ISO 45001 Risk & Opportunity — Clause 6.1 (Hazard Identification & Risk Assessment)
ISO 45001:2018 makes hazard identification and risk assessment the engine of the whole system — Clause 6.1. Unlike ISO 9001, where risk is broad, ISO 45001’s Clause 6.1.2.3 requires a documented process for hazard identification, and Clause 6.1.2.1 requires ongoing risk assessment. This page explains how to build a defensible register.
Clause 6.1 — the OH&S planning core
Clause 6.1.1 sets the general requirement to establish, implement and maintain a process for hazard identification, risk and opportunity assessment. Clause 6.1.2 then details it: an ongoing process for hazard identification, a method for risk assessment, and determination of controls. This is the heart of the standard — everything else (operation, performance evaluation) refers back to it.
Building the hazard register
A credible register captures hazards by work activity, assesses likelihood and severity, ranks risk, and records the chosen control using the hierarchy of controls (eliminate, substitute, engineer, administrative, PPE). Clause 6.1.2.3 explicitly requires a procedure for hazard identification — it is one of the few mandatory procedures in the standard.
From risk to operation
The assessed risks must flow into operational controls (Clause 8.1), competence (Clause 7.2), and emergency preparedness (Clause 8.2). Auditors check that the controls you documented in Clause 6.1 are the ones actually applied on the floor — a register disconnected from operations is a classic finding.
Frequently asked questions
Does ISO 45001 require a documented hazard-identification procedure?
Yes. Clause 6.1.2.3 explicitly requires a documented procedure for the ongoing process of hazard identification. This is one of the few named mandatory procedures in ISO 45001.
What is the hierarchy of controls and why does it matter?
It is the ordered approach to risk: eliminate, then substitute, engineer out, administrative controls, and lastly PPE. Auditors expect higher risks to be controlled as far up the hierarchy as reasonably practicable, not defaulting to PPE.
How is ISO 45001 risk different from ISO 9001 risk?
ISO 9001 risk-based thinking is broad and strategic. ISO 45001 Clause 6.1 is specifically about worker hazards and OH&S risk, with a mandatory hazard-identification procedure and explicit linkage to operational controls.