Summary
In short
- Build the assessment from observation, not from the procedure. The procedure states intent; the observed task states practice, and the gap between them is the finding.
- Assess by task rather than by area or machine, because exposure attaches to what people do rather than to where they stand.
- Frequency matters as much as severity. A short task performed forty times a shift can carry more cumulative exposure than an annual high-hazard operation.
- Include non-routine modes: setting, clearing, cleaning, sampling, fault finding and recovery from abnormal conditions, which is where most injuries occur.
- Residual risk should be accepted by a named person with authority, because an unaccepted assessment leaves the residual risk owned by nobody.
- Where the assessment concludes in training and PPE alone, check whether higher controls were considered and rejected, or simply not considered.
What it is
What it is
What is a task risk assessment?
A structured assessment of a specific task: what it involves, who is exposed and how often, what could go wrong, how severe it would be, and what controls reduce it. It concludes with residual risk and a formal acceptance by someone with the authority to accept it.
How is it different from a job safety analysis?
Largely in emphasis and origin rather than substance. A JSA typically breaks the task into steps and identifies hazards per step, and a task risk assessment typically adds explicit risk evaluation and acceptance. Both address the same question, and the useful distinction is whether either describes the task as it is actually performed.
When to use it
When to use it, and when not to
This assesses a defined task. It is the foundation on which permits, procedures and pre-task checks all rest.
Use it for
- Any task with a credible potential for harm, assessed before it is performed routinely
- New or changed tasks, equipment, materials or work environment
- Following an incident, near miss or observed deviation involving the task
- Periodic review where nothing has changed but the assessment is aged
- Where a permit, procedure or training package needs a documented basis
Not for
- Pre-task or point-of-work checks, which confirm this assessment's assumptions still hold on the day
- Permit to work, which authorises a specific high-risk activity
- Method statement, which describes the sequence and method rather than evaluating risk
- Machine risk assessment, which addresses the equipment across its lifecycle
- COSHH or chemical assessment, which addresses substance exposure specifically
Standards
What it is built against
Task assessment is the core hazard identification requirement in every management system standard.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.6.1.2 | Hazard identification covering routine and non-routine activities, human factors and work organisation | Task and exposure |
| ISO 45001 cl.6.1.2.2 | Assessment of OH&S risks with defined methodologies and criteria, applied proactively | Hazards and risk |
| ISO 45001 cl.8.1.2 | Elimination of hazards and reduction of risk applying the hierarchy of controls | Hazards and risk |
| ISO 31000 cl.6 | Risk assessment process: identification, analysis and evaluation, within an established context | Header |
| HSE Management Regs reg.3 | Suitable and sufficient assessment, reviewed when no longer valid or when significant change occurs | Header |
| OSHA 1910.132(d) | Workplace hazard assessment determining PPE requirements, with written certification | Related records |
| ISO 45001 cl.5.4 | Participation of non-managerial workers in hazard identification and risk assessment | Task and exposure |
| ISO 45001 cl.7.5 | Documented information controlled, current and available where needed | Acceptance |
What it does not cover
- Pre-task or point-of-work checks, which confirm these assumptions on the day.
- Permit to work, authorising a specific activity under defined gates.
- Method statement, describing sequence and method rather than evaluating risk.
- Machine risk assessment, which addresses equipment design across the lifecycle.
- Chemical and manual handling assessments, which apply specific methodologies to specific exposures.
Filling it in
Filling it in well
Observe, assess frequency alongside severity, cover the abnormal modes, and get acceptance from someone who can give it.
Watch the task, ideally more than once and on more than one shift, and ask the person performing it what they do when it does not go to plan. The observed version and the written version differ in every operation, and the difference is where the exposure lives.
Severity dominates most scoring matrices, which systematically under-ranks frequent low-severity tasks. A reach past a guard performed forty times a shift carries more cumulative exposure than a well-controlled annual entry, and the matrix will usually rank the annual entry higher.
Setting, changeover, clearing a jam, cleaning, sampling, fault finding and recovery. These are where guards are opened, isolations are skipped and improvisation happens, and an assessment covering only the running task has described the safest part of the job.
Someone with authority proportionate to the risk, recorded by name. Where nobody accepts it, the residual risk is owned by whoever is standing closest when it materialises, and after an incident the absence of an acceptance is a more difficult question than the level of risk itself.
Audit findings
Common audit findings
Task assessment findings concentrate on what was assessed rather than on the scoring.
| Finding | Clause | What fixes it |
|---|---|---|
| Assessment written from the procedure without observing the task. | ISO 45001 cl.6.1.2 | Observe on more than one shift; the written and performed tasks differ everywhere. |
| Non-routine modes not assessed. | ISO 45001 cl.6.1.2 | Cover setting, clearing, cleaning and recovery; that is where injuries occur. |
| Frequency not weighed against severity. | ISO 31000 cl.6 | High-frequency short exposures accumulate and are systematically under-ranked. |
| Controls default to training and PPE. | ISO 45001 cl.8.1.2 | Record why elimination, substitution and engineering were rejected. |
| Residual risk not formally accepted by a named person. | ISO 45001 cl.5.3 | Name the acceptor; unaccepted residual risk is owned by nobody. |
| Workers performing the task not involved in the assessment. | ISO 45001 cl.5.4 | Participation is a requirement and the only reliable source of what actually happens. |
| Assessment not reviewed after an incident involving the task. | HSE Management Regs reg.3 | An incident is direct evidence the assessment was incomplete. |
| Human factors not considered: fatigue, time pressure, unfamiliarity. | ISO 45001 cl.6.1.2 | These are named in the standard and change what counts as an adequate control. |
| Assessment aged with no review despite operational change. | HSE Management Regs reg.3 | Review when it may no longer be valid, not only on a cycle. |
| Not available at the point of work. | ISO 45001 cl.7.5 | An assessment in a folder in an office informs nobody performing the task. |
Worked case
Case in point: the step that was not in the procedure
A task risk assessment for a filling line covered the running operation, changeover and cleaning. It was well written, scored, reviewed annually and signed. The procedure it was built from described eleven steps.
Observation for an unrelated project found a twelfth. When a container jammed at the infeed, operators reached through a gap beside the guard with a length of bar kept on top of the panel for the purpose. Stopping the line properly took four minutes and lost a batch of product; the reach took eight seconds and was performed several times per shift.
The bar had been there for years. It appeared in no procedure, no assessment and no training material, and every operator on all three shifts knew about it.
Definitions
Definitions and key terms
- Residual risk
- The risk remaining after controls are applied, which requires acceptance by someone with appropriate authority.
- Non-routine activity
- Setting, changeover, cleaning, fault finding and recovery, explicitly within the scope of hazard identification.
- Human factors
- Fatigue, time pressure, unfamiliarity, distraction and competence, named in ISO 45001 as part of hazard identification.
- Hierarchy of controls
- Elimination, substitution, engineering, administrative, PPE, applied in order with rejections recorded.
- Exposure frequency
- How often a person encounters the hazard, which accumulates and is under-weighted in most scoring matrices.
- Suitable and sufficient
- The legal standard in Great Britain: proportionate, genuinely engaging with the risks, not a tick-box minimum.
- Workaround
- An undocumented step people take because the written method is impractical, and the most productive thing an assessment can find.
- Risk acceptance
- Formal agreement by a named person that the residual risk is tolerable, at a level of authority proportionate to it.
FAQ
Frequently asked questions
How do we find the steps that are not in the procedure?+
Watch the task, on more than one shift, and ask what people do when it does not go to plan. Look for tools that are not standard issue kept near equipment, gaps beside guards, and steps performed quickly when someone knows they are being observed. Improvised implements are the most reliable single indicator of an undocumented task step.
Should assessments be by task, area or machine?+
By task. Exposure attaches to what people do rather than to where they stand or which machine they stand at, and area-based assessments reliably miss activities that cross boundaries or that occur only occasionally. Machine assessments are a separate and complementary exercise addressing the equipment across its lifecycle.
Why does frequency matter so much?+
Because cumulative exposure is a product of both. Most scoring matrices weight severity heavily, so a short task performed forty times a shift ranks below an annual high-hazard operation that is thoroughly controlled. In practice the frequent task is where people are hurt, and it receives less attention precisely because each individual instance looks minor.
Who should accept the residual risk?+
Someone with authority proportionate to the level of risk, named on the record. This matters more than it appears: where nobody has accepted it, the residual risk is effectively owned by whoever is nearest when it materialises, and after an incident the absence of an acceptance is a harder question to answer than the risk rating itself.
When should it be reviewed?+
When it may no longer be valid: a change to equipment, materials, method, staffing or environment, after an incident or near miss involving the task, and when observation suggests the assessment no longer describes what people do. A periodic review is a backstop for changes nobody flagged, not the primary trigger.
The agents
What the agents do with it
The assessment is the foundation for permits, procedures and training. What fails is the desk-written version and the residual risk nobody accepted.
Holds assessments by task with named acceptance, links them to the permits and procedures derived from them, and flags aged assessments against operational change.
Connects incidents and observed deviations back to the assessment for the task, which is direct evidence it was incomplete.
Applies quantified methods where manual handling or posture dominates, which a general task assessment cannot resolve.
Derives training content from the assessed task including the abnormal modes, rather than from the procedure alone.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Sources
Sources
- ISO 45001:2018 clauses 6.1.2, 8.1.2 and 5.4
- ISO 31000:2018, risk management guidelines
- Management of Health and Safety at Work Regulations 1999, regulation 3 (GB)
- 29 CFR 1910.132(d), workplace hazard assessment, OSHA
- HSE guidance on risk assessment and the hierarchy of control