What is risk assessment?
Article 3 of the Regulations for Prevention Services defines it as the process of estimating the magnitude of risks that could not be avoided. The information obtained allows for a decision to be made regarding whether measures are needed and, if so, which ones. The INSST emphasizes that the assessment is a means to make decisions and improve working conditions , not merely a document for its own purposes.
Your unit of analysis can be a job, task, process, location, piece of equipment, or situation, depending on how the exposure occurs. You must consider routine and non-routine work, maintenance, foreseeable emergencies, and variations. Include all potentially exposed individuals and pay attention to those who are especially sensitive due to their personal characteristics or known biological condition.
Differences between identifying hazards, assessing and planning
Identifying hazards means recognizing sources, situations, or actions capable of causing harm. Assessing risks links these hazards to exposure, probability, consequences, and existing controls to estimate the magnitude and make decisions. Planning preventive activities translates the results into measures, priorities, responsibilities, resources, and timelines. These are connected but not interchangeable stages.
A list of hazards without assessment makes prioritization impossible; a matrix without metrics is ineffective; and planning disconnected from assessment can address secondary problems. Nor should assessment be confused with measurement. Measurements are necessary when the nature of the risk demands it, but they always require strategy, methodology, and interpretation. In other cases, observation, interviews, documentation, and appropriate qualitative or semi-quantitative methods are used.
When should it be performed and reviewed?
The company conducts an initial risk assessment, taking into account the company’s activities, job positions, and personnel. This assessment is updated when equipment, substances, technology, locations, organizational structure, or conditions change; when a new employee is hired whose known characteristics make them particularly vulnerable; and when regulations or evidence indicate new risks. It is also reviewed when injuries occur, when health checks reveal potential hazards, or when existing measures may be inadequate.
The review does not always require redoing the entire document; it should address the affected part and verify its relationship with the rest of the system. A review schedule can be agreed upon between the company and employee representatives, taking into account the anticipated deterioration of the process elements. In any case, a scheduled date never justifies waiting when a change or sign of damage occurs.
How to do it step by step
A rigorous sequence is:
- Define scope, tasks, people and conditions, gathering reliable information.
- Identify hazards and existing controls through observation and participation.
- Determine who may be harmed, how, and for how long.
- Select the appropriate method; take measurements when necessary.
- Estimate the risk by combining the available information and its uncertainties.
- Compare with legal requirements, values or technical criteria and decide on acceptability.
- Propose measures according to the preventive hierarchy and prioritize them.
- Document results, those responsible, and the rationale for the decision.
- Verify effectiveness and set review conditions.
If there is any doubt, the Regulation requires that the most favorable preventive measures be adopted from a prevention point of view.
Methods, competence and participation
The method must inspire confidence in the result and be appropriate for the risk. General methods can be used for an initial assessment, and specific methods for noise, chemicals, ergonomics, psychosocial factors, or other agents. Where specific regulations exist, their procedures are followed; in their absence or as a supplement, standards, INSST guidelines, competent bodies, or recognized professional methods are used.
The assessment is conducted by personnel with the appropriate preventative skills for its complexity. The company consults with employees about the procedure and gathers their knowledge of deviations, peak periods, maintenance, and non-prescribed work. This participation does not replace technical expertise, but it prevents the analysis from merely describing the theoretical process. Assumptions, limitations, and missing data must be declared so that the decision can be reviewed.
Practical example
A new loading area with forklifts and pedestrian access is being implemented in a warehouse. The assessment examines routes, intersections, visibility, speeds, lighting, peak activity, battery charging, and non-routine tasks. It includes external carriers and cleaning duties, not just regular operators. Previous incidents and staff experience reveal a blind intersection that the plan did not show as a problem.
Distributing vests as the sole response is not the priority. Traffic flows are redesigned to separate people and vehicles, intersections are eliminated, barriers and access controls are installed, and speed limits are imposed. Signage, regulations, training, and high visibility complement these measures. Observations, speeds, and incidents are then reviewed, and the assessment is revised if the distribution or volume of traffic changes.
Documentation and traceability
The documentation identifies the position or situation, existing risks, people affected, outcome, appropriate measures, and criteria and methods used. When measurements have been taken, it retains the information necessary to interpret their validity. It should allow for understanding why a decision was made and subsequently verifying whether it was implemented and effective. A number in a matrix without context does not provide that traceability.
Digital tools can facilitate versioning, assignment, and tracking, but they do not guarantee quality. A copied, generic, or closed assessment without feedback is not improved simply by being on a platform. Changes must be linked to closing measures and evidence. Personal and health data are handled with appropriate safeguards; the preventative document uses only the necessary information without disclosing individual diagnoses.
Regulatory framework
Law 31/1995 mandates an initial assessment and, based on its results, the planning of preventive measures. Royal Decree 39/1997 details the definition, content, procedure, review, and documentation in Articles 3 to 7. Specific regulations detail assessments for certain agents, equipment, or activities.
Framework Directive 89/391/EEC establishes the general approach to prevention and assessment in the European Union. EU-OSHA maintains OiRA, a platform for creating sector-specific tools that guide micro and small businesses through the process and planning. OiRA can facilitate the work, but the obligation and suitability to the context rest with each organization. Assessment retains its value when it leads to concrete actions and continuous improvement.
