Risk control in effective health and safety management

All you need to know about risk control in effective health and safety management strategies

IOSH risk control UK


  • IOSH Managing Safely and risk control
  • RoSPA’s opinion of the IOSH Managing Safely Course
  • What is the difference between risk control and hazard control?
  • What is a risk?
  • What is a hazard?
  • Implementing risk control
  • Looking deeper into implementing risk control


When it comes to the prevention of accidents or injuries in the workplace, risk control is a crucial element. It is important that risk control forms part of a company's broader health and safety plan by providing a method to identify, control, and reduce risks which are present in the workplace.

However, it is important to understand that risk control is only one element of effective management of health and safety in the workplace, and that there are multiple pieces to the health and safety ‘jigsaw’, all of which are required to securely interlock to create a complete ‘picture’ of a robustly implemented health and safety policy in the workplace.

As with any business decision, it needs to be made 100% clear to one individual that they will be responsible for all aspects of health and safety in the workplace. In small-to-medium-sized companies, this will often be the proprietor/owner, while in larger companies, it will fall to a member of senior management.

In larger companies, it is also often the case that while a senior executive may have overall responsibility for the correct and effective implementation of health and safety measures, either an outside contractor or a specific health and safety officer is appointed to oversee all aspects of health and safety in the workplace. 

IOSH Managing Safely and risk control 

The Institution of Occupational Safety and Health (IOSH) places considerable emphasis on the aspects of risk control within the context of Managing Safely, and it is also recommended that owners of, or senior managers within a company complete the IOSH Managing Safely Course, which is available through Commodious.

RoSPA’s opinion of the IOSH Managing Safely Course

The Royal Society for the Prevention of Accidents (RoSPA) states that taking “this course will help you improve the safety awareness culture in your organisation, see your productivity increase and enhance your reputation within your supply chain, embedding safety and health across the whole organisation.”

Once you have taken the course, you should be able to:

  • Achieve greater productivity as fewer hours will be lost due to sickness and accidents
  • Improve your organisation’s safety awareness culture and appreciation of safety measures
  • Get staff actively involved in improving the workplace
  • Enhance your organisation’s reputation within the supply chain as you will be able to advise clients you are in receipt of an internationally recognised certificate.

What is the difference between risk control and hazard control?

Risk control and hazard control are closely intertwined as hazard control is an element of risk control. To better understand this, it might be better to understand the difference between a risk and a hazard.

What is a risk?

When we refer to risk in relation to occupational safety and health, the most commonly used definition is ‘risk is the likelihood that a person may be harmed or suffers adverse health effects if exposed to a hazard.’

What is a hazard?

When we refer to hazards in relation to occupational safety and health, the most commonly used definition is ‘A Hazard is a potential source of harm or adverse health effect on a person or persons’.

There are nine hazard categories, of which six are deemed to be primary hazards and three as additional hazards. These are as follows:

  • Mechanical hazards – e.g., crushing, shearing, stabbing, or puncturing of the body, etc.
  • Physical hazards – e.g., fire, explosion, electric shock, etc.
  • Chemicals – e.g., spillage, ingestion or inhalation, etc.
  • Biological hazards – e.g., bacteria, viruses, mould, etc.
  • Environmental hazards – e.g., excessive noise or vibration, poor lighting conditions, etc.
  • Organisational hazards – e.g., lack of training, lack of supervision, etc.
  • Access hazards – e.g., slips, trips, falls, working at height, etc.
  • Ergonomic hazards – e.g., repetitive movement, lifting heavy loads, etc.
  • Individual-related hazards – e.g., physical disability, unsuited to long working hours, etc.

Consequently, to reduce the level of risk, you have to tackle the hazard first, which is part of risk control.

Implementing risk control

Generally speaking, there are six control measures you can take where risk is concerned:

  1. Eliminate
  2. Substitute
  3. Isolate
  4. Engineering controls
  5. Administrative controls
  6. Personal protective equipment (PPE)

This list is a hierarchy and belongs in the above order, which makes perfect sense when you look at it more closely and logically. Why? 

Well, if we look at point 1, Eliminate, that has to be the most effective step to take when it comes to risk control, as if the hazard no longer exists, then the risk can no longer exist either.

When it comes to point 6, deploying/employing PPE as a means of risk control, this implies that, at best, the risk may have been reduced but still very much exists, or there has been no successful remedy applied to reducing the harmful nature of the hazard. In other words, ‘we can’t get rid of the hazard, so the best we can do is help protect you against it by getting you to wear protective clothing.’ 

Looking deeper into implementing risk control

Eliminate the hazard

While it will always be the optimum solution, the elimination of a hazard is not always achievable.  If you can remove hazards totally, this will automatically eliminate the risk of anyone being exposed to the hazard. An example of this would be that in the past, petrol pump attendants and those who constantly came into contact with petroleum ran the risk of lead poisoning from the lead content in the petrol. That risk has now been totally eliminated through two implementations, the self-service petrol pump and the removal of lead from petroleum.

Substitute the hazard with a lesser risk

While substituting the hazard may not eliminate all of the risks associated with a particular process or activity, and it may even introduce alternative hazards, such a substitution should still reduce the level of the overall potential for harm or health effects. As an example, painting the gable end of a house would require you to work at the top of a ladder with someone standing below you, steadying the ladder. The ladder could be replaced by scaffolding which does not completely eliminate the fall risk, but the sturdier platform would make working conditions far safer.

Isolate the hazard

When it comes to isolating a hazard, this can be achieved by restricting access to plant and/or equipment, or in the case of toxic or flammable substances, locking them away in a safe container and done so under strict controls. If you are using certain chemicals, a fume cupboard can isolate the hazard from those persons in the vicinity, while placing noisy equipment in a non-accessible enclosure or room isolates the hazard from person(s). A classic example of this is the correct and safe storage of fireworks during a display.

Use engineering controls

The term ‘engineering’ here can be slightly misleading as we are not discussing mechanical or electrical engineering. What is meant by the use of the word ‘engineering’ is as an alternative to the words ‘devising’,  ‘designing’ or ‘redesigning’ a process to place a barrier between the person(s) and a hazard or removing the hazard entirely from the person’s vicinity, such as machinery guarding, proximity guarding, extraction systems or removing the operator to a remote location away from the hazard.

Use administrative controls

When we talk about administrative controls, we are referring to how things are done, how people work to complete a task. Thus administrative controls include adopting standard operating procedures or safe work practices or providing appropriate and sufficient training, instruction or information to mitigate any potential for harm and/or adverse health effects to person(s). Permit-to-work procedures are considered to be administrative controls, and an excellent example of this can be found in the Commodious Knowledge Bank in our article on Permit to Work in a Confined Space.

Use personal protective equipment

Personal protective equipment (PPE) includes but is not limited to gloves, glasses, earmuffs, aprons, safety footwear, and dust masks, all of which are designed to minimise exposure to particular hazards. PPE is usually looked upon as a last line of defence and is normally used not just on its own but also in conjunction with one or more of the other control measures that have been listed above. An example of the lack of effectiveness of this control measure is that it is widely recognised that single-use dust masks cannot consistently achieve and maintain an effective seal around the nose and mouth, which can lead to a dangerous false sense of security and, consequently, an increased risk. In such instances, a dust extraction system with fitted respirators could well be preferable where the hazard may have significant health effects even from very low levels of exposure such as using chemicals containing isocyanate.


Here at Commodious we specialise in providing online courses that cover many aspects of Health & Safety at work. If you would like to learn more about any of these, please feel free to get in contact with us.




Further Reading