Most safety systems chase the dramatic. Work at height, confined spaces, crane lifts, hot work. Those risks attract a permit, a SWMS and a supervisor. Everyday workplace hazards get a line in the risk register, a bullet in the induction, then nobody looks at them again.
However, that is where the injuries come from. Safe Work Australia’s serious claims data has told the same story for years. Body stressing, falls on the same level and being hit by moving objects account for the largest share of serious workers compensation claims. None of those mechanisms are exotic. Instead, they come out of routine work the crew has done a thousand times.
The gap is rarely hazard identification. Most businesses can list their hazards. Rather, the gap is control: whether the control was ever high enough on the hierarchy, whether it is still in place today, and whether anyone has checked.
What the law requires for everyday workplace hazards
Section 19 of the Work Health and Safety Act 2011 places a primary duty on a person conducting a business or undertaking to ensure health and safety so far as is reasonably practicable. The method then sits in section 17: eliminate risks where that is reasonably practicable, and minimise them where it is not. Reasonably practicable has its own definition in section 18. It weighs likelihood, degree of harm, what the duty holder knows, the availability of controls, and cost.
The model Work Health and Safety Regulations 2011 set the mechanics. First, regulation 34 makes you identify your hazards. Next, regulation 35 makes you manage the risk. Regulation 36 then sets the hierarchy of control measures and makes duty holders work down it in order. Regulation 37 makes you maintain each control so it stays effective, and that is the one most businesses quietly breach. Finally, regulation 38 makes you review and revise controls in defined circumstances. Victoria applies equivalent duties through the Occupational Health and Safety Regulations 2017.
ISO 45001:2018 mirrors this. Clause 6.1.2 covers hazard identification. Clause 8.1.2 sets out elimination of hazards and reduction of risks using the same hierarchy. In addition, Clause 8.1.3 requires management of change, which is where new hazards usually enter a business unnoticed. ISO 9001:2015 Clause 8.5.1 and ISO 14001:2015 Clause 8.1 apply the same operational control logic to product conformity and environmental aspects. Therefore one integrated register serves all three standards.
The hierarchy of controls is a sequence, not a menu
Regulation 36 lists six levels in a fixed order. Eliminate the hazard. Substitute it with something safer. Isolate people from it. Apply an engineering control. Apply an administrative control. Finally, provide personal protective equipment. The order matters, because effectiveness and reliability fall sharply as you move down.
In practice, most routine hazards get an administrative control or PPE straight away. Those two options cost the least and take the least time to write down. Someone issues a procedure. A supervisor runs a toolbox talk. The storeman hands out gloves. Meanwhile, the hazard itself never moves.
The test is simple. For every control on your register, ask what would have to be true for elimination or substitution to be reasonably practicable. Often the answer is a purchasing decision that nobody has raised, because the administrative control made the problem look solved. For example, kerb units lifted by hand become a hired vacuum lifter. Concrete cut dry becomes water suppression and on-tool extraction. Pedestrians in a plant zone get a physically separated walkway.
Therefore, record the hierarchy level against every control. A register where most entries sit at administrative or PPE is telling you something, and an auditor will read it the same way.
Why everyday workplace hazards slip through between audits
Three failure patterns turn up in almost every business, and all three hit routine work harder than high-risk work.
First, there is the control that nobody ever installed. It exists in the risk assessment and in the SWMS. However, no one fitted the guard, poured the bollard or hired the extraction unit. Nobody verified, so nobody knew.
Second, there is control drift. The engineering control went in, then it slowed the job down. As a result, someone bypasses the interlock. The barrier moves for delivery access and never goes back. Regulation 37 is explicit here. Your control measure must stay effective, remain fit for purpose, and sit correctly installed, set up and used.
Third, there is the paper control. A procedure exists, so someone marks the risk as controlled. Yet nobody has watched the task against that procedure since the day it went out. Administrative controls depend entirely on human behaviour. Consequently, they need the most verification, not the least.
Verify controls on a cycle, not on a hunch
Every control on your register needs four extra fields to become real: a verification method, a verification frequency, the date it was last verified, and the date it next falls due. Without those, a hazard register is simply a historical document.
Match the frequency to the control type. Engineering controls tied to plant follow the maintenance or inspection schedule. Similarly, isolation controls such as barriers and exclusion zones get a pre-start check on the affected site. By contrast, you verify an administrative control by watching the task, not by confirming the procedure exists. PPE controls need a condition check plus a look at whether the crew actually wears the gear at the point of exposure.
Next, set your review triggers to match regulation 38. Review a control before a change to the work, the workplace, the plant or the substance. An incident or near miss involving that hazard triggers another one. Also review when someone identifies a new risk, when consultation points to a review, and when a health and safety representative asks for one. Consultation under sections 47 to 49 of the WHS Act belongs in that process, because the workers doing the task know which controls have quietly stopped working.
Practical Application
Consider an Australian civil contractor with twenty-five staff working across several sites at once. Its register of everyday workplace hazards runs to roughly sixty entries: manual handling of kerb and pit components, silica dust from concrete cutting, mobile plant and pedestrian interaction, work adjacent to live traffic, heat and ultraviolet exposure, noise, and hazardous chemicals in the yard.
Each entry carries an initial risk rating, the control, its hierarchy level, a residual rating and a named responsible position. For instance, silica dust moves from a dust mask, which is PPE, to on-tool water suppression plus H-class extraction, which is engineering, with respiratory protection retained as a backstop under Chapter 7 of the WHS Regulations. Likewise, kerb handling moves from a lifting technique toolbox, which is administrative, to a hired mechanical lifter, which substitutes the method.
The business then schedules verification rather than assuming it. Supervisors check isolation and engineering controls at pre-start on the days the relevant task runs. In addition, the QHSE Manager walks one observation-based verification each month, watching two tasks end to end rather than reading the paperwork. Every verification updates the Last Verified date, which rolls Next Verification Due forward automatically. Anything overdue then turns orange on the dashboard.
At the quarterly review, the register does the talking. Controls verified as ineffective twice get escalated up the hierarchy instead of being re-briefed. In short, that is the difference between a business that manages risk and one that documents it.
Conclusion
Everyday workplace hazards do not fail loudly. Instead, they fail quietly, between audits, in the gap between the control you wrote down and the control actually running today. Closing that gap takes three disciplines. Choose the control as high on the hierarchy as is reasonably practicable. Maintain it as regulation 37 requires. Then verify it on a defined cycle with a named owner and a due date.
Do that and your risk register stops being a compliance artefact and becomes an operational tool. The MiSAFE All-in-One QHSE subscription includes configuration of your hazard and control register inside your QHSE platform. It also includes pre-start verification prompts for supervisors, automated overdue escalation, and control effectiveness reporting ready for management review.
Ready to act? Contact us today or book a free 45-minute consultation.
Download the Free Template
Download the free Hazard and Control Register (.xlsx) and give every control on your register a hierarchy level, an owner and a verification due date.
Recent Comments