HIRA South Africa: Hazard Identification, 5-Step Risk Assessment, Risk Matrix & Free Template
Quick Answer: What Is HIRA in South Africa?
HIRA stands for Hazard Identification and Risk Assessment. It is a structured process for identifying workplace hazards, considering who could be harmed and how, evaluating the level of risk, deciding what controls are required and checking whether those controls actually work.
For South African employers, the important legal foundation is section 8 of the Occupational Health and Safety Act 85 of 1993. It requires employers, as far as reasonably practicable, to establish workplace hazards and determine the precautionary measures needed to protect people. The Department of Employment and Labour describes workplace risk management as a systematic process of identifying, assessing, controlling and monitoring hazards. Labour.gov.za
A HIRA should therefore not end with:
“Risk score = 15.”
It should end with:
What must change, who is responsible, by when, and how will management verify that the risk has actually been reduced?
HIRA at a Glance
Stage | Management question | Required output |
1. Define | What work, area, equipment or activity are we assessing? | Scope and assessment team |
2. Identify | What could cause injury, illness or another harmful event? | Hazard register |
3. Assess | How serious could the consequence be and how likely is it? | Risk rating / priority |
4. Control | Can we eliminate or reduce the risk more effectively? | Control action plan |
5. Verify | Were actions completed and did they reduce the risk? | Residual risk, evidence and review |
Important: South African law does not prescribe one universal five-step HIRA form or one compulsory 5×5 matrix for every workplace. A matrix is a management tool. The assessment method must make sense for the workplace and any sector-specific legal requirements that apply.
What Does HIRA Mean?
HIRA is normally expanded as:
Hazard Identification and Risk Assessment.
The two parts must not be confused.
What Is a Hazard?
A hazard is something with the potential to cause harm.
Examples can include:
an unguarded machine;
moving forklifts;
work at height;
hot surfaces;
electricity;
hazardous substances;
excessive noise;
poor manual-handling conditions;
slippery floors;
confined spaces;
sharp tools;
fire and explosion sources;
poor workplace layout.
What Is Risk?
Risk considers what could happen because of the hazard and how significant that possibility is.
For example:
Hazard: forklift movement in a warehouse.
Possible event: forklift strikes a pedestrian.
Possible consequence: serious injury or fatality.
The HIRA process then asks:
Who is exposed?
How often?
What controls already exist?
How likely is the harmful event?
How severe could the consequence be?
What additional controls are reasonably practicable?
Who must implement them?
When must they be completed?
How will their effectiveness be verified?
That is much more useful than simply writing:
“Forklifts — High Risk.”
What Does South African Law Require About Workplace Risk?
The Occupational Health and Safety Act does not merely tell employers to keep a safety file.
Section 8 places a broad duty on an employer to provide and maintain, as far as reasonably practicable, a workplace that is safe and without risk to employees.
It specifically includes taking reasonably practicable steps to eliminate or mitigate hazards and establishing what hazards are associated with work, substances, plant and machinery, together with the precautionary measures required. The Act also addresses information, instruction, training and supervision. Labour.gov.za
The Department of Employment and Labour's employer guidance translates this into a practical risk-management process involving:
hazard identification → risk evaluation → risk control
and describes risk management as a systematic approach involving identification, assessment, control and monitoring. Labour.gov.za
Does the OHS Act Require a Specific HIRA Form?
Not as a universal form for every employer.
Do not confuse the legal duty to identify and manage hazards with the idea that every South African workplace must use:
the same HIRA template;
the same 5×5 matrix;
the same colour bands;
the same risk-score cut-offs;
or the same assessment terminology.
The methodology needs to be suitable for the workplace and sufficiently useful to identify, evaluate and control the relevant risks.
Sector-specific regulations can impose more explicit requirements.
Construction Work Has More Specific Risk-Assessment Duties
For construction work, the position is much more prescriptive.
Under the current Construction Regulations 2014, Regulation 9 requires a contractor, before and during construction work, to have risk assessments performed by a competent person appointed in writing. Those assessments must include hazard/risk identification, analysis and evaluation using a documented method, controls and safe-work procedures, a monitoring plan and a review plan. South African Government
The Regulations also require relevant assessments to be reviewed when changes alter the risk profile or after an incident. South African Government
The Department published replacement Construction Regulations in March 2025 as draft regulations for public comment and stated that they were intended to replace the Construction Regulations 2014. Employers should verify the current regulatory position applicable to their work before relying on a particular edition.
HIRA South Africa: The 5-Step Workplace Risk Assessment Process
A useful HIRA South Africa process should move from identification to verified action.
Step 1: Define the Scope Before You Start Scoring Risks
Do not start with a blank matrix and immediately assign numbers.
First establish exactly what is being assessed.
Define the Workplace, Activity or Process
The scope might be:
an entire workplace;
one department;
a warehouse;
a workshop;
a production line;
a maintenance activity;
a machine;
a chemical-handling task;
loading and off-loading;
work at height;
welding or hot work;
contractor activity;
a new process;
a planned change.
A vague assessment produces vague controls.
“Workshop hazards” is weak.
“Grinding, cutting and welding activities in Fabrication Bay A during normal and overtime shifts”
is substantially more useful.
Identify Who Could Be Exposed
Do not assess only the employee operating the equipment.
Consider, where relevant:
operators;
assistants;
maintenance workers;
cleaners;
contractors;
delivery personnel;
visitors;
supervisors;
people working nearby;
new or inexperienced employees;
employees who may have particular vulnerability to the hazard.
The Department's own risk-assessment guidance tells employers to consider where work is performed, equipment, working periods, the environment and characteristics of people who may be exposed. Labour.gov.za
Step 2: Identify the Hazards
This is where many risk assessments become too generic.
Do not begin with:
“What risks do we have?”
Begin with:
“What could cause harm?”
Look Beyond the Obvious Safety Hazards
A workplace review may need to consider:
Hazard group | Examples |
Mechanical | moving machinery, pinch points, cutting tools |
Physical | noise, heat, vibration, lighting |
Electrical | damaged leads, live parts, unsuitable equipment |
Chemical | fumes, vapours, gases, dusts, cleaning agents |
Biological | infectious material, contaminated waste |
Ergonomic | lifting, posture, repetitive work |
Fire / explosion | ignition sources, flammables, hot work |
Workplace movement | vehicles, forklifts, pedestrians |
Falls | ladders, roofs, openings, elevated platforms |
Work organisation | fatigue, long hours, inadequate supervision |
Environmental / layout | access, congestion, poor housekeeping |
The assessment should reflect the actual workplace rather than becoming a generic list copied from another company.
Use Evidence to Find Hazards
Good hazard identification can draw from:
workplace inspections;
employee consultation;
incident and near-miss history;
maintenance records;
manufacturers' instructions;
safety data sheets where applicable;
job/task observation;
process flow;
legal requirements;
contractor activities;
changes in plant or layout;
previous risk assessments;
emergency-drill findings.
A previous incident is useful evidence.
It should not be the first time the organisation discovers the hazard.
Step 3: Assess and Prioritise the Risk
Once the hazard and credible harmful event are understood, the organisation can decide which risks require the most urgent attention.
One common method compares:
LIKELIHOOD × SEVERITY
A matrix helps make that comparison more consistent.
It does not remove the need for competent judgement.
How Does a 5×5 Risk Assessment Matrix Work?
A simple example can use five likelihood levels and five consequence levels.
Example Likelihood Scale
Rating | Likelihood | Example interpretation |
1 | Rare | Not expected under normal conditions |
2 | Unlikely | Could occur, but not commonly expected |
3 | Possible | Credible under foreseeable circumstances |
4 | Likely | Could reasonably occur repeatedly |
5 | Very likely | Expected or repeatedly encountered |
Example Severity Scale
Rating | Severity | Example interpretation |
1 | Minor | Minor injury or limited effect |
2 | Moderate | Injury requiring treatment / limited disruption |
3 | Serious | Serious injury or significant operational impact |
4 | Major | Major injury or potentially life-changing consequence |
5 | Catastrophic | Potential fatality or multiple severe consequences |
Example Risk Score
If:
Likelihood = 4
and:
Severity = 5
then:
4 × 5 = 20
But the calculation is only the beginning.
Management must decide:
what the score means;
what action level it triggers;
whether work should continue;
which control is required;
who has authority to accept or escalate residual risk.
Do Not Copy Another Company's Red-Amber-Green Thresholds Blindly
A 5×5 matrix is not a magic compliance formula
.
Two businesses can use the same arithmetic while defining their categories differently.
If your organisation uses:
1–4 = low;
5–9 = moderate;
10–16 = high;
17–25 = critical;
that is an organisation-defined methodology, not a universal statutory scoring scale.
Your procedure should define the meaning of the scores and the response expected at each level.
Step 4: Select Controls Using the Hierarchy of Controls
The objective is not to make the risk register look complete.
The objective is to reduce real exposure.
1. Eliminate
Can the hazard be removed entirely?
Examples:
stop performing an unnecessary hazardous task;
remove damaged equipment from use;
design out a dangerous process.
2. Substitute
Can a less hazardous material, method or process be used?
3. Engineering Controls
Can people be physically separated from the hazard?
Examples may include:
guards;
barriers;
extraction;
isolation;
interlocks;
improved access systems.
4. Administrative Controls
Examples include:
procedures;
scheduling;
permits;
access rules;
supervision;
signage;
inspections;
training.
5. Personal Protective Equipment
PPE can be essential.
But PPE should not automatically become the first or only answer where a more effective reasonably practicable control can eliminate or reduce the hazard.
That principle is particularly important because section 8 expressly refers to eliminating or mitigating hazards before resorting to personal protective equipment. Labour.gov.za
Step 5: Record, Assign, Verify and Review
This is where a HIRA becomes a management system rather than a paperwork exercise.
Every material corrective action should answer:
WHAT?
What must be corrected?
WHO?
Who owns the action?
WHEN?
What is the due date?
EVIDENCE?
What proves it was completed?
VERIFY?
Who confirms that the action actually reduced the risk?
RESIDUAL RISK?
What level of risk remains after the controls?
A completed action does not automatically mean an effective action.
If management installs a barrier but employees can still bypass it easily, the corrective action may be technically “closed” while the exposure remains.
That is why verification matters.
What Should a HIRA Risk Register Contain?
A strong register should contain enough information for somebody other than its author to understand the decision.
Recommended fields include:
Field | Purpose |
Assessment reference | Document control |
Workplace / department | Defines location |
Task / activity | Defines scope |
Hazard | What can cause harm |
Potential event | What could happen |
Persons exposed | Who may be harmed |
Existing controls | What already reduces exposure |
Likelihood | Probability/frequency judgement |
Severity | Potential consequence |
Initial risk | Prioritisation before further action |
Additional controls | Required improvement |
Control hierarchy | Quality of proposed control |
Responsible person | Accountability |
Target date | Action deadline |
Completion evidence | Proof |
Residual likelihood | Risk after controls |
Residual severity | Remaining consequence |
Residual risk | Remaining priority |
Verification | Confirms effectiveness |
Review date / trigger | Keeps assessment current |
Initial Risk vs Residual Risk
These should not be confused.
Initial risk is the assessed risk before proposed additional controls are implemented.
Residual risk is what remains after the controls have been implemented.
That distinction allows management to answer a much more meaningful question:
Did the action materially reduce exposure?
If the risk remains unacceptably high after the proposed action, the organisation may need a stronger control.
Baseline, Task-Specific, Issue-Based and Continuous Risk Assessment
These terms are frequently used in South African safety practice, but employers should not assume every term has exactly the same statutory meaning in every industry.
Baseline Risk Assessment
A baseline assessment generally gives management a broad view of the major hazards and risks across:
a workplace;
facility;
project;
operation;
or planned scope of work.
Construction law expressly uses the term baseline risk assessment in relation to a client's duties for intended construction work. South African Government
Task-Specific or Activity Risk Assessment
This examines the hazards arising from a particular activity.
Examples:
changing a machine blade;
welding inside a restricted area;
loading steel using lifting equipment;
roof work;
cleaning a chemical vessel.
Issue-Based Risk Assessment
An organisation may initiate an assessment because something material changes or a particular risk requires deeper investigation.
Examples include:
new equipment;
new substance;
changed process;
changed layout;
incident;
near miss;
new contractor activity;
repeated control failure.
Continuous or Dynamic Assessment
Workers and supervisors should remain alert to changing conditions while work is taking place.
That operational awareness does not replace a documented assessment where one is required.
It complements it.
When Should a HIRA Be Reviewed?
Avoid creating an unsupported rule such as:
“Every HIRA must legally be renewed annually.”
There is no single universal review interval that applies to every South African workplace assessment in every context.
A review should be triggered when circumstances materially change, including where relevant:
new machinery or equipment;
new substances;
changed workflow;
changed layout;
new work method;
contractor changes;
abnormal operating conditions;
incident or near miss;
evidence that a control is ineffective;
changed legal or technical requirements;
new information about a hazard.
For construction work, Regulation 9 specifically requires review when design or construction changes alter the risk profile or when an incident has occurred. South African Government
An organisation can also establish scheduled review periods under its own management system.
The important distinction is:
internal review frequency is not automatically the same as a universal legal frequency.
Who Should Conduct a HIRA?
For a normal workplace, avoid inventing a universal statutory title such as:
“Every company must appoint a HIRA Officer.”
The appropriate level of competence should match the complexity and consequences of the work.
A competent assessment team may need knowledge of:
the work process;
equipment;
hazards;
affected employees;
existing controls;
legal requirements;
incident history;
risk-assessment methodology.
For higher-risk or specialist hazards, technical expertise may be necessary.
Construction Has a Specific Competence Requirement
Construction Regulation 9 specifically requires risk assessments to be performed by a competent person appointed in writing. South African Government
That construction requirement should not be carelessly copied and presented as though the identical appointment rule applies word-for-word to every employer in every sector.
HIRA Example: Warehouse Forklift and Pedestrian Interaction
Consider this simplified scenario.
Activity
Forklifts move stock between receiving, storage and dispatch areas.
Hazard
Moving forklift traffic.
People Exposed
forklift operators;
pickers;
warehouse staff;
cleaners;
visitors;
delivery personnel.
Credible Event
Pedestrian struck by forklift.
Existing Controls
licensed/authorised operators;
basic floor markings;
speed limit;
warning devices.
Initial Assessment
Likelihood: 4
Severity: 5
Example risk score:
20
Weak Corrective Action
“Remind staff to be careful.”
That may add little meaningful protection.
Stronger Control Review
Management could examine, where reasonably practicable:
pedestrian/vehicle segregation;
physical barriers;
controlled crossings;
route redesign;
one-way traffic;
exclusion zones;
visibility improvement;
loading-area controls;
speed-control measures;
supervision;
site rules;
induction and refresher communication.
The important point is not that every warehouse must use the same controls.
It is that the HIRA should drive a control decision, not merely generate a number.
HIRA Example: Welding and Hot Work
Hazard
Hot metal, sparks, ignition sources, fumes, electricity and compressed gases.
Poor Assessment
“Welding — High Risk — PPE required.”
Better Assessment
Separate the credible events:
ignition of combustible material;
burns;
exposure to welding fumes;
electrical contact;
cylinder-related hazards;
eye exposure;
people entering the work zone.
Then assess the controls for each significant exposure.
One line labelled “welding” can hide several different hazards requiring completely different controls.
HIRA vs Workplace Hazard Identification Checklist
These should also remain two different search-intent assets.
Hazard Identification Checklist
The existing SSA article should own:
What hazards should I look for?
It is the discovery layer.
HIRA South Africa
This article owns the next question: What do I do with the hazards once I have identified them?
HIRA evaluates the hazard, considers who may be exposed, assesses likelihood and consequence, prioritises the risk, selects controls, assigns corrective actions and verifies the residual risk.
If you first need help identifying workplace hazards, use our Workplace Hazard Identification Checklist South Africa before completing the HIRA process.
HIRA vs Safety Inspection
A safety inspection asks:
What condition exists now?
A HIRA asks:
What hazard exists, what could happen, how significant is the risk and what controls are needed?
An inspection may identify:
damaged guard;
obstructed walkway;
missing barrier;
leaking container.
Those findings can feed into a risk assessment.
But an inspection checklist alone does not necessarily evaluate the risk or determine the best controls.
HIRA vs Job Safety Analysis
A job or task analysis normally breaks a particular job into activities or steps and considers the hazards and controls associated with them.
A broader HIRA can examine:
entire sites;
operations;
processes;
departments;
activities;
categories of exposure.
They can complement each other.
They should not be treated as interchangeable labels merely because both discuss hazards.
For a specialist example of applying risk-assessment principles to fall exposure, see our Working at Heights Risk Assessment South Africa — Step-by-Step Guide & Template.
What Are the Most Common HIRA Mistakes?
1. Starting With the Risk Score Instead of the Hazard
The number becomes the focus.
The actual harmful event becomes vague.
2. Copying Another Company's Risk Assessment
Their:
work;
machinery;
layout;
substances;
people;
exposure;
controls
may be completely different.
3. Writing “PPE” as the Answer to Everything
This can skip opportunities to eliminate, substitute or engineer out the hazard.
4. Treating Training as the Only Corrective Action
Training may be appropriate when the gap involves:
competence;
awareness;
procedure;
supervision.
Training cannot physically repair:
a broken guard;
defective extraction;
a failed barrier;
unsafe access;
damaged electrical equipment.
5. Forgetting Contractors and Visitors
People who are not permanent employees can still be exposed to workplace hazards.
6. Ignoring Existing Controls
You cannot meaningfully assess residual exposure if you have not established what already exists.
7. Closing Actions Without Evidence
“Completed” is not evidence.
The assessment should record enough evidence to show what actually changed.
8. Never Recalculating Residual Risk
If risk is still high after the corrective action, further action may be required.
9. Never Reviewing the Assessment After Change
A beautifully formatted HIRA can become obsolete when the work changes.
10. Treating the Matrix as the Law
The matrix supports judgement.
It does not replace it.
HIRA & Workplace Risk Assessment Pack — South Africa
The pack should include:
Part 1 — Assessment Planning Sheet
Record:
workplace;
area;
activity;
assessor/team;
assessment date;
scope;
people exposed;
documents reviewed.
Part 2 — Hazard Identification Worksheet
Separate:
activity;
hazard;
hazardous event;
exposed people;
possible consequence.
Part 3 — 5×5 Risk Matrix
Include editable:
likelihood definitions;
consequence definitions;
organisation-defined risk bands;
action rules.
The pack should expressly warn that the example matrix is a management tool rather than a universal statutory scoring model.
Part 4 — HIRA Risk Register
Include:
hazard;
consequence;
existing controls;
initial score;
additional controls;
responsible person;
due date;
evidence;
residual score.
Part 5 — Hierarchy of Controls Decision Sheet
Force the user to ask:
Can we eliminate this before accepting PPE/admin controls?
Part 6 — Corrective Action Tracker
Record:
finding;
action;
owner;
deadline;
status;
evidence.
Part 7 — Management Verification
Record:
action checked;
control present;
control working;
residual risk acceptable under the organisation's method;
further action required.
Part 8 — Review Trigger Register
Include:
incident;
process change;
new plant;
new substance;
new contractor;
layout change;
control failure;
scheduled review.
Part 9 — Worker Consultation Record
Record:
employees consulted;
issues raised;
hazards added;
controls discussed.
Part 10 — HIRA Evidence File Index
Help employers retain:
assessments;
corrective actions;
photographs;
procedures;
training evidence where relevant;
inspection records;
consultation evidence;
review history.
What Should Employers Do After the HIRA?
Management should classify every significant finding.
Physical / Engineering Gap
Examples:
guarding;
extraction;
barrier;
access platform;
isolation.
Action: engineering or physical correction.
Equipment / Maintenance Gap
Examples:
damaged lead;
defective tool;
failed alarm.
Action: repair, replace, isolate or maintain as appropriate.
Process Gap
Examples:
unsafe flow;
poor segregation;
incompatible work activities.
Action: redesign the process or sequence.
Procedure Gap
Action: establish or improve the procedure and ensure it is understood.
Supervision Gap
Action: clarify accountability and ensure adequate supervision.
Competence / Training Gap
Action: determine what knowledge or competence is actually required and provide suitable
information, instruction or training.
This classification stops an organisation from trying to solve every safety problem with a course.
How Should Management Know Whether the HIRA Is Working?
Ask five questions.
1. Are the highest-priority actions closing?
If the same high-risk findings remain open month after month, the system is not functioning.
2. Are Controls Actually Present?
Do not rely only on signatures.
Verify physically where possible.
3. Are Controls Being Used?
A guard that has been removed is no longer a control.
4. Are Incidents Exposing Missed Hazards?
Incident and near-miss information should inform review.
5. Is Residual Risk Falling?
The objective is not a bigger risk register.
The objective is better-controlled work.
Frequently Asked Questions
Is HIRA required in South Africa?
South African employers have a general legal duty under section 8 of the Occupational Health and Safety Act to establish workplace hazards and determine appropriate precautionary measures, as far as reasonably practicable. The exact assessment requirements can become more specific under particular regulations or sectors. Labour.gov.za
What does HIRA stand for?
HIRA commonly stands for Hazard Identification and Risk Assessment.
Is a HIRA the same as a hazard-identification checklist?
No. Hazard identification establishes what could cause harm. HIRA continues into evaluating the associated risk and deciding what controls and actions are required.
Is a 5×5 risk matrix compulsory in South Africa?
There is no universal requirement that every employer must use one specific 5×5 matrix. It is a commonly used management method for comparing likelihood and consequence. The organisation must define and consistently apply its chosen methodology.
What is the difference between a hazard and a risk?
A hazard is something with the potential to cause harm. Risk considers the likelihood and consequence associated with a credible harmful event arising from that hazard.
Who should conduct a workplace risk assessment?
The person or team should have sufficient knowledge of the work, hazards and assessment methodology for the complexity of the task. Certain sectors impose more explicit competence requirements. Construction Regulation 9, for example, requires risk assessments to be performed by a competent person appointed in writing. South African Government
How often should a HIRA be reviewed?
There is no single universal review period for every risk assessment in every workplace. Review should occur when relevant conditions or risks change and according to applicable regulations and the organisation's management system. Construction Regulation 9 specifically identifies changes to the risk profile and incidents as review triggers. South African Government
What is residual risk?
Residual risk is the level of risk remaining after controls have been implemented.
Is PPE enough to control a high risk?
Not automatically. Employers should consider whether hazards can first be eliminated or mitigated by stronger reasonably practicable controls. Section 8 specifically addresses eliminating or mitigating hazards before resorting to PPE. Labour.gov.za
Does completing a HIRA template make a company legally compliant?
No.
A form is evidence of a process.
Legal compliance depends on the actual duties that apply, the adequacy of the assessment, the controls implemented, the competence and involvement of relevant people, the workplace circumstances and whether the system is maintained.
Does every company need a HIRA officer?
Do not assume there is a universal OHS Act rule requiring every employer to appoint somebody under the exact title “HIRA Officer.” Sector-specific appointment and competence requirements must be checked separately.
Should employees be involved in risk assessment?
Employee knowledge can be extremely valuable because the people performing work often understand practical exposure, abnormal conditions and control failures that may not be visible from paperwork alone. In construction, Regulation 9 also contains specific consultation requirements for monitoring and reviewing site risk assessments. South African Government
Authoritative Sources & Regulatory References
Authoritative Source | What It Supports |
Section 8 employer duties, hazard identification, precautionary measures, risk reduction, information, training and supervision. | |
Official practical guidance describing risk management through hazard identification, risk evaluation, control and monitoring. | |
Baseline and construction risk-assessment duties; Regulation 9 competence, documented methodology, controls, monitoring and review requirements. | |
Confirms the 2025 construction regulations were released as draft proposals intended to replace the 2014 regulations, preventing the article from treating the draft as final law. |
Read More
Read More | Why Read It |
Use this first when you need a structured way to identify workplace hazards before assessing and prioritising the risks. | |
Understand the broader employer compliance framework surrounding hazard control, duties, appointments, records and workplace safety. | |
See how risk-assessment principles are applied to a specialist high-risk activity without turning the general HIRA page into a working-at-heights duplicate. |
Final Word
A useful HIRA does not tell management that the workplace contains “high”, “medium” and “low” risks.
It tells management what can go wrong, who is exposed, why the existing controls may be inadequate, what needs to change, who owns that change and whether the resulting risk is actually lower.
The strongest workplace risk-assessment system therefore moves through:
IDENTIFY → ASSESS → CONTROL → ASSIGN → CORRECT → VERIFY → REVIEW
The form is only the record.
Risk reduction is the objective.
