Assessing and controlling risks means identifying what could hurt people at work, working out how likely and how serious that harm would be, and then putting practical measures in place to reduce it. It’s a legal requirement for most Pakistani employers under the Factories Act 1934 and the provincial OSH Acts and it’s the single most effective thing you can do to prevent workplace injuries.
What Does “Assessing and Controlling Risks” Mean?
Assessing and controlling risks is the process of identifying hazards, evaluating the likelihood and severity of harm they could cause, and implementing measures to eliminate or reduce that harm. It’s the foundation of every occupational health and safety (OSH) system, and it applies to any workplace a factory floor, a construction site, or an office.
Two terms get mixed up constantly, so let’s separate them:
- Hazard anything with the potential to cause harm. A spinning blade, a chemical, a slippery step.
- Risk the chance that the hazard will actually cause harm, combined with how bad that harm would be.
A hazard can exist without much risk. A tin of paint on a high shelf is a hazard; if it’s properly secured and rarely accessed, the risk is low. The same tin, wobbling on an unguarded ledge above a walkway, is a much higher risk same hazard, different risk level.
The 4-Step Process for Assessing and Controlling Risks
Every credible OSH framework from the UK’s HSE to the ILO to Pakistan’s own provincial OSH Acts builds on the same core sequence.
Step 1 Identify the Hazards
Walk the workplace and look for anything that could cause harm. Don’t rely on memory alone familiarity makes hazards easy to overlook.
Useful sources for identifying hazards:
- Physical inspections and walkthroughs
- Equipment manuals and safety data sheets (SDS)
- Past accident and near-miss records
- Direct input from workers doing the job daily
Cover the full range: physical (machinery, falls), chemical (fumes, spills), biological (mold, infectious material), and ergonomic (repetitive strain, heavy lifting) hazards.
Step 2 Assess the Risk
For each hazard, ask two questions:
- How likely is it that someone gets hurt?
- How severe would the harm be if it happened?
Multiply the two (on a simple scale) and you get a risk rating you can act on. This is covered in detail in the risk matrix section below.
Step 3 Control the Risk
Once you know which risks matter most, put measures in place to reduce them using the hierarchy of controls, explained in full further down.
Step 4 Review and Monitor
A risk assessment isn’t a one-time document. Review it whenever:
- New equipment, materials, or processes are introduced
- An accident or near-miss occurs
- Staff turnover changes who’s exposed to a hazard
- At a scheduled interval (most organizations use annually as a baseline)
How Do You Use a Risk Matrix?
A risk matrix is a simple grid that turns “how bad could this be” into a number you can prioritize against. It plots likelihood on one axis and severity on the other.
Here’s a straightforward 5×5 version you can start using immediately:
| Likelihood \ Severity | Minor | Moderate | Major | Severe | Catastrophic |
| Rare | 1 | 2 | 3 | 4 | 5 |
| Unlikely | 2 | 4 | 6 | 8 | 10 |
| Possible | 3 | 6 | 9 | 12 | 15 |
| Likely | 4 | 8 | 12 | 16 | 20 |
| Almost Certain | 5 | 10 | 15 | 20 | 25 |
A common way to read the score:
- 1–3 (Low): Monitor. No immediate action needed.
- 4–9 (Moderate): Plan and schedule improvements.
- 10–15 (High): Act soon prioritize controls.
- 16–25 (Extreme): Stop the activity until controls are in place.
Worked example: A worker occasionally climbs an unguarded ladder to access a rooftop unit say the likelihood is “Possible” and a fall from that height would be “Major.” That scores a 9 (Moderate-High) enough to justify fitting a guard rail or fall-arrest system before the next access, not something to leave for the next budget cycle.
What Is the Hierarchy of Controls?
Once you’ve scored a risk, you need to decide how to reduce it. The hierarchy of controls ranks your options from most effective to least effective:
- Elimination remove the hazard entirely (e.g., stop using a dangerous chemical)
- Substitution replace it with something less hazardous
- Engineering controls isolate people from the hazard (guarding, ventilation, barriers)
- Administrative controls change how people work (training, signage, procedures, rotation)
- Personal Protective Equipment (PPE) the last line of defense (gloves, respirators, helmets)
The mistake most workplaces make is jumping straight to PPE because it’s cheap and fast. PPE is real protection, but it should be the backstop, not the primary strategy it depends entirely on correct, consistent use by every worker, every shift.
Is Risk Assessment a Legal Requirement in Pakistan?
Yes. Pakistan’s occupational safety and health framework has developed significantly over the past decade, moving from a single outdated federal law toward a mix of federal and provincial legislation.
Federal level:
- The Factories Act, 1934 (Chapter 3) remains the longstanding core law governing workplace safety in factories, including provisions on hazardous operations and protective measures.
- The Hazardous Occupations Rules, 1963, made under the Factories Act, name specific high-risk processes including work with lead, chromium, sandblasting, and petrol gas generating plants and give the Chief Inspector of Factories authority to declare additional processes hazardous.
- The Pakistan Occupational Health and Safety Act, 2018 (POHSA 2018) was introduced to establish a broader foundation for OSH regulation, requiring employers to provide a work environment free from recognized hazards.
Provincial level since labour became a provincial subject, each province has enacted its own OSH legislation:
- Sindh Occupational Health and Safety Act, 2017 the first of the provincial Acts, establishing an OSH Council, mandatory safe-workplace provisions, worker training requirements, and an OSH Fund
- Punjab Occupational Health and Safety Act, 2019 in effect since February 2019, covering both public and private workplaces
- Khyber Pakhtunkhwa OSH Act, 2022
- Balochistan OSH Act, 2022
For employers, the practical takeaway is simple: a documented risk assessment isn’t just good practice in Pakistan it’s how you demonstrate compliance if a labour inspector or an accident investigation ever asks “what did you do to identify and control this hazard?”
A Real Workplace Example Assessing Risk on a Construction Site
[Flag for client: this section is a strong candidate for a genuine first-party example a real (anonymized) site assessment, photo, or before/after control measure from your own project history would significantly strengthen E-E-A-T here. Below is a representative scenario to use as a placeholder structure.]
On a typical mid-rise construction site, a common hazard is material falling from height near a public-facing boundary. Using the process above:
- Identify: Loose materials stored near an open edge on scaffolding
- Assess: Likelihood “Possible,” Severity “Major” → score of 9 (Moderate-High)
- Control: Install toe boards and debris netting (engineering control), restrict ground-level access with barriers (administrative control), and require hard hats in the zone (PPE)
- Review: Re-inspect weekly as materials are moved in and out
This is the same logic that applies to a textile factory floor, a warehouse, or an office — only the hazards change.
Common Mistakes When Assessing and Controlling Risks
- Treating it as a paperwork exercise a completed form means nothing if the controls aren’t actually implemented and checked
- Skipping worker input the people doing the job daily often spot risks that a walkthrough misses
- Over-relying on PPE using it as the only control instead of the last layer
- Never updating the assessment a risk assessment from three years ago on a process that’s since changed is close to useless
- Assessing hazards in isolation some risks compound when combined (e.g., noise plus poor lighting increases the chance of missing a warning signal)
How Often Should You Review a Risk Assessment?
There’s no single fixed number that fits every workplace but a documented risk assessment should be reviewed at least annually, and immediately after any of these triggers: a new piece of equipment or process is introduced, an accident or near-miss occurs, or there’s a significant change in staffing or work volume. Waiting for a scheduled review after any of these events leaves a known gap in your protection.
Conclusion
Assessing and controlling risks is a fundamental part of creating a safe and compliant workplace. By identifying hazards, evaluating their potential impact, and implementing effective control measures, organizations can reduce accidents, protect employees, and meet legal health and safety requirements. Regular risk assessments, ongoing monitoring, and continuous improvement help build a proactive safety culture and ensure long-term business success.
Want to master this in practice, not just on paper? Our IOSH Managing Safely course teaches you exactly how to identify hazards, score risks, and apply the hierarchy of controls in your own workplace with a globally recognized certification at the end. Enroll now →
FAQs
What is the difference between a hazard and a risk?
A hazard is anything with the potential to cause harm a chemical, a machine, a slippery floor. Risk is the likelihood that the hazard will actually cause harm, combined with how severe that harm would be.
What are the 4 steps of assessing and controlling risks?
Identify the hazards, assess the risk (likelihood × severity), control the risk using the hierarchy of controls, and review the assessment regularly.
What is the hierarchy of controls?
A ranked list of ways to reduce risk, from most to least effective: elimination, substitution, engineering controls, administrative controls, and PPE.
Is risk assessment a legal requirement in Pakistan?
Yes. It’s required under the Factories Act 1934, the Pakistan Occupational Health and Safety Act 2018, and the relevant provincial OSH Act (Sindh 2017, Punjab 2019, KP 2022, or Balochistan 2022) depending on where the workplace is located.
How is a risk matrix used?
A risk matrix scores each hazard by multiplying its likelihood and potential severity on a simple scale (e.g., 1–25), which helps prioritize which risks need action first.