How to Manage Work Risks Under New Zealand's HSWA

Risk management under New Zealand's Health and Safety at Work Act 2015 starts with the work people actually do. A list of hazards is useful only if it leads to controls that protect workers and others, and if those controls remain effective as tasks change. The practical sequence is to identify what could cause harm, understand who could be exposed and how, eliminate the risk where reasonably practicable, minimise what remains and check whether the chosen measures work.

The Health and Safety at Work Act 2015 sets the primary duty for a person conducting a business or undertaking, or PCBU. Section 36 concerns the health and safety of workers and other people affected by work. Section 30 sets the risk-management duty: eliminate risks so far as is reasonably practicable, and where elimination is not reasonably practicable, minimise them so far as is reasonably practicable. This guide explains how to work through that duty without treating a score, template or software output as a legal decision.

Know where the statutory process applies

The Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 add a prescribed process for particular risks. Regulation 4 limits the application of regulations 5 to 8 to risks specified in regulations. Those provisions address identifying hazards, the hierarchy of control measures, keeping controls effective and reviewing them. It would overstate the law to say that this precise regulatory sequence automatically applies to every possible work risk in every context.

The Act's general duties still matter across work. WorkSafe New Zealand's risk-management guidance provides a practical approach that can help a PCBU manage risks more broadly. Distinguish that guidance from a provision that applies because a particular regulation specifies the risk. Other regulations and approved codes may add requirements for particular work, plant or substances. Check the rules for the activity rather than assuming this article is exhaustive.

Step 1: identify hazards where work happens

Start by observing tasks, not by copying a generic list. Watch preparation, routine work, cleaning, maintenance, shutdown and unusual conditions. Ask workers what changes when the team is under pressure or the usual equipment is unavailable. Consider physical hazards, hazardous substances, plant, vehicles, manual tasks, noise, psychosocial risks and other sources of harm relevant to the work. Identify people who may be affected, including contractors, visitors and people near the workplace.

Look at incidents, near misses, complaints, maintenance records and previous inspections. These can show a problem that was not obvious during a scheduled walk-through. A process change, new product or different site may introduce a new risk even when the job title remains the same. WorkSafe's guidance emphasises ongoing review of work activities and controls.

Write the hazard in a way that connects it to exposure. “Forklift” names a piece of plant. “Pedestrians crossing the forklift route during dispatch” tells the team how someone could be struck. A useful description helps the people choosing a control. Do not confuse a safety data sheet, a standard operating procedure or a previous assessment with observation of the present work.

Step 2: understand the risk and set priorities

Ask what could happen, how serious the harm could be, how people are exposed and who may be affected. Likelihood matters, but low-frequency events can still demand strong controls when the consequences are severe. Consider the conditions that could cause a control to fail, such as a missing guard, blocked view, fatigue or work by someone unfamiliar with the site.

A risk matrix can help organise discussion, but the number or colour it produces is a tool, not the legal test. A “medium” score does not authorise a weak control. HSWA section 22 defines “reasonably practicable” by reference to relevant matters including the likelihood of the risk, the degree of harm, what is known about the risk and ways to eliminate or minimise it, availability and suitability of controls, and cost considered after assessing the risk and available measures. Cost is not a simple reason to disregard a serious known hazard.

Prioritise immediate threats and work that could cause serious injury or chronic ill health. If an activity is unsafe now, use the site's escalation and stop-work process while a suitable control is decided. Do not leave people exposed simply because a formal assessment meeting is scheduled for next week.

Step 3: eliminate where reasonably practicable

Elimination removes the risk rather than asking people to work around it. Can a hazardous task be avoided, a material removed, or work moved away from an exposure? Sometimes the work is essential and elimination is not reasonably practicable. Record the reason based on the actual task and available options, then move to measures that minimise risk. The Act's section 30 makes this order central to risk management.

For specified risks, GRWM regulation 6 sets a hierarchy once elimination is not reasonably practicable: use the most appropriate and effective substitution, isolation or engineering measures so far as reasonably practicable; then administrative measures for remaining risk; then suitable personal protective equipment for risk that remains. Multiple controls can be needed. A procedure and PPE may support an enclosure, but they do not erase the need to consider a stronger control.

For other risks, the same hierarchy is a useful way to reason about protection under WorkSafe guidance, while the precise legal obligation comes from the Act and any applicable specific rule. Do not copy regulation 6 into an assessment without checking that it applies to that risk.

Step 4: make controls workable

An engineering control must fit the equipment and task. A barrier that blocks an essential escape route will not be a suitable answer. A safe work procedure must match the real sequence of work and reach everyone affected. PPE must be suitable, available and used correctly. Ask the workers who will use a control whether it works in normal and difficult conditions. GRWM regulation 7, where applicable, requires controls to be effective and maintained so they remain fit for purpose, suitable for the work and correctly installed, set up and used.

Give each action a clear owner, implementation date and verification step. Communicate a changed method to contractors and other shifts. Train workers where the control requires a skill. If the permanent measure is delayed, decide whether a temporary measure adequately protects people and whether the activity should stop in the meantime. That decision is site-specific and cannot be made by this guide.

Step 5: consult and coordinate

People doing the work can identify failure points before management sees them. Consult workers and their representatives when identifying risks and deciding controls as required by the Act. At a shared workplace, businesses with overlapping duties should communicate and coordinate. A principal business cannot assume a contractor's checklist covers a hazard it creates, and a contractor cannot ignore the site's traffic or emergency arrangements. Explain who controls what, how changes are reported and who confirms that the combined system is safe enough to operate.

Consultation is more than asking for a signature after a decision. Present the hazard and options, listen to the practical effects of proposed controls, and tell people what was decided and why. Where a worker reports that a guard is routinely bypassed, the issue needs investigation rather than a repeat reminder. The goal is to design a system people can use while meeting the duty to protect them.

Step 6: review and improve

Check whether controls are being used and whether they reduce exposure. Review after an incident, near miss, new information, worker concern, changed process, new equipment or a change in people or site conditions. For specified risks, GRWM regulation 8 identifies circumstances in which controls must be reviewed and revised as necessary. WorkSafe also describes ongoing review as part of effective risk management.

Verification should look at the actual control, not only a closed action. Is the extraction working during the task? Is the pedestrian route kept clear at the busiest time? Are workers following a revised method because it is practical, or finding a workaround? A new control can introduce a different risk. If it fails, revisit the hazard and select a better measure.

Example: a change to a cutting process

A workshop changes material and starts a new cutting job. The supervisor notices more airborne dust. The team stops and identifies who could breathe it in, what the material is and what controls are available. They consider whether the cutting method or material can be changed. If not, they investigate suitable extraction and enclosure before relying on masks and reminders. Workers explain that the existing extraction hood does not fit the new pieces. The business adjusts the engineering control and checks its performance during the real task. It updates instructions and training and schedules another review after the process has run for a period.

This example illustrates the sequence, not a determination that any particular dust control meets an exposure limit. Substance-specific rules, monitoring and competent technical assessment may be needed. The assessment should cite the actual material and local applicable requirements.

Make the record useful

A concise risk record can capture the task and location, people exposed, credible harm, controls considered, chosen measures, owner, date and verification evidence. Link it to worker consultation and any relevant monitoring or incident information. Record changes when the work changes. The quality of the reasoning matters more than a long form or a high-looking score. Some specific rules impose documentation requirements; check those separately. Do not assume every HSWA risk needs one legally prescribed template.

For teams assessing ways to organise records and follow-up, review Complys New Zealand risk assessment software. Ask the product team to show the current workflow. This article does not assert that Complys judges reasonable practicability, selects a control, calculates legal risk acceptability or certifies compliance.