WHS Regulation 2025, multiple parts

Regulation

Chemicals, manual tasks, noise, heights, confined spaces

Mandatory For

WHS Act s.19 — all hazards

General Duty

Change, incident, new information

Review Trigger

At least every 5 years

Chemical Review

Required with workers

Consultation

The WHS Regulation 2025 mandates documented risk assessments for specific categories of work. These include work involving hazardous chemicals where a risk assessment must identify health hazards, exposure routes, and controls under Part 7.1. Hazardous manual tasks where a risk assessment must consider postures, movements, forces, and duration under Part 4.2. Work at heights where a risk assessment must identify fall hazards and determine appropriate controls under Part 4.4. Confined space entry where a risk assessment must address atmospheric hazards, engulfment, and rescue under Part 4.3. Noise exposure where a risk assessment must determine whether workers are likely to be exposed above the exposure standard under Part 4.1. Electrical work where a risk assessment must address the risk of electric shock, arc flash, and fire under Part 4.7. Work involving plant where a risk assessment must address the risks of the plant in its intended operating environment under Part 5.1. Work involving demolition, excavation, and diving each have specific risk assessment requirements. Each of these mandatory risk assessments must be documented and kept readily accessible.

Beyond the mandatory triggers, a risk assessment should be conducted whenever a new hazard is identified, a new process or activity is introduced, a change is made to existing processes, equipment, or work methods, an incident or near miss occurs, worker health monitoring or exposure monitoring reveals unexpected results, or a worker or health and safety representative raises a concern. While these situations may not trigger a specific mandatory risk assessment provision in the Regulation, the general duty under Section 19 of the WHS Act to manage risks so far as is reasonably practicable requires a systematic approach to hazard identification and risk management. A documented risk assessment is the standard method for demonstrating that the PCBU has turned their mind to the risks and implemented appropriate controls. The absence of a risk assessment for a foreseeable hazard is evidence that the PCBU did not take a systematic approach to managing the risk.

A documented risk assessment must identify the hazard, describe the risk, assess the likelihood and consequence, identify the controls in place, and determine whether the residual risk is acceptable. The assessment must record who conducted it, the date, and the workers or their representatives who were consulted. Controls must be selected using the hierarchy of controls, with preference given to elimination, substitution, isolation, and engineering controls over administrative controls and personal protective equipment. The risk assessment must be reviewed when the controls are found to be inadequate, when a change occurs that is likely to affect the risk, when new information about the hazard becomes available, when monitoring or testing reveals an issue, or when a health and safety representative requests a review. For hazardous chemicals, risk assessments must also be reviewed at least every five years. Risk assessments must be kept at the workplace and be readily accessible to workers who may be affected by the hazard.

The most common risk assessment mistakes identified by regulators include conducting a risk assessment as a one-off paperwork exercise without genuine hazard identification or worker consultation, using generic templates without site-specific adaptation, failing to apply the hierarchy of controls and defaulting to PPE as the primary control, failing to review risk assessments when conditions change or incidents occur, and failing to implement the controls identified in the risk assessment. A risk assessment that identifies a control measure but does not implement it creates a worse legal position than having no risk assessment at all, because it demonstrates that the PCBU was aware of the risk and the available control but chose not to act. Risk assessments must be living documents that are actively used, regularly reviewed, and consistently implemented. Workers must be consulted during the risk assessment process and informed of the results including the controls that apply to their work.