Every day, people go to work on construction sites and in factories. Most come home safe. But some don't. Some get hurt because risks weren't managed properly. This guide will show you exactly how to manage risks step by step. We'll use a real example throughout so you can see how it works in practice.
A company called Precision Pans makes stainless steel cooking pans. They have 300 workers. The factory is old and busy. They recently got ISO 45001 certification for health and safety. They have internal audits and safety committees. On paper, they look good.
A new apprentice starts work in the manufacturing department. On his first morning, he meets his supervisor. The supervisor is very busy because one of the machines has broken down and production is being delayed. There is a pile of metal discs waiting to be processed.
The supervisor does the induction quickly. They stand next to a loud power press. The supervisor gives the apprentice some ear defenders. They don't fit well but the apprentice doesn't say anything. He can barely hear what the supervisor is saying because of the noise and the defenders. The supervisor points at a blue sign that says ear defenders must be worn. He points at some paperwork and says "that's a risk assessment, it's just something managers do to keep themselves legal, it's not important for you." He shows the apprentice how to use the press and watches him do two pans. Then he leaves to fix the broken machine. The apprentice is alone.
The ear defenders are really uncomfortable. The apprentice checks if anyone is watching and takes them off. He works slowly because he's not confident. After 30 minutes the supervisor comes back and sees only four pans done. He gets angry and shouts that if the apprentice doesn't work faster he won't pass his probation.
That night the apprentice can't sleep. He has a headache and ringing in his ears. The next day he tells the supervisor. The supervisor records it and tells the health and safety manager. They try different ear defenders and find some that fit. The apprentice says he'll wear them from now on. But the damage was already done.
At the same time, the company is building a new factory next door. For this project, they do everything right. They check contractors carefully. They give everyone an induction. They have daily safety meetings. They do spot inspections. One part of the company is safe. The other part just hurt a new worker on his first day.
This story shows us what happens when risk management works and when it fails. Let's look at each part of risk management and learn from it.
1. Finding hazards: you can't manage what you don't see
The first step in risk management is finding the hazards. A hazard is anything that could cause harm. In our story, there were many hazards. The obvious ones were the loud noise from the press, the moving parts of the machine, and the heavy metal discs. But there were other hazards too that weren't so obvious.
The missing sound panels on the ceiling were a hazard. They were supposed to absorb noise but they were broken and no one had fixed them. The ill-fitting ear defenders were a hazard. If PPE doesn't fit, it doesn't protect. The pressure to work fast was a hazard. When people feel rushed, they take shortcuts. The supervisor's attitude was a hazard. When he said risk assessments aren't important, he was teaching the apprentice that safety doesn't matter. The apprentice's fear of speaking up was a hazard. He didn't ask questions because he didn't want to look stupid.
On the construction side, they did better at finding hazards. They knew about the overhead electric cables and the underground water pipe. They put this information in the pre-construction documents. They planned to contact the utilities companies to make things safe before work started. This is good practice.
To find all hazards on your site, you need to look everywhere. Walk around and watch people working. Talk to them about what problems they have. Look at accident reports. Check equipment is in good condition. Think about the obvious physical hazards but also think about the human factors like pressure, fatigue, and attitude.
2. Understanding the risks: how bad and how likely
Once you've found hazards, you need to understand the risks. Risk is the chance that someone will be harmed and how badly. In our story, the noise hazard had a high risk. The apprentice was exposed to loud noise for hours. Without proper protection, he would almost certainly get hearing damage. And hearing damage is permanent. You can't fix it.
The risk assessment for the press was sitting by the machine. But it was just paperwork. The supervisor never explained it to the apprentice. He said it wasn't important. This is a huge mistake. A risk assessment is only useful if people know about it and understand it.
A good risk assessment asks two questions. First, how likely is it that something will go wrong? Second, how bad would it be if it did? For the apprentice, the noise risk was very likely to cause harm and the harm would be serious. That means it needed fixing immediately.
On the construction site, they assessed the risks of the overhead cables and underground pipe. They knew that hitting a cable or pipe could kill someone. So they planned to make them safe before digging. This is the right approach. High risk activities need extra planning and care.
3. Controlling risks: use multiple layers of protection
Once you understand the risks, you need to put controls in place. One control is never enough. You need layers. Think of it like Swiss cheese. Each layer has holes. If you have enough layers, the holes don't line up and nothing gets through.
In our story, every layer had holes that lined up perfectly. The engineering layer: sound panels were missing. The equipment layer: ear defenders didn't fit. The training layer: induction was rushed and noisy. The supervision layer: apprentice was left alone. The cultural layer: pressure to work fast and fear of speaking up. All the holes lined up and the apprentice got hurt.
The best controls are at the source. If you can eliminate the hazard completely, do that. The company is planning to buy new automated machines that are quieter. That's elimination. It's the best solution. But until then, they need other controls.
Engineering controls are next best. Fix the sound panels. Put enclosures around noisy machines. Install guards on presses. These protect everyone without them having to do anything.
Administrative controls are next. These are things like procedures, training, and signs. In our story, the blue sign was an administrative control. But it wasn't enough on its own because the apprentice didn't understand why it mattered. Good administrative controls include proper induction in a quiet room, clear instructions, and enough supervision for new workers.
PPE is the last layer. It's the least reliable because it depends on people wearing it correctly. In our story, the PPE failed because it didn't fit and because the apprentice took it off. If you rely on PPE, you must make sure it fits properly and people understand why they need it. Offer different sizes and styles. Fit-test it. Check it regularly. Enforce its use but also make it comfortable so people want to wear it.
4. Communication: make sure everyone understands
The apprentice didn't ask any questions during his induction. Why? Because he found it confusing and didn't want to embarrass himself. This is a communication failure. Good communication means creating an environment where people feel safe to speak up.
The supervisor did his induction next to a loud machine. The apprentice couldn't hear properly. That's another communication failure. Always do inductions and safety training in a quiet place where people can hear and concentrate.
The supervisor pointed at a risk assessment and said it wasn't important. That's the biggest communication failure of all. He was telling the apprentice that safety paperwork is just bureaucracy, not something that matters. This attitude spreads. Soon everyone thinks safety is just for show.
Good communication means explaining why. Don't just say "wear these." Say "wear these because the noise here can permanently damage your hearing. Once it's gone, it's gone forever. If they don't fit right, tell me and we'll find some that do. Your hearing matters."
Good communication also means checking understanding. Ask the person to tell you back what you've said. Ask if they have any questions. Make it clear that questions are welcome, not stupid. The apprentice in our story had questions but was too scared to ask. That's on the supervisor.
The company had a suggestion scheme and a noticeboard. That's good for ongoing communication. But it didn't help a new person on day one. Communication needs to reach everyone, especially newcomers who don't know how things work yet.
5. Monitoring: check that controls are working
The missing sound panels in our story weren't noticed until after the apprentice got hurt. Why? Because monitoring failed. Someone should have been checking those panels regularly. When they went missing or broke, they should have been reported and fixed immediately.
Monitoring means walking around and looking at things. Are the guards still in place? Is the PPE being worn correctly? Are there any new hazards? Talk to workers. Ask them if anything is making their job difficult or unsafe. They often know about problems before anyone else.
The company did internal audits every few months. That's good for checking systems and procedures. But it's not enough for day-to-day hazards. You need frequent, informal checks as well. Supervisors should be doing this every day. Safety reps should do regular walkarounds. Managers should show up and look at things too.
On the construction site, the HSM planned to do unscheduled inspections. This is excellent. When people don't know when you're coming, they can't tidy things up just for the inspection. You see how things really are. The same approach should apply to the factory floor.
Health monitoring is also important. The apprentice developed symptoms and reported them the next day. That's good. But what about hearing tests? If the company did regular audiometry for noise-exposed workers, they might have spotted problems earlier. Health surveillance can catch issues before they become serious.
6. Managing change: when things are different, risks change too
The company is building a new factory next to the old one. This is a big change. Change brings new risks. In this case, they did many things right. They selected contractors carefully. They gave them an induction. They restricted access to safe areas. They had daily meetings. They planned inspections.
But they might have missed some things. Will construction noise affect the factory workers? Will it make it harder for them to hear warnings or communicate? Will vibration from construction affect the old machinery? Will dust get into the factory? Will emergency exits be blocked at any point? When planning a change like this, you need to think through everything that could be affected.
The new machines they're buying are supposed to be quieter. That's a good change. But new machines bring their own risks. They need to be installed safely. Workers need training on them. Procedures need updating. Don't assume new things are automatically safer. Assess them properly.
The apprentice was a change too. A new person starting work is a change. Yet the company didn't manage this change well. They didn't assess the risks of having a new, inexperienced worker on the shop floor. They didn't put extra controls in place. They treated him like an experienced worker and left him alone. When new people start, you need more supervision, more checks, more support. It takes time to learn.
7. Investigating incidents: learn the real lessons
The apprentice reported his symptoms. The supervisor recorded it and told the HSM. That's the right thing to do. All incidents, even near misses, should be reported. But what happens next matters even more.
The HSM determined that the investigation level would be medium. According to HSG245, this is appropriate. There was actual harm (tinnitus) and medium likelihood of recurrence if controls aren't fixed. But the investigation needs to go deep enough to find the real causes.
The immediate causes are obvious. The apprentice removed his defenders. The defenders didn't fit. The panels were missing. But if you stop there, you'll miss the real problems. Why did the apprentice remove them? Because they were uncomfortable and he didn't understand the risk. Why didn't they fit? Because no one checked. Why were the panels missing? Because maintenance wasn't doing proper checks. Why was he left alone? Because the supervisor was too busy with a breakdown. Why was there so much pressure? Because the factory is at full capacity and production delays are a big deal.
The root causes are deeper. The safety culture allows supervisors to dismiss risk assessments. The training system doesn't verify understanding. The PPE selection process doesn't include fit-testing. The maintenance system misses broken controls. The production pressure overrides safety concerns. These are the things that need fixing.
A good investigation looks at all these levels. It makes recommendations that address the root causes, not just the immediate ones. It doesn't blame individuals. It looks for system failures. The apprentice wasn't to blame. The system failed him.
8. What good looks like: the construction side
It's useful to look at what the company did right with the construction project. They invited three contractors to visit the site and discuss the project. Each contractor submitted proposals with costings, risk assessments, method statements, qualifications, and details of how they would report and investigate incidents. All of them planned to fence off the site to prevent unauthorized access. The HSM checked customer references before choosing Contractor A.
This is thorough risk management. It shows that the company knows how to do things right. The problem is that they applied this rigor to the construction project but not to the apprentice's first day. Safety must be consistent across everything you do. You can't have one set of standards for contractors and another for your own workers. You can't have good safety on new projects and poor safety on existing operations.
9. Practical steps you can use tomorrow
Here are simple things you can do on your site starting tomorrow.
First, talk to your new people properly. Do induction in a quiet room. Explain why things matter, not just what to do. Check that they understand. Ask them questions. Make it clear they can ask you anything.
Second, check your PPE. Do you have different sizes and styles? Do you help people find what fits? Do you explain why it's needed? Do you check that it's being worn correctly? If not, start doing these things.
Third, walk around and look for broken controls. Are there missing guards? Broken panels? Damaged equipment? Make a list and get things fixed. Don't wait for an accident.
Fourth, talk to your people about pressure. Ask them if they ever feel rushed to get work done. Ask if that ever leads to shortcuts. Listen to what they say. If there's pressure, find ways to reduce it. Safety takes time.
Fifth, check your supervision. Are new workers being left alone too soon? Do supervisors have enough time to train people properly? Do they understand that safety is part of their job, not extra paperwork? Train your supervisors if they need it.
Sixth, use your incidents to learn. When something goes wrong, even a near miss, investigate it properly. Look for the deep causes. Fix those, not just the obvious ones. Share what you learn with everyone.
Seventh, be consistent. If you have high standards for contractors, have the same standards for your own people. If you have good systems for new projects, apply them to everyday work too. Safety isn't something you turn on and off. It's always on.
10. The main lesson
The apprentice in our story got hurt because the system failed him. The company had ISO 45001 certification. They had internal audits. They had risk assessments. They had safety committees. They had a suggestion scheme. They had all the paperwork. But on the day, none of it protected him.
The supervisor was too busy. The panels were broken. The PPE didn't fit. The training was rushed. The pressure was on. The apprentice was scared to speak up. All the holes in the Swiss cheese lined up.
Risk management isn't about having a binder full of policies. It's about what happens when the supervisor walks away. It's about a new worker feeling able to say "this doesn't fit." It's about fixing broken panels the moment they break. It's about making sure production pressure never trumps safety. It's about consistency across everything you do.
The good news is that all of this is fixable. The company in our story can repair the panels. They can improve their induction. They can offer different ear defenders. They can train their supervisors better. They can reduce production pressure. They can create a culture where people speak up. They've already shown they know how to do this on the construction side. They just need to apply it everywhere.
Every worker should go home as healthy as they arrived. That's what risk management really means. It's not complicated. It's just paying attention, caring about people, and fixing things before someone gets hurt.
— End of guide —
![How to Complete Part 3 [Prioritise 3 actions with justification for the selection] of the IG2 Risk Assessment](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcQwvFuxbzNnLuPJFUi-hQGm80NPnuH67qjg3FBFcaN0MVZ1MLPE-q_y25sBixuKAMhd7nCH5juYA2OATZb0u0XAu6BUqLe5FoyoTRfmizSRCzZd7oLUbQkprGWvP8qfwo6meJQtbFafsb8t4Rv_zUS3YYp5LcNXnVePzROt05VH-Qe8QrVDdBvoIRRckE/w680/Part%203%20%5BPrioritise%203%20actions%20with%20justification%20for%20the%20selection%5D%20of%20the%20IG2%20Risk%20Assessment.png)
