What is HIRARC? Hazard Identification, Risk Assessment & Risk Control

HIRARC stands for Hazard Identification, Risk Assessment and Risk Control. It is the systematic way Malaysian workplaces answer three simple questions: What could hurt someone here? How bad is the risk? And what are we going to do about it? The method follows the HIRARC guidelines published by DOSH, and it is the foundation of practically every safety system.

Since the OSHA (Amendment) Act 2022 took effect on 1 June 2024, conducting a risk assessment is a legal duty for employers — so understanding HIRARC is no longer just good practice, it is part of compliance.

The three parts of HIRARC

1. Hazard Identification

First, break your work into activities and, for each one, list everything with the potential to cause harm. Hazards come in several forms: physical (moving machinery, working at height, noise), chemical (solvents, dusts, fumes), ergonomic (manual handling, repetitive motion), biological (bacteria, viruses) and psychosocial (fatigue, workplace stress). The goal is to see the workplace as it really is — not as you assume it to be — so walking the floor and talking to workers matters more than sitting in an office.

2. Risk Assessment

Next, judge how serious each hazard is. HIRARC does this by combining two factors:

• Likelihood — how probable it is that the hazard causes harm, rated from 1 (very unlikely) to 5 (almost certain).
• Severity — how bad the harm would be if it happened, rated from 1 (negligible) to 5 (catastrophic or fatal).

Multiply the two together and you get a risk score from 1 to 25. Plotting Likelihood against Severity on a 5-by-5 matrix sorts each risk into a band — typically Low, Medium or High. The score tells you two things: which risks to deal with first, and how much control effort each one justifies.

3. Risk Control

Finally, decide how to reduce each risk — and here the order matters. HIRARC uses the hierarchy of control, from most effective to least:

• Elimination — remove the hazard entirely (the best option).
• Substitution — replace it with something safer (a less hazardous chemical, for example).
• Engineering controls — isolate people from the hazard (machine guards, ventilation, barriers).
• Administrative controls — change the way people work (procedures, training, signage, job rotation).
• Personal Protective Equipment (PPE) — the last line of defence (gloves, goggles, respirators).

The reason for the order is simple: controls at the top remove or contain the hazard regardless of what people do, while PPE only works if it is available, correct and worn properly every time. PPE is important, but it should never be your only control.

HIRARC is a living document

A HIRARC is never truly finished. It should be reviewed whenever something changes — new machinery, a new process, a new chemical, a new layout — and after any incident or near miss. Regular scheduled reviews keep it honest. A HIRARC that sits in a folder untouched for three years is a compliance risk in itself.

Common mistakes we see

• Writing the HIRARC from a desk instead of observing the actual work.
• Listing PPE as the control for every hazard, skipping the more effective options above it.
• Never involving the workers who face the hazards daily — they usually know them best.
• Treating it as a one-off document to satisfy an auditor rather than a tool that guides day-to-day decisions.

How ProSafe helps

ProSafe HSE Consultancy runs practical HIRARC sessions with your team — on your actual site, for your actual work — and trains your people to keep it up to date. You end up with a documented risk assessment that satisfies OSHA, and, more importantly, one your supervisors actually use.