How to Do a HIRA (Hazard Identification & Risk Assessment) in South Africa

Is a risk assessment legally required in South Africa?

Yes. The Occupational Health and Safety Act 85 of 1993 places a general duty on every employer (section 8) to provide and maintain a working environment that is safe and without risk to health, "as far as is reasonably practicable". You cannot demonstrate that you have done this without first identifying the hazards and assessing the risks.

Several regulations make it explicit. The Construction Regulations 2014 require a documented risk assessment before construction work begins, and hazard-specific regulations (for example those covering hazardous chemical agents and noise) require assessments for those exposures. In practice, a written HIRA is the document an inspector, client or principal contractor will ask for first.

HIRA vs risk assessment vs hazard identification — what is the difference?

These terms overlap, which causes a lot of confusion:

• Hazard identification is the first step — finding anything with the potential to cause harm (a hazard).
• Risk assessment is evaluating how likely that harm is and how severe it would be, then deciding on controls.
• HIRA bundles the two into one structured process and document. When South Africans say "HIRA" they almost always mean the full written assessment.

The 5 steps of a HIRA

1. Identify the hazards. Walk the actual workplace or task. Look at equipment, substances, work at height, electricity, manual handling, traffic, and the work environment. Talk to the people who do the job — they know the hazards a desk review misses.
2. Identify who could be harmed and how. Employees, contractors, visitors, the public. Note vulnerable groups (new or young workers, pregnant employees).
3. Evaluate and rank the risk. Score each hazard using a risk matrix — typically likelihood × severity. Rank the results so you tackle the high-risk items first.
4. Decide on controls using the hierarchy of controls. Work top-down: eliminate the hazard, then substitute, then engineering controls, then administrative controls (procedures, training, signage), and only then PPE as the last line of defence.
5. Record, communicate and review. Document the assessment, brief the affected workers, and set a review date — and re-assess whenever the task, equipment or site changes.

Baseline, issue-based and continuous risk assessments

A complete programme usually has three layers, and inspectors expect to see all three:

• Baseline risk assessment — a broad, once-off assessment of all significant risks across the operation or project.
• Issue-based (task) risk assessment — a focused assessment of a specific task, change or new activity.
• Continuous risk assessment — ongoing, day-to-day identification of hazards (e.g. pre-task checks, toolbox talks).

Common mistakes that get a HIRA rejected

• Generic, copy-paste assessments that do not match the actual site or task.
• Listing PPE as the primary control instead of working through the hierarchy of controls first.
• No competent person involved — the assessment must be done by someone with the right knowledge and experience.
• No review date, or never re-assessing after an incident or a change to the work.
• No evidence that workers were briefed on the findings.

Sources and legal references

Primary sources used for this guide. Check the linked official publication for the current legal text and any amendments.

• Occupational Health and Safety Act 85 of 1993 — South African Government
• Occupational Health and Safety Act: Construction Regulations, 2014 — South African Government