What are the 5 steps of HIRARC?

The 5 steps are: (1) Classify work activities, (2) Identify hazards for each activity, (3) Assess the risk using likelihood and severity scoring, (4) Determine control measures using the hierarchy of controls, and (5) Record findings and review periodically.

What is the HIRARC risk matrix used in Malaysia?

The DOSH risk matrix uses a 5x5 grid combining Likelihood (1-5) and Severity (1-5). Risk Rating = Likelihood x Severity, giving scores from 1-25 classified as Low (1-4), Medium (5-9), High (10-16), or Extreme (17-25).

How often must HIRARC be reviewed?

HIRARC must be reviewed at least annually, after any accident or near-miss, when new equipment or processes are introduced, when there are changes in legislation, or when monitoring reveals controls are inadequate.

← SafeSyt

HIRARC Guide Malaysia 2026 — Hazard Identification & Risk Assessment

Updated May 2026 · 9 min read · Based on DOSH Guidelines for HIRARC 2008

HIRARC (Hazard Identification, Risk Assessment and Risk Control) is the foundation of workplace safety management in Malaysia. Required under Section 15 of OSHA 1994, HIRARC is the systematic process of identifying workplace hazards, assessing their risks, and implementing appropriate controls.

This guide covers the complete HIRARC process as prescribed by DOSH, including the risk matrix methodology, control hierarchy, and practical templates you can use immediately.

The 5 Steps of HIRARC

Step	Activity	Output
1	Classify work activities	Activity inventory list
2	Identify hazards	Hazard register
3	Assess risks (likelihood × severity)	Risk rating for each hazard
4	Determine control measures	Control action plan
5	Record and review	HIRARC document with review schedule

Step 1: Classify Work Activities

Group all workplace activities into manageable categories:

Routine activities (daily operations, maintenance tasks)
Non-routine activities (shutdowns, emergency repairs, cleaning)
Activities of all persons with access (employees, contractors, visitors)
Facilities, machinery, and equipment at the workplace
Consider geographic/environmental factors (weather, terrain)

Step 2: Identify Hazards

For each activity, identify all potential hazards using these methods:

Workplace inspection: Physical walkthrough observing conditions
Task analysis: Breaking down each job into steps
Accident history: Reviewing past incidents and near-misses
Worker consultation: Interviewing employees who perform the work
Material Safety Data Sheets: For chemical hazards
Manufacturer guidelines: For machinery and equipment hazards

Common hazard categories:

Category	Examples
Physical	Noise, vibration, radiation, temperature extremes
Chemical	Dust, fumes, gases, solvents, acids
Biological	Bacteria, viruses, fungi, animal bites
Ergonomic	Repetitive motion, awkward postures, heavy lifting
Psychosocial	Stress, bullying, shift work, fatigue
Mechanical	Moving parts, sharp edges, falling objects
Electrical	Exposed wiring, faulty equipment, static

Step 3: Risk Assessment — The Risk Matrix

Risk is calculated as: Risk Rating = Likelihood × Severity

Likelihood Scale:

Score	Likelihood	Description
1	Rare	May occur only in exceptional circumstances
2	Unlikely	Could occur but not expected
3	Possible	Might occur at some time
4	Likely	Will probably occur in most circumstances
5	Almost Certain	Expected to occur in most circumstances

Severity Scale:

Score	Severity	Description
1	Negligible	No injury or first aid only
2	Minor	Minor injury requiring medical treatment
3	Moderate	Injury requiring hospitalisation; temporary disability
4	Major	Serious injury; permanent disability
5	Catastrophic	Death or multiple fatalities

Risk Rating Classification:

Risk Score	Level	Action Required
1 – 4	Low	Acceptable; monitor and maintain controls
5 – 9	Medium	Reduce risk with additional controls; set timeline
10 – 16	High	Immediate action required; do not proceed until reduced
17 – 25	Extreme	Stop work immediately; senior management intervention

Step 4: Hierarchy of Controls

Controls must be applied in order of effectiveness (most effective first):

Elimination: Remove the hazard entirely (e.g., automate a dangerous task)
Substitution: Replace with something less hazardous (e.g., use water-based instead of solvent-based paint)
Engineering controls: Isolate people from the hazard (e.g., machine guards, ventilation systems)
Administrative controls: Change the way people work (e.g., procedures, training, job rotation, signage)
PPE: Personal protective equipment as last resort (e.g., gloves, respirators, hard hats)

Control Level	Effectiveness	Example
Elimination	Most effective (100%)	Remove asbestos entirely from building
Substitution	Very effective (75-90%)	Replace toxic chemical with safer alternative
Engineering	Effective (50-75%)	Install machine guarding, local exhaust ventilation
Administrative	Moderate (20-50%)	Safe work procedures, training, warning signs
PPE	Least effective (10-30%)	Safety glasses, ear plugs, respirators

Step 5: Record and Review

HIRARC must be documented and reviewed:

At least annually as a scheduled review
After any accident, incident, or near-miss
When new equipment, processes, or materials are introduced
When there are changes in legislation or standards
When monitoring reveals existing controls are inadequate
When there are changes in workforce (new workers, contractors)

HIRARC Template Example

Activity	Hazard	Risk (L×S)	Rating	Control Measure	Residual Risk
Welding at height	Fall from scaffold	4×5=20	Extreme	Guardrails + harness + PTW	2×5=10 (High)
Chemical mixing	Skin contact with acid	3×4=12	High	Enclosed system + PPE + SOP	2×4=8 (Medium)
Forklift operation	Pedestrian struck	3×4=12	High	Segregated walkways + lights + training	2×4=8 (Medium)
Office work (VDU)	Ergonomic strain	3×2=6	Medium	Ergonomic assessment + breaks	2×2=4 (Low)

Common HIRARC Mistakes

Conducting HIRARC as a one-time exercise instead of a living document
Not involving frontline workers in hazard identification
Relying solely on PPE without considering higher-level controls
Underestimating severity or likelihood to avoid implementing costly controls
Not reassessing residual risk after controls are implemented
Generic assessments that don't reflect actual site conditions

Digitise Your HIRARC Process

SafeSyt provides digital HIRARC templates, automatic risk scoring, control tracking, and review reminders — all in one platform.

Try SafeSyt Free