Hazard analysis is the systematic work of finding conditions in a workplace or process that have the potential to cause harm, and assessing how often and how severely the resulting risk could materialise. Türkiye's Occupational Health and Safety Risk Assessment Regulation separates the two concepts: a hazard is the potential to cause harm or damage, while risk is the likelihood that loss, injury or another harmful outcome arises from that hazard.
The regulation entered into force on 30 December 2012 and covers all workplaces within the scope of Türkiye's Occupational Health and Safety Law No. 6331. A risk assessment must be renewed at least every two, four and six years in very hazardous, hazardous and less hazardous workplaces respectively. In the process industries, the process safety rule of the US Occupational Safety and Health Administration (OSHA) lists six methods for process hazard analysis (PHA), including HAZOP, plus an appropriate equivalent method.
In short:
- Hazards are identified first, then the risk of each hazard is analysed for frequency and severity, and finally control measures are chosen (Turkish OHS regulation).
- A risk matrix is not the analysis itself but a tool that ranks and displays its result; IEC 31010 lists it among recording and reporting techniques.
- HAZOP is a team exercise that questions deviations using guide words; its application guide is IEC 61882.
What is the difference between a hazard and a risk?
Under the regulation, a hazard is the potential, existing in the workplace or coming from outside, to cause harm or damage affecting workers or the workplace. Risk assessment is the whole body of work done to identify hazards, analyse and rank the factors that turn them into risk and the risks themselves, and decide on control measures.
An example: a platform used for work at height is a hazard; the likelihood of a fall, and its consequence, during a shift when the guardrail is missing is the risk. Risk can be reduced without removing the hazard; fitting a guardrail changes the risk, not the hazard. For the broader risk management framework, see the article on the ISO 31000 risk management process.
How is hazard identification done?
Article 7 of the regulation starts the process at the design or set-up stage and follows this sequence: identifying hazards, determining and analysing risks, deciding on control measures, documentation, updating and, where needed, renewal. Workers are to take part and be consulted at every stage.
Article 8 lists the minimum information to collect when identifying hazards, including:
- Buildings and annexes, activities carried out, production processes and techniques, work equipment and substances used.
- Organisational structure, duties and authorities; workers' experience and views.
- Records of occupational accidents, occupational diseases and near misses; safety data sheets; workplace measurements.
The assessment is done by a team, not a single expert. Under Article 6, the team includes the employer or their representative, the occupational safety specialist and workplace physician, worker representatives, support staff, and workers who know the hazard sources, chosen to represent all units.
How is a risk matrix used?
Article 9 of the regulation requires each hazard to be considered separately, determining how often the risk may occur and who or what may be harmed, how and how severely, taking existing controls into account. The analysis method is not fixed; one or more methods may be chosen based on the nature of the business, the hazards involved, or national or international standards.
The risk matrix is one of these options: likelihood on one axis, severity of consequence on the other, and each cell corresponding to a risk level. IEC 31010 lists the matrix, under the name "consequence/likelihood matrix (risk matrix or heat map)," among recording and reporting techniques; in its table of contents, example consequence and likelihood scales are given as separate figures before the matrix itself.
That order carries a practical warning: if the matrix is filled in before the scales are defined, the same hazard can land in two different colours for two different people. The following is practical advice, not a sourced rule:
- Write down the likelihood and severity levels with verbal and, where possible, numerical definitions.
- Decide in advance which colours are unacceptable and who approves what.
- Use the matrix as a summary of the team discussion, not as a replacement for it.
What are PHA and HAZOP, and when are they used?
In OSHA's 1910.119 rule, PHA is the process hazard analysis carried out to identify, evaluate and control hazards in covered processes. The rule lists these methods: What-If, Checklist, What-If/Checklist, HAZOP, Failure Mode and Effects Analysis (FMEA), Fault Tree Analysis and an appropriate equivalent methodology. The analysis must address the hazards of the process, previous incidents with catastrophic potential, engineering and administrative controls, facility siting and human factors. The team includes at least one employee with experience of the process and one member who knows the method being used; the analysis is updated and revalidated at least every five years.
HAZOP (hazard and operability study) is one of the methods with its own international application guide. According to IEC 61882:2016, HAZOP examines systems using guide words; the guide covers the definition, preparation, examination sessions, documentation and follow-up of a study. Its second edition of 2016 aligned terminology with ISO 31000 and added an improved case study of a procedural HAZOP. IEC 31010 also lists HAZOP, together with FMEA, SWIFT and scenario analysis, among techniques for identifying risk.
FMEA and fault tree analysis are detailed methods in their own right; this article only touches on their place in hazard analysis.
In what order are risk control measures chosen?
Article 10 of the regulation requires risk to be eliminated entirely or, if that is not possible, reduced to an acceptable level, and sets the order: eliminating the hazard or its source, replacing the hazardous with the non-hazardous or less hazardous, and combating risks at source. Collective protection takes priority over personal protection. Once measures are in place, the risk level is determined again; if it is still above the acceptable level, the steps are repeated.
An assessment is not a permanent document. Under Article 12, it is renewed in full or in part when, for example, the workplace moves, technology or production methods change, or an occupational accident, occupational disease or near miss occurs.
Conclusion: is hazard analysis a form or a team exercise?
Legislation and standards meet at the same point: hazard analysis is a team exercise that brings the right people together with the right data; forms and matrices are the record of that work. A practical start is to collect near-miss reports regularly, write down the matrix scales, and make renewing the assessment a habit whenever a process changes.
Hazard analysis and risk assessment are part of Orient Global's corporate training catalogue; details are on the trainings page.
This article is for general information only and is not legal advice; the current text of the regulation prevails.
#interimmanagement #forwarddeployedengineering #hazardanalysis #riskassessment #hazop