Study Guide PDF

Risk and WHS
Study Guide
ACTB
Risk and WHS- Study Guide Version January 2014
Page 2 of 47
Section 1: Manage Risks

What is risk?
Whether you're aware of it or not, risks are all around you. From the moment you
get up in the morning until the moment you go to bed, you're constantly being
exposed to risks of varying degrees. Some examples of risks you may face in your
everyday life include:
Slipping in the shower and seriously injuring yourself
Getting burnt while cooking breakfast
Hitting a car while driving to work
Getting food poisoning after lunch at the local take-away shop
Suffering a stroke due to a lifetime of smoking
Trying to define the exact nature of a risk is not always straight forward; in fact, the
term risk may have slightly different definitions depending on the discipline in
context, e.g. engineering and finance etc.
For example, in some disciplines, the definitions of risk place a great deal of
emphasis on the probability of an event occurring, while a more comprehensive
definition might incorporate both the probability of the event occurring and the
consequences of the event.
In engineering, risk is defined as the product of the probability of an event occurring,
that is viewed as undesirable, and an assessment of the expected harm from the
event occurring.
However for the purposes of a small business, a risk can be simply defined as an
event or circumstance that has a negative effect on your business, for example, the
risk of losing money due to bad business decisions.
It is also useful to understand the components that make up a risk. Research shows
that an existence of a risk requires two elements:
There has to be uncertainty about the potential outcomes; and
The outcomes have to matter in terms of providing utility.
Types of business risk

There are many different types of business risk. Risks can be internal and external to
your business. They can also directly or indirectly affect your business's ability to
operate. Risks can be hazard-based (e.g. chemical spills), uncertainty-based (e.g.
natural disasters) or associated with opportunities (e.g. taking them up or ignoring
them). The Australian standard AS/NZS4360 defines risk as 'the chance of
something happening that will have an impact on objectives'.
Page 3 of 47
Common small business risks

Being aware of the most common risks small businesses are faced with enables you
to be better prepared and hence deal with them appropriately.
Business risks can be broken up into the following:
Strategic risks - risks that are associated with operating in a particular industry
Compliance risks - risks that are associated with the need to comply with laws and
regulations.
Financial risks - risks that are associated with the financial structure of your
business, the transactions your business makes and the financial systems you
already have in place
Operational risks - risks that are associated with your business' operational and
administrative procedures.
Market/Environmental risks - external risks that a company has little control over
such as major storms or natural disasters, global financial crisis, changes in
government legislation or policies
Risks can also be seen in terms of direct risks and indirect risks
Direct risks to your business

Some common risk categories are:
o natural disasters, such as floods, storms, bushfires and drought
o pandemic, such as human influenza, swine flu or bird flu
o legal, such as insurance issues, resolving disputes, contractual breaches,
non-compliance with regulations, and liabilities
o global events, such as pandemics and interruptions to air traffic
o technology, such as computer network failures and problems associated
with using outdated equipment
o regulatory and government policy changes, such as water restrictions,
quarantine restrictions, carbon emission restrictions and tax
o environmental, such as climate change, chemical spills and pollution
o workplace health and safety, such as accidents caused by materials,
equipment, or location of your work
o property and equipment, such as damage from natural disasters, burst
water pipes, robbery and vandalism
o security, such as theft, fraud, loss of intellectual property, terrorism,
extortion and online security and fraud
o economic and financial, such as global financial events, interest rate
Page 4 of 47
increases, cash flow shortages, customers not paying, rapid growth and
rising costs
o staffing, such as industrial relations issues, human error, conflict
management and difficulty filling vacancies
o suppliers, such as issues within their business or industry resulting in
failure or interruptions to the supply chain of products or raw materials
o market, such as changes in consumer preference and increased
competition
o utilities and services, such as failures or interruptions to the delivery of
your power, water, transport and telecommunications.
You should use this list as a starting point for thinking broadly about the types of
risks that could impact your business. You may discover that you need to consider
other important areas of risk that are not listed here.
Indirect risks to your business

People often make the mistake of overlooking things that don't directly
impact their business and are therefore unprepared to deal with change. For
example, while your business might not be directly affected by a natural
disaster, you may still suffer if it affects your suppliers, customers or general
location.
Consider how these scenarios could affect your business:
o If your suppliers are affected, you may run out of the products you sell, or
the materials you need to make products.
o If your customers are personally affected their priorities may change and
you could experience a reduced demand for your products or services.
o If your general location is affected, you and your customers may not be
able to access your premises, or your utilities could be affected. For
example, you could lose power, which could mean you:
will not be able to operate your business
may need to throw out any perishable goods and replace them,
which can be costly.
Keep in mind that not all risks will fit perfectly into one of the above categories.
There may be incidents where a risk overlaps into two or more categories such as
the protection of confidential information. In this example, there are laws that have
to be considered, making it a compliance risk. However, the management of
confidential information can also be an operational risk as it may be part of a
business' daily activities.
Page 5 of 47
What is risk management?

Risk management involves the ability for organisations to obtain a balance between
realising opportunities for gains while minimising losses. Essential to good
management practices, risk management is also an important element in the
element of corporate governance.
In order to manage risk effectively, it is important to first understand the legislative
framework and the standards that apply to risk management
Standards Australia
A standard is how specifications and procedures are designed to make sure that
methods and materials are fit for the purpose intended. They are documents that
are published to make sure that the standards are consistent across Australia.
The guide for managing risk is the Australian Standard ISO31000: 2009. Your
organisation will influence the design and implementation of risk through its
objectives, its products, services and the processes that it utilises.
In 2009, the AS/NZS1 4360:2004 was replaced with ISO 31000: 2009, Risk
Management Principles and Guidelines. Building on AS/NZS 4360:2004, ISO 31000
aims to improve and advance risk management practices within an organisation to
the point that it can be utilised by the organisation to benchmark and evaluate the
organisations practices.
Risk is defined by ISO 31000 as effect of uncertainty on objectives which is in
alignment with AS/NZS 4360:2004 the chance of something happening that will
impact on objectives. Hazards are defined as things that go wrong. The ISO
31000 standard has yet to be implemented, however, we shall now reflect on the
path that it shall take us in.
Risk management plan
The process of identifying risks, assessing risks and developing strategies to manage
risks is known as risk management. A risk management plan is an essential part of
any business as it helps you to understand potential risks to your business and
identify ways to minimise them or recover from their impacts.
Risk management is the process whereby organisations identify, assess and treat
risks that could potentially affect their business operations. It should be a central
part to any organisation's strategic management and its objective is to add
maximum sustainable value to all the activities of the organisation.
Risk management is not something that you just do once and forget about. Rather, it
should be a continuous and developing process. Risk management should also be
integrated into the culture of your business and you should put in effort to convey
Page 6 of 47
this to all your staff, from management to the workers. This approach to risk
management will create an environment of accountability, performance
measurement and reward, thus promote operational efficiency at all levels within
your business.
The following are some ways in which risk management can protect and add value to
your business:
Provide a framework for your business that enables future activity to take place in
a consistent and controlled manner
Improve decision making, planning and prioritisation by comprehensive and
structured understanding of business activity, volatility and project
opportunity/threat
Contribute to more efficient use/allocation of capital and resources
Reduce volatility in the non essential areas
Protect and enhance assets and the image of your business
Optimise operational efficiency
Preparing a risk management plan and business impact analysis

The process of identifying risks, assessing risks and developing strategies to manage
risks is known as risk management. A risk management plan and a business impact
analysis are important parts of your business continuity plan. By understanding
potential risks to your business and finding ways to minimise their impacts, you will
help your business recover quickly if an incident occurs.
Types of risk vary from business to business, but preparing a risk management plan
involves a common process. Your risk management plan should detail your strategy
for dealing with risks specific to your business.
It's important to allocate some time, budget and resources for preparing a risk
management plan and a business impact analysis. This will help you meet your legal
obligations for providing a safe workplace and can reduce the likelihood of an
incident negatively impacting on your business.
This guide outlines the steps involved in preparing a risk management plan and a
business impact analysis for your business.
Step 1: Identify risks to your business
The first step in preparing a risk management plan is to identify potential risks to
your business. Understanding the scope of possible risks will help you develop
realistic, cost-effective strategies for dealing with them.
Page 7 of 47
It's important that you think broadly when considering types of risks for your
business, rather than just looking at obvious concerns (e.g. fire, theft, market
competition).
Step 2: Assessing your business
Before you begin identifying risks, you need to assess your business. Think about
your critical business activities, including your key services, resources and staff, and
things that could affect them, such as power failures, natural disaster and illness.
Assessing your business will help you work out which aspects you couldn't operate
without.
Step 3: Identifying risks
Once you have a clear picture of your business, you can begin to identify the risks.
Review your business plan and think about what you couldn't do without, and what
type of incidents could impact on these areas. Ask yourself:
when, where, why and how are risks likely to happen in your business?
are the risks internal or external?
who might be involved or affected if an incident happens?
The following are some useful techniques for identifying risks.

Ask 'what if?' questions
Thoroughly review your business plan and ask as many 'what if?' questions as you
can. Ask yourself what if:
you lost power supply?

key documents were destroyed?
your premises was damaged or you were unable to access it?
one of your best staff members quit?
your suppliers went out of business?
the area your business is in suffered from a natural disaster?
the services you need, such as roads and communications, were closed?
Brainstorm
Brainstorming with different people, such as your accountant, financial adviser, staff
and other interested parties, will help you get many different perspectives on risks
to your business.
Page 8 of 47
Analyse other events

Think about other events that have, or could have, affected your business. What
were the outcomes of those events? Could they happen again? Think about what
possible future events could affect your business. Analyse the scenarios that might
lead to an event and what the outcome could be. This will help you identify risks that
might be external to your business.
Assess your processes
Use flow charts, checklists and inspections to assess your work processes. Identify
each step in your processes and think about the associated risks. Ask yourself what
could prevent each step from happening and how that would affect the rest of the
process.
Consider the worst case scenario
Thinking about the worst things that could happen to your business can help you
deal with smaller risks. The worst case scenario could be the result of several risks
happening at once. For example, someone running a restaurant could lose power,
which could then cause the food to spoil. If the restaurant owner was unaware of
the power outage or the chef decided to serve the food anyway, customers could
get food poisoning and the restaurant could be liable and suffer from financial losses
and negative publicity.
Once you've identified risks relating to your business, you'll need to analyse their
likelihood and consequences and then come up with options for managing them.
Step 4: Analyse and evaluate the impact of risks
Once you have identified the risks to your business, you need to assess the possible
impact of those risks. You need to separate minor risks that may be acceptable from
major risks that must be managed immediately.
Analysing the level of risk
To analyse risks, you need to work out the likelihood of it happening (frequency or
probability) and the consequences it would have (the impact) of the risks you have
identified. This is referred to as the level of risk, and can be calculated using this
formula:
level of risk = consequence x likelihood
Level of risk is often described as low, medium, high or very high. It should be
analysed in relation to what you are currently doing to control it. Keep in mind that
Page 9 of 47
control measures decrease the level of risk, but do not always eliminate it.
A risk analysis can be documented in a matrix, such as this:
Likelihood scale example
Level
4
3
2
1
Likelihood
Very likely
Likely
Unlikely
Very unlikely
Description
Happens more than once a year in this industry
Happens about once a year in this industry
Happens every 10 years or more in this industry
Has only happened once in this industry
Consequences scale example

Level Consequence
Description
4
Severe
Financial losses greater than $50,000
3
High
Financial losses between $10,000 and $50,000
2
Moderate
Financial losses between $1000 and $10,000
1
Low
Financial losses less than $1000
Note: Ratings vary for different types of businesses. The scales above use 4 different
levels; however, you can use as many levels as you need. Also use descriptors that
suit your purpose (e.g. you might measure consequences in terms of human health,
rather than dollar value).
Evaluating risks
Once you have established the level of risk, you then need to create a rating table for
evaluating the risk. Evaluating a risk means making a decision about its severity and
ways to manage it.
For example, you may decide the likelihood of a fire is 'unlikely' (a score of 2) but the
consequences are 'severe' (a score of 4). Using the tables and formula above, a fire
therefore has a risk rating of 8 (i.e. 2 x 4 = 8).
Risk rating table example
Risk rating
12-16
8-12
4-8
1-4
Description
Severe
High
Moderate
Low
Action
Needs immediate corrective action
Needs corrective action within 1 month
Needs corrective action within 3 months
Does not currently require corrective action
Your risk evaluation should consider the following factors:
Page 10 of 47
the importance of the activity to your business

the amount of control you have over the risk
potential losses to your business
any benefits or opportunities presented by the risk.
Once you have identified, analysed and evaluated your risks, you need to rank them
in order of priority. You can then decide which methods you will use to treat
unacceptable risks.
Step 5: Treat risks to your business

Treating risks involves working through options to deal with unacceptable risks to
your business. Unacceptable risks range in severity; some risks will require
immediate treatment while others can be monitored and treated later.
Your risk analysis and evaluation will help you prioritise the risks that need to be
treated. When you are developing a plan for treating the risks, consider the:
method of treatment
people responsible for treatment
costs involved
benefits of treatment
likelihood of success
ways to measure the success of treatments.
How and why you have chosen to treat risks should be outlined in your risk
management plan. It's important to review your plan regularly to take into account
any new risks associated with changes in your business or improvements in
techniques for treating risks. The following are different options for treating risks.
Avoid the risk
If it's possible, you may decide not to proceed with an activity that is likely to
generate risk. Alternatively, you may think of another way to reach the same
outcome that doesn't involve the same risks. This could involve changing your
processes, equipment or materials.
Reduce the risk
You can reduce a risk by:
reducing the likelihood of the risk happening - for example, through quality control
Page 11 of 47
processes, auditing, compliance with legislation, staff training, regular

maintenance or a change in procedures
reducing the impact if the risk occurs - for example, through emergency
procedures, off site data backup, minimising exposure to sources of risk, or
using public relations.
Transfer the risk

You may be able to shift some or all of the responsibility for the risk to another party
through insurance, outsourcing, joint ventures or partnerships. You may also be able
to transfer risk by:
cross-training staff so that more than one person knows how to do a certain task
and you don't risk losing essential skills or knowledge if something happens
to one of your staff members
identifying alternative suppliers in case your usual supplier is unable to deliver
keeping old equipment (after it is replaced) and practising doing things manually in
case your computer networks or other equipment can't be used.
Make sure you have adequate insurance

Speak to your insurer to find out if you have the right insurance cover for your
business. Be sure to clarify whether you are covered for the risks you have identified
in your risk management plan. Keep in mind that insurance policies may have
different definitions for certain incidents (e.g. flooding).
You should also check that you:
have coverage for the loss of income you could incur if customers affected by the
crisis stop ordering your product or service
have appropriate insurance to cover other related issues such as on-site injuries to
staff or visitors, or for loss of your customers' goods or materials
have coverage in case your supplier/s are affected by a crisis and can't deliver
necessary supplies for your business
are meeting your workers' compensation obligations in case any of your staff are
injured in a crisis.
Find out more about business insurance.
Accept the risk
You may accept a risk if it can't be avoided, reduced or transferred. Other risks may
be extremely unlikely and therefore too impractical or expensive to treat. However,
you will need to develop an incident response plan and a recovery plan to help you
Page 12 of 47
deal with the consequences of the risk if it occurs.
Review and update your risk management plan

You will need to test, evaluate and update your risk management plan regularly as
risks can change as your business, your industry and the environment you operate in
change. Regularly reviewing your risk management plan is essential for identifying
new risks and monitoring the effectiveness of your risk treatment strategies.
Strategies for testing your risk management plan
The following are some strategies for testing your plan.
Drills and training
You may be legally required to provide training and conduct drills to test some of the
workplace health and safety aspects of your business continuity plan, such as fire
evacuation plans. If you deal with hazardous materials, special equipment, or in risky
environments, you may need to provide training for your staff so they can do their
jobs safely and respond appropriately if there is an incident. Find out what
workplace health and safety codes of practice apply to your business.
Planning meetings
Planning meetings are a good way to bring staff together to inform them of the
business continuity plan and their individual responsibilities in an incident.
Examine the plan as a group to identify problems and solutions. If you have
developed a new plan or updated your old one, this will highlight any oversights. You
will then be able to modify the plan before undertaking testing exercises (e.g.
training or drills).
Scenario testing
Scenario testing works by simulating a live event and allowing staff to make
decisions as the scenario unfolds in much the same way they would in the event of a
real incident. When writing scenarios, think about the risks to your business that you
identified in your risk management plan. This will help you make the scenarios more
realistic and give you a better idea of how effective your plan is likely to be.
Business continuity
Your risk management plan should be part of a broader business continuity plan that
includes strategies for responding to and recovering from incidents if they do
happen. Making sure your business continuity plan is reliable and up to date will
help you resume operations quickly after an incident and reduce the impact to your
business.
Page 13 of 47
While you may be able to predict and deal with a large number of potential risks,
there will be some that are unexpected or impossible to plan for. Preparing an
incident response plan and a recovery plan as part of your overall business
continuity plan can help you deal with these situations if they happen.
A risk management plan is the prevention step in the prevention, preparedness,
response and recovery (PPRR) model of business continuity planning.
Step 6: Conduct a business impact analysis

Once you have developed a risk management plan, you can conduct a business
impact analysis to assess the likely impact of these risks on your business operations.
This is the preparedness step in the prevention, preparedness, response and
recovery (PPRR) model for developing a business continuity plan.
Critical business activities
A business impact analysis identifies the activities in your business operations that
are key to its survival. These are referred to as critical business activities. You should
consider things such as:
the records and documents you need everyday

the resources and equipment you need to operate
the access you need to your premises
the skills and knowledge your staff have that you need to run your business
external stakeholders you rely on or who rely on you
the legal obligations you are required to meet
the impact of ceasing to perform critical business activities
how long your business can survive without performing these activities.
As part of your business impact analysis, you should assign recovery time objectives
to each activity to help determine your basic recovery requirements. The recovery
time objective is the time from when an incident happens to the time that the
critical business activity must be fully operational in order to avoid damage to your
business.
Key questions in a business impact analysis
To conduct a business impact analysis for your business, ask yourself:
What are the daily activities conducted in each area of my business?
What are the long-term or ongoing activities performed by each area of my
business?
Page 14 of 47
What are the potential losses if these business activities could not be provided?
How long could each business activity be unavailable for (either completely or
partially) before my business would suffer?
Do these activities depend on any outside services or products?
How important are the activities to my business? For example, on a scale of 1 to 5
(1 being the most important and 5 being the least important), where would
each activity fall in relation to the rest of the business?
As the risks to your business change, so too will their potential impacts. When you
update your risk management plan, you will also need to conduct a new business
impact analysis. options for managing them.
Page 15 of 47
Section 2: Workplace health and safety

risk management
All businesses, regardless of their structure or size, must have workplace health and
safety risk assessment that is current and meets legal obligations.
What is the WHS law in Australia?

Work health and safety (WHS) legislation in Australia aims to prevent injury and
disease to persons in the workplace. State, Territory or Commonwealth legislation
applies.
Work health and safety is primarily the role of the States and Territories. The
Commonwealth is responsible for the health and safety and workers compensation
of its own employees and it also jointly funds the independent statutory agency Safe
Work Australia with the state and territory governments.
Most of the States and Territories have harmonised their legislation. The harmonised
jurisdictions are: NSW, QLD, SA, TAS, the ACT, the NT and the Commonwealth. WA is
likely to introduce legislation in 2013, to commence in 2014, but Victoria has no
legislation planned.
Despite some differences even in the harmonised legislation, the basic provisions are
essentially the same. The content of the legislation is comprehensive and the
following provisions appear in each one:
duties to provide a safe and healthy workplace for all workers and other
people who attend the workplace
work systems that are safe and without risk to health
training of workers to work in a safe and competent manner
requirements to take steps to prevent injury, illness and disease
Page 16 of 47
requirements to consult with employees and their representatives over WHS

matters
provisions for workplace inspectors to visit workplaces, investigate accidents
and enforce provisions of the legislation.
Common to all WHS legislation in Australia are the following features:

support for WHS in the workplace
provision of systems of work that are safe and without risk to health
prevention of injury and disease through the elimination or minimisation of
risks
protection of the general publics safety and health
workplace representation, consultation, co-operation and issue resolution
inspectors
regulations
enforcement.
The model Work Health and Safety (WHS) Act and the Work Health and Safety (WHS)
Regulations came into effect on 1 January
2012.
In addition to the WHS laws, there are
also model Codes of Practice which
provide support and guidance on
different issues in work health and safety.
Work Health and Safety Act 2011

The Work Health and Safety Act 2011(WHS Act) provides a framework to protect the
health, safety and welfare of all workers at work. It also protects the health and
safety of all other people who might be affected by the work.
All workers are protected by the WHS Act. This includes employees, contractors,
subcontractors, outworkers, apprentices and trainees, work experience students,
volunteers and employers who perform work. The WHS Act also provides protection
for the general public so that their health and safety is not placed at risk by work
activities.
Page 17 of 47
The WHS Act places the primary health and safety duty on a person conducting a
business or undertaking (PCBU), who must ensure, so far as is reasonably
practicable, the health and safety of workers at the workplace. Duties are also
placed on officers of a PCBU, workers and other persons at a workplace.
All duties under the WHS Act are qualified by the term 'reasonably practicable'.
Section 19
Primary duty
Persons conducting a business or undertaking (alone or with others, and whether or
not for profit or gain) have work health and safety duties unless they conduct the
business or undertaking solely as a worker in, or as an officer of, that business or
undertaking.
The duty of a person conducting a business or undertaking must ensure, so far as is
reasonably practicable, the health and safety of:
workers engaged, or caused to be engaged by the person, and
workers whose activities in carrying out work are influenced or directed by
the person, while the workers are at work in the business or undertaking.
A person conducting a business or undertaking must also ensure, so far as is
reasonably practicable, that the health and safety of other persons is not put
at risk from work carried out as part of the conduct of the business or
undertaking.
This primary duty encompasses the provision and maintenance of a work
environment without risks to health or safety, safe plant and structures and
safe systems of work. It also includes the safe use, handling, storage and
transport
of plant, structures and substances, the provision of and access to adequate
facilities for the welfare of workers, the provision of information, training,
instruction or supervision, and monitoring of the health of workers and the
conditions at the workplace.
Section 27
Officer duties
Officers of persons conducting a business or undertaking that have a duty or
obligation under the WHS Act must exercise due diligence to ensure that the
person conducting a business or undertaking complies with that duty or obligation.
Due diligence is defined to include taking reasonable steps in relation to:
acquiring and keeping up to date knowledge of work health and safety
matters,
gaining an understanding of the nature of the operations and the hazards
and risks associated with those operations,
ensuring that the person conducting a business or undertaking has available
and uses appropriate resources and processes to enable hazards associated
with the operations to be identified and risks eliminated or minimised,
Page 18 of 47
ensuring that the person conducting a business or undertaking has

appropriate processes for receiving and considering information regarding
incidents, hazards and risks and responding to these in a timely way,
ensuring that the person conducting a business or undertaking has and
implements processes for complying with the bodys duties and obligations,
and
verifying all of the above.
Officers of a person conducting a business or undertaking include all persons
who are officers under the Corporations Act 2001 (Cth) (other than a partner
in a partnership) and persons who are officers of the Crown, a public
authority (other than an elected member of a local authority) or an
unincorporated association.
Section 28
Workers duties
Workers must:
1. take reasonable care for their own health and safety,
2. take reasonable care that their acts or omissions do not adversely affect the
health and safety of other persons, and
3. comply, so far as the worker is reasonably able with any reasonable
instruction given by a person conducting a business or undertaking to allow
the person conducting the business or undertaking to comply with the model
WHS Bill, and
4. cooperate with any reasonable policy or procedure of the person conducting
the business or undertaking which relates to work health or safety and that
has been notified to workers.
The WHS Act also sets out the requirements for the following:
incident notification (Section 35-39)
Workplace incidents involving the death of a person, serious illness or injury
of a person and notifiable incidents (i.e. incidents that expose persons to
serious risks at a workplace) must be reported to the regulator by the person
who conducts the business or undertaking out of which the incident arose.
Persons with management or control of the workplace must ensure, so far as
is reasonably practicable, that the site of the incident is not disturbed until an
inspector arrives at the site or as otherwise directed by an inspector. There
are exceptions to this duty including any action taken to assist an injured
person.
This duty only applies so far as is reasonably practicable because the person
with management or control of a workplace will not always have complete
control of that workplace or the people within it.
Consultation with workers (Section 47-49)
Duty to consult workers (s47)
Persons conducting a business or undertaking must, so far as is reasonably
practicable, consult with workers who carry out work for the business or undertaking
Page 19 of 47
who are, or are likely to be, directly affected by a matter relating to health or safety
at work. Consultation must be in accordance with any procedures agreed between
the person conducting the business or undertaking and the workers.
The level of consultation should be proportionate to the circumstances, including
the significance of the work health or safety issue. All relevant factors must be
considered in determining the scope of the duty in a particular case, including the
seriousness of the matter, the number of affected workers and how the matter
affects individual workers.
More serious health or safety matters will attract more extensive consultation
requirements. This is important to ensure that businesses are fully informed when
making decisions about important health and safety matters
Nature of consultation (s48)

Consultation means:
sharing relevant information
giving workers a reasonable opportunity to express their views, raise issues
and contribute to decision making
taking workers views into account, and
advising workers of the outcome of the consultation in a timely manner.
If the workers are represented by a Health and Safety Representative, the
consultation must involve that representative.
When consultation is required (s49)
Consultation is required:
when identifying hazards and assessing risks arising from work
making decisions about ways to eliminate or minimise those risks
making decisions about the adequacy of facilities for the welfare of workers
proposing changes that may affect the health or safety of workers
making decisions about the procedures for resolving health or safety issues,
monitoring the health of workers or workplace conditions, information and
training or consultation with workers, and
and when carrying out any other activity prescribed by the model WHS
Regulations.
issue resolution (Section 80-82)
Issue resolution
Parties to an issue must use the issued resolution process under the model
WHS Bill if a work health or safety matter is not resolved after discussion
between the parties. The relevant parties are the person conducting the
relevant business or undertaking, the Health and Safety Representatives for
affected workers, and if nonethe affected workers or their representatives.
Parties to the issue are required to make reasonable efforts to achieve a
timely, final and effective resolution of the issue in accordance with the
relevant agreed procedure, or if there is no agreed procedure, the default
procedure prescribed by the model WHS Regulations.
Page 20 of 47
If the issue remains unresolved after reasonable efforts have been made, it
may be referred to an inspector to assist in resolving the issue.
inspector powers and functions (Section 156-190)

Inspectors may enter workplaces and exercise a broad range of powers upon entry
to monitor and secure compliance with the model WHS Bill and model WHS
Regulations.
Inspectors have prescribed powers relating to entry and assistance, search warrants,
requiring production of documents and answers to questions, obtaining and
retaining documents that are relevant to the exercise of their powers, seizing any
thing the inspector reasonably believes is evidence of an offence against the model
WHS Bill, taking and removing for examination, analysis or testing a sample of any
substance or thing, seizing dangerous workplaces and things, and other related
matters.
Inspectors also have a role in:
assisting with or determining particular disputes that may arise under the
model WHS Bill (e.g. in relation to work groups or Health and Safety
Representatives)
reviewing disputed Provisional Improvement Notices
requiring compliance with the model WHS Bill through the issuing of notices
investigating contraventions of the model WHS Bill, and
assisting in the prosecution of offences.
It is an offence to hinder or obstruct, impersonate, assault, threaten or
intimidate an inspector.
Offences and penalties (Section 30-33)

Penalty structure
Three categories of penalties apply to breaches of the work health and safety duties:
Category 1 - for reckless conduct that exposes an individual to a risk of death
or serious injury or illness and is engaged in without reasonable excuse,
Category 2 - failure to comply with a health and safety duty and exposing an
individual to a risk of death or serious injury or illness, and
Category 3 - failure to comply with a health and safety duty.
Maximum penalties are set according to the category of offence committed
and the type of duty holder (i.e. individual, officer or body corporate)
convicted of the offence
Page 21 of 47
WHS Regulations
1. The Regulations are made under section 276 of the Work Health and Safety
Act.
2. The Regulations are about a wide range of matters relating to work health
and safety, including:
1. (a) representation and participation (Chapter 2)
2. (b) managing risks to health and safety and general workplace
management (Chapter 3)
3. (c) hazardous work involving noise, hazardous manual tasks, confined
spaces, falls, demolition
work, electrical safety and energised electrical work, diving work and
licensing of high risk
work and accreditation of assessors of competency (Chapter 4)
4. (d) plant and structures (Chapter 5)
5. (e) construction work (Chapter 6)
6. (f) hazardous chemicals including lead (Chapter 7)
7. (g) asbestos (Chapter 8)
8. (h) major hazard facilities (Chapter 9);
9. (i) mines (Chapter 10), and
10. (j) review of decisions, exemptions, and prescribed serious illnesses
(Chapter 11).
Codes of practice
A code of practice provides practical guidance for people who have work health and
safety duties about how to achieve the standards required under the Act, and about
effective ways to identify and manage risks.
A code of practice applies to anyone who has a duty of care in the circumstances
described in the code. In most cases, following an approved code of practice would
achieve compliance with the health and safety duties in the Act, in relation to the
subject matter of the code. Like regulations, codes of practice deal with particular
issues and do not cover all hazards or risks which may arise. The health and safety
duties require duty holders to consider all risks associated with work, not only those
for which regulations and codes of practice exist.
Managing WHS risk

The WHS legislation requires persons who conduct a business or undertaking
(PCBUs) to manage all work health and safety risks, so that the health and safety of
workers and other people are not affected by an organisation's conduct.
Explaining 'hazards' and 'risks'
Hazard: A hazard is a situation that has the potential to harm a person.
Risk: A risk is the possibility that the harm (i.e. death, an injury or an illness) might
occur when exposed to a hazard.
Page 22 of 47
Risks and hazards

A hazard is something with the potential to cause harm. A risk is the likelihood that
the harm will occur from exposure to the hazard.
For example, if you have identified electricity as a potential hazard in your
workplace, the risk is the likelihood that a worker might be electrocuted because of
exposure to electrical wires that are inadequately insulated.
Another example would be where a worker is using a petrol-operated pump in a
confined space, such as a well. In this situation, carbon monoxide is a hazard. The
associated risk is the likelihood that the worker might suffer carbon monoxide
poisoning while working in the confined space because of the operating pump.
Hazards involving the risks of illness or injury may include:
chemicals and substances hazards - such as hazardous substances and
dangerous goods, asbestos, lead and waste management
biological hazards and infectious diseases - such as legionella and swine
influenza
physical hazards - such as equipment, confined spaces, electrical hazards and
working at heights
manual tasks hazards - such as the use of the human body to perform any
kind of manual task
environmental hazards - such as noise, lighting, surrounding environment
(including uneven floor surfaces, etc.), cold, dust and heat stress
psychosocial hazards - such as fatigue, mental stress, workplace harassment
and occupational violence
Risk management Code of Practice requirements

What is involved in managing risks?
Management commitment
Effective risk management starts with a commitment to health and safety from
those who operate and manage the business or undertaking. You also need the
involvement and cooperation of your workers, and if you show your workers that
you are serious about health and safety they are more likely to follow your lead.
To demonstrate your commitment, you should:
get involved in health and safety issues
invest time and money in health and safety
ensure health and safety responsibilities are clearly understood.
Page 23 of 47
A step-by-step process
A safe and healthy workplace does not happen by chance or guesswork. You have to
think about what could go wrong at your workplace and what the consequences
could be. Then you must do whatever you can (in other words, whatever is
reasonably practicable) to eliminate or minimise health and safety risks arising from
your business or undertaking.
This process is known as risk management and involves the four steps set out in this
Code (see Figure 1 below):
identify hazards find out what could cause harm

assess risks if necessary understand the nature of the harm that could be
caused by the hazard, how serious the harm could be and the likelihood of it
happening
control risks implement the most effective control measure that is
reasonably practicable in the circumstances
review control measures to ensure they are working as planned.
Figure 1: The risk management process

Many hazards and their associated risks are well known and have well established
and accepted control measures. In these situations, the second step to formally
assess the risk is unnecessary. If, after identifying a hazard, you already know the risk
and how to control it effectively, you may simply implement the controls.
Risk management is a proactive process that helps you respond to change and
facilitate continuous improvement in your business. It should be planned, systematic
and cover all reasonably foreseeable hazards and associated risks.
Consulting your workers
Page 24 of 47
Section 47: The WHS Act requires that you consult, so far as is reasonably
practicable, with workers who carry out work for you who are (or are likely to be)
directly affected by a work health and safety matter.
Section 48: If the workers are represented by a health and safety representative, the
consultation must involve that representative.
Consultation involves sharing of information, giving workers a reasonable
opportunity to express views and taking those views into account before making
decisions on health and safety matters.
Consultation with workers and their health and safety representatives is required at
each step of the risk management process. By drawing on the experience,
knowledge and ideas of your workers you are more likely to identify all hazards and
choose effective control measures.
You should encourage your workers to report any hazards and health and safety
problems immediately so that risks can be managed before an incident occurs.
If you have a health and safety committee, you should engage the committee in the
risk management process as well.
Consulting, co-operating and co-ordinating activities with other duty holders
Section 46: The WHS Act requires that you consult, co-operate and co-ordinate
activities with all other persons who have a work health or safety duty in relation to
the same matter, so far as is reasonably practicable.
Sometimes you may share responsibility for a health and safety matter with other
business operators who are involved in the same activities or who share the same
workplace. For example, if you engage on-hire workers as part of your workforce you
share a duty of care to these workers with the business that provides them. In these
situations, you must discuss the hazards and risks associated with the work and what
precautions will be taken with the on-hire firm.
Never assume that someone else is taking care of a health and safety matter. Find
out who is doing what and work together with other duty holders in a co-operative
and co-ordinated way so that all risks are eliminated or minimised as far as
reasonably practicable.
When entering into contracts you should communicate your safety requirements
and policies, review the job to be undertaken, discuss any safety issues that may
arise and how they will be dealt with. Remember that you cannot transfer your
responsibilities to another person.
Further guidance on consultation is available in the Code of Practice: Work Health
and Safety Consultation, Co-operation and Co-ordination.
When should a risk management approach be used?
Page 25 of 47
Managing work health and safety risks is an ongoing process that is triggered when
any changes affect your work activities. You should work through the steps in this
Code when:
starting a new business or purchasing a business

changing work practices, procedures or the work environment
purchasing new or used equipment or using new substances
planning to improve productivity or reduce costs
new information about workplace risks becomes available
responding to workplace incidents (even if they have caused no injury)
responding to concerns raised by workers, health and safety representatives
or others at the workplace
required by the WHS regulations for specific hazards
It is also important to use the risk management approach when designing and
planning products, processes or places used for work, because it is often easier and
more effective to eliminate hazards before they are introduced into a workplace by
incorporating safety features at the design stage.
STEP 1 HOW TO IDENTIFY HAZARDS
Identifying hazards in the workplace involves finding things and situations that could
potentially cause harm to people. Hazards generally arise from the following aspects
of work and their interaction:
physical work environment

equipment, materials and substances used
work tasks and how they are performed
work design and management
Table 1 below lists some common types of workplace hazards. Some hazards are
part of the work process, such as mechanical hazards, noise or toxic properties of
substances. Other hazards result from equipment or machine failures and misuse,
chemical spills and structural failures.
A piece of plant, substance or a work process may have many different hazards. Each
of these hazards needs to be identified. For example, a production line may have
dangerous moving parts, noise, hazards associated with manual tasks and
psychological hazards due to the pace of work.
Table 1: Examples of common hazards
Hazard
Potential harm
Manual tasks
Overexertion or repetitive movement can cause

muscular strain
Gravity
Falling objects, falls, slips and trips of people can cause

fractures, bruises, lacerations, dislocations, concussion,
Page 26 of 47
permanent injuries or death

Electricity
Potential ignition source.

Exposure to live electrical wires can cause shock, burns
or death from electrocution
Machinery and equipment
Being hit by moving vehicles, or being caught by

moving parts of machinery can cause fractures, bruises,
lacerations, dislocations, permanent injuries or death
Hazardous chemicals
Chemicals (such as acids, hydrocarbons, heavy metals)

and dusts (such as asbestos and silica) can cause
respiratory illnesses, cancers or dermatitis
Extreme temperatures
Heat can cause burns, heat stroke or fatigue

Cold can cause hypothermia or frost bite
Noise
Exposure to loud noise can cause permanent hearing

damage
Radiation
Ultra violet, welding arc flashes, micro waves and lasers

can cause burns, cancer or blindness
Biological
Micro-organisms can cause hepatitis, legionnaires

disease, Q fever, HIV/AIDS or allergies
Psychosocial hazards
Effects of work-related stress, bullying, violence and

work-related fatigue
How to find hazards

Inspect the workplace
Regularly walking around the workplace and observing how things are done can help
you predict what could or might go wrong. Look at how people actually work, how
plant and equipment is used, what chemicals are around and what they are used for,
what safe or unsafe work practices exist as well as the general state of
housekeeping.
Things to look out for include the following:
Does the work environment enable workers to carry out work without risks
to health and safety (for example, space for unobstructed movement,
adequate ventilation, lighting)?
How suitable are the tools and equipment for the task and how well are they
maintained?
Have any changes occurred in the workplace which may affect health and
safety?
Page 27 of 47
Hazards are not always obvious. Some hazards can affect health over a long period
of time or may result in stress (such as bullying) or fatigue (such as shiftwork). Also
think about hazards that you may bring into your workplace as new, used or hired
goods (for example, worn insulation on a hired welding set).
As you walk around, you may spot straightforward problems and action should be
taken on these immediately, for example cleaning up a spill. If you find a situation
where there is immediate or significant danger to people, move those persons to a
safer location first and attend to the hazard urgently.
Make a list of all the hazards you can find, including the ones you know are already
being dealt with, to ensure that nothing is missed. You may use a checklist designed
to suit your workplace to help you find and make a note of hazards.
Consult your workers
Ask your workers about any health and safety problems they have encountered in
doing their work and any near misses or incidents that have not been reported.
Worker surveys may also be undertaken to obtain information about matters such as
workplace bullying, as well as muscular aches and pains that can signal potential
hazards.
Review available information
Information and advice about hazards and risks relevant to particular industries and
types of work is available from regulators, industry associations, unions, technical
specialists and safety consultants.
Manufacturers and suppliers can also provide information about hazards and safety
precautions for specific substances (safety data sheets), plant or processes
(instruction manuals).
Analyse your records of health monitoring, workplace incidents, near misses, worker
complaints, sick leave and the results of any inspections and investigations to
identify hazards. If someone has been hurt doing a particular task, then a hazard
exists that could hurt someone else. These incidents need to be investigated to find
the hazard that caused the injury or illness.
Page 28 of 47
STEP 2 HOW TO ASSESS RISKS

A risk assessment involves considering what could happen if someone is exposed to
a hazard and the likelihood of it happening. A risk assessment can help you
determine:
how severe a risk is

whether any existing control measures are effective
what action you should take to control the risk
how urgently the action needs to be taken.
A risk assessment can be undertaken with varying degrees of detail depending on

the type of hazards and the information, data and resources that you have available.
It can be as simple as a discussion with your workers or involve specific risk analysis
tools and techniques recommended by safety professionals.
When should a risk assessment be carried out?
A risk assessment should be done when:
there is uncertainty about how a hazard may result in injury or illness

the work activity involves a number of different hazards and there is a lack of
understanding about how the hazards may interact with each other to
produce new or greater risks
changes at the workplace occur that may impact on the effectiveness of
control measures.
A risk assessment is mandatory under the WHS Regulations for high risk activities
such as entry into confined spaces, diving work and live electrical work.
Some hazards that have exposure standards, such as noise and airborne
contaminants, may require scientific testing or measurement by a competent person
to accurately assess the risk and to check that the relevant exposure standard is not
being exceeded (for example, by using noise meters to measure noise levels and
using gas detectors to analyse oxygen levels in confined spaces).
A risk assessment is not necessary in the following situations:
Legislation requires some hazards or risks to be controlled in a specific way

these requirements must be complied with.
A code of practice or other guidance sets out a way of controlling a hazard or
risk that is applicable to your situation and you choose to use the
recommended controls. In these instances, the guidance can be followed.
There are well-known and effective controls that are in use in the particular
industry, that are suited to the circumstances in your workplace. These
controls can simply be implemented.
How to do a risk assessment

All hazards have the potential to cause different types and severities of harm,
ranging from minor discomfort to a serious injury or death.
Page 29 of 47
For example, heavy liquefied petroleum gas (LPG) cylinders can cause muscular
strain when they are handled manually. However, if the cylinder is damaged causing
gas to leak which is then ignited, a fire could result in serious burns. If that leak
occurs in a store room or similar enclosed space, it could result in an explosion that
could destroy the building and kill or injure anyone nearby. Each of the outcomes
involves a different type of harm with a range of severities, and each has a different
likelihood of occurrence.
Work out how severe the harm could be
To estimate the severity of harm that could result from each hazard you should
consider the following questions:
What type of harm could occur (e.g. muscular strain, fatigue, burns,
laceration)? How severe is the harm? Could the hazard cause death, serious
injuries, illness or only minor injuries requiring first aid?
What factors could influence the severity of harm that occurs? For example,
the distance someone might fall or the concentration of a particular
substance will determine the level of harm that is possible. The harm may
occur immediately something goes wrong (e.g. injury from a fall) or it may
take time for it to become apparent (e.g. illness from long-term exposure to a
substance).
How many people are exposed to the hazard and how many could be harmed
in and outside your workplace? For example, a mobile crane collapse on a
busy construction site has the potential to kill or injure a large number of
people.
Could one failure lead to other failures? For example, could the failure of
your electrical supply make any control measures that rely on electricity
ineffective?
Could a small event escalate to a much larger event with more serious
consequences? For example, a minor fire can get out of control quickly in the
presence of large amounts of combustible materials.
Work out how hazards may cause harm

In most cases, incidents occur as a result of a chain of events and a failure of one or
more links in that chain. If one or more of the events can be stopped or changed, the
risk may be eliminated or reduced.
One way of working out the chain of events is to determine the starting point where
things begin to go wrong and then consider: If this happens, what may happen
next? This will provide a list of events that sooner or later cause harm. See the case
study in Appendix A.
In thinking about how each hazard may cause harm, you should consider:
the effectiveness of existing control measures and whether they control all
types of harm,
Page 30 of 47
how work is actually done, rather than relying on written manuals and
procedures
infrequent or abnormal situations, as well as how things are normally meant
to occur.
Consider maintenance and cleaning, as well as breakdowns of equipment and

failures of health and safety controls.
Work out the likelihood of harm occurring

The likelihood that someone will be harmed can be estimated by considering the
following:
How often is the task done? Does this make the harm more or less likely?
How often are people near the hazard? How close do people get to it?
Has it ever happened before, either in your workplace or somewhere else?

How often?
Table 2 contains further questions that can help you estimate likelihood.
You can rate the likelihood as one of the following:
Certain to occur - expected to occur in most circumstances

Very likely - will probably occur in most circumstances
Possible might occur occasionally
Unlikely could happen at some time
Rare may happen only in exceptional circumstances
The level of risk will increase as the likelihood of harm and its severity increases.
Page 31 of 47
Table 2
Questions to ask in
Explanation and examples
determining likelihood
How often are people
exposed to the
hazard?
A hazard may exist all of the time or it may only exist occasionally. The
more often a hazard is present, the greater the likelihood it will result
in harm.
For example:
Meshing gears in an enclosed gearbox can cause crushing only if

the gearbox is open during maintenance, and therefore the
potential for harm will not occur very often.
How long might

people be exposed to
the hazard?
Continuously lifting heavy boxes has the potential to cause

harm whenever the work is done.
The longer that someone is exposed to a hazard, the greater the
likelihood that harm may result.
For example:
The longer a person is exposed to noisy work, the more likely it is that
they will suffer hearing loss.
How effective are

current controls in
reducing risk?
In most cases the risks being assessed will already be subject to some
control measures. The likelihood of harm resulting from the risk will
depend upon how adequate and effective the current measures are.
For example:
Traffic management controls have been implemented in a warehouse
to separate moving forklifts from pedestrians by using signs and
painted lines on the floor. These controls may need to be upgraded to
include physical barriers.
Could any changes in

your organisation
increase the
likelihood?
The demand for goods or services in many organisations varies

throughout the year. Changes in demand may be seasonal, depend on
environmental conditions or be affected by market fluctuations that
are driven by a range of events. Meeting increased demand may cause
unusual loads on people, plant and equipment and systems of work.
Failures may be more likely.
For example:
Inner city restaurants and bistros are very busy in the period prior to
Christmas, placing extra demands on kitchen and serving staff. The
increase in volume of food to be prepared and serving a larger number
of patrons increases the potential for human error and the likelihood of
Page 32 of 47
harm.
Are hazards more
likely to cause harm
because of the
working environment?
Could the way people

act and behave affect
the likelihood of a
hazard causing harm?
Do the differences
between individuals in
the workplace make it
more likely for harm
to occur?
Examples of situations where the risk of injury or illness may become

more likely:
Environmental conditions change. For example, work performed

in high temperatures in a confined space increases the potential
for mistakes because workers become fatigued more quickly;
wet conditions make walkways and other things slippery.
People are required to work quickly. The rate at which work is
done (e.g. number of repetitions) can over-stress a persons
body or make it more likely that mistakes will be made.
There is insufficient light or poor ventilation.
The possibility that people may make mistakes, misuse items, become
distracted or panic in particular situations needs to be taken into
account. The effects of fatigue or stress may make it more likely that
harm will occur.
People with disabilities may be more likely to suffer harm if the
workplace or process is not designed for their needs.
New or young workers may be more likely to suffer harm because of
inexperience.
People who do not normally work at the workplace will have less
knowledge than employees who normally work there, and may be
more likely to suffer harm. These people include contractors, visitors or
members of the public.
Page 33 of 47
STEP 3 HOW TO CONTROL RISKS

The most important step in managing risks involves eliminating them so far as is
reasonably practicable, or if that is not possible, minimising the risks so far as is
reasonably practicable.
In deciding how to control risks you must consult your workers and their
representatives who will be directly affected by this decision. Their experience will
help you choose appropriate control measures and their involvement will increase
the level of acceptance of any changes that may be needed to the way they do their
job.
There are many ways to control risks. Some control measures are more effective
than others.
You must consider various control options and choose the control that most
effectively eliminates the hazard or minimises the risk in the circumstances. This may
involve a single control measure or a combination of different controls that together
provide the highest level of protection that is reasonably practicable.
Some problems can be fixed easily and should be done straight away, while others
will need more effort and planning to resolve. Of those requiring more effort, you
should prioritise areas for action, focusing first on those hazards with the highest
level of risk.
The hierarchy of risk control
The ways of controlling risks are ranked from the highest level of protection and
reliability to the lowest as shown in Figure 2. This ranking is known as the hierarchy
of risk control. The WHS Regulations require duty holders to work through this
hierarchy when managing risk under the WHS Regulations.
Page 34 of 47
Figure 2: The hierarchy of risk control

You must always aim to eliminate a hazard, which is the most effective control. If
this is not reasonably practicable, you must minimise the risk by working through the
other alternatives in the hierarchy.
Level 1 control measures

The most effective control measure involves eliminating the hazard and associated
risk. The best way to do this is by, firstly, not introducing the hazard into the
workplace. For example, you can eliminate the risk of a fall from height by doing the
work at ground level.
Eliminating hazards is often cheaper and more practical to achieve at the design or
planning stage of a product, process or place used for work. In these early phases,
there is greater scope to design out hazards or incorporate risk control measures
that are compatible with the original design and functional requirements. For
example, a noisy machine could be designed and built to produce as little noise as
possible, which is more effective than providing workers with personal hearing
protectors.
You can also eliminate risks by removing the hazard completely, for example, by
removing trip hazards on the floor or disposing of unwanted chemicals.
Page 35 of 47
It may not be possible to eliminate a hazard if doing so means that you cannot make
the end product or deliver the service. If you cannot eliminate the hazard, then
eliminate as many of the risks associated with the hazard as possible.

If it is not reasonably practicable to eliminate the hazards and associated risks, you
should minimise the risks using one or more of the following approaches:
Substitute the hazard with something safer
For instance, replace solvent-based paints with water-based ones.
Isolate the hazard from people
This involves physically separating the source of harm from people by distance or
using barriers. For instance, install guard rails around exposed edges and holes in
floors; use remote control systems to operate machinery; store chemicals in a fume
cabinet.
Use engineering controls
An engineering control is a control measure that is physical in nature, including a

mechanical device or process. For instance, use mechanical devices such as trolleys
or hoists to move heavy loads; place guards around moving parts of machinery;
install residual current devices (electrical safety switches); set work rates on a
production line to reduce fatigue.

These control measures do not control the hazard at the source. They rely on human
behaviour and supervision, and used on their own, tend to be least effective in
minimising risks. Two approaches to reduce risk in this way are:
Use administrative controls
Administrative controls are work methods or procedures that are designed to

minimise exposure to a hazard. For instance, develop procedures on how to operate
machinery safely, limit exposure time to a hazardous task, use signs to warn people
of a hazard.
Use personal protective equipment (PPE)
Examples of PPE include ear muffs, respirators, face masks, hard hats, gloves, aprons
and protective eyewear. PPE limits exposure to the harmful effects of a hazard but
only if workers wear and use the PPE correctly.
Administrative controls and PPE should only be used:
when there are no other practical control measures available (as a last resort)
Page 36 of 47
as an interim measure until a more effective way of controlling the risk can
be used
to supplement higher level control measures (as a back-up).
Regulation 44-47: The WHS Regulations include specific requirements if PPE is to

be used at the workplace, including that the equipment is:
selected to minimise risk to health and safety
suitable for the nature of the work and any hazard associated with the work
a suitable size and fit and reasonably comfortable for the person wearing it
maintained, repaired or replaced so it continues to minimise the risk
used or worn by the worker, so far as is reasonably practicable.
A worker must, so far as reasonably able, wear the PPE in accordance with any
information, training or reasonable instruction.
How to develop and implement control options

Information about suitable controls for many common hazards and risks can be
obtained from:
codes of practice and guidance material

manufacturers and suppliers of plant, substances and equipment used in
your workplace
industry associations and unions.
In some cases, published information will provide guidance on the whole work
process. In other cases, the guidance may relate to individual items of plant or how
to safely use specific substances. You may use the recommended control options if
they suit your situation and eliminate or minimise the risk.
Developing specific control measures

You may need to develop specific control measures if the available information is not
relevant to the hazards and risks or circumstances at your workplace. This can be
done by referring to the chain of events that were recorded during the risk
assessment.
For each of the events in the sequence, ask: What can be done to stop or change
the event occurring? An example of this approach is shown in Appendix A.
Working through the events in the sequence will give you ideas about all possible
ways to eliminate or minimise the risk. There may be more than one solution for
each of the events. The control option you choose should be:
one that provides the highest level of protection for people and is the most
reliable that is, controls located towards the top of the hierarchy in Figure 2
available that is, it can be purchased, made to suit or be put in place.
Page 37 of 47
suitable for the circumstance in your workplace that is, it will work properly
given the workplace conditions, work process and your workers.
Where the hazard or risk has the potential to cause death, serious injury or illness,
more emphasis should be given to those controls that eliminate or reduce the level
of harm, than those that reduce the likelihood of harm occurring.
Make sure that your chosen solution does not introduce new hazards.
Cost of control measures

All risks can be controlled and it is always possible to do something, such as stopping
the activity or providing instructions to those exposed to the risk. There will normally
be a number of different options between these two extremes. Cost (in terms of
time and effort as well as money) is just one factor to consider when determining
the best control option.
The cost of controlling a risk may be taken into account in determining what is
reasonably practicable, but cannot be used as a reason for doing nothing.
The greater the likelihood of a hazard occurring and/or the greater the harm that
would result if the hazard or risk did occur, the less weight should be given to the
cost of controlling the hazard or risk.
If two control measures provide the same levels of protection and are equally
reliable, you can adopt the least expensive option.
Cost cannot be used as a reason for adopting controls that rely exclusively on
changing peoples behaviour or actions when there are more effective controls
available that can change the risk through substitution, engineering or isolation.
Implementing controls
The control measures that you put into operation will usually require changes to the
way work is carried out due to new or modified equipment or processes, new or
different chemicals or new personal protective equipment. In these situations, it is
usually necessary to support the control measures with:
Work procedures
Develop a safe work procedure that describes the task, identifies the hazards
and documents how the task is to be performed to minimise the risks.
Training, instruction and information

Train your workers in the work procedure to ensure that they are able to
perform the task safely. Training should require workers to demonstrate that
they are competent in performing the task according to the procedure. It is
insufficient to simply give a worker the procedure and ask them to
acknowledge that they understand and are able to perform it. Training,
Page 38 of 47
instruction and information must be provided in a form that can be

understood by all workers.
Information and instruction may also need to be provided to others who
enter the workplace, such as customers or visitors.
Supervision
The level of supervision required will depend on the level of risk and the
experience of the workers involved. High levels of supervision are necessary
where inexperienced workers are expected to follow new procedures or
carry out difficult and critical tasks.
You may prepare a risk register that identifies the hazards, what action needs to be
taken, who will be responsible for taking the action and by when. An example is
provided at Appendix B.
How to ensure that controls remain effective
The following actions may help you monitor the control measures you have
implemented and ensure that they remain effective:
Accountability for health and safety Accountability should be clearly

allocated to ensure procedures are followed and maintained. Managers and
supervisors should be provided with the authority and resources to
implement and maintain control measures effectively.
Maintenance of plant and equipment This will involve regular inspection

and testing, repair or replacement of damaged or worn plant and equipment.
It includes checking that any control measures are suitable for the nature and
duration of work, are set up and used correctly.
Up-to-date training and competency Control measures, particularly lower

level controls, depend on all workers and supervisors having the appropriate
competencies to do the job safely. Training should be provided to maintain
competencies and to ensure new workers are capable of working safely.
Up-to-date hazard information Information about hazards, such as plant

and substances, may be updated by manufacturers and suppliers and should
be checked to make sure controls are still relevant. New technology may
provide more effective solutions than were previously available. Changes to
operating conditions or the way activities are carried out may also mean that
control measures need to be updated.
Regular review and consultation Control measures are more effective

where there is regular review of work procedures and consultation with your
workers and their representatives.
Page 39 of 47
STEP 4 HOW TO REVIEW CONTROLS

The control measures that you put in place should be reviewed regularly to make
sure they work as planned. Dont wait until something goes wrong.
There are certain situations where you must review your control measures under the
WHS Regulations and, if necessary, revise them. A review is required:
when the control measure is not effective in controlling the risk

before a change at the workplace that is likely to give rise to a new or different
health and safety risk that the control measure may not effectively control
if a new hazard or risk is identified
if the results of consultation indicate that a review is necessary
if a health and safety representative requests a review.
You may use the same methods as in the initial hazard identification step to check
controls. Consult your workers and their health and safety representatives and
consider the following questions:
Are the control measures working effectively in both their design and
operation?
Have the control measures introduced new problems?
Have all hazards been identified?
Have new work methods, new equipment or chemicals made the job safer?
Are safety procedures being followed?
Has instruction and training provided to workers on how to work safely been
successful?
Are workers actively involved in identifying hazards and possible control
measures? Are they openly raising health and safety concerns and reporting
problems promptly?
Is the frequency and severity of health and safety incidents reducing over
time?
If new legislation or new information becomes available, does it indicate
current controls may no longer be the most effective?
If problems are found, go back through the risk management steps, review your
information and make further decisions about risk control. Priority for review should
be based on the seriousness of the risk. Control measures for serious risks should be
reviewed more frequently.
Quality assurance processes may be used if you design, manufacture or supply
products used for work to check that the product effectively minimises health and
safety risks. Obtain feedback from users of the product to determine whether any
improvements can be made to make it safer.
Page 40 of 47
KEEPING RECORDS
Keeping records of the risk management process demonstrates potential compliance
with the WHS Act and Regulations. It also helps when undertaking subsequent risk
assessments.
Keeping records of the risk management process has the following benefits. It:
allows you to demonstrate how decisions about controlling risks were made
assists in targeting training at key hazards
provides a basis for preparing safe work procedures
allows you to more easily review risks following any changes to legislation or
business activities
demonstrates to others (regulators, investors, shareholders, customers) that
work health and safety risks are being managed.
The detail and extent of recording will depend on the size of your workplace and the
potential for major work health and safety issues. It is useful to keep information on:
the identified hazards, assessed risks and chosen control measures (including
any hazard checklists, worksheets and assessment tools used in working
through the risk management process)
how and when the control measures were implemented, monitored and
reviewed
who you consulted with
relevant training records
any plans for changes.
There are specific record-keeping requirements in the WHS Regulations for some
hazards, such as hazardous chemicals. If such hazards have been identified at your
workplace, you must keep the relevant records for the time specified.
You should ensure that everyone in your workplace is aware of record-keeping
requirements, including which records are accessible and where they are kept.
Page 41 of 47
Section 3: Managing workplace health and safety in

your business in Queensland
You can improve how your business manages workplace health and safety by using
the following helpful resources.
Build business resilience
Improve how you will deal with workplace incidents by developing a business
continuity plan and conducting a comprehensive analysis of how your business could
be affected by various possible incidents.
If your business does suffer from a major incident, having a business continuity plan
could help you continue to operate and avoid having to close.
Participate in the Zero Harm at Work initiative
All Queensland workplaces are encouraged to participate in the Zero Harm at Work
initiative. Zero harm means no harm to anyone, anytime while at work. The initiative
hopes to achieve this by building a positive safety culture in Queensland workplaces.
Get involved in Zero Harm at Work.
Access Workplace Health and Safety Queensland's resources
You may be eligible for a Workplace Health and Safety Queensland (WHSQ) small
business advisor to visit your workplace and assess your situation. They can give you
advice on your safety management system and provide information on solutions
available to fix health and safety issues. Find out if you're eligible and arrange a
workplace consultation for your business.
WHSQ also offers:
information on workplace training, which helps ensure staff have the skills
and knowledge they need to perform their work safely
a range of small business workshops to help you manage safety in your
workplace
information on specific hazards and health and safety guides for various small
businesses, industry sectors and occupations
educational resources, events, publications and videos
up-to-date information in the eSAFE newsletter.
Page 42 of 47
Keeping your workplace safe

As an employer, you are legally obligated to provide a safe workplace for yourself,
your workers, customers, and other people such as members of the public and
visitors. This is a requirement under the Work Health & Safety Act 2011, and
significant fines and penalties apply for employers who don't meet the obligations
under the Act.
You can manage workplace health and safety in your business by developing a plan
that is simple, practical, and easy to implement. Effectively managing health and
safety in your workplace is also good business - avoiding accidents and illness at
work can lower your costs, increase productivity and improve your reputation.
This guide gives you the information you need to keep your workplace safe.
Workplace rights and obligations
Workplace health and safety obligations apply to everyone involved in a business.
Ensure you meet your obligations by familiarising yourself with the laws and
following them.
If you don't meet your workplace health and safety obligations, you are putting
people's health and even their lives at risk. You are also breaking the law and you
may face penalties or prosecution.
Business owners and employers
If you operate a business, you are legally required to provide and maintain a safe and
healthy workplace for yourself and your workers, volunteers, customers and visitors.
Workplace health and safety legislation requires you to:
ensure safe systems of work
ensure safe use and handling of goods and substances
provide information, instruction, training and supervision to your workers to
ensure they are safe
assess risks and implement appropriate measures for controlling them
report notifiable incidents to Workplace Health and Safety Queensland
investigate incidents and take action to avoid having something similar
happen again
provide workers' compensation insurance.
Workers
Workers have workplace health and safety obligations to themselves and their
workmates. As a worker, you must:
comply with instructions given for workplace health and safety
use personal protective equipment if your employer provides it and if you are
properly trained to use it
not wilfully or recklessly interfere with or misuse anything provided for
workplace health and safety at the workplace
not wilfully place others at risk
not wilfully injure yourself.
Page 43 of 47
Legislation in Queensland
Workplace Health and Safety Queensland (WHSQ) monitors workplace health and
safety in Queensland businesses. WHSQ enforces workplace health and safety laws
and conducts inspections and investigations to ensure employers and others are
meeting their obligations.
To understand your obligations and safety requirements, you must be familiar with:
Work Health and Safety Act 2011 (PDF, 1.41MB), which imposes obligations
on people at workplaces to ensure workplace health and safety
Work Health and Safety Regulation 2011 (PDF, 2.70MB), which describes
what must be done to prevent or control certain hazards which cause injury,
illness or death
work health and safety codes of practice, which are designed to give practical
advice about ways to manage exposure to risks common to industry.
If there is a regulation or code of practice that describes how to manage a risk in
your business, you must follow it. If there is no regulation or code of practice, you
must take reasonable precautions and choose an appropriate way to minimise the
risk.
WHSQ inspectors help employers to develop and improve work practices in the
workplace. If you fail to meet your health and safety obligations, a provisional
improvement notice (PIN) or prohibition notice may be issued. Read more about
enforcement options.
Workplace incidents
You should be proactive in preparing for workplace incidents, as they can have a
dramatic impact on your business - for example, loss of staff, decreased productivity,
and repair and rehabilitation costs.
By law, you must report certain incidents such as a death, serious injury or illness to
Workplace Health and Safety Queensland (WHSQ). You may face penalties if you fail
to report these events. You are also legally obligated to prepare for emergency
situations, such as fire.
Preparing for workplace incidents
Develop and implement a safety management system for addressing incidents in
your workplace before they happen. A safety management system combines
information, resources and processes that you need to manage workplace health
and safety.
WHSQ's Serious about Safe Business pack can help you develop your own safety
management system. It includes advice on:
Page 44 of 47
achieving commitment from managers

consulting with staff
safe work procedures
training and supervision
reporting incidents
workers' compensation and return-to-work programs.
Preparing for emergency situations

You must follow the Building Fire Safety Regulation 2008 (PDF, 531KB) to ensure you
are prepared in case of fire or other emergency situations.
The Queensland Fire and Rescue Service offers comprehensive fire safety training
and a range of other products and services for workplaces in businesses and
industry.
You should also consider emergencies specific to your location, such as floods or
cyclones, and implement plans for dealing with them. Learn more about preparing
your business for emergencies and disasters.
Reporting and recording workplace incidents
You are legally required to report a 'notifiable' workplace incident immediately after
becoming aware that it has occurred. If you fail to report a notifiable incident, you
may face penalties. Notifiable incidents include:
death
serious bodily injury
work-caused illness
dangerous events
dangerous electrical events
serious electrical incidents
major accidents.
Other 'non-notifiable' incidents don't need to be reported; however, WHSQ
recommends that you record and investigate them so that you can prevent
something similar from happening again.
Investigating workplace incidents
You must investigate workplace incidents, whether they are reported to WHSQ or
not, and find a solution.
To investigate an incident, you need to collect information and establish facts about
the incident - who was involved, what happened, where and how it happened, and
why. This information will help you work out how to fix the problem. You may
appoint trained safety advisors, workplace health and safety representatives, or
committees to conduct an internal investigation and make recommendations.
Resolving and recovering from workplace incidents
Page 45 of 47
Once you have completed an investigation of a workplace incident and found a

solution, you should reassess workplace health and safety policies, procedures and
systems. You may need to implement new guidelines for safe work, review staff
training and change work spaces and equipment.
A workplace incident may involve workers' compensation. Under workers'
compensation laws, you may be required to develop a rehabilitation return-to-work
plan for an injured worker.
Legal obligations when training staff
As an employer, you are legally obliged to make sure your staff are trained to do
their jobs safely. Certain industries also require specific training. Remember to keep
a record of any training your staff complete.
Workplace health and safety training
As an employer, you must provide workplace health and safety training in order to
keep your workplace safe for you, your staff and any visitors or customers.
You need to train your staff when they start working for you and provide regular
refresher training. If you have made any changes to your business (e.g. to
equipment, materials or processes), you will need to update your training. Providing
training can reduce the chances of workplace incidents and injuries. Find out more
about keeping your workplace safe.
You must include workplace health and safety training in inductions for new and
returning staff. You should also train staff in pandemic risk management.
Changes to workplace health and safety legislation
Queensland's workplace health and safety laws changed as of 1 January 2012. The
new legislation brings all Australian states and territories together under the Work
Health Safety Act 2011.
Fire and emergency training
You must make sure your staff know what to do in the event of a fire or other
emergency. You must provide regular evacuation training for staff so they
understand emergency procedures, including evacuation instructions, assembly
point locations and use of fire alarms and equipment.
As a business owner or manager occupying a building in Queensland, you have a
legal obligation to ensure the safety of any person in that building in the event of a
fire or other emergency. It is also a legal requirement that you practice an
evacuation annually as part of your training.
The Queensland Fire and Rescue Service offers comprehensive fire safety training
and a range of other products and services for workplaces. Learn more about
training and emergency management.
Page 46 of 47
Personal protective equipment (PPE)

If your staff need to use PPE in order to keep safe when they're doing their jobs, you
need to make sure they are properly trained. Training should cover arrangements for
providing, using, storing and maintaining PPE.
Industry-specific training
Certain industries and job roles will require specific training. For example, if your
staff need to drive a truck, forklift or operate machinery, you must make sure they
have the appropriate licences.
Some key examples of industry and job-specific training are:
Security and cash
You should make sure that your staff are trained to use security equipment and
understand cash management procedures. Staff should also be trained to be
prepared in the event of an attempted robbery. Find out more about protecting your
business from crime and personal security in the workplace.
Page 47 of 47

Study Guide PDF

Cargado por

Información del documento

Título original

Derechos de autor

Formatos disponibles

Compartir este documento

Compartir o incrustar documentos

Opciones para compartir

¿Le pareció útil este documento?

¿Este contenido es inapropiado?

Copyright:

Formatos disponibles

Study Guide PDF

Cargado por

Copyright:

Formatos disponibles

Risk and WHS

Risk and WHS- Study Guide Version January 2014

Section 1: Manage Risks

Types of business risk

Risk and WHS- Study Guide Version January 2014

Common small business risks

Direct risks to your business

Risk and WHS- Study Guide Version January 2014

Indirect risks to your business

will not be able to operate your business

Risk and WHS- Study Guide Version January 2014

What is risk management?

Risk and WHS- Study Guide Version January 2014

Preparing a risk management plan and business impact analysis

Risk and WHS- Study Guide Version January 2014

The following are some useful techniques for identifying risks.

you lost power supply?

Risk and WHS- Study Guide Version January 2014

Analyse other events

Risk and WHS- Study Guide Version January 2014

Consequences scale example

Your risk evaluation should consider the following factors:

Risk and WHS- Study Guide Version January 2014

the importance of the activity to your business

Step 5: Treat risks to your business

Risk and WHS- Study Guide Version January 2014

processes, auditing, compliance with legislation, staff training, regular

Transfer the risk

Make sure you have adequate insurance

Risk and WHS- Study Guide Version January 2014

deal with the consequences of the risk if it occurs.

Review and update your risk management plan

Risk and WHS- Study Guide Version January 2014

Step 6: Conduct a business impact analysis

the records and documents you need everyday

Risk and WHS- Study Guide Version January 2014

Risk and WHS- Study Guide Version January 2014

Section 2: Workplace health and safety

What is the WHS law in Australia?

Risk and WHS- Study Guide Version January 2014

requirements to consult with employees and their representatives over WHS

Common to all WHS legislation in Australia are the following features:

Work Health and Safety Act 2011

Risk and WHS- Study Guide Version January 2014

Risk and WHS- Study Guide Version January 2014

ensuring that the person conducting a business or undertaking has

Risk and WHS- Study Guide Version January 2014

Nature of consultation (s48)

Risk and WHS- Study Guide Version January 2014

inspector powers and functions (Section 156-190)

Offences and penalties (Section 30-33)

Risk and WHS- Study Guide Version January 2014

Managing WHS risk

Risk and WHS- Study Guide Version January 2014

Risks and hazards

Risk management Code of Practice requirements

get involved in health and safety issues

invest time and money in health and safety

ensure health and safety responsibilities are clearly understood.

Risk and WHS- Study Guide Version January 2014

identify hazards find out what could cause harm

Figure 1: The risk management process

Risk and WHS- Study Guide Version January 2014