Hazard vs. Risk: What's the Difference?

In a food-storage warehouse in Damascus, a forklift crosses the main aisle every few minutes — the very same aisle workers walk through on their way to the packaging area. Three years have passed without a single incident, so no one sees it as a problem anymore. Then an inspector visits and asks one question: "What's stopping the same thing that happened at the warehouse next door last month — where a forklift broke a worker's leg — from happening here?" You have no written answer.

You saw in the previous lesson that a safety management system is built on identifying and controlling hazards. But that entire pillar rests on a distinction many people blur: the difference between a hazard and a risk. Confusing the two doesn't just muddle terminology — it distorts your priorities, so you spend on what doesn't deserve it and neglect what could kill.

A Hazard Is a Source; Risk Is a Calculation

A hazard is a potential source of harm. A forklift moving through a shared aisle is a hazard. A wet floor is a hazard. An exposed wire is a hazard. Notice: a hazard exists whether or not harm has actually occurred — three years without an incident didn't eliminate the forklift's hazard, it only concealed it.

Risk is a calculation performed on that hazard: the likelihood of harm occurring × its severity if it does. That's why a single hazard can carry two entirely different risk levels depending on context: the same forklift in an almost-empty outdoor yard carries low risk, while in a narrow aisle crossed by forty workers every shift it carries high risk.

Hazards aren't limited to machinery: there are physical hazards like noise and forklifts, chemical hazards like cleaning fumes, ergonomic hazards like lifting loads with poor posture, and psychosocial hazards like the strain of long shifts. All are sources of harm, and all belong in the same hazard inventory.

The rule, then: you spot a hazard with your eyes, but you calculate a risk with your mind.

The Calculation: Likelihood × Severity

Take a simple five-point scale for each dimension, and rate the warehouse forklift: likelihood 4 out of 5 (a shared crossing happening daily, a blind corner at the turn, no separation between paths), and severity 5 out of 5 (a forklift striking a body could cause a fatal injury). Risk = 4 × 5 = 20 out of 25 — red, at the very top of your table.

Compare that to the wet floor in front of the sink: likelihood 3, severity 2 (bruises, most likely), giving a risk of 6. Both are genuine hazards, but the calculation is what decides where your budget goes first. This ranking is the essence of risk assessment:

1. Identify the hazards: what could cause harm?
2. Estimate the likelihood and severity for each hazard.
3. Rank the results from highest to lowest.
4. Put controls in place for the highest-ranked ones first.
5. Recalculate after the control is applied.

Apply step four to the forklift: a barrier separating the pedestrian path, mirrors at the blind corner, an internal speed limit, and routine brake maintenance. Recalculate: likelihood drops from 4 to 2, so risk becomes 2 × 5 = 10.

Notice two things about this number. First: the controls lowered the likelihood without touching the severity — if a collision does happen, the nature of the harm is unchanged; reducing severity requires a deeper change to the work itself, such as replacing the forklift in that aisle with a fixed automated conveyor. Second: the remaining ten is called residual risk, and it isn't forgotten once the assessment is done — it's knowingly accepted and monitored through your recurring inspections.

Common Mistakes

1. Treating a hazard list as if it were a risk assessment. A hazard inventory is only half the job; without calculating likelihood and severity, a fatal forklift ends up ranked the same as a wet floor, and the budget goes to whoever complains loudest, not to what actually threatens the most.
2. Improving the numbers on paper. Lowering the likelihood in the table because you "decided" to install a barrier that hasn't been installed yet. An assessment describes today's actual reality, not intentions — a control only enters the calculation the day it's actually in place.
3. An assessment done once and left to go stale. A new production line, a change to the warehouse layout, an incident that occurred — all of these should reopen the assessment. An assessment is a living document updated with every change, not a one-time founding file that gets filed away and forgotten.

In goiso

When you activate ISO 45001 in goiso, its clauses appear color-coded on your compliance surface, including the clauses for hazard identification and risk assessment: they stay amber until you attach your assessment as evidence on the clause card, at which point they turn green. Then the seed wizard takes over: it converts these clauses into recurring inspections distributed across your sites and team, turning hazard review from a once-a-year event that gets forgotten into a scheduled, recurring round. See How I Track Standard Clauses and How the Seed Wizard Turns Clauses into Tasks.

Summary

• A hazard is a potential source of harm, and it exists whether or not harm has actually occurred.
• Risk = likelihood × severity, and it's what ranks your priorities and budget.
• Controls usually reduce likelihood; reducing severity requires a more fundamental change to the work itself.
• An assessment is a living document redone after every change and every incident, and any residual risk is knowingly accepted and monitored.

This cycle — assess, control, review, assess again — is no accident; it's the pattern all ISO standards are built on, called the PDCA continuous improvement cycle, the subject of the next lesson.