Is a risk assessment legally required in Australia?

The duty to manage risk is. Australian work health and safety law requires the business carrying out the work to eliminate risk so far as is reasonably practicable, and to minimise it where elimination is not reasonably practicable. A written risk assessment is expressly required for some work, including high risk construction work, confined spaces, asbestos and hazardous chemicals. For everything else the assessment is how you demonstrate the duty was met, rather than a document the law names.

What is the difference between a risk assessment and a SWMS?

A risk assessment is the thinking: what could cause harm, how serious, how likely, and what will be done about it. A Safe Work Method Statement is a specific document required before high risk construction work starts, setting out the work in a logical sequence of steps with the hazards and controls for each. The risk assessment feeds the SWMS. One is the reasoning, the other is the document a principal contractor asks for.

Who should carry out a risk assessment?

The business carrying out the work is responsible for it. In practice it should be prepared by someone with the knowledge and skills for that work, in consultation with the workers who will do it. Consultation is a legal requirement rather than good practice, because the people doing the job know where the written procedure and the actual work diverge.

How often does a risk assessment need to be reviewed?

Before the work starts, and again whenever the work, the site, the plant, the people or the sequence changes. It must also be reviewed after an incident or near miss, when a control is found not to be working, and when a worker or health and safety representative asks for one. A document dated once and never revisited is the most common finding in a review.

What is a Risk Assessment?

A risk assessment is a record of thinking that has already happened. You work out what could hurt someone, how badly and how likely that is, decide what you will do about it, and write down what remains once those controls are in place. The document is evidence of the reasoning. It is not the safety itself.

That distinction matters on site. A thorough-looking document nobody used is worth less than a short one the crew worked through together.

Why it exists

Australian work health and safety law places a duty on the business carrying out the work to ensure health and safety so far as is reasonably practicable. That phrase does most of the work. It weighs how likely the harm is, how serious it would be, what the business knows or ought to know about the risk and the ways of controlling it, how available and suitable those controls are, and only then the cost. Cost comes last, and it has to be grossly disproportionate to the risk before it justifies doing less.

A risk assessment is how you show those things were weighed rather than guessed.

When you need one

High risk construction work requires a Safe Work Method Statement before the work starts. The risk assessment is the thinking that feeds it.
Specific hazards carry their own requirements, including confined spaces, asbestos, hazardous chemicals, falls and plant.
Everything else still sits under the general duty. A formal assessment is not always named in the regulations, but the risk still has to be managed, and a record is how you show it was.

The four steps

Identify the hazards. Anything with the potential to cause harm. Walk the job, look at the plant and substances, talk to the people who do the work, read the incident history and the safety data sheets.
Assess the risk. How likely is the harm, and how serious. That gives a rating from the matrix.
Control the risk. Work down the hierarchy below rather than straight to personal protective equipment.
Review. Check the controls are in place and working, and reassess when anything changes.

Rating likelihood against consequence

Two questions, kept separate. Consequence is how bad the realistic worst outcome is, not the worst imaginable one. Likelihood is the chance of that outcome occurring with the controls you are describing in place.

The common error is rating the likelihood of the hazard existing rather than the likelihood of the harm occurring. Live power on a site is near certain. Someone being electrocuted by it should not be.

The hierarchy of control

Controls are not equal, and the law expects you to work down this order rather than pick the convenient one.

Eliminate. Remove the hazard. Prefabricate at ground level instead of working at height. The only control that cannot fail.
Substitute. Swap it for something less hazardous.
Isolate. Separate people from the hazard with distance or a barrier.
Engineering controls. Guarding, on-tool extraction, mechanical aids.
Administrative controls. Procedures, training, signage, rotation. These rely on people behaving as intended every time.
Personal protective equipment. Last, because it protects one person, only while worn correctly, and does nothing to the hazard itself.

The bottom two are the weakest and the most common. A row controlled only by training and PPE is usually a row that has not been thought through.

Residual risk, and what counts as acceptable

Residual risk is what remains after the controls. It should be lower than the initial rating, and if it is not, the controls are not doing anything.

A high residual rating is not automatically wrong. Where the consequence is a fatality, the consequence usually stays extreme whatever you do, because controls reduce how likely the harm is rather than how bad it would be. That is why serious hazards often sit at high after controls, and that is honest rather than alarming. What matters is whether everything reasonably practicable has been done.

Consultation is not optional

The law requires consultation with the workers who carry out the work. They know where the procedure and the job differ. An assessment written at a desk and handed down is both weaker and harder to defend.

What reviewers pick up most often

Generic wording that could belong to any site on any job
Controls that are only training and personal protective equipment
A residual rating identical to the initial one, with no explanation
No named person responsible for a control
No evidence the crew was consulted or signed on
Legislation cited for the wrong state
A document dated once and never revisited

Risk assessment, SWMS or JSA?

The three overlap and the words get used loosely. A risk assessment is the underlying reasoning and can cover a project, a trade or a single task. A SWMS is the document required before high risk construction work, set out as a sequence of steps. A JSA breaks one job into its steps and is widely used but not named in the regulations the way a SWMS is. See SWMS vs JSA and the 18 categories of high risk construction work.

Build one

Our free Risk Assessment Builder loads the common risks for your trade, lets you add the tasks the job actually involves, rates them against the same matrix our documents use, and exports to PDF or Excel. Nothing you type leaves your browser.

It produces a starting point rather than a finished assessment. The risks listed are common ones, not a complete list, and no tool can know your site, your people or your conditions. It still has to be completed and reviewed by a competent person in consultation with the workers doing the work, for the jurisdiction you are working in. See also SWMS requirements by state, or browse the trade packs.

Start from a proper SWMS, not a blank page

State-specific, editable templates written for your state. Download instantly, then make it yours for the job and the site.

Browse Trade Packs Find an Individual SWMS

This guide is general information, not legal or safety advice, and does not guarantee compliance. Laws and site conditions vary, so always check your state regulator and have documents reviewed by a competent person.

What is a risk assessment, and how do you do one?