HIRA: A Practical Foundation for Workplace Risk Management

A Hazard Identification and Risk Assessment — commonly called a HIRA — is one of the most useful tools for managing occupational health and safety in South Africa. The OHS Act 85 of 1993 places broad duties on employers to provide and maintain, as far as reasonably practicable, a workplace that is safe and without risk to employees. Many specific regulations also require formal risk assessments for particular hazards or activities. A HIRA helps the employer turn those duties into a structured process for identifying hazards, assessing risk and deciding what controls are needed.

Despite its importance, HIRA is frequently misunderstood. Some workplaces have no structured risk-assessment process, while others rely on an old document that no longer reflects the work being done. The problem is not simply whether a file contains a document called “HIRA”. The real issue is whether the employer has identified the relevant hazards, assessed the risks and implemented suitable controls that still reflect current conditions.

This post explains what a HIRA is, how risk assessment fits into South African OHS compliance, how the process works in practice, and when professional assistance may be useful.

If you need a workplace-specific assessment rather than a generic template, Altra Medical provides a workplace risk assessment service to help identify hazards, assess risk and develop practical corrective actions.

What Does HIRA Stand For — and What Is It?

HIRA stands for Hazard Identification and Risk Assessment. It is a structured, documented process through which an employer identifies the hazards present in the workplace, evaluates the likelihood and severity of harm those hazards could cause, and determines the control measures needed to eliminate or reduce risk to an acceptable level.

The two components — hazard identification and risk assessment — are distinct but inseparable:

• Hazard identification asks: what could go wrong? A hazard is any source, situation or act with the potential to cause harm — whether physical (machinery, working at height, electrical systems), chemical (substances, gases, dusts), biological (pathogens, mould), ergonomic (repetitive strain, manual handling) or psychosocial (workplace violence, excessive workload).
• Risk assessment asks: how likely is harm, and how severe would it be? Risk is the combination of the probability that a hazard causes harm and the magnitude of that harm. Assessing risk allows the employer to prioritise control measures — addressing the highest-risk hazards first and allocating resources accordingly.

A common output of the HIRA process is a documented risk register that records identified hazards, the associated risks, existing and additional controls, responsible persons and review actions. The format can vary, but the assessment should function as a live management tool rather than a once-off document created only for an audit.

What Does the OHS Act Require?

The OHS Act 85 of 1993 does not create one universal document called a “HIRA” that every employer must complete in exactly the same format. Instead, the Act creates broad duties to provide a safe workplace, while a number of regulations require risk assessments for particular hazards, activities and sectors.

Section 8 places a general duty on the employer to provide and maintain, as far as reasonably practicable, a working environment that is safe and without risk to employees. Section 9 addresses risks to persons other than employees who may be directly affected by the employer’s activities. In practical terms, employers need a reliable way to identify hazards and evaluate risk before suitable controls can be selected.

Several regulations make risk assessment requirements explicit. For example, the Construction Regulations 2014 require a risk assessment for construction work and require fall-protection planning where employees may be exposed to a risk of falling. Specialist regulations may also require formal assessments for particular exposures or hazards. The exact assessment method, competence requirement and review frequency therefore depend on the legislation that applies to the work.

The practical lesson is that a risk assessment must reflect the work that is actually taking place. A generic assessment copied from another business is unlikely to help management control real hazards or demonstrate that suitable precautions have been considered.

The HIRA Process: How It Works in Practice

A well-conducted HIRA follows a structured sequence. The exact methodology can vary according to the workplace and the applicable legal requirement, but a useful process normally includes the following steps:

Step 1: Define the scope

Before any assessment begins, the scope must be defined — which work areas, activities, tasks and job roles will be covered. A comprehensive HIRA covers all routine activities (day-to-day operations), non-routine activities (maintenance, shutdowns, emergency responses) and any activities performed by contractors on site.

Step 2: Identify hazards

Hazard identification is conducted through a combination of physical workplace inspections, task observations, review of incident and near-miss records, consultation with employees and supervisors, and reference to applicable legislation and industry standards. Employees are a critical source of hazard information — they often know the practical risks of their tasks better than anyone.

Step 3: Assess the risk

Each identified hazard is assessed against a risk matrix that evaluates the likelihood of harm (from rare to almost certain) and the potential severity of harm (from negligible to catastrophic). The combination produces a risk rating — typically low, medium, high or critical — that determines the urgency and extent of control measures required.

Step 4: Determine and implement control measures

Controls are applied in accordance with the hierarchy of control, which the OHS Act and international standards recognise as the correct order of preference:

1. Elimination — remove the hazard entirely (the most effective control)
2. Substitution — replace a hazardous substance or process with a less hazardous one
3. Engineering controls — physical barriers, guarding, ventilation systems
4. Administrative controls — safe work procedures, permits to work, training, supervision
5. Personal Protective Equipment (PPE) — the last line of defence, not the first

The HIRA must document not only what controls are in place but what residual risk remains after controls are applied and whether that residual risk is acceptable.

Step 5: Document, communicate and review

The completed assessment should be documented in a form suitable for the workplace, communicated to the people affected by the hazards and reviewed when circumstances change or when an incident, near miss, new process, new equipment or other information indicates that the existing assessment may no longer be adequate. Some regulations prescribe specific review intervals; there is no single universal annual review period that applies to every workplace HIRA.

Who Should Conduct the HIRA?

The competence required depends on the assessment and the legal requirement that applies. Some regulations expressly require a competent person or other specified specialist, while a general workplace HIRA may be carried out internally where the people involved have sufficient knowledge of the work, hazards and chosen risk-assessment method.

An internal safety officer, supervisor, manager or risk-assessment team may be able to perform the assessment where they have suitable knowledge and experience. Specialist hazards may require additional technical expertise. External assistance can be useful where the organisation does not have sufficient internal competence or wants an independent assessment.

Altra Medical’s Risk Assessment (HIRA) consulting service can assist with defining the assessment process, conducting workplace inspections and hazard identification, developing a suitable risk matrix, producing the documented risk register and helping management prioritise corrective actions. SAQA Unit Standard 120330 was historically used for continuous risk-assessment training, but SAQA records show that it has passed its end date and that the last date for new enrolment was 30 June 2024.

The HIRA and Your Training Obligations

One of the most practical outputs of a HIRA is the identification of training requirements. When hazards are identified and risk levels assessed, the control measures required frequently include training — and the HIRA gives you the documented basis to determine which training is legally necessary for which employee groups.

Training needs that may be identified through a workplace HIRA include:

• First Aid training — employee numbers, shift coverage and workplace risks should all be considered when planning first-aid competence. The law does not create a universal formula that automatically maps low, medium and high risk to First Aid Levels 1, 2 and 3. See our post on First Aid Level 1 vs Level 2 vs Level 3.
• Fire-fighting training — the fire risk, layout, occupancy, shifts and emergency arrangements help determine whether selected employees need practical first-response fire-fighting competence and how much coverage is appropriate. See our post on workplace fire-fighting training for more detail.
• Work at Heights training — any HIRA conducted in a workplace where employees work at height must address fall risks, and the control measures required will typically include formal training in fall prevention or fall arrest. See our post on fall prevention vs fall arrest for a practical guide to these distinctions.
• SHE Representative training — the OHS Act requires the appointment of health and safety representatives in workplaces above a certain size, and those representatives must be trained to fulfil their statutory duties.

In other words, a properly conducted HIRA can help management identify where training is a necessary control and build a more defensible training matrix around actual roles and hazards.

Common HIRA Mistakes That Create Liability

In Altramed’s experience conducting HIRA consulting across South African workplaces, the same errors appear repeatedly. Being aware of them is the first step to avoiding them:

• A HIRA that exists only on paper. A risk assessment that no longer reflects the workplace, equipment or activities provides little practical value and may fail to satisfy the specific legal requirement under which the assessment is required.
• Failure to cover non-routine activities. Many HIRAs cover only routine daily tasks and omit maintenance activities, emergency responses and contractor activities — precisely the scenarios where the most serious incidents occur.
• PPE as the primary control. Relying on personal protective equipment as the main or only control measure, without first applying higher-order controls, is both poor practice and legally indefensible if an employee is harmed.
• No employee consultation. A HIRA conducted entirely from behind a desk, without direct input from the employees who perform the tasks, will routinely miss hazards that are obvious to the workforce.
• Not communicating the outcomes. The OHS Act requires that employees be informed of the hazards and risks relevant to their work. A HIRA that sits in a filing cabinet and is never communicated to the workforce fails this requirement.

Do You Need Professional HIRA Assistance?

If you are unsure whether your current risk assessments reflect the actual work or whether all applicable legal requirements have been considered, an independent review can help identify gaps before they become incidents or inspection findings.

For a broader review of appointments, training, risk assessments, emergency arrangements and other OHS controls, an OHS compliance audit can establish a clearer baseline for management.

Altra Medical’s OHS consulting team assists employers with workplace risk assessments and can also help businesses develop internal risk-assessment competence. When booking formal training in 2026, employers should confirm the provider’s current programme and accreditation basis rather than relying on new enrolment against expired SAQA Unit Standard 120330.

Contact us on 086 111 1504 or visit www.altramed.co.za to discuss your risk assessment requirements.

Frequently Asked Questions

Is a HIRA legally required in South Africa?

The OHS Act does not prescribe one universal document called a HIRA for every employer. It places broad duties on employers to provide a safe workplace, while many regulations require formal risk assessments for particular hazards and activities. A structured workplace risk assessment is therefore an important way to identify hazards, determine controls and support compliance.

How often must a HIRA be reviewed?

There is no single universal review period for every workplace risk assessment. Review the assessment when the work, equipment, substances, people or conditions change, when an incident or near miss suggests the assessment may be inadequate, and at any interval prescribed by the specific regulation that applies.

Can we do our own HIRA internally?

Yes, provided the person conducting the HIRA is competent — meaning they have the training, knowledge and experience to identify hazards and assess risks accurately in your specific work environment. If internal competency does not exist, engaging a professional OHS consultant is the appropriate and legally