HIRARC: how to do hazard identification, risk assessment and risk control

What HIRARC means

HIRARC is short for Hazard Identification, Risk Assessment and Risk Control. In Malaysia the term comes from the Department of Occupational Safety and Health (DOSH) publication Guidelines for Hazard Identification, Risk Assessment and Risk Control (HIRARC), issued in 2008. It is still the reference most DOSH officers, auditors and safety officers expect to see.

The guideline defines a hazard as a source or situation with the potential for harm to people, property or the environment, and risk as the combination of the likelihood of a hazardous event and the severity of the harm it causes. HIRARC is the process of finding those hazards, scoring the risk, and putting controls in place before someone gets hurt.

The 2008 guideline says its method is intended for physical (safety) hazards. For health hazards such as chemicals hazardous to health or noise, DOSH expects you to use the specific assessments designed for them, carried out by the right assessor, in addition to your HIRARC.

Is HIRARC a legal requirement in Malaysia?

The 2008 guideline is guidance, not law. The legal duty sits in the Occupational Safety and Health Act 1994. Since the amendments came into force on 1 June 2024, section 18B requires every employer, self-employed person and principal to conduct a risk assessment of the safety and health risks to anyone who may be affected by their undertaking at the place of work, and to implement the controls the assessment shows are needed. Breaching it carries a fine of up to RM500,000, up to two years in prison, or both.

The Act does not prescribe a format, so you can use any sound method. HIRARC is the one DOSH published, which makes it the safest default for most workplaces. Our OSHA amendment 2022 guide covers the other new duties.

The four HIRARC steps

The guideline describes HIRARC as four steps, done by a team led by a trained person and including the workers who do the job.

1. Classify work activities

Break the work into activities that are neither too big ("building a car") nor too small ("fixing a nut"). Group them by area, by stage of the process, or by defined task such as loading, packing, mixing or cutting. Include non-routine work: maintenance, cleaning, changing blades, breakdowns and shutdowns are where many serious injuries happen.

2. Identify hazards

For each activity, ask what could cause harm. The guideline groups hazards into safety (slips and trips, fire, moving machinery, work at height, pressure systems, vehicles, manual handling, working alone), health (chemical, biological, physical agents such as noise, heat and radiation, and ergonomic) and environmental (releases to air, drains or soil). Useful inputs include incident and first aid records, inspection results, employee complaints and safety data sheets. Techniques include workplace inspections and job hazard analysis.

3. Assess the risk

For each hazard, write down the effect (what injury or damage could result) and the existing controls, then rate likelihood and severity taking the existing controls into account. Multiply the two to get the risk score and band.

4. Decide and apply controls

Where the risk is not acceptable, recommend further controls using the hierarchy of control, assign a person in charge (PIC) and a due date, and track the status. After the controls are in place, re-assess to confirm the residual risk is acceptable.

The HIRARC risk matrix

The DOSH guideline uses a 5×5 matrix. Rate each hazard on two scales.

Relative risk = L × S, giving a score from 1 to 25. The guideline bands it like this:

Because the scores are products, some numbers never appear (there is no 7, 11, 13, 14, 17 and so on). A score of 4 × 4 = 16 is High; 4 × 3 = 12 is Medium. Do not borrow a different matrix's colour bands and mix them with the DOSH table.

How to fill in the HIRARC form

The HIRARC form in Appendix C of the guideline has a header (company, process or location, conducted by, approved by, dates, next review date) and three blocks of columns:

1. Hazard identification: No., work activity, hazard, which can cause/effect.
2. Risk analysis: existing risk control (if any), likelihood, severity, risk.
3. Risk control: recommended control measures, PIC (due date and status).

A worked line, in the style of the guideline's own examples:

Practical tips from the guideline: use one form per work process, record the names and designations of the team, and have the form signed by the person in charge of the area and approved by management. Communicate the results to the employees who do the work. Keep the records for at least three years, and review the HIRARC every three years or whenever the process or activity changes. Download our free HIRARC template, which follows this layout and includes the matrix on the same sheet.

Choosing controls: the hierarchy of control

Control hazards as close to the source as possible. The DOSH guideline lists, from most to least effective:

• Elimination: remove the hazardous task, tool, machine or substance altogether.
• Substitution: do the same job in a less hazardous way, for example a less hazardous chemical.
• Engineering controls: redesign, isolation (an enclosed control room), automation, barriers and machine guards, energy isolation (lockout), ventilation.
• Administrative controls: safe work procedures, permits, supervision and training, job rotation, housekeeping and maintenance, hygiene.
• Personal protective equipment: the last line, used when other measures are not feasible or as extra protection. PPE that is not fitted, maintained and understood can give an illusion of protection.

High-risk, non-routine jobs usually need a permit to work and a written safe work procedure, and work on machinery or electrical systems needs energy isolation. Short-term controls such as hearing protection can protect people while a long-term fix such as an enclosure is installed. Then check the controls work: are they being used, have they created new hazards, and do the incident reports show improvement?

Common HIRARC mistakes

• Done once for an audit and never reviewed. HIRARC is a living document. Review it after incidents, near misses, new equipment and process changes.
• Written in the office. If the people who do the job were not involved, hazards get missed. The guideline expects consultation with workers and their safety representatives.
• Routine tasks only. Maintenance, cleaning, start-up and breakdown work are often left out.
• Ignoring existing controls, or counting controls that do not exist. Rate the risk as it really is today.
• PPE as the only control for every High risk. Look higher up the hierarchy first.
• No owner or date. A recommended control without a PIC and due date rarely happens.
• Hazards described vaguely ("unsafe condition"). Name the energy: height, moving parts, electricity, heat, load, chemical.
• Human factors overlooked. Fatigue, time pressure and unclear communication change likelihood; the Human Factors lesson shows how.

Spotting hazards is a skill people get better at with practice. The linked WorkQuest2U lessons put staff in a 3D work scene where they look for hazards, choose controls and see the consequences, which works well as preparation before a team sits down to complete a real HIRARC. Brief the results back to the crew in a toolbox talk.