ISO Advice: Risk vs Hazard; What’s the Difference?

As an ISO Consultant, we deal with identifying risks and hazards with our clients when building their ISO Management Systems. During this phase, there are often questions about risk vs hazard and what the differences are.

As ISO certifications have evolved over time, it seems like the main emphasis of the newer standards is on identifying the risks and doesn’t focus on the hazards as much.

If you would like some support on identifying the risks and hazards within your organisation for ISO compliance, then contact our team of isologists today.

Risk vs Hazard

From an ISO consultancy perspective, it’s essential to distinguish clearly between hazards and risks, as the two are often confused. A hazard is anything with the inherent potential to cause harm, for example, a process, substance, activity, or condition. In contrast, risk reflects the likelihood that the harm will actually occur, combined with the severity of its potential impact.

When we work with clients, we help them not only identify hazards within their operations but also evaluate and prioritise the associated risks. This ensures resources are directed where they can make the most meaningful difference. Understanding this distinction underpins effective risk-based thinking, a core expectation across modern ISO management system standards.

ISO 45001 – More emphasis on Risk, rather than Hazard?

ISO 45001 is the Occupational Health and Safety Management; within this standard, risks and hazards are particularly prevalent. Following the update in 2018, this standard has more emphasis on risks than hazards.  This can be seen as more proactive. The requirements and structure of ISO 45001 require risks to be evaluated and remedied, rather than being hazard control.

With the inclusion of identifying OH&S (and other) opportunities, addressing the need to act to enhance or improve the management system comes out of the risk identification, hazard identification and other activities within the organisation.

Risks in ISO Standards

Risk is ‘the effect of uncertainty’, and by reducing the effect of uncertainty, we will reduce our organisation’s risk exposure.  ISO 45001 sets out to do this by requiring organisations to be clear on and understand:

• What they have to do (legal requirements).
• What they chose to do (other requirements).
• How they will do it (planning, support, and operations).
• It is being done (performance evaluation).
• How to do it better (Improvement).

Risk-based thinking starts at the very beginning, when organisations are considering their context, the relevant requirements of their interested parties and the scope that the OH&S management system is to cover. Considerations should be made for both internal and external issues, and the potential impact they can have on the systems and processes.

Internal Risk Examples

These originate within the organisation and are influenced by internal processes, culture, or resources. Examples include:

• Inadequate training or competence gaps leading to unsafe work practices.
• Poor safety culture, such as low incident reporting or weak leadership engagement.
• Ageing or poorly maintained equipment increasing the likelihood of failure.
• High staff turnover resulting in inexperienced workers on critical tasks.
• Ineffective communication causing misunderstandings about safety procedures.
• Process changes introduced without proper risk assessment.

External Risk Examples

These arise from outside the organisation and are often less directly controllable, but still need to be considered and assessed.

• Supply chain disruptions, impacting the availability of safe equipment or PPE.
• Changes in legislation requiring rapid adjustment to safety controls.
• Extreme weather events affecting site safety or access.
• Contractor performance issues, where third-party practices don’t meet required standards.
• Economic pressures, leading to reduced budgets for maintenance or safety improvements.
• Technological changes requiring new competencies or introducing new hazards.

When identifying external and internal issues, and needs and expectations of interested parties, there may be a risk source that will require assessment and action as required.

As with all risk-related areas, planning to address should be proportionate to the perceived level of risk identified and the objectives of the organisation.

Hazards in ISO Standards

Whilst considering all potential risks (to OH&S performance), focus should be on those hazards that are most likely to occur or have the most impact.

Hazard Examples include;

Physical Hazards

• Working at height (ladders, scaffolds, roofs)
• Moving or rotating machinery
• Noise, vibration, or extreme temperatures
• Slips, trips, and falls from poor housekeeping or wet floors
• Electrical hazards from damaged cables or faulty equipment

Chemical and Biological Hazards

• Exposure to hazardous substances, fumes, dusts, or solvents
• Poor storage, handling, or mixing of chemicals
• Bacteria, viruses, moulds, or other biological agents
• Contact with waste, bodily fluids, or contaminated materials

Other Hazards

• Excessive workloads, stress, bullying, or poor organisational culture

These examples support a thorough hazard identification process aligned with ISO 45001’s proactive, risk-based approach.

Reduction and/or prevention of undesired effects will help the organisation achieve its goals and objectives and continual improvement.

Risks and Hazards in ISO Certifications

Awareness of these sources of risk, which have the potential to occur or are known actual events and consequences, can lead to both risk and opportunity. Identifying and determining the risks and opportunities can support the organisation at both its strategic and operational levels.

Contact Blackmores today for more information.