HIRA vs risk assessment: what is the difference?

2026-11-12 · Compliance · 6 min read

HIRA and risk assessment are often used as one thing. Here is how they relate, what the OHS Act expects, and how to do one properly. For SA managers.

HIRA and risk assessment mean almost the same thing at work. HIRA (Hazard Identification and Risk Assessment) is the safety-specific kind: you find what can hurt people, rate the risk and decide on controls. A general risk assessment can also cover money or operations. The OHS Act expects you to do the safety kind.

This guide shows how the two terms relate, what the Act asks of you, and how to run one that will stand up to an inspector.

What is the difference between HIRA and a risk assessment?

Think of it as a wide term and a narrow term.

• Risk assessment is the general idea. It can look at financial exposure, supply problems, legal liability or anything else that might go wrong for the business.
• HIRA is the narrow version aimed at workplace hazards: things that could injure or make a worker ill. It is task by task and place by place.

The difference is scope, not method. Both ask what could go wrong, how likely it is and how bad it would be. One international guide describes HIRA as the safety-specific subset of risk assessment, and notes that people use the two terms interchangeably.

For a South African workplace, treat them as one job. When an inspector, a client or a safety file asks for a "risk assessment", they almost always mean the HIRA.

What does the OHS Act say about identifying hazards?

The Act never uses the word HIRA. It sets a duty, and HIRA is how employers meet it. Read it for yourself in Section 8 of the Occupational Health and Safety Act 85 of 1993.

Four points matter:

1. A safe working environment. Section 8(1) makes the employer responsible for keeping the workplace safe and free of health risk, within what is reasonably practicable.
2. Know the hazards. Section 8(2)(d) requires the employer to establish, as far as is reasonably practicable, what hazards are attached to the work, to any article or substance used, and to any plant or machinery. You must also establish what precautionary measures are needed and provide the means to apply them.
3. Control before PPE. Section 8(2)(b) says to take reasonably practicable steps to eliminate or mitigate a hazard before resorting to personal protective equipment.
4. Tell and train people. Section 8(2)(e) requires information, instruction, training and supervision. Section 13 requires you, as far as is reasonably practicable, to make every employee conversant with the hazards of their work and the precautions to take.

Section 8(2)(f) adds that, as far as is reasonably practicable, an employee should not be allowed to do the work until those precautions are in place.

Some regulations add their own risk assessment duties, for example for construction work and hazardous chemical agents. Check the regulation that applies to your industry. We have not quoted them here.

Who is responsible for the HIRA?

The employer. In practice that lands on the chief executive officer. Section 16(1) says the CEO must, as far as is reasonably practicable, ensure the employer's duties under the Act are properly discharged.

Under section 16(2) the CEO may assign a duty to a person under their control. That person acts under the CEO's direction. The CEO keeps their own responsibility and liability.

If you delegate, do it in writing. Our legal appointments template pack includes Section 16.1 and 16.2 letters, and the templates are free.

How do you do a HIRA, step by step?

The method below is the standard approach. The Act does not prescribe a format, so use a consistent one.

1. Plan the scope. List the areas, tasks, plant and substances to cover. Decide who takes part. Include the people who do the work, not only management.
2. Identify the hazards. Walk the site. For each task ask what could harm someone. Think physical, chemical, ergonomic and biological hazards.
3. Say who could be harmed, and how. Staff, contractors, visitors and drivers.
4. Rate the risk. A common method scores likelihood and severity, usually from 1 to 5 each, and multiplies them to get a rating. The result tells you what to fix first.
5. Choose controls. Work through the hierarchy: remove the hazard, replace it, engineer it out, change the way of working, and use PPE last. This matches section 8(2)(b).
6. Record it. Write down hazards, ratings, controls, owners and dates.
7. Communicate and train. Make sure everyone affected knows the hazards and precautions, as section 13 expects.
8. Review. Update when the work, equipment, people or an incident changes things.

Baseline and continuous assessments

Two types are worth planning for. A baseline assessment is the first full look at an operation. A continuous assessment keeps it current: a quick check before a task, or after a change. Our course covers both, together with job hazard analysis.

What should a HIRA register contain?

A register that is easy to read is easier to defend. Include at least:

• The area, task or equipment.
• The hazard and what harm it could cause.
• Who is exposed.
• The existing controls.
• Likelihood, severity and the risk rating.
• Additional controls, the person responsible and a target date.
• The residual risk after the controls.
• The date of assessment and the date of the next review.

Our risk assessment template pack includes a 5x5 risk rating matrix, a hazard identification worksheet, a control measures hierarchy, a risk assessment register, an action plan template and a sign-off and review section. Use it as a starting point and adapt it to your site.

Common HIRA mistakes

• Copying a generic template without walking the site.
• Leaving out the people who do the job. They know the shortcuts.
• Stopping at "wear PPE". The Act expects you to try to eliminate or mitigate the hazard first.
• Filing it and forgetting it. A HIRA that is two years old and ignores new equipment will not impress an inspector.
• No link to training. If workers are not told about the hazards, the assessment has not done its job.

Which training helps with HIRA?

Pick the course that matches the person's role.

The HIRA course is recognised by SAIOSH for 5 CPD points. It covers key concepts of hazards and risks, employer responsibilities under the law, baseline and continuous risk assessments, job hazard analysis, and recording, analysing and reporting hazards.

Get your team trained

We train on site nationwide, and at our Stikland (Bellville) and Germiston campuses. You can also book the course online. To train a whole team in one visit, tell us how many people you have, or contact us.

General guidance only, not legal advice.

Common questions

What is HIRA in risk assessment?

HIRA stands for Hazard Identification and Risk Assessment. It is the workplace-safety form of risk assessment: you find what can hurt people, rate how likely and how serious the harm is, and decide on controls.

Is HIRA the same as a risk assessment?

In most South African workplaces the two terms are used for the same job. The only real difference is scope: HIRA looks at hazards to people at work, while a general risk assessment can also cover financial or operational risk.

Does the OHS Act use the word HIRA?

No. Section 8(2)(d) requires the employer to establish what hazards attach to work, substances and machinery, and what precautionary measures to take. HIRA is the common name for the process that meets that duty.

Who must do a HIRA at my workplace?

The employer carries the duty, and under section 16(1) the chief executive officer must ensure it is discharged. The CEO may assign the task to a person under their control, but stays responsible.

How long does HIRA training take?

Our Hazard Identification and Risk Assessment course is 2 days in person (R1,380 excl. VAT) or online (R1,205 excl. VAT).

Sources

1. Occupational Health and Safety Act 85 of 1993, Section 8: General duties of employers to their employees
2. Occupational Health and Safety Act 85 of 1993, Section 13: Duty to inform
3. Occupational Health and Safety Act 85 of 1993, Section 16: Chief executive officer charged with certain duties
4. Certainty Software: HIRA, Hazard Identification and Risk Assessment