WHS risk assessment template: record the decision, not just a risk score

Direct answer. A useful WHS risk assessment records the activity, who may be harmed, the hazards and potential harm, the controls already in place, what further action is reasonably practicable, who will do it, and how the control will be checked. The form below is a starting point for an Australian workplace. It does not make a generic written risk matrix a universal legal requirement. The relevant WHS duties concern eliminating or minimising risks so far as reasonably practicable, consulting workers and keeping controls effective; specific hazards and jurisdictions can impose additional documentation requirements. Safe Work Australia model risk-management code; Safe Work Australia PCBU duties.

Check the enacted law and regulator guidance in the state or territory where the work occurs. Safe Work Australia develops model WHS material; it is not the regulator for a particular site. Victoria uses its own OHS Act and regulations. This template deliberately avoids pretending that a score such as “12 = medium” has statutory force everywhere.

Copyable WHS risk assessment form

Complete the header first, then add one row for each distinct task or hazard. If several workers, shifts or sites perform the activity differently, record those differences rather than issuing one identical form to everyone.

Assessment details

Hazard, control and action table

Decision and review record

This is a decision record, not an instruction to fill every cell with generic text. A valid assessment may be short for a simple, well-controlled task. A complex activity needs enough detail for a competent reader to understand the risk and why the controls are suitable. A separate safe work method statement, permit, chemical assessment or other specific record may be necessary under the applicable law; this general form does not replace it.

Work through the real task before assigning numbers

Start by observing the activity, including preparation, normal operation, cleaning, maintenance, foreseeable failure and handover. Talk to workers who do it; they may know that an access route is blocked on night shift or that a lifting aid is stored too far away to be used. Check near misses, injury reports, inspection findings, manufacturer instructions, SDS where substances are involved, and any regulator code relevant to the hazard. Safe Work Australia's model code begins with identifying hazards, then assessing risks if necessary, controlling them and reviewing the controls. An elaborate numeric matrix is not a substitute for understanding the work. Safe Work Australia model risk-management code.

Describe how harm could happen. “Forklift” is not a risk statement; “pedestrian crosses the reversing forklift route during dispatch, with a risk of collision” identifies the event, people and consequence. “Chemicals” is too broad; “worker decants an irritant cleaning product without a suitable transfer method, creating splash and inhalation exposure” gives a control problem to solve. This level of specificity makes the assessment usable in the field.

Assess the seriousness and likelihood when that helps choose between controls or decide urgency. The model code says a formal assessment may not be needed where a well-known risk has established effective controls. Conversely, uncertainty, high potential harm or several interacting hazards may warrant specialist input. Do not manipulate the score to make a deadline. If the proposed control cannot be implemented, the assessment should say so and identify what changes before work proceeds.

Select controls in a sensible order

Ask whether the hazardous activity or exposure can be eliminated. If not, consider substitution, isolation and engineering measures before relying entirely on procedures, training or personal protective equipment. The precise combination depends on the hazard, the available controls and what is reasonably practicable. A guard and interlock may be central for machinery; traffic separation and delivery redesign may be central for vehicle movements; a safer product may be the best chemical control. The controls must match the task, not a prewritten hierarchy paragraph. Safe Work Australia model risk-management code.

Example: shared loading yard. A warehouse uses forklifts and has delivery drivers walking from parked trucks to an office. The initial assessment notes an uncontrolled crossing. A sign saying “watch for forklifts” may help communication but does little to remove the interaction. Consider a segregated driver walkway, a waiting point outside the traffic zone, physical barriers where suitable, scheduled movements and a controlled unloading handover. The action table should say who installs or changes each measure, when it will be in place, and how supervisors check drivers actually use the route. If a temporary diversion removes the barrier during maintenance, that is a review trigger.

Example: cleaning in an occupied workplace. A contractor changes to a stronger product. The business should obtain the current SDS, assess exposure and suitability of the product and process, consider a safer substitute, arrange ventilation or isolation where needed, and consult both its workers and the contractor about access. The form should identify who approves the product change and who checks the revised method. A generic “gloves and goggles” line does not answer whether the substance, concentration and work area are appropriate.

Consult, assign and check

Workers' experience should shape the hazard description and control choice. The model WHS framework includes consultation duties with workers and, where applicable, health and safety representatives. Where several PCBUs share a workplace or activity, consultation, cooperation and coordination are also relevant. Record how the parties resolved a shared interface, not just that an email was sent. Safe Work Australia PCBU duties.

Every action needs an owner, due date and completion test. “Improve training” is not a completed control. State who changes the briefing, who attends, how performance is observed and what happens if the method is not followed. If a guard is ordered but not installed, record the interim restriction. A risk assessment that treats the purchase order as the finished control can create false confidence.

Check controls in the workplace. Ask whether people use them, whether they introduced another hazard, whether the equipment is maintained and whether the instruction still matches the site. Reviews are especially important after an incident, a near miss, a process change, new plant, different people or new information about a hazard. Record the revised decision and tell affected people what changed. Safe Work Australia model risk-management code.

What this template cannot decide

It does not tell you whether a particular activity legally requires a SWMS, a confined-space permit, a hazardous-chemical register, a licence or a specialist engineering assessment. Those questions depend on the task and enacted jurisdictional requirements. It cannot certify that a control is adequate, replace manufacturer instructions or approve a high-risk method. If competence or measurement is needed—for example, an engineer's temporary-works design, exposure monitoring or electrical isolation verification—obtain it rather than asking a generic form to stand in for it.

It also does not create a universal retention period. Keep the record for as long as the relevant legal, contractual and evidence needs require, and check any specific hazard or incident rule. Avoid adding a five-year or seven-year claim without the exact jurisdiction and record type.

Keep the record useful after assessment day

Issue a readable current version to the people who need it. Link supporting documents such as the relevant operating procedure, inspection record, permit or SWMS rather than pasting them into one enormous form. Maintain a change log so a supervisor can see which control applied when an earlier job was done. During an inspection or client review, the strongest evidence is the connection between the identified risk, the chosen control and the field check that confirms it works.

The designated Australian risk assessment software page is a natural next step for teams trying to organise multiple assessments and their review owners. The publication copy should only describe functions verified in the deployed Complys product; the form itself does not imply automatic risk scoring, statutory approval or specialist assessment. A buyer can ask to see how one real assessment, action and revision would be handled before choosing a system.

Source and claim register — checked 5 October 2026