Back to list

News

Workplace Health & Safety Risk Assessments

Risk Assessment
A workplace risk assessment is the process of identifying hazards, evaluating how likely each one is to cause harm and how serious that harm could be, and deciding whether your existing controls are enough. In New Zealand, this process is set out in regulations 5 to 8 of the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016, and it applies to every PCBU regardless of industry or size.

Risk assessment is not a one-off exercise you do when the business starts and then file away. It is an ongoing obligation. Your risks change as your work changes, as your people change, and as your site changes. The law requires you to identify hazards, assess risks, implement controls, and then review those controls to make sure they are actually working.

This guide covers how the process works in New Zealand, what the law actually requires, and when it makes sense to bring in outside help.

Need a professional risk assessment?
We carry out on-site risk assessments for Auckland workplaces. You get a written report, a risk register, and a prioritised action plan. More about our risk assessment service →
Get a quote

What the Law Requires

The risk management framework in New Zealand is set out across two pieces of legislation.

The Health and Safety at Work Act 2015 establishes the overarching duties. Section 30 requires a PCBU to eliminate risks so far as is reasonably practicable, or if elimination is not reasonably practicable, to minimise risks so far as is reasonably practicable. Section 36 sets out the primary duty of care.

The Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 set out the specific process. Regulations 5 to 8 prescribe a four-step risk management cycle.

Step Regulation What it requires
1. Identify hazards Regulation 5 Identify reasonably foreseeable hazards that could give rise to risks to health and safety
2. Assess risks Regulation 6 Assess the risks arising from those hazards, considering the likelihood of harm and the severity of that harm
3. Control risks Regulation 7 Implement control measures to eliminate or minimise risks, following the hierarchy of controls
4. Review controls Regulation 8 Review control measures regularly to ensure they remain effective, and revise them if they are not

This is not optional and it is not limited to high-risk industries. Every PCBU, whether you run a construction company, a warehouse, a cafe, or an office, must follow this process for the risks in your workplace.

The Hierarchy of Controls

When you identify a risk, the law does not let you jump straight to PPE. You must work through the hierarchy of controls in order, starting with elimination and only falling back to lower-order controls when higher-order ones are not reasonably practicable.

Level Control type Example
1. Eliminate Remove the hazard entirely Automating a manual lifting task so no one does it by hand
2. Substitute Replace with something less hazardous Switching from a solvent-based cleaner to a water-based alternative
3. Isolate Separate people from the hazard Fencing around moving machinery
4. Engineering controls Redesign the work or environment Installing extraction ventilation for welding fumes
5. Administrative controls Change how people work Job rotation, safe work procedures, signage, training
6. PPE Personal protective equipment Hearing protection, safety glasses, gloves

The most common mistake businesses make is defaulting to PPE without considering whether a higher-order control is available. WorkSafe expects to see evidence that elimination and substitution were considered first, even if PPE ends up being part of the control package.

When to Do a Risk Assessment

There is no fixed legal schedule, but the GRWM Regulations 2016 require you to review your controls whenever there is reason to believe they may not be effective. In practice, you should assess or reassess risks when:

  • A new activity, process, or piece of equipment is introduced
  • An incident, near miss, or injury occurs
  • Workers raise concerns about a hazard
  • The physical work environment changes (new site, layout changes, new substances)
  • New information becomes available about a risk (updated WorkSafe guidance, industry alerts)
  • You have not reviewed your risk assessments in over 12 months

If your hazard register was written when the business started and has not been touched since, it is almost certainly out of date. That is not a criticism. It is the most common situation we see.

Common Workplace Hazards in New Zealand

The specific hazards depend on your industry, but most New Zealand workplaces face some combination of the following.

  • Physical hazards: working at height, moving plant and vehicles, manual handling, noise, vibration, confined spaces
  • Chemical hazards: hazardous substances, dust, fumes, gases, and exposure risks (covered by the Hazardous Substances Regulations 2017)
  • Biological hazards: exposure to infectious agents, mould, animal-borne risks
  • Ergonomic hazards: repetitive tasks, awkward postures, workstation design, manual handling techniques
  • Psychosocial hazards: work-related stress, fatigue, bullying, harassment, lone working, violence
  • Environmental hazards: extreme temperatures, poor lighting, inadequate ventilation, slips and trips

A good risk assessment does not just list these categories. It identifies the specific hazards present in your specific workplace, assesses the real level of risk, and checks whether your controls are actually adequate.

Can You Do It Yourself?

Yes, and many businesses do. The law places the duty on the PCBU, not on an external consultant. If you have the knowledge to identify the hazards in your workplace, assess the risks accurately, and apply the hierarchy of controls properly, you can do it internally.

Where businesses typically need outside help is when:

  • The hazard register is out of date and you are not sure where to start
  • An incident has occurred and you need an independent view of what went wrong
  • A prequalification scheme or a client is asking for evidence of a formal risk assessment
  • Your industry has hazards that require specialist knowledge (hazardous substances, noise, confined spaces)
  • You want an independent check on whether your current controls are actually adequate
Want an independent assessment?
We visit your workplace, identify the real hazards, and deliver a report with a risk register and prioritised action plan. More about our risk assessment service →
Get a quote

Risk Assessment vs. Audit vs. Gap Analysis

These terms get used interchangeably, but they are different pieces of work.

Service Focus Format
Risk assessment Specific hazards, their likelihood and severity, and whether controls are adequate On-site, hazard-focused
Workplace site audit Broader compliance check of physical conditions and documentation across the site On-site inspection
Gap analysis Your documented H&S system as a whole, checked against HSWA 2015 Documentation review, no site visit

A risk assessment answers "what could hurt someone here and is it controlled?" A site audit answers "does this site comply?" A gap analysis answers "does our paperwork stack up?" Different questions, different outputs, all valuable at different times.

Frequently Asked Questions

Yes. Under section 30 of the Health and Safety at Work Act 2015 and regulations 5 to 8 of the General Risk and Workplace Management Regulations 2016, every PCBU must identify hazards, assess risks, implement controls, and review those controls. This applies to every industry and every workplace.
There is no fixed legal frequency. The law requires you to review controls whenever there is reason to believe they may not be effective, and whenever the work, the workplace, or the people change. As a minimum, most businesses should review their risk assessments at least annually.
A hazard is anything that could cause harm: a wet floor, an unguarded machine, a toxic chemical. A risk is the combination of how likely that hazard is to cause harm and how serious the harm could be. Risk assessment evaluates the risk, not just the hazard.
The hierarchy of controls is the order in which you must consider risk controls: eliminate the hazard first, then substitute, isolate, use engineering controls, use administrative controls, and finally PPE as a last resort. Higher-order controls are more effective and must be considered before lower-order ones.
A risk register is the document that captures the output of your risk assessments. It lists every identified hazard, the assessed risk level, the controls in place, and the review status. It is a living document that should be updated whenever risks change. WorkSafe publishes a template on their website.
Not necessarily. The duty sits with the PCBU, and many businesses can do their own risk assessments if they have the knowledge. Where businesses typically need outside help is when the hazard register is out of date, an incident has occurred, a client or prequalification scheme requires formal evidence, or the hazards need specialist knowledge.

Sources

  • Health and Safety at Work Act 2015, section 30: duty to eliminate or minimise risks so far as is reasonably practicable. legislation.govt.nz
  • Health and Safety at Work Act 2015, section 36: primary duty of care. legislation.govt.nz
  • Health and Safety at Work (General Risk and Workplace Management) Regulations 2016, regulations 5 to 8: the prescribed risk management process. legislation.govt.nz
  • WorkSafe New Zealand, risk management guidance: practical guidance including the hierarchy of controls. worksafe.govt.nz
Need help with your risk assessments?
We visit your workplace, identify the hazards, rate the risks, and give you a clear report with a risk register and action plan. More about our risk assessment service →
Get a quote
Reuben Brooker, Lead Consultant · Last updated: September 2026

What We Do

We help small businesses to ensure they are compliant with the Health and Safety at Work Act 2015.

Our experienced consultants design & implement systems for a safer environment.

With 10+ years of expertise in the field, we offer practical solutions tailored to your specific needs.
Get A Free Quote Today