Every workplace of any size has an occupational health risk assessment sitting somewhere. A binder, a shared drive, a folder nobody opens. It exists because someone was legally required to produce it, and it stays unread for the same reason most compliance documents do: reading it is work, and nothing bad has happened yet.
But here’s the uncomfortable part. That document isn’t just paperwork. It’s the operating manual for your lungs, ears, skin, and nervous system, written in the flattest language possible so nobody has to think too hard about what it means. And it’s frequently wrong, out of date, or carefully worded to be technically true while being practically useless.
This is what an occupational health risk assessment actually is, how it gets gamed, and how to read one like someone who knows exactly where the soft spots are.
What It Actually Is
Strip away the jargon and an occupational health risk assessment answers three questions: what in this job can hurt a person’s health, how likely is it to do so, and what are we doing about it.
That’s it. Everything else — the scoring matrices, the risk ratings, the colour-coded spreadsheets — is scaffolding built around those answers so they can be compared, filed, and defended later.
Note the word health. Most workplace safety culture is obsessed with acute injury: falls, cuts, crush hazards, anything that sends you home that same day. Health hazards run on a completely different clock. Dust, solvents, noise, vibration, heat, ergonomic load, biological agents — none of these hurt on a Tuesday. They hurt in fifteen years, by which point the paperwork has been archived and the person who wrote it has moved companies.
The Five Steps, Translated Into Real Life
You’ve seen the standard framework. Here’s what each step actually looks like on a shop floor.
- Identify the hazards. In practice this means walking the floor with someone who’s been doing the job for a decade and asking what makes them feel like garbage. That one conversation finds more real hazards than any generic checklist.
- Decide who might be harmed. Not just employees. Contractors, cleaners, night shift, visitors, pregnant workers, people with existing conditions, and the person who does the task twice a week and gets missed by every template.
- Evaluate the risk and pick controls. This is where the actual decisions happen — and where most of the corner-cutting happens too.
- Record your findings. Recording is not the same as acting. Plenty of organisations are brilliant at step four and terrible at step three.
- Review and update. Almost never done properly. An assessment from before the last process change is a fiction with a date stamp on it.
Qualitative vs Quantitative: The Number Game
Most assessments are qualitative: low, medium, high. Fast, cheap, and essentially an opinion with a grid drawn around it. Two people can look at the same task and produce ratings two levels apart, and both can defend themselves perfectly.
Quantitative assessment means measuring. Air sampling, noise dosimetry, vibration exposure, biological monitoring. It produces numbers, and numbers create obligations. Which is precisely why qualitative assessments are so popular.
Here’s the rule of thumb: the vaguer the language in a risk assessment, the less the organisation wants to know.
The Hierarchy of Controls — Read It Bottom-Up
Everyone learns the hierarchy as a pyramid read from the top down. In practice, most workplaces read it from the bottom, because PPE is cheap and elimination is expensive.
- Elimination — stop doing the task. Rarely chosen, because it costs output.
- Substitution — swap the nasty substance for a less nasty one. Genuinely underused, often surprisingly easy.
- Engineering controls — extraction, enclosures, soundproofing, automation. Effective, capital cost, quietly deferred to next year’s budget. Again.
- Administrative controls — rotate staff, shorten exposure time, signage, procedure tweaks. Cheap, and massively over-relied on, because rotating people through a hazard doesn’t remove the hazard. It just spreads it around.
- PPE — the last line of defence, treated as the first.
If an assessment lands on PPE without seriously documenting why the four better options were rejected, that’s not a risk assessment. That’s a receipt for a respirator.
The Loopholes You’ll Actually See
Averaging exposure over a whole shift
Exposure limits are typically expressed as an average across a working period. So a task that spikes exposure hard for an hour can sit comfortably inside a compliant eight-hour average. Technically sound. Biologically, the dose still landed. Peak exposures matter enormously for substances that overwhelm the body’s ability to clear them, and averaged numbers hide that completely.
“Reasonably practicable”
This phrase is the single most load-bearing piece of language in occupational health. It means an employer has to do what’s proportionate, weighing the risk against the cost and effort of controlling it. It was written to stop employers bankrupting themselves over trivial hazards.
In practice it becomes a negotiation where the price of a human outcome gets compared against the price of a machine. Whoever writes the assessment decides which side of that line the argument falls on.
Sampling designed not to fail
Where and when you sample determines what you find. Sampling on a quiet day. Sampling the task instead of the person. Sampling the worker who’s been in the role for years and has instinctively learned to work clean. Monitoring for the substance listed on the data sheet rather than the one actually being formed by the process. All of these are legitimate methodologies that happen to produce a very comfortable result.
The copy-paste template
Generic assessments get dropped onto specific jobs. Faster, cheaper, ticks the box. It also means nobody has genuinely looked at your job.
The missing people
Contractors, agency staff, cleaners, and maintenance crews are consistently under-assessed because they’re technically someone else’s responsibility. They also get the worst exposures, since they’re usually doing the dirtiest work without local knowledge or any real ability to complain upward.
How to Read One Like You Mean It
- Look at the date first. Anything older than a significant process change is fiction.
- Check whether hazards are described specifically or generically. “Chemicals” is not a hazard. A named substance with a measured level is.
- Find the controls column. Count how many entries end in PPE.
- Look for measurement data. If there is none and the risk is rated low, ask how they know.
- Check whether the task you actually do appears in there. Job titles lie. Tasks don’t.
- Look for who’s missing — nights, temps, cleaners, visitors, the guy who covers holidays.
What You Can Actually Do About It
You don’t need to be a specialist to push back, and you don’t need to be confrontational about it.
The most effective move is a specific, dated, written question. “The assessment rates this as low risk with no monitoring. Can I see the basis for that?” Vague complaints get ignored. Specific requests for the evidence behind a written claim create a paper trail, and paper trails are the one thing organisations reliably respond to.
Second: report symptoms as symptoms, not as inconvenience. Health surveillance exists in most systems precisely so early effects get caught before they become permanent. Nobody has ever received a medal for toughing out tinnitus.
Third: know that surveillance results are typically confidential and kept separate from your personnel file, and that many jurisdictions place a legal duty on employers to monitor people exposed to hazards capable of causing occupational disease. Ask whether that monitoring is actually happening. The silence afterwards is often informative.
The Bottom Line
An occupational health risk assessment is really two documents wearing one coat. It’s a genuine tool for stopping people from getting sick, and it’s a document organisations use to demonstrate that they’ve thought about it. Sometimes those two things overlap neatly. Often they don’t, and the gap between them is exactly where real people get hurt.
You’ll never be handed the honest version. But you can learn to read the diplomatic one, ask the questions that force specifics, and remember that “we assessed it” and “we controlled it” are not the same sentence — no matter how many times someone says them back to back.