, it is a label rather than a record. Once records reach that standard, rating and prioritisation become mechanical steps, covered in the risk matrix guide, and the combined framing many organisations use is set out in the HIRA guide.

12. How identification fails in practice

The failure patterns are consistent enough to list, and every one of them produces a document that looks finished.

• The copied generic assessment. A template from another site or a trade association with the names changed. It holds the generic hazards of the activity and none of the specific hazards of your premises, which are the ones that will hurt someone.
• Identification done from a desk. Produced from drawings and previous documents without anyone going to look, so it captures the work as designed, and the gap between designed and actual is where the hazards are.
• A checklist treated as exhaustive. Coverage of the known mistaken for coverage of everything.
• Maintenance and cleaning excluded. The asset assessed in its normal running state only, so every hazard that exists because a protective feature was deliberately removed goes unrecorded.
• Contractors and visitors not considered. Scoped to employees, leaving out the people least familiar with the site and most likely to be working on it at unusual hours.
• Non-routine work left out. Breakdowns, one-off jobs, project work, trials, emergency response: the highest harm potential with the least procedural support.
• One person doing it alone. Usually the safety adviser, under time pressure, producing something technically literate and operationally unrecognisable.

There is one organisational tell worth more than any audit question: a site's hazard list has not changed in years while the site plainly has. New plant has gone in, a wall has moved, a contractor has taken over the cleaning, three of the original team have left, the throughput has gone up. If the register still reads as it did four years ago, it is not stable, it is not being done. A live hazard list changes because the workplace changes.

The wider legal framing supports that reading. Under Great Britain's Health and Safety at Work etc. Act 1974 (c. 37) and the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), the assessment duty is continuing rather than one-off, and HSE publishes free guidance on the process. That is Great Britain only: Northern Ireland has separate instruments with different years, and readers elsewhere should work from their own framework.

The idea to walk away with

Hazard identification is not the administrative preamble to risk assessment. It determines whether the assessment has any relationship to reality, and it is the only step whose failure leaves no trace. A hazard nobody identified is rated zero by default, and a register full of well-scored, well-controlled hazards tells you nothing about the hazards that never made the list.

So the practical measure of an identification exercise is not how tidy the output looks. It is how hard the exercise worked to find what resists being found: the operating modes nobody observes, the interactions between separately safe jobs, the hazard profile during maintenance and cleaning, the exposures whose harm arrives in a decade, and the conditions everybody has stopped noticing. Those account for the gap between organisations with good paperwork and organisations that are actually safe.

Final thoughts

The sequence I would advise needs no technique catalogue to start. Read the maintenance and incident history before you go anywhere. Walk the place with someone who works there and someone who does not. Watch two or three jobs actually being done. Run the hazard categories as a deliberate prompt, including the three that usually get skipped. List every operating state of the significant assets and identify against each separately, maintenance and cleaning included. Then record each hazard with its mechanism and its exposed people rather than as a one-word label.

None of that requires a standard, a licence or a platform. It requires time on the floor, a willingness to be told things you would rather not hear, and the discipline to keep asking what is not on the list. Most of the hazards that hurt people were findable by someone who looked properly, watched the real work, and asked the question in a way that made it safe to answer honestly.

Related reading: Hazard vs risk: the difference, Risk assessment: complete guide, Risk matrix: calculating risk, Hierarchy of controls, HIRA, Job safety analysis (JSA), Near miss reporting, Unsafe act vs unsafe condition, What is HSE, Failure modes and how to analyse them, Permit to work integration.