How to Do a Workplace Risk Assessment (Step-by-Step for Small Businesses)
Every OHS obligation in this silo hangs off one document: the risk assessment. It is the first thing an inspector asks for, the thing a court looks for after an injury, and the thing that tells you what training, equipment and procedures your workplace actually needs. The good news for small businesses: the method is simple, the afternoon it takes is the best safety investment you will make, and this guide walks through it step by step.
- ✔Five steps: identify hazards, who is harmed, evaluate and control, record and implement, review.
- ✔The assessment must be written — an unwritten one is invisible in an inspection.
- ✔Controls follow a hierarchy: eliminate, substitute, engineer, administrate, protect.
- ✔Review annually, after incidents, and whenever work changes.
- ✔The assessment drives everything else: training, PPE, procedures and appointments.
Step one and two: identify hazards and who is at risk
A hazard is anything with the potential to cause harm: wet floors, grinders, ladders, solvents, delivery vehicles, frayed extension leads, a dark stairwell, aggressive clients, lone working after hours. Walk the workplace deliberately — every area, every task — and involve the people who do the work, because they know where the near-misses live. Then, for each hazard, ask who could be harmed and how: employees, but also visitors, contractors and the public (your section 9 duty under the OHS Act).
- Physical: machinery, vehicles, electricity, heights, noise, slips and trips.
- Chemical: cleaning agents, solvents, fuels, dusts and fumes.
- Ergonomic: lifting, repetitive work, poor workstation setup — offices included.
- Environmental and human: heat, cold, lighting, violence, stress, lone work.
Step three: evaluate the risk and choose controls
Risk is likelihood times severity. Rate each hazard honestly — a paper cut and a fall from a roof are not peers — and then select controls using the hierarchy that OHS practice and inspectors expect: eliminate the hazard if you can, substitute something safer, engineer a physical control (guards, ventilation, railings), administrate (procedures, training, rotation, signage), and only then rely on personal protective equipment as the last line.
| Control level | Example |
|---|---|
| Eliminate | Stop storing stock above shoulder height entirely |
| Substitute | Water-based cleaner instead of solvent |
| Engineering | Guard on the grinder; rails on the mezzanine |
| Administrative | Two-person rule for ladder work; induction training |
| PPE | Gloves, goggles, boots — issued free, with training |
Handing out gloves while leaving the hazard untouched is the classic failed-assessment pattern. PPE manages residual risk after better controls are in place — and by law it is provided at the employer’s cost.
Steps four and five: record, implement, review
Write it down: the hazards, who is at risk, your risk ratings, the controls chosen, who is implementing them and by when. A simple table in a document is enough for a small business — the legal weight comes from being written, implemented and reviewed, not from expensive formatting. Then close the loop: actually install the guard, run the training, buy the equipment, and sign it off.
Review the assessment at least annually, immediately after any incident or near-miss, and whenever something material changes — new machinery, new premises, new processes, new substances. A two-year-old assessment for a workplace that has changed is evidence against you, not for you. The record-keeping rules that sit alongside this are in employee record keeping.
From risk assessment to working safety system
The assessment is the map; the system is the territory. Its findings tell you which training to run (and record), which appointments to make (safety reps, first aiders), what first-aid provision you need (first aid requirements), and which procedures need to exist in writing. Reviewed annually, it is also your standing answer to the inspector’s first question.
And when a hazard does hurt someone despite the system, the assessment becomes the spine of the incident file — alongside the 7-day reports to the Department (incident reporting) and the Compensation Fund (COIDA claims). The full OHS picture is in the OHS pillar guide.
Always confirm current requirements with the official source — rules and deadlines change.
- ✔Admin Boss handles registrations, filings and payroll admin
- ✔Registered tax practitioner · 20+ years experience
- ✔Fully remote — all 9 provinces
Frequently asked questions
Is a written risk assessment legally required?
The OHS Act requires hazards to be identified and precautionary measures implemented — and in practice only a written assessment proves that. Inspectors ask for it first, and after an incident an unwritten assessment is indistinguishable from no assessment.
How often must a risk assessment be reviewed?
At least annually as good practice, immediately after any incident or near-miss, and whenever the workplace materially changes — new equipment, premises, processes or substances.
Can I do the risk assessment myself?
Yes — the law does not require a consultant, and a structured walk-through with your own staff produces a credible assessment for most small workplaces. High-risk industries (construction, chemicals, heavy machinery) benefit from professional input.
What is the hierarchy of controls?
The preferred order for controlling hazards: eliminate the hazard, substitute something safer, engineering controls, administrative controls (procedures and training), and personal protective equipment as the last line of defence.
Last reviewed: July 2026 · How we research our guides
EmployerGuide.online provides general information about South African employer obligations — not legal, tax or professional advice for your specific situation. Laws, rates and deadlines change; confirm current requirements with the official sources linked above, or ask Admin Boss. See our disclaimer.