The scope of work changes — a different area, a different task sequence, work extending beyond what was originally assessed.
Level 2 · Practitioner · Free
Advanced Risk Assessment and Practical Application
Move from recognising a hazard to running a systematic risk assessment, judging a matrix's limits, choosing controls that hold up on site, and owning residual risk like a practitioner.
14 modules + worked example + tool exercise + assessment · Estimated 2–2.5 hours
0% complete
Course boundary
This course builds practitioner-level judgement on top of Myaser Academy's Level 1 hazard-recognition training. It does not replace your organization's approved risk assessment procedure, a competent person's sign-off, or local legal requirements. For confined-space, hot-work, or other high-hazard tasks, always follow your site's specific permit and authorization system.
Risk, uncertainty, scope and context
Level 1 training teaches you to recognise a hazard and stop before continuing into danger. A systematic hazard identification and risk assessment process is what an organization uses to find hazards across a whole site or scope of work, not just react to the one in front of you.
1 / 5
Uncertainty is part of every assessment
Every risk assessment carries some uncertainty. The likelihood and severity figures you assign are judgements, not measurements — based on incident history, exposure data, manufacturer information and experience, all of which are incomplete to some degree. Treat the matrix output as a considered estimate that supports a decision, not an exact number. Where the evidence is thin (a new process, a substance with limited data, a task nobody has done this way before), say so explicitly in the assessment rather than assigning false confidence, and weight the decision toward the more cautious end of the uncertainty rather than the average.
Setting the scope
This kind of assessment starts by defining its scope, including the area, process or project phase, the period covered and the people involved. The team then reviews the activities within that scope using a consistent method. Scope-setting is where assessments most often fail before they even begin: too narrow, and it misses the interfaces between this task and the work happening around it; too broad, and it becomes a document nobody can use at the point of work. Involve the people who will actually do the work when the scope is set, not only when it's reviewed afterward — they are usually the first to know where a proposed boundary doesn't match how the job actually happens.
Rating each hazard
Once hazards are identified, each one is assessed for likelihood and severity using the organization's approved risk matrix, the same educational approach introduced in the Level 1 hazard-recognition course, now applied at the scale of a full work area rather than a single observation.
A living document, not a filing exercise
This kind of assessment is a living document, not a filing exercise. It is reviewed when the scope of work changes, when new equipment or materials are introduced, after an incident or near miss, and on a scheduled interval set by the organization's own system, exactly the kind of ongoing review ISO 45001 requires of hazard identification and risk assessment as a management system activity.
HITRA, HARC, HIRA: the names vary
Organizations use different names for structured risk assessment. Some BP contractor material uses HITRA, Hazard Identification and Task Risk Assessment. SLB material uses HARC, Hazard Analysis and Risk Control. Other organizations use terms like HIRA, JSA, JHA, TRA, or simply a risk register. These names, and the exact procedure behind each one, are company-specific. This course does not reproduce or endorse any one company's proprietary system, and does not certify learners in one.
Finding hazards systematically
Hazard identification at this level should draw on multiple sources at once: direct observation, incident and near-miss records, manufacturer information, applicable law, and input from the people doing the work, who often know about a hazard long before it appears in any document. An assessment that reflects only the office view of the task, without input from the crew that actually performs it, usually misses the real exposure.
A frame for organizing what you find: People, Task, Equipment, Environment
A useful practitioner habit is to work the scope systematically against four categories, so nothing gets missed simply because it didn't come up naturally in conversation:
People
Who is exposed — workers, contractors, visitors, the public — and anything about them that changes the risk: experience level, training, physical demands, language.
Task
What is actually being done, including steps that aren't in the written procedure, and how the task changes under pressure, at night, or when short-staffed.
Equipment
Tools, plant, and materials involved, their condition, and any interaction between pieces of equipment that individually seem fine.
Environment
The physical and organizational surroundings — weather, lighting, noise, nearby work, and site conditions that change over the course of a shift or project.
In practice, identification at scope level combines a structured walk-through of the whole area (not just the single task Level 1 training covers), a review of incident and near-miss history for that scope, a check of manufacturer and regulatory information for the equipment and substances involved, and short conversations with the people who do the work regularly. None of these alone is sufficient; together, they catch what any one method misses on its own.
The hazard and risk register, and where JSA fits
The practical output of a hazard identification and risk assessment process is usually a hazard and risk register: a document that pairs each identified hazard with its assessed risk and the controls selected to manage it. Where the assessment itself is the process of finding and rating hazards, the register is usually the working document that carries that information forward into day-to-day site control, often the one referenced during a permit-to-work or a toolbox talk.
Where that process and its register work at the level of a site or scope of work, Job Safety Analysis, also called Job Hazard Analysis, works at the level of a single task. A JSA breaks a job into its individual steps, in the order they are actually performed, and asks what could go wrong at each one and what control addresses it, before the work starts.
Illustration: replacing a valve on a live process line
1. Isolate and lock out the line.
Isolate and lock out the line. Hazard: stored energy or residual pressure. Control: verified isolation, lockout-tagout, and a bleed-down check before work begins.
2. Remove the old valve.
Remove the old valve. Hazard: manual handling, sharp edges, residual fluid. Control: correct lifting technique or mechanical aid, gloves rated for the fluid, drip containment.
3. Fit the new valve.
Fit the new valve. Hazard: incorrect torque, misalignment. Control: torque specification confirmed, correct tooling, competent fitter.
4. Reinstate and test.
Reinstate and test. Hazard: uncontrolled pressurisation. Control: gradual pressure-up under supervision, leak check before returning to service.
1 / 4
Each step gets its own hazard and its own control, not one general statement covering the whole job. That step-by-step discipline is what makes a JSA useful at the point of work, where a full hazard and risk register is too broad to consult line by line.
This course stops here on JSA. Knowing when a task-step breakdown is the right tool — and being able to read one, as above — is a practitioner-level skill this course teaches. Facilitating a full JSA yourself (running the session, structuring the form, training a crew to use the technique) is its own methodology and its own body of practice, and belongs to a separate, future JSA/JHA practitioner course. Treat the boundary between a hazard and risk register and a task-step breakdown as a decision you should now be able to make correctly, not as an invitation to run either process end to end from this course alone.
Risk matrices, their limits, and judging likelihood and severity
Judging likelihood and severity consistently
Likelihood should be grounded in something more than instinct: how often is the task performed, how often has this hazard actually materialised (here or in comparable operations), and how many people are exposed and for how long. Severity should be judged against a credible worst case for the hazard as it stands right now, not the most likely outcome and not a worst case so extreme it stops being realistic. A fall from height, for example, has a credible worst-case severity of a fatality regardless of how rarely a fall actually happens — conflating "unlikely" with "not serious" is one of the most common judgement errors at this level.
Try itYour team is rating "fall from a 4 m mezzanine edge during stock picking". Nobody has fallen in eight years. A colleague wants to score severity as "minor" because falls are so rare. What do you say?
That conflates "unlikely" with "not serious". The rarity belongs in the likelihood score; it says nothing about how bad a fall would be.
Right. Severity is judged against a credible worst case for the hazard as it stands now. A 4 m fall can kill, however rarely it happens.
Inflating every input isn't caution, it's noise. It hides the hazards that really need attention. Ground each score in evidence and document your reasoning.
What the matrix does not tell you
A risk matrix is a decision-support tool, not a precision instrument, and a practitioner should be able to say where it falls short:
False precision
A 3×3 or 5×5 grid presents a risk score as if it were exact, when the likelihood and severity inputs feeding it are judgement calls with real uncertainty behind them.
Boundary disputes
A hazard sitting right at the line between two adjacent bands can be rated either way by two competent assessors in good faith — the matrix doesn't resolve that disagreement, people do, and the more defensible choice is usually the higher band when the case is genuinely close.
Inter-rater inconsistency
Different assessors routinely rate the same hazard differently. This is a known limitation of matrix-based methods, not a sign that someone did it wrong — it's a reason to document the reasoning behind a rating, not just the rating itself.
Poor fit for low-likelihood, high-severity events
Catastrophic but rare events (a major process safety event, for instance) often compress into the same matrix cells as far less serious risks when likelihood is scored on a simple linear scale, understating how much management attention they deserve relative to their score.
None of this is a reason to abandon the matrix — it's a reason to use it as a structured starting point for judgement, and to be willing to override a borderline score when the underlying reasoning calls for it, documenting why.
Existing controls: verifying what's actually there
A documented control does not reduce risk unless it is implemented and works as intended. Before starting, verify barriers, ventilation, isolation, permits and other required controls. Continue checking controls when conditions can change during the task.
"Documented" and "present" are not the same claim, and a practitioner-level assessment treats them as two separate checks. A control that's listed in the register but wasn't actually confirmed at the worksite hasn't been verified — it's been assumed. Verification means direct observation at the point of work: is the barrier physically there, is the ventilation actually running, has the isolation been tested, not just applied. This is routine, expected practitioner work, not a once-a-year audit activity, and it should happen again whenever conditions change during the task, since a control verified at the start of a shift can stop being effective partway through it.
Try itThe register for a tank-cleaning job lists "forced ventilation running" as a control. At the worksite you find the fan in place but switched off, with the crew about to enter. What's the right call?
"Documented" and "present" are different claims. A control that isn't working isn't reducing any risk.
Right. Verification means direct observation at the point of work: is it physically there, and is it actually working? And re-check whenever conditions change.
Better than nothing, but switching it on isn't the same as confirming it has done its job. If the procedure requires an atmosphere check after ventilation, that comes first.
Hierarchy of controls
Apply the hierarchy of controls in order of preference, not convenience: eliminate the hazard where possible, substitute it with something less hazardous, use engineering controls that remove reliance on individual behaviour, then administrative controls, and personal protective equipment last, as the layer that protects the individual after everything upstream of it has already been tried.
Control
Level in the hierarchy
0 of 5 matched
A control's adequacy also has to match the severity of what it is controlling. A minor, easily reversible hazard may be reasonably managed with a single administrative control. A hazard with a realistic chance of serious injury or worse generally needs more than one independent layer of control, so that the failure of any single measure does not remove all protection at once.
Critical controls
The previous lesson's point — that a serious hazard generally needs more than one independent layer of control — leads directly to a distinction every practitioner should be able to make: not every control on a hazard's control list carries equal weight. A critical control is one that is crucial to preventing or mitigating a serious event: its absence or failure materially increases the risk of that serious event happening. Identifying the critical controls in a hazard's control list, and treating them differently from the rest, is practitioner-level judgement this course expects you to develop.
A control being critical is not the same question as a control being the only layer of protection. Single-point dependency — a situation where one control is all that stands between the current state and a serious event, with no independent backup — is a separate, especially vulnerable condition worth flagging on its own. A critical control can exist alongside other independent layers and still be critical; a control can be the sole layer in place and still be a comparatively minor one. Treat "is this control critical" and "is this the only thing standing between us and a serious outcome" as two different questions you ask about the same control list, not one question with two names.
In practice: for each hazard with a realistic chance of a serious outcome, ask which of its controls, if it failed or was absent right now, would most directly allow that outcome to happen. Those are the controls that deserve the most attention at the point of work — the most frequent verification, the clearest ownership, and the lowest tolerance for "it's usually fine."
Try itFor hot work near a fuel tank, the control list is: hot-work permit, gas test before work, fire watch, warning signs, and a toolbox talk. Which control, if it failed right now, would most directly allow an explosion?
Signs help keep people away, but their absence wouldn't directly let an ignitable atmosphere meet a spark.
Right. It's the control that confirms there's no flammable atmosphere for the spark to ignite. That makes it critical: it deserves the most frequent verification and the clearest ownership.
Useful for awareness, but a missed briefing doesn't by itself put fuel vapour and ignition together.
HSE Hub's article Stop Counting Actions. Start Verifying Controls. develops this distinction further, including why an action tracker being busy is not the same thing as the barriers that actually prevent a fatal event being available, understood and tested.
Human factors
A hazard and risk register describes a task in its intended state. Real work is done by people who get tired, feel pressure to keep pace, become complacent about a task they've done a thousand times without incident, and sometimes lose track of what's changed around them. These are human factors, and a static hazard list doesn't capture them on its own — a practitioner-level assessment should.
Fatigue
Reduces attention, slows reaction, and increases the chance a step gets skipped or a control gets bypassed, particularly on long shifts, night work, or after several consecutive working days.
Complacency
Tends to grow with repetition: a task performed correctly hundreds of times without incident can create a false sense that the hazard has effectively gone away, when only the outcome, not the hazard, has stayed favourable so far.
Production pressure
— real or perceived — can push people to skip a verification step, work around a missing control, or treat a stop-work situation as something to push through rather than resolve.
Situational awareness
Can degrade when a task demands narrow focus (fine manual work, for instance) in an environment where conditions around the worker can still change.
A risk assessment cannot design fatigue or complacency out of a workplace by itself, but it can account for them: building in controls that don't rely purely on sustained individual vigilance (the same logic behind preferring engineering controls over administrative ones), and flagging tasks where human-factor risk is especially high as ones that need more than the standard level of supervision or checking.
HSE Hub's article Your Procedure Says One Thing. The Job Is Done Another Way. looks at this from the other direction — the gap between work as written and work as actually performed, and why that gap is useful evidence rather than simply a compliance failure.
Routine versus non-routine work, and change during execution
Most risk assessments are written for the task as it's normally done. Non-routine work — a first-of-its-kind job, an unusual combination of trades working together, an unfamiliar piece of equipment — and changes that happen during execution of an otherwise routine task can both introduce hazards or exposures that the original assessment never captured, simply because nobody was assessing for them.
This isn't a claim that non-routine work is automatically more dangerous than routine work in every case — it's narrower and more useful than that: an assessment written for one set of conditions doesn't automatically cover a different set of conditions, and the gap between what was assessed and what's actually happening is where unassessed risk lives. A simple, practical habit closes most of that gap: before continuing, ask whether anything has changed since this task was last assessed — the people, the equipment, the sequence, the surrounding work, the weather, the time pressure — and if something has, treat that as a trigger to reassess before proceeding, not as a detail to note afterward.
Try itA routine pump changeout is half done when the scaffold crew next door starts grit blasting and the wind picks up. The task assessment didn't mention either. What now?
The assessment covers the pump changeout under the conditions it assumed. The surrounding work and weather have changed, and that gap is where unassessed risk lives.
Right. A change during the task is a trigger to reassess before proceeding, not a detail to note afterwards.
Speeding up under changed conditions adds production pressure to an unassessed exposure, the combination that most often goes wrong.
Residual risk and risk ownership
Elimination can remove a specific hazard. Where a hazard remains, residual risk is the risk left after controls are applied. The organization must decide whether that risk is acceptable under its approved criteria and authorization process.
Re-rate the risk using the same approved matrix and its definitions. Do not reduce severity automatically because controls exist. Some controls reduce likelihood, some reduce the possible consequence, and some affect both. If residual risk remains high or unacceptable, add or strengthen controls and obtain the required authorization before work proceeds.
Review triggers
An assessment reviewed only on its scheduled interval, and never in between, will always be out of date for some period after a real change happens. Practitioner-level practice is to name specific conditions that should trigger an out-of-cycle review, rather than leaving "review when appropriate" as the only guidance:
New equipment, materials, or substances are introduced that weren't part of the original assessment.
An incident or near miss occurs anywhere within the assessed scope, whether or not it directly involved the hazard in question.
A control that was assessed as available or effective is found to be missing, degraded, or bypassed.
The scheduled interval set by the organization's own system is reached, even if none of the above has happened.
Naming these triggers explicitly in the assessment — not just relying on someone remembering to check — is what makes "living document, not filing exercise" an operating practice rather than a description.
Common weak assessments: a poor versus strong comparison
A weak risk assessment is often hard to spot from its format — it can use the right form, the right matrix, and the right headings, and still fail to actually manage the risk. Recognising the difference is a practitioner skill. Here is the same hazard, assessed two ways.
Hazard: "Working with chemicals." Control: "PPE, training."
Hazard: skin and inhalation exposure to a named solvent during a specific transfer step. Control: local exhaust ventilation confirmed running, nitrile gloves rated for that solvent, closed-transfer method — PPE listed last, not first or alone.
Control field says "guard fitted" — no note on whether it was checked this shift.
Control field notes the guard was visually confirmed in place and secured at shift start, with a re-check trigger if the machine is stopped and restarted.
A control was added after a near miss; the likelihood rating is left unchanged from before the near miss.
The rating is re-assessed against the same matrix after the new control is added, with a note on whether it reduced likelihood, severity, or both.
A control is written as applying to "this type of task" in general.
The control is checked against the specific task being assessed, not assumed from a template written for a similar but not identical situation.
Notice what the strengthened column has in common across every row: it's specific to the actual task and the actual moment, not a general statement that could apply to almost any similar job. That specificity is usually the single biggest difference between an assessment that genuinely manages risk and one that only looks like it does.
Worked example: full assessment walk-through
Before reading the discussion below, work through this scenario yourself: a contractor needs to carry out hot work, welding, inside a confined tank that previously held flammable material. List the hazards you would expect, the controls you would require before work starts, and what residual risk you would still flag for a competent person's sign-off.
The same scenario, as a structured assessment entry
Everything above is correct as a discussion, but a practitioner needs to be able to turn it into the structured format an actual register — and the Risk Assessment Tool — expects:
| Field | Entry |
|---|---|
| Hazard | Ignition of residual flammable vapour or atmosphere during hot work inside a confined tank |
| People exposed | Welder inside the tank; standby/rescue person at the entry point |
| Harm | Fire or explosion; asphyxiation or toxic exposure from a compromised atmosphere |
| Existing controls | Site confined-space and hot-work permit system; general isolation procedure |
| Additional controls | Verified isolation; cleaning and purging; atmospheric testing (oxygen, flammables, relevant toxics) before entry and at a set monitoring interval; mechanical ventilation running throughout; trained standby and rescue arrangements; fire watch and suppression on hand |
| Initial risk (before additional controls) | High likelihood × catastrophic severity |
| Residual risk (after additional controls) | Low-to-medium likelihood × catastrophic severity — flagged for competent-person sign-off regardless of the numeric score, because severity was never reduced, only likelihood |
| Owner / review trigger | Confined-space supervisor owns the residual risk; review immediately if atmospheric readings drift, ventilation stops, or personnel or task sequence change |
Notice that the residual risk stays flagged for sign-off even after strong controls are added — this is a direct application of Lesson 4's warning against automatically reducing severity, and Lesson 10's point that residual-risk ownership is a distinct, named accountability, not just a box that gets checked once controls exist.
Practical exercise: building an assessment in the Risk Assessment Tool
HSE Hub's Risk Assessment Tool lets you build, save and export a structured risk assessment using this same likelihood-and-severity method, so you can apply what this course covers to a real task rather than only in theory. This exercise is a self-guided, ungraded practice run — the tool does not currently verify or score a learner's entry as part of this course's completion, so treat it as a chance to apply the method, not as a certification requirement.
Your task
Using a different scenario from the worked example in the previous lesson, build a complete entry in the Risk Assessment Tool: routine planned maintenance on a hydraulic power unit that has been isolated but has a known history of slow-draining stored pressure in its accumulator.
Open the Risk Assessment Tool and start a new assessment. Set the title, work area and task description for this maintenance job.
Add at least one hazard entry. Name the specific hazard (not "hydraulic hazards" in general), who is exposed, and what harm could result.
Record the existing controls actually in place today, and any additional controls the task needs before work starts — apply the hierarchy of controls from Lesson 6, and identify which control, if any, is critical under Lesson 7's definition.
Score the initial likelihood and severity, then the residual likelihood and severity after your additional controls, using the same judgement discipline from Lesson 4. Don't reduce severity just because a control exists, per Lesson 10.
Name an action owner and a review trigger for this hazard, distinguishing (per Lesson 10) between who owns the follow-up action and who owns the residual-risk decision if they're different people.
Mark the assessment complete once you're satisfied it reflects the task accurately.
Compare your finished entry against the worked example's table in the previous lesson. If your entry reads as specific to this exact task — not a general statement that could apply to any hydraulic maintenance job — you've applied Lesson 12's weak-versus-strong distinction correctly.
Professional references
- OSHA: Job Hazard Analysis
- OSHA: Hazard prevention and control
- UK HSE: Asphyxiation hazards in welding and allied processes
- UK HSE: Human factors, an introduction
- UK HSE: HSG48, Reducing error and influencing behaviour
- ISO: ISO 45001 occupational health and safety management systems
- BP US Terminals and Pipelines: HITRA contractor material
- SLB: HARC terminology example
Final assessment
The assessment has ten questions. A verified learner must complete all lessons and score at least 75%. The certificate confirms completion of this Level 2 course and the recorded knowledge-assessment score. It does not confirm occupational competence, authorize safety-critical work or replace an approved risk assessment and competent-person authorization.
Question 1 of 10