How to Do a Risk Assessment: Construction Safety Guide

August 30, 2026 Aiman Shazadi EHS Guidelines 0
How to do a risk assessment in construction
Step-by-step guide to conducting a construction risk assessment.

TL;DR

  • A risk assessment is a structured process for identifying hazards, evaluating the probability and severity of harm, and implementing controls before work begins.
  • Under 29 CFR 1926 Subpart C and 29 CFR 1910.132(d), construction employers are legally obligated to assess workplace hazards and certify that assessment in writing.
  • The process follows five steps: identify hazards → determine who is at risk → evaluate risks and select controls → record findings → review and update.
  • Every risk assessment must be documented. The written record must identify the workplace, the assessor, and the date of assessment.
  • Controls must follow the hierarchy: elimination → substitution → engineering controls → administrative controls → PPE.

How to Do a Risk Assessment: A Step-by-Step Construction Safety Guide

How to do a risk assessment in construction
Step-by-step guide to conducting a construction risk assessment.

A risk assessment is a systematic examination of a workplace to identify hazards that could cause harm, evaluate the likelihood and severity of that harm, and determine the controls required to eliminate or reduce risk to an acceptable level. Under 29 CFR 1910.132(d), every employer must assess the workplace to determine whether hazards are present – or are likely to be present – that necessitate the use of personal protective equipment. Under 29 CFR 1926 Subpart C (§ 1926.20(b)), construction employers must initiate and maintain safety programs that include frequent and regular inspections of job sites, materials, and equipment by competent persons. The risk assessment is the foundational document that makes those inspections systematic and legally defensible.

This guide explains how to do a risk assessment on a construction site, step by step, with regulatory anchors, a worked example, and a comparison of related analysis tools.

What Is a Risk Assessment?

A risk assessment is the formal process of identifying hazards, evaluating the probability and consequence of harm arising from those hazards, and determining the control measures required to protect workers. OSHA defines “risk” as the product of hazard and exposure: risk can be reduced by controlling or eliminating the hazard, or by reducing workers’ exposure to it.

Under OSHA’s Recommended Practices for Safety and Health Programs, hazard identification and risk assessment is described as “a critical element of any effective safety and health program” – one that must be proactive and ongoing, not reactive. OSHA identifies failure to recognize hazards as one of the root causes of workplace injuries, illnesses, and incidents.

A health and safety risk assessment is distinct from a simple inspection. An inspection identifies conditions that exist. A risk assessment evaluates those conditions against the probability of harm and the severity of potential injury, then assigns a priority for corrective action.

Key terms defined:

  • Hazard: Any source, situation, or act with the potential to cause injury, illness, or damage to property.
  • Risk: The combination of the likelihood that a hazard will cause harm and the severity of that harm.
  • Control measure: Any action taken to eliminate the hazard or reduce risk to an acceptable level.
  • Competent person: Under 29 CFR 1926.32(f), a person capable of identifying existing and predictable hazards in the surroundings or working conditions that are unsanitary, hazardous, or dangerous to employees, and who has the authority to take prompt corrective measures.

When Is a Risk Assessment Required?

OSHA does not use the term “risk assessment” in a single, universal mandate. Instead, the obligation to assess hazards is embedded across multiple standards. The following regulatory triggers apply to construction employers.

1. 29 CFR 1910.132(d) – PPE Hazard Assessment The employer must assess the workplace to determine whether hazards are present that require PPE. The assessment must be certified in writing. The certification must identify: (a) the workplace evaluated, (b) the person certifying the assessment, (c) the date(s) of the assessment, and (d) that the document is a certification of hazard assessment. This standard applies to eyes, face, head, feet, hands, and – following the 2024 final rule – personal fall protection systems.

2. 29 CFR 1926 Subpart C – General Safety and Health Provisions Section 1926.20(b)(1) requires the employer to initiate and maintain safety programs necessary to comply with Part 1926. Section 1926.20(b)(2) requires those programs to provide for frequent and regular inspections by competent persons. Section 1926.21(b)(2) requires the employer to instruct each employee in the recognition and avoidance of unsafe conditions.

3. 29 CFR 1926.502 – Fall Protection Before work begins at heights of six feet or more above a lower level, the employer must assess fall hazards and select appropriate fall protection systems.

4. 29 CFR 1910.119 – Process Safety Management (PSM) For construction work within PSM-covered facilities, employers must conduct a pre-startup safety review and hazard analysis before introducing new or modified processes.

5. OSHA General Duty Clause (Section 5(a)(1) of the OSH Act) Where no specific standard applies, the General Duty Clause requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. A documented risk assessment is the primary evidence of compliance.

The assessment is required before work begins. Conducting it after an incident is not compliance – it is documentation of a failure.

The 5 Steps of a Risk Assessment

OSHA’s Hazard Identification and Assessment guidance organizes the process around six action items. For construction sites, those action items map to five operationally distinct steps. Each step carries specific obligations.

Step 1 – Identify the Hazards

The employer must collect, organize, and review all available information about hazards present – or likely to be present – on the job site. This is the foundation of hazard identification and risk assessment in construction. No subsequent step is valid if this step is incomplete.

Sources to review before site work begins:

  • Equipment and machinery operating manuals
  • Safety Data Sheets (SDS) for all chemicals on site
  • OSHA 300 and 301 logs from previous similar projects
  • Workers’ compensation records showing injury patterns
  • Results of prior job hazard analyses (JHAs) or job safety analyses (JSAs)
  • Applicable OSHA standards for the specific scope of work (excavation, scaffolding, electrical, confined spaces, etc.)
  • NIOSH Construction Program alerts and hazard reviews published at cdc.gov/niosh/construction

Physical inspection requirements:

Section 1926.20(b)(2) requires inspections by a competent person. The competent person must walk the entire job site – not just the primary work area – and document:

  1. Physical hazards: unguarded edges, excavation walls, overhead power lines, scaffold integrity, floor openings
  2. Chemical hazards: silica dust, lead paint, solvents, welding fumes, adhesives
  3. Biological hazards: mold in renovation work, vector exposure in outdoor sites
  4. Ergonomic hazards: manual material handling, repetitive overhead work, whole-body vibration from equipment
  5. Electrical hazards: temporary power, ground fault protection, proximity to energized lines
  6. Struck-by and caught-between hazards: crane swing radius, vehicle traffic patterns, pinch points

Involve workers. OSHA’s guidance is explicit: workers must participate in the hazard identification process. Workers performing the task have direct knowledge of conditions that a supervisor or safety professional may not observe during a single walk-through.

Document every hazard identified. An undocumented hazard is a hazard that cannot be controlled or tracked.

Step 2 – Determine Who Is at Risk and How

The employer must identify every person who could be harmed by each hazard identified in Step 1, and describe the mechanism of harm. This step prevents the common error of assessing hazards in the abstract without connecting them to actual exposure.

Categories of exposed persons on a construction site:

  • Direct trade workers performing the task (ironworkers, carpenters, electricians, concrete finishers)
  • Workers in adjacent areas who are not performing the task but are within the hazard zone
  • Subcontractor employees whose work overlaps with the primary scope
  • Delivery personnel and equipment operators
  • Site visitors, inspectors, and owner representatives
  • Members of the public where the site boundary is adjacent to occupied areas

For each hazard, the assessment must specify:

  1. Which job classifications are exposed
  2. The route of exposure (inhalation, skin contact, struck-by, fall, etc.)
  3. The duration and frequency of exposure
  4. Whether the exposure is routine, nonroutine, or emergency-scenario-only

Section 1926.21(b)(2) requires the employer to instruct each employee in the recognition and avoidance of unsafe conditions. That instruction must be tailored to the specific hazards the employee will encounter – a generic safety orientation does not satisfy this requirement.

Nonroutine and emergency scenarios must be included. OSHA’s guidance specifically requires employers to identify hazards associated with emergency situations and infrequent tasks such as maintenance, startup, and shutdown activities.

Step 3 – Evaluate the Risks and Decide on Controls

The employer must evaluate each identified hazard by assessing the severity of potential harm, the likelihood that harm will occur, and the number of workers exposed. This evaluation produces a risk level that determines the priority and type of control required.

Risk matrix – standard construction application:

Likelihood Severity: Minor Severity: Moderate Severity: Major Severity: Catastrophic
Almost Certain Medium High Critical Critical
Likely Low Medium High Critical
Possible Low Medium High High
Unlikely Negligible Low Medium High
Rare Negligible Negligible Low Medium

Definitions:

  • Catastrophic: Fatality or permanent total disability
  • Major: Lost-time injury, serious illness, or permanent partial disability
  • Moderate: Medical treatment injury, restricted work
  • Minor: First-aid-only injury, no lost time

Control selection – the hierarchy of controls:

OSHA requires employers to use the hierarchy of controls. Controls are not optional alternatives; they are ranked by effectiveness. The employer must implement the highest-order control that is feasible.

  1. Elimination: Remove the hazard entirely (e.g., prefabricate components off-site to eliminate working at height)
  2. Substitution: Replace the hazardous material or process (e.g., use water-suppression methods instead of dry cutting to reduce silica dust)
  3. Engineering controls: Isolate workers from the hazard (e.g., guardrails, ventilation systems, machine guarding)
  4. Administrative controls: Change work practices or schedules (e.g., job rotation to limit silica exposure duration, exclusion zones around crane swing radius)
  5. PPE: Provide and require appropriate personal protective equipment as the last line of defense – not the first

Under 29 CFR 1910.132(d), PPE selection must be based on the hazard assessment. The employer must select PPE that fits properly and communicate the selection to affected employees. PPE that is not based on a documented hazard assessment does not satisfy the standard.

Interim controls must be implemented immediately for Critical and High risk levels while permanent controls are engineered and installed. OSHA’s guidance confirms that employers have an ongoing obligation to control all serious recognized hazards.

Step 4 – Record Your Findings

The employer must document the risk assessment in writing. Documentation is not optional. Under 29 CFR 1910.132(d)(2), the certification of hazard assessment must be a written record. The General Duty Clause and OSHA enforcement practice treat an undocumented assessment as no assessment at all.

The written risk assessment record must include:

  1. The name and address of the workplace or project site evaluated
  2. The date(s) the assessment was conducted
  3. The name and qualifications of the person who conducted the assessment
  4. A list of all hazards identified
  5. The population at risk for each hazard
  6. The risk level assigned (using the risk matrix)
  7. The control measures selected and the rationale for their selection
  8. The hierarchy-of-controls tier at which each control operates
  9. The date by which each control will be implemented
  10. The name of the person responsible for implementing each control
  11. A signature certifying that the assessment has been completed

Retain records. OSHA’s recordkeeping standard (29 CFR 1904) requires retention of injury and illness records for five years. Risk assessment records should be retained for the duration of the project plus five years, or longer if the project involves hazardous substances subject to longer retention requirements under 29 CFR 1910.1020.

The written record is also the primary document used during OSHA inspections. A compliance officer who finds a hazard on site and no corresponding risk assessment record has grounds for a citation under both the specific applicable standard and the General Duty Clause.

Step 5 – Review and Update the Assessment

The risk assessment is not a one-time document. The employer must review and update it whenever conditions change. OSHA’s guidance requires periodic workplace inspections and incident investigations as ongoing elements of hazard identification.

Mandatory triggers for reassessment:

  1. A new phase of work begins (e.g., transition from excavation to structural steel erection)
  2. New equipment, materials, or chemicals are introduced to the site
  3. A workplace incident, near-miss, or close call occurs
  4. A worker reports a new or previously unrecognized hazard
  5. Significant changes to the workforce, including new subcontractors or temporary workers
  6. Changes in site conditions (weather events, adjacent construction, utility strikes)
  7. Regulatory changes that affect the scope of work

Frequency of scheduled review:

The competent person must conduct regular inspections under § 1926.20(b)(2). For active construction sites, a weekly review of the risk assessment against current site conditions is a defensible minimum. High-hazard operations (confined space entry, hot work, work near energized electrical equipment) require a task-specific reassessment before each occurrence.

Near-miss reporting must feed the reassessment. OSHA’s guidance states that close calls provide a clear indication of where hazards exist. An organization that investigates near-misses and updates its risk assessments accordingly demonstrates the proactive safety culture that OSHA’s Recommended Practices require.

Risk Assessment Example: Construction Site

The following is a worked construction risk assessment example for a concrete formwork and pour operation on a mid-rise building project. This example demonstrates how to do a risk assessment for a single work activity.

Project: Mid-Rise Office Building – Level 4 Concrete Deck Pour Date of Assessment: [Insert date] Assessed by: Site Safety Manager (CSP) Applicable Standards: 29 CFR 1926 Subpart Q (Concrete and Masonry Construction), 29 CFR 1926.502 (Fall Protection), 29 CFR 1910.1053 (Respirable Crystalline Silica)

Hazard Who Is at Risk Likelihood Severity Risk Level Control Measure
Fall from open deck edge (6 ft+ above lower level) Formwork carpenters, concrete finishers Likely Catastrophic Critical Install guardrail system (top rail, mid-rail, toe board) per § 1926.502(b) before deck work begins. Personal fall arrest system (PFAS) required where guardrails are not feasible.
Struck-by falling formwork panels during stripping Workers below stripping operation Possible Major High Establish and enforce exclusion zone below stripping area. Post barricades and signage. Sequence work to eliminate overhead exposure.
Silica dust inhalation during concrete cutting and grinding Concrete finishers, adjacent workers Likely Major High Use Table 1 engineering controls per 29 CFR 1910.1053: wet methods or integrated water delivery on grinders. Provide N95 respirators (minimum) where Table 1 controls are not fully effective. Medical surveillance required for workers with 30+ days/year exposure.
Musculoskeletal injury from manual handling of formwork panels (panels up to 80 lbs) Formwork carpenters Almost Certain Moderate High Use mechanical lifting aids (panel carts, crane-assisted placement) for panels exceeding 50 lbs. Implement two-person lift protocol. Rotate tasks to limit continuous manual handling to 20-minute intervals.
Electrical contact – temporary power leads on deck All deck workers Unlikely Catastrophic High GFCI protection on all temporary power per § 1926.404(b)(1). Daily inspection of leads by competent electrician. Cord management plan to prevent trip and contact hazards.
Concrete burns (skin and eye contact with wet concrete – pH 12–13) Concrete finishers, pump operators Likely Moderate Medium Provide alkali-resistant gloves, rubber boots, and safety glasses with side shields. SDS for concrete mix reviewed in toolbox talk. Emergency eyewash station within 10 seconds of work area.
Heat illness – outdoor work in high ambient temperature All workers on deck Possible Major High Implement OSHA Heat Illness Prevention Program: water (1 qt/hr), rest (minimum 10 min/2 hrs), shade. Acclimatization plan for new workers (14-day schedule). Designate heat illness first-aid responder on site.
Vehicle/equipment struck-by – concrete pump truck and transit mixers All workers in delivery zone Possible Catastrophic Critical Establish dedicated vehicle access route segregated from worker pedestrian paths. Spotter required for all reversing vehicles. High-visibility vests (ANSI Class 2 minimum) required in vehicle operating zone.

Risk Assessment Summary:

  • Critical risks: 2 (fall from height, vehicle struck-by) – controls must be in place before work begins
  • High risks: 5 – controls must be implemented and verified by competent person prior to task start
  • Medium risks: 1 – controls implemented; monitor effectiveness during work

This construction risk assessment example illustrates that a single concrete pour activity generates multiple overlapping hazards requiring controls at different tiers of the hierarchy. The assessment must be reviewed at the start of each pour day and updated if conditions change.

Risk Assessment vs. JSA vs. HIRA – What’s the Difference?

Construction safety professionals use three related but distinct tools. Understanding their scope prevents duplication and gaps.

Aspect Risk Assessment JSA (Job Safety Analysis) HIRA (Hazard Identification and Risk Assessment)
Purpose Evaluate hazards across a work area, activity, or project phase and assign risk levels Break one specific job into sequential steps; identify hazards and controls for each step Identify and assess hazards across an entire project, process, or facility
Scope Moderate – one activity or work area Narrow – one specific task Broad – entire project or site
Timing Before a work phase begins; updated when conditions change Before the specific task starts; updated if the job method changes During planning and design; reviewed periodically
Output Risk register with risk levels and control measures Step-by-step safe work procedure for crew briefing Risk matrix and prioritized control plan for project management
OSHA terminology “Hazard assessment” (29 CFR 1910.132(d)); “hazard identification” (§ 1926.20) “Job Hazard Analysis (JHA)” – OSHA’s preferred term Not a specific OSHA term; used in ISO 45001 and industry practice
Who conducts it Competent person or safety professional Supervisor and workers performing the task Safety manager, project engineer, or EHS team
Best use Regulatory compliance documentation; project-level hazard control planning Field-level task execution; crew toolbox talks Strategic risk prioritization; design-phase hazard elimination

How they work together: HIRA is conducted first to identify and rank major project hazards. The risk assessment translates those findings into documented controls for each work phase. The JSA (or JHA) operationalizes those controls at the task level for the crew performing the work.

The three tools are not interchangeable. A JSA does not satisfy the 29 CFR 1910.132(d) written hazard assessment requirement. A project-level HIRA does not replace the task-specific JSA required before confined space entry or hot work.

Common Mistakes That Invalidate a Risk Assessment

The following errors are the most frequently cited deficiencies in construction risk assessment documentation. Each one creates regulatory exposure and, more critically, leaves workers unprotected.

1. Generic, non-site-specific language A risk assessment that lists “fall hazard – install guardrails” without specifying the location, the height, the affected workers, and the guardrail specification is not a compliant assessment. OSHA enforcement requires specificity. The assessment must describe the actual conditions on the actual site.

2. Failure to involve workers OSHA’s Recommended Practices explicitly require worker participation in hazard identification. An assessment completed solely by a safety manager without input from the workers performing the task is incomplete. Workers identify hazards that are not visible during a walk-through.

3. Treating PPE as the primary control The hierarchy of controls requires the employer to implement elimination, substitution, and engineering controls before defaulting to PPE. An assessment that lists only PPE as the control for a hazard that could be controlled by engineering means does not satisfy OSHA’s requirements and will not withstand inspection.

4. No written certification Under 29 CFR 1910.132(d)(2), the hazard assessment must be certified in writing. A verbal assessment, a mental note, or an unsigned form does not satisfy the standard. The certification must identify the workplace, the assessor, and the date.

5. Failure to update after incidents or scope changes A risk assessment that was completed at project mobilization and never updated does not reflect current site conditions. OSHA’s guidance requires reassessment after incidents, near-misses, and scope changes. An outdated assessment is evidence of a failed safety program, not a functioning one.

6. Assigning risk levels without defined criteria Risk levels must be assigned using a defined and documented risk matrix. “High,” “medium,” and “low” designations that are not tied to explicit likelihood and severity criteria are subjective and undefensible. The risk matrix must be part of the documented assessment.

7. No defined responsibility or timeline for control implementation The assessment must name the person responsible for each control and the date by which it will be implemented. An assessment that identifies hazards and controls but assigns no accountability is not an action plan – it is a list.

8. Omitting nonroutine and emergency scenarios OSHA’s guidance specifically requires assessment of hazards associated with emergency situations and infrequent tasks. Maintenance activities, equipment startups, and emergency response scenarios must be included. Omitting them leaves workers unprotected during the highest-risk moments.

Frequently Asked Questions

What are the 5 steps of a risk assessment?

The five steps of a risk assessment are: (1) identify the hazards present or likely to be present in the workplace; (2) determine who is at risk and how they could be harmed; (3) evaluate the risk level for each hazard and select control measures following the hierarchy of controls; (4) record the findings in a written document certified by the assessor; and (5) review and update the assessment whenever conditions change. These steps are consistent with OSHA’s Hazard Identification and Assessment guidance and the requirements of 29 CFR 1910.132(d) and 29 CFR 1926 Subpart C.

Is a risk assessment legally required on construction sites?

Yes. Under 29 CFR 1910.132(d), employers must assess the workplace for PPE hazards and certify that assessment in writing. Under 29 CFR 1926.20(b), construction employers must maintain safety programs that include regular inspections by competent persons. The OSHA General Duty Clause (Section 5(a)(1) of the OSH Act) requires employers to address all recognized hazards – a documented risk assessment is the primary evidence of compliance. Failure to conduct and document a hazard assessment is a citable OSHA violation.

What is the difference between a hazard and a risk?

A hazard is any source, situation, or act with the potential to cause injury, illness, or property damage. Risk is the combination of the likelihood that the hazard will cause harm and the severity of that harm. OSHA defines risk as the product of hazard and exposure. A wet concrete floor is a hazard; the risk is determined by how likely a worker is to slip on it and how severe the resulting injury would be.

How often must a construction risk assessment be reviewed?

The risk assessment must be reviewed whenever conditions change: when a new work phase begins, when new materials or equipment are introduced, after any incident or near-miss, when new workers or subcontractors arrive on site, or when site conditions change significantly. For active construction sites, a weekly review against current conditions is a defensible minimum. Task-specific assessments for high-hazard work (confined space entry, hot work, work near energized equipment) must be conducted before each occurrence.

What is a construction risk assessment example?

A construction risk assessment example documents the hazards associated with a specific work activity – such as a concrete deck pour – and records for each hazard: who is at risk, the likelihood and severity of harm, the resulting risk level, and the control measures required. For example, a fall hazard at an open deck edge would be rated Critical (Likely × Catastrophic), with the required control being a guardrail system installed per 29 CFR 1926.502(b) before work begins. The full worked example in this guide covers eight hazards for a Level 4 concrete pour operation.

What is the difference between a risk assessment and a Job Safety Analysis (JSA)?

A risk assessment evaluates hazards across a work area or activity phase and assigns risk levels to prioritize controls. A Job Safety Analysis (JSA) – also called a Job Hazard Analysis (JHA) under OSHA terminology – breaks a single specific task into sequential steps, identifies the hazard in each step, and defines the safe procedure for that step. The risk assessment is the project-level document; the JSA is the task-level field tool. A JSA does not replace a risk assessment for purposes of 29 CFR 1910.132(d) compliance.

Useful Sources

The following official sources were used in the preparation of this guide and are recommended for regulatory reference.

Related Articles

Be the first to comment

Leave a Reply

Your email address will not be published.


*