Quick answer: Under regulation 38 of the Work Health and Safety Regulation 2011 (Qld), control measures must be reviewed, and revised as necessary, in five situations: when a control isn't working, before a change that may create a new or different risk, when a new hazard or risk is identified, when consultation shows a review is needed, and when a health and safety representative requests one under the regulation. A risk assessment doesn't automatically expire after 12 months, and Safe Work Australia's guidance adds that controls should also be reviewed regularly, so many businesses set a review schedule on top.
A risk assessment that was accurate on the day it was written can quietly stop being accurate. New equipment arrives, the team changes, a task gets done a different way, and the document stays exactly as it was. That gap is what this article is about.
The five situations that require a review
- A control isn't working. An incident, near miss or complaint shows the control didn't do its job.
- Before a change. Before a change at the workplace that is likely to create a new or different risk the current control may not manage, such as new plant, a new process, a new site, or a change in how work is organised.
- A new hazard or risk is identified.
- Consultation points to it. The results of consultation with workers indicate a review is necessary.
- A health and safety representative requests a review. The regulation provides for a representative to request a review in particular circumstances, so a request does not trigger this requirement automatically in every case.
Safe Work Australia also notes that reports, incidents, complaints and grievances from workers can all point to new hazards or risks and should trigger a review, including informal complaints. The duty is to review and revise as necessary, not to replace a risk assessment every time something happens: a review may well confirm the existing controls are still working.
Beyond the triggers
A risk assessment doesn't automatically become invalid just because it reaches 12 months old. What matters is whether it still reflects the work, the equipment and the controls. The five situations are the floor, not a schedule. Safe Work Australia's guidance says reviewing controls should be done regularly, and must be done in those situations. Many businesses therefore review their key controls on a regular basis, for example at the start of a new project or once a year, because that catches slow drift that no single event would. A simple schedule, and a risk register listing the controls in place, give you one record to review against.
Three kinds of review, and how they differ
People use 'review' to mean three different things, and it helps to keep them apart.
- A legally triggered review of control measures. This is regulation 38 and the five situations above. It requires the controls to be reviewed and revised as necessary.
- A scheduled review of your risk assessments. This is the business's own good-practice rhythm, for example at the start of a project or once a year, set by how quickly the work changes and how serious the risks are. A risk assessment doesn't expire on a date, but a schedule helps catch drift.
- A review of a SWMS. A business carrying out high risk construction work must ensure its SWMS is reviewed and revised if necessary. WorkSafe Queensland also says a generic SWMS must be reviewed and revised before each new activity so that it fits the actual work and workplace, and that if a safer method is identified, the SWMS should be revised before work resumes.
A review that changes a control for a task covered by a SWMS should flow through to that SWMS. Our post on the difference between a risk assessment and a SWMS explains how the two fit together.
What a review involves
A review doesn't need to be elaborate. The useful questions are whether the controls are working without creating new risks, whether any upcoming changes could expose workers to new or different risks, and whether better controls are now available. If the review finds a changed hazard or risk, the process starts again: assess it, consult your workers, and put new or better controls in place.
For example, a warehouse's forklift risk assessment was written when pallets were racked along one wall. If a layout change now sends forklifts and pedestrians through the same aisle, that change is a trigger, and the controls should be reviewed before the change goes ahead, not after the first near miss. The review might confirm the existing controls still work, or it might lead to changes to traffic routes, pedestrian separation or visibility.
Frequently asked questions
How often should a risk assessment be reviewed?
Regulation 38 sets out situations that require a review rather than a fixed interval, and a risk assessment doesn't automatically become invalid at 12 months. Guidance says controls should also be reviewed regularly, so many businesses add a schedule on top, based on how quickly the work changes and how serious the risks are.
Does an incident always mean the controls failed?
Not automatically, but it should trigger a review. After a notifiable incident in particular, the controls for that task or plant should be revisited.
Who needs to be involved in the review?
Workers and their representatives should be consulted, since consultation is itself one of the triggers, and a health and safety representative can request a review in the circumstances the regulation provides for.
Keeping your assessments current
Not sure whether your risk assessments and SWMS still match how the work is done? Overwatch Safety Solutions offers a WHS Risk Assessment and SWMS Review. We check your risk assessments and SWMS against how the work is done today, flag where controls have drifted, and give you a clear action plan to bring them up to date.
Sources: Work Health and Safety Regulation 2011 (Qld), regulation 38; Safe Work Australia, review of control measures; WorkSafe Queensland, Safe work method statements.