[ISO 45001 Series] Planning: Assessing Risks and Opportunities

Update (September 2026): This article discusses the 2015 version of Taiwan’s Risk Assessment Technical Guidelines. On September 21, 2026, the Occupational Safety and Health Administration published the renamed Risk Assessment Guidelines. For practical application, check the current guidance and applicable law.

Introduction

After the hazard-identification process and the identification of applicable legal and other requirements discussed in the preceding articles, the next step is to assess risks and opportunities.

You may be wondering: if the organization has already identified hazards and determined its legal and other requirements, why does it still need to assess risks and opportunities?

In my view, hazard identification and the determination of legal and other requirements address a different level of the problem from the assessment of risks and opportunities.

A hazard-identification checklist can show that a particular source may cause harm, while a compliance evaluation can reveal the organization’s current occupational health and safety conditions. Those steps, however, only identify the problem. That information alone cannot reduce or eliminate the hazard, improve OH&S performance, or reveal opportunities to improve the management system.

To reduce or eliminate a hazard effectively, the organization must understand the causal relationship between the source and the harm, as well as the sequence through which the hazardous event may develop. Only then can it identify opportunities to reduce the hazard, improve OH&S performance and the management system, and design corresponding controls.

That is why ISO 45001 also requires risks and opportunities to be assessed. The ultimate purpose of an OH&S management system is to reduce harm. Finding a problem is not enough; we must understand how it happens before we can plan controls and identify opportunities to make the working environment progressively better.

ISO 45001 Requirements for Assessing Risks and Opportunities

ISO 45001 addresses the assessment of risks and opportunities in the Planning clause, after hazard identification and before the determination of legal and other requirements. It distinguishes four combinations: OH&S risks, OH&S opportunities, risks to the OH&S management system, and opportunities for the OH&S management system.

Let us first briefly clarify what these four forms of risk and opportunity mean in ISO 45001.

Occupational health and safety risk (OH&S risk) combines the likelihood of a work-related hazardous event or exposure with the severity of the injury or ill health that it could cause. Assessing OH&S risk means evaluating identified hazards while taking the effectiveness of existing controls into account.

An occupational health and safety opportunity (OH&S opportunity) is a circumstance that can improve OH&S performance—for example, an opportunity involving hazard identification, communication, analysis, or the elimination of known hazards.

Risks to the OH&S management system concern uncertainty affecting the management system itself, while opportunities for the OH&S management system are strategies that can improve the system itself. These risks are assessed against the processes and measures currently built into the management system.

ISO 45001 does not prescribe exactly how the organization must assess either OH&S risks or risks to the OH&S management system, but it does provide guidance on assessment methods and relevant considerations.

For OH&S risks, the method and its complexity should suit the type of hazard rather than merely the size of the organization. The organization should establish systematic methodologies and criteria and maintain and retain them as documented information.

For risks to the OH&S management system, ISO 45001 calls for consideration of routine operations and decisions, external issues, and related factors. Suggested approaches include consulting workers affected by routine activities, monitoring and communicating new legal and other requirements, and confirming that sufficient resources are available for current and changing needs.

When assessing OH&S opportunities and opportunities for the OH&S management system, the organization should consider planned changes to the organization and its policies, opportunities to adapt work and the working environment to workers, and conditions that support the elimination of hazards and reduction of OH&S risks. The aim is to identify ways to improve both OH&S performance and the management system.

A Practical Method

These four concepts are closely related. In my view, an organization does not need four disconnected processes to identify OH&S risks and opportunities and management-system risks and opportunities. A systematic, integrated process can assess them together more completely, coherently, and efficiently.

Because the purpose of assessing risks and opportunities is to trace the causal relationship between a source and a hazard, understand how harm develops, and identify ways to reduce hazards and improve OH&S performance and the management system, I recommend organizing the process as a safety assessment.

Safety Assessment

Under Article 3, paragraph 1 of Taiwan’s Regulations Governing Periodic Process Safety Assessment, “process safety assessment” means an assessment that uses structured and systematic methods to identify and analyse potential workplace hazards and adopt necessary preventive measures.

Common safety-assessment methods include checklists, What-If Analysis, Hazard and Operability Studies (HAZOP), Fault Tree Analysis (FTA), and Failure Modes and Effects Analysis (FMEA).

Process safety assessment is governed by regulations authorized under Article 15, paragraph 3 of Taiwan’s Occupational Safety and Health Act. The statutory requirement applies to petrochemical industries engaged in petroleum cracking and to business entities that manufacture, handle, or use hazardous chemicals above quantities specified by the central competent authority. Those entities must conduct periodic process safety assessments, prepare reports, and adopt necessary preventive measures; the legal duty does not apply to every organization.

Nevertheless, the concept of safety assessment is highly useful for systematically understanding the causal path between a source and a hazard and for finding opportunities to reduce hazards and improve OH&S performance and the management system. Organizations that are not legally required to conduct process safety assessments can still borrow these concepts and methods.

Among the available methods, What-If Analysis has a relatively low entry barrier and can accommodate a wide range of views. The discussion below therefore combines What-If Analysis with the hazard-identification checklist introduced earlier.

What-If Analysis is a brainstorming method that encourages creative thinking. For each work-related process, the team asks “What if...?” and works through possible answers _[1]. This can reveal the causal sequence and consequences between a source and the resulting harm, identify weaknesses at each stage, and expose opportunities and directions for improvement.

Before beginning a What-If Analysis, define the object of analysis, consider the consequences that each hazard source might produce, and gather useful information such as domestic and international industry hazard data and details of workers’ tasks.

The organization should form an assessment team and determine its size according to the complexity of the subject being analysed.

At minimum, the team should include someone with knowledge and experience of the work and someone familiar with What-If Analysis. Frontline workers can also participate. At the start of the meeting, explain the subject and the organization’s current practices; team members then raise different “What if...?” questions and discuss possible solutions.

Record the questions and proposed solutions after the analysis. The What-If Analysis worksheet below is one example that can support the subsequent assessment of risks and opportunities.

What-If Analysis is simple and adequate for straightforward source-to-harm relationships. It is less suitable for analysing hazards in highly complex manufacturing processes, however, and it depends heavily on the team’s technical background and knowledge of the work.

Because my objective here is an OH&S management approach that organizations across industries can use, I begin with the more accessible What-If method. Organizations with more complex operations should adopt a more systematic and comprehensive safety-assessment method.

Safety-Assessment Checklists vs. Hazard-Identification Checklists

In “[ISO 45001 Series] Planning: Overview and Hazard Identification”, I recommended building a hazard-identification checklist. Its function may appear similar to a checklist used as a safety-assessment method, but there are important differences.

A safety-assessment checklist is often taken from an existing checklist for similar equipment or constructed by the analyst from specialist literature, data, or personal experience _[2]. The hazard checklist proposed here begins with statutory duties imposed on employers and is then adjusted for organizational scale and the requirements of other interested parties under ISO 45001. It is therefore comparatively more objective and comprehensive.

More precisely, my method links a checklist with What-If Analysis. The hazard-identification checklist first screens hazard sources associated with a particular role or task; the team then examines the causal path between each source and the possible harm. This reduces some of the What-If method’s dependence on the analysts’ background knowledge and familiarity with the work.

By linking the hazard-identification checklist with What-If Analysis, the assessment team can identify causes along the path from a source to harm, including hazards that the checklist may initially have missed. Proposed improvements can reduce or eliminate hazards while also revealing opportunities to improve OH&S performance.

Risk Assessment

The process so far links the organizational-context review to an inventory of workers and working environments by role or task, followed by a hazard-identification checklist for each category. This provides an initial understanding of hazard types and sources associated with the work.

What-If Analysis then clarifies the causal sequence between the source and the harm, possible ways to eliminate or reduce the hazard, and opportunities to improve OH&S performance.

Because organizational resources are limited, however, hazards must be prioritized. This is the function of risk assessment.

Risk assessment is important for setting OH&S objectives, identifying high-risk areas, prioritizing training, and performing other OH&S management work _[3]. ISO 45001 distinguishes assessment of OH&S risks from assessment of risks to the OH&S management system; the following sections outline both.

Assessment of OH&S Risks

ISO 45001 does not prescribe a specific method for assessing OH&S risks. It requires the methodology and complexity to suit the type of hazard, and it requires the organization to establish systematic methodologies and criteria and maintain and retain them as documented information.

The approach proposed here uses the Risk Assessment Technical Guidelines revised and issued by Taiwan’s Occupational Safety and Health Administration in 2015 as its framework, with adjustments based on the guidance in ISO 45001.

The following diagram presents the risk-assessment flow that I developed from the Risk Assessment Technical Guidelines. Note in particular that ISO 45001 requires the organization to retain documented information on its methodology and criteria for assessing OH&S risks.

An OH&S risk combines the severity of the harm with the likelihood of the hazardous event or exposure.

For severity, the Risk Assessment Technical Guidelines recommend considering: (1) the body parts or number of people that may be affected; and (2) the degree of harm. Because the guidance primarily addresses industrial safety, it also considers material releases and the extent of their impact. The severity scale used in the guidance is reproduced below.

As explained above, this assessment follows the inventory of workers and working environments by role or task, the hazard-identification checklist, and What-If Analysis.

Because I recommend including external interested parties affected by the organization’s activities within the scope of hazard identification, severity should consider not only the body parts affected, the number of workers, and the degree of injury or ill health, but also the wider extent of impact, as the guidance suggests.

The guidance allows an organization to adjust the number of severity levels and define their criteria according to its scale and nature. I agree with that principle.

Manufacturing and service organizations, for example, should not necessarily use the same threshold for a major risk. In 2017, manufacturing accounted for 40.86% of occupational accidents across all industries _[4], 46.15% of closed fatal cases, and 71.43% of closed permanent-total-disability cases _[4]. These historical figures illustrate how substantially risk profiles can differ by industry.

For industries with comparatively low occupational-accident rates, I recommend lowering the threshold at each severity level—for example, treating injuries to three or more people as major severity even when no death occurs. To prevent the criteria from becoming subjective or being deliberately raised to avoid action, the organization should consult government or industry accident statistics when defining severity and retain the supporting basis as documented information for later review.

When estimating likelihood, the Risk Assessment Technical Guidelines recommend considering: (1) the frequency and duration of exposure; (2) the presence and effectiveness of existing safeguards; and (3) the function and actual use of personal protective equipment. The guidance then divides likelihood into four levels, as shown below.

In addition to the assessment team’s judgement, industry statistics on the occurrence of particular hazards can help reduce subjectivity. The guidance is also right to consider the condition and effectiveness of existing safeguards.

Some hazards may never have occurred since the organization was established, making likelihood difficult to estimate. In those cases, several assessors should discuss the evidence and seek a consistent judgement.

Once the severity and likelihood scales have been established, each hazard can be assigned a risk level by combining them. The Risk Assessment Technical Guidelines use the 4 × 4 matrix shown below.

The guidance divides the combinations of severity and likelihood into five risk levels and specifies corresponding planning responses, as shown below.

Risk levels 3 and above require controls to reduce the risk to level 2 or below. Levels 1 and 2 are described as risks reduced to a degree that can be tolerated in light of applicable legal requirements and the organization’s OH&S policy. No additional control may be necessary, but the effectiveness of existing safeguards must still be maintained.

The guidance also states that any breach of occupational safety and health legislation identified during the assessment must be treated as an unacceptable risk and subjected to risk controls.

Did you notice the consequence? If the organization proceeds directly from hazard identification to risk assessment without first determining applicable legal requirements, it cannot know whether a particular hazard involves a legal nonconformity. That is why I place the determination of legal and other requirements before the assessment of risks and opportunities.

For example, under the reference matrix, a hazard rated as major in severity and highly likely to occur receives a risk level of 5. The corresponding control plan requires immediate risk-reduction measures, and the activity should not begin or continue until the risk has been reduced.

I use the Ministry of Labor’s Risk Assessment Technical Guidelines because the ISO 45001 management system developed in this series is intended to work across industries. A highly technical and complicated method may be impractical for smaller organizations whose OH&S personnel do not have specialist risk-assessment expertise.

The method is also flexible: an organization can adapt the severity scale, likelihood scale, risk levels, and associated measures to its scale, allowing the assessment to fit different organizations.

That flexibility is also the method’s weakness. The scales and classifications often depend heavily on the assessors’ knowledge of the hazard, and both the criteria and the classification of a hazard can become subjective.

To reduce this weakness, the organization can use accident statistics from the same industry or comparable work when setting severity and likelihood criteria and classifying hazards. It can also increase the number of participants as organizational scale and hazard complexity increase.

Because the process depends on familiarity with the method, technical knowledge of the hazard, and an understanding of the work, the team should include someone familiar with risk-assessment methods, someone knowledgeable about the hazard, and frontline workers. This both reduces subjectivity and supports the ISO 45001 requirement for worker participation in hazard identification and the assessment of risks and opportunities.

Assessment of Risks to the OH&S Management System

Under ISO 45001, a risk to the OH&S management system is uncertainty affecting the management system itself.

These risks are generally less complex than OH&S risks. I therefore recommend a simpler assessment process rather than applying the full OH&S risk-assessment method to every management-system issue.

Possible methods include consulting workers, reviewing the OH&S management system against the latest applicable standard, and having the personnel responsible for the system conduct a What-If Analysis. The purpose is to identify gaps in the system and discuss possible solutions at the same time.

If an existing management-system risk reflects nonconformity with an applicable standard that the organization is required to meet, it must be corrected promptly. If it does not amount to nonconformity, the organization can weigh its resources and improve the issue in light of the What-If findings and recommendations.

Retaining Documented Information

Although ISO 45001 does not state that every risk-assessment result must be retained as documented information—the express requirement discussed above concerns the risk-assessment methodology—the standard does require documented information on risks and opportunities, the processes and actions used to address them, and the assessment criteria. Drawing on the Risk Assessment Technical Guidelines, I therefore recommend retaining the full assessment process, including: (1) participants and assessment date; (2) role, department, operation, work-environment cycle, machinery, equipment, tools, chemicals, energy sources, and required qualifications; (3) hazard type, cause, and consequence; (4) existing safeguards; (5) risk degree or level; (6) planned risk-reduction controls; and (7) reviewer and review date.

Items (2) and (4) come from the earlier inventory of workers and working environments. Item (3) can be developed from the hazard-identification checklist and What-If Analysis. Items (1), (5), (6), and (7) can be recorded in the worksheet below for hazards, OH&S opportunities, planned controls, and estimated residual risk.

Conclusion

Good hazard identification supports a good assessment of risks and opportunities, which in turn supports sound control planning. This is a point I have emphasized throughout the series: every step is connected to the next.

For practical operation and efficiency, the workflow I use does not follow the clause order of ISO 45001. I arrange it as hazard identification, determination of legal and other requirements, and then assessment of risks and opportunities. In practice, OH&S risks and opportunities and management-system risks and opportunities often concern closely related matters.

Improving the OH&S management system—an opportunity for the management system—can also help reduce OH&S risk. Treating the two as wholly separate processes can cause the same work to be repeated. I therefore integrate and streamline the process, while drawing on methods already available in Taiwan’s Risk Assessment Technical Guidelines rather than discarding established practice.

Once the organization has assessed its risks and decided which hazards require priority treatment, the next step is to plan controls—and control planning is another crucial part of the system!

At this point, is there any part that is not crucial? Apparently not, XD. Every step really does matter. I will see you in the next article. :)

References

[1] Huang, Ching-Hsien. Hazard Analysis and Risk Assessment, 2nd ed., 2018, pp. 221–222. (Chinese)

[2] Ibid., p. 218.

[3] Occupational Safety and Health Administration, Ministry of Labor. Risk Assessment Technical Guidelines, 2015, pp. 89–103. (Chinese)

[4] Occupational Safety and Health Administration, Ministry of Labor. Annual Labor Inspection Report, 2017, p. 230; Table 8-1, “Overview of Occupational Accident Statistics by Industry.” (Chinese)