What a risk assessment is, and when one is not required

Most content on this subject implies a documented risk assessment is compulsory for every task. Safe Work Australia's own guidance says otherwise in plain words. The assessment is a step in a process, and the process — not the paperwork — is the duty.

Last updated 2026-08-24

The process the regulator describes

Safe Work Australia sets it out as a sequence: identify hazards, assess the risks, control the risks, then review the controls. Hazards, in its words, are "things and situations that could harm a person". Assessment "involves looking at what could happen if someone is exposed to a hazard and the likelihood of it happening".

The sequence exists because the steps depend on each other. You cannot control a hazard you have not identified, and a control that is never reviewed is a control you are assuming still works. The review step is the one most often quietly dropped, and it is the one that catches a control that has drifted — a walkway line worn off the floor, a guard that stopped being refitted.

The step that is not always required

This is the sentence worth having: on assessing risks, Safe Work Australia states "You may not need to undertake this step if the hazards, risks, and control measures are well known."

That is the regulator saying the assessment step can be skipped where the hazard is already understood and the controls are established. It does not say the duty disappears — you still have to control the risk, and you still have to review the control. It says the analytical step in the middle is not a universal requirement, which is exactly what a great deal of safety marketing implies it is.

Being careful about the direction of that: this is not permission to skip anything at your site. Whether the hazards, risks and controls are well known in your operation is a judgement about your operation. We are reporting what the regulator publishes, not applying it.

Eliminate first, and what "reasonably practicable" is doing

The same guidance is direct about the order: "You should always aim to eliminate risks, as this is the best way to manage risk. If you can't eliminate risks, you must minimise risks so far as is reasonably practicable."

Eliminate is a strong word and it is meant literally — remove the hazard, not reduce exposure to it. Moving a fast-moving line to a lower level removes a reaching-overhead task rather than managing it. That is a slotting decision as much as a safety one, which is typical: most real eliminations look like operational changes rather than safety purchases.

"So far as is reasonably practicable" is the qualifier that carries most of the legal weight in Australian WHS law, and it weighs what is known about the hazard, the likelihood and degree of harm, the availability of controls and their cost. It is not a cost-only test, and cost alone does not excuse an available control.

  • Identify, assess, control, review — with the assessment step conditional
  • Elimination sits above every other control, and usually looks operational
  • Reasonably practicable weighs what is known and available, not just what is cheap

A risk assessment is not a SWMS, and neither is an inspection

These three get conflated constantly. A risk assessment is a step in the general process above, applying to any hazard at any workplace. A safe work method statement is a specific, legally defined document tied to defined categories of high risk construction work — a construction concept, not a general warehouse document.

A racking inspection is different again: not a WHS instrument at all, but a physical examination of a structure by someone qualified to judge it. The difference between an audit and an inspection is worth understanding on its own terms, and what competence means for that work is not defined by any of the documents on this page.

The frame all three sit inside is the PCBU, officer and worker duty structure, and the benchmark any of them is measured against is an approved Code of Practice where one has been approved in your jurisdiction.

Where the process actually bites in a warehouse

The categories a warehouse process spends its time on are reasonably predictable: manual handling at the pick face, vehicles and pedestrians on shared concrete, the plant on the floor, noise, chemicals stored for clients, work above ground level.

The useful discipline is that each of those is a defined category with a regulator document behind it, rather than a general sense that something looks dangerous. Reporting is the other half — a near miss recorded properly is the input that makes the review step mean something, and a system that only records injuries is reviewing controls with most of the data missing. Businesses running a formal management system layer this over the top, which is what the safety management system standard is for.

Common questions

Is a documented risk assessment legally required?
Not universally. Safe Work Australia's guidance on managing risks states that you may not need to undertake the assessment step where the hazards, risks and control measures are well known. Specific regulations do require assessments or documented processes for particular hazards, so the answer depends on the hazard and on your jurisdiction rather than being a blanket yes.
What is the difference between a hazard and a risk?
Safe Work Australia describes hazards as things and situations that could harm a person. The risk is what could happen if someone is exposed to that hazard, combined with how likely it is. A tall stack of poorly wrapped pallets is a hazard; the risk is what a collapse would do and how likely one is.
How often should controls be reviewed?
The guidance treats review as an ongoing step rather than a fixed interval, with the obvious triggers being a change to the work, a new hazard, an incident or a control that is not working. Any specific interval you see quoted comes from somewhere other than the general risk management guidance, so it is worth asking where.
Does a risk assessment replace a racking inspection?
No. They answer different questions. A risk assessment is a step in a management process; an inspection is a physical examination of a structure by someone with the training and experience to judge its condition. Neither substitutes for the other.

Sources

Read next