Risk Assessment vs Hazard Identification: What Is the Difference?

Quick answer: Hazard identification finds things that could cause harm. Risk assessment evaluates how likely that harm is, how serious it could be, and what controls are needed. They are not alternatives — hazard identification must happen before risk assessment, and both are required under Australian WHS law.

Last reviewed: June 2026 by the BlueSafe Technical Team. Reflects current Model WHS Act and Regulations.

	Hazard Identification	Risk Assessment
What it is	Finding things that could cause harm	Evaluating the likelihood and consequence of that harm
When it happens	First step	Second step — follows identification
Legal basis	WHS Act, s. 17 duty to manage risks	WHS Regulations, r. 34–38 risk management process
Output	A list of hazards present	A risk rating and a decision on controls
Can it stand alone?	No — must be followed by assessment	No — cannot assess what has not been identified
Who is responsible?	PCBU, with worker input	PCBU, with worker input

Why the Distinction Matters

On Australian worksites, the terms hazard identification and risk assessment are often used interchangeably. They are not the same thing.

Hazard identification is about finding what could cause harm. Risk assessment is about understanding how serious that harm could be and deciding what to do about it. You cannot do a risk assessment without first identifying hazards, and identifying hazards without then assessing the risks they create leaves your workers and your business unprotected.

Confusing the two is a common reason WHS audits find gaps in risk management systems. If a hazard register lists hazards but shows no risk ratings or control decisions, regulators will not consider that document a genuine risk assessment.

This guide explains what each step involves, how they fit together, and how to apply both correctly.

What Is Hazard Identification?

Hazard identification is the process of finding anything in the workplace that has the potential to cause harm. A hazard is a source of potential harm — it has not necessarily caused an injury yet.

Hazards can be:

Physical — unguarded machinery, falls from height, noise, heat.
Chemical — hazardous substances, fumes, dust.
Biological — mould, sharps, infectious materials.
Ergonomic — repetitive motion, manual handling, awkward postures.
Psychosocial — work-related stress, fatigue, bullying, violence.
Environmental — extreme weather, uneven terrain, poor lighting.

Hazard identification should be done:

Before work starts (during planning and design).
When new plant, equipment, or substances are introduced.
When work processes change.
Following an incident, near miss, or complaint.
As part of regular workplace inspections.

Common hazard identification methods

There are several structured approaches that can help, including site inspections, task observation, consultation with workers, review of incident records, and analysis of manufacturer safety data sheets. For a detailed guide, see Hazard Identification Methods.

The output of hazard identification is a list of hazards. That list is the starting point for the next step.

What Is Risk Assessment?

Risk assessment is the process of evaluating the likelihood and consequence of harm from each identified hazard, then deciding whether existing controls are adequate or whether further action is needed.

Under the WHS Regulations, a risk assessment typically involves:

Describing the hazard — what is it, where does it exist, and who could be affected.
Assessing likelihood — how probable is it that the hazard will actually cause harm, given current conditions?
Assessing consequence — if harm occurs, how serious would it be?
Determining a risk level — commonly plotted on a risk matrix combining likelihood and consequence (e.g., low, medium, high, extreme).
Selecting control measures — applying the hierarchy of controls to eliminate or minimise the risk.
Recording the assessment — documenting the findings and the controls selected.
Reviewing — reassessing after controls are applied or when conditions change.

A risk assessment that simply lists hazards and skips the likelihood/consequence evaluation is not a complete assessment. The purpose of the evaluation is to prioritise which hazards need the most urgent attention and to justify the controls chosen.

For a step-by-step guide to the assessment process, see How to Conduct a WHS Risk Assessment.

The Sequential Relationship: Why Order Matters

Hazard identification and risk assessment are not alternatives — they are sequential steps in the same risk management process. The WHS Regulations set out a four-step process:

Identify hazards.
Assess the risks those hazards create.
Control the risks.
Review the controls.

This process is sometimes called the risk management cycle or the ICRC framework. Each step builds on the one before it.

If you start assessing risks without a thorough hazard identification step, you will miss hazards. If you identify hazards but do not assess them, you have no rational basis for deciding which controls to apply or how urgently. Both steps are legally required and practically inseparable.

Hazard vs Risk: A Key Distinction

Before you can apply these steps correctly, it helps to understand the difference between a hazard and a risk:

A hazard is a source of potential harm — for example, a wet floor.
A risk is the likelihood and consequence of harm occurring from that hazard — for example, the probability that a worker slips on the wet floor and suffers an injury.

The same hazard can present very different risks depending on circumstances. A wet floor in a heavily trafficked entry area presents a higher risk than a wet floor in a rarely visited storeroom. Risk assessment accounts for this context. Hazard identification alone does not.

What the WHS Act and Regulations Require

Under the Model WHS Act, a PCBU must ensure, so far as is reasonably practicable, that workers and other persons are not exposed to health and safety risks arising from the business. This duty to manage risks requires both steps.

The Model WHS Regulations (r. 34–38) set out specific obligations for managing risks:

Identify hazards that could give rise to risks.
Eliminate risks so far as is reasonably practicable, and if that is not reasonably practicable, minimise them.
Implement and maintain control measures.
Review control measures.

While the Regulations do not prescribe a single document format for every risk assessment, regulators and courts look for evidence that a genuine, structured process was followed. A document that records both the hazard identification and the risk evaluation — with control decisions — provides that evidence.

Common Mistakes to Avoid

1. Treating hazard identification as the whole job Listing hazards on a form and then filing it away without assessing the risk does not satisfy WHS obligations. Identification is the start of the process, not the end.

2. Skipping worker consultation Workers often know the hazards better than managers. The WHS Act requires PCBUs to consult workers when identifying hazards and assessing risks. A risk assessment carried out behind a desk, without site observation or worker input, is a weak document.

3. Using the same risk rating for every hazard If every item on your risk assessment is rated "medium", it is likely the assessment was not done thoroughly. Ratings should reflect the actual conditions, frequency of exposure, and potential severity for each specific hazard.

4. Not reviewing after controls are applied Risk assessment is not a one-off exercise. Controls must be reviewed to confirm they are working. If a control is not effective, the risk rating will not have changed and further action is needed.

5. Conflating hazard identification with risk assessment in SWMS and JSAs A Safe Work Method Statement or Job Safety Analysis that lists hazards but shows no risk evaluation is incomplete. Both document types require you to work through the full sequence — identify, assess, control.

Who Should Be Involved?

Both steps should involve:

The PCBU or their nominated competent person — to take responsibility for the process.
Supervisors and leading hands — who understand the work at a practical level.
Workers — who are closest to the hazards and often have the best insight into what goes wrong and why.

Under the WHS Act, consultation with workers is not optional. Involving workers also makes the resulting controls more likely to be followed.

Frequently asked questions

What is the difference between hazard identification and risk assessment?

Hazard identification is the process of finding things in the workplace that could cause harm. Risk assessment is the next step — it evaluates the likelihood and consequence of harm from each identified hazard and decides what controls are needed. They are sequential steps, not alternatives.

Which comes first — hazard identification or risk assessment?

Hazard identification always comes first. You cannot assess the risk of something you have not yet identified. Once a hazard is identified, you then assess the risk it poses and decide on appropriate control measures.

Do I need to do both?

Yes. Under the WHS Regulations, PCBUs must manage risks to health and safety. This requires identifying hazards, assessing the risks they create, implementing controls, and reviewing those controls. Skipping either step leaves gaps in your WHS system and exposes you to legal liability.

Can hazard identification and risk assessment be done at the same time?

In practice, they often happen in close sequence during a walkthrough or toolbox discussion. However, they remain distinct activities — you identify a hazard first, then assess its risk. Conflating the two often leads to hazards being noted without any genuine evaluation of the harm they could cause.

How BlueSafe Helps

Building thorough, regulation-aligned risk management documents from scratch takes time — and a poorly completed form can leave the same gaps as having no document at all.

BlueSafe provides pre-built WHS templates and online tools designed around the Model WHS Act and Regulations. They guide you through both the hazard identification and risk assessment steps, so nothing is missed and your documentation stands up to scrutiny from SafeWork inspectors, clients, and insurers.

Disclaimer: This article is provided for general information purposes only. It does not constitute legal advice. WHS requirements may vary between states and territories and are subject to change. Always consult your state or territory WHS regulator or a qualified WHS professional for advice specific to your situation.

Recommended Resource

Get the compliant template for this task.