Risk Management — The Complete Process

Risk Management

Managing risk is the foundation of your Safety Management System. You need a systematic process that is supported by a strong safety culture and dynamic, on-the-job risk awareness.

The Risk Management Process

Effective risk management follows a continuous cycle:

• Identify hazards — what could cause harm in your activity environment?
• Assess the risk — how likely is harm, and how severe would it be?
• Control the risk — what measures will you put in place?
• Review controls — are they working? Are new hazards emerging?

Safety Culture

A documented risk assessment is only as good as the culture that supports it. A strong safety culture means:

• Staff feel comfortable raising safety concerns
• Incidents and near misses are reported without blame
• Safety briefings are taken seriously, not rushed
• The most experienced person in the field has authority to stop an activity

Dynamic Risk Management

Beyond written risk assessments, staff must continuously assess risk as conditions change:

• Weather deteriorating during an activity
• A participant showing signs of fatigue or distress
• Equipment behaving unexpectedly
• Group dynamics changing

This is sometimes called "dynamic risk assessment" — the ongoing, real-time process of adjusting to conditions on the ground.

Hierarchy of Controls

When identifying controls, apply the hierarchy:

• Eliminate — remove the hazard entirely if possible
• Substitute — replace with something less risky
• Isolate — separate people from the hazard
• Engineer — use physical controls (barriers, safety equipment)
• Administrative — procedures, training, supervision ratios
• PPE — personal protective equipment as a last layer

Natural Hazards

As of April 2025, WorkSafe requires explicit consideration of natural hazards (flooding, landslips, snowfall) in your risk management planning. Your SMS must document how you monitor and respond to natural hazard conditions. See the Natural Hazards guidance section.