What is the difference between a hazard and a risk?

In the parlance of health and safety management, the terms hazard and risk are often confused. It becomes difficult to have a discussion about assessment and mitigation when we can’t agree on a glossary first. The confusion might come from the fact that these are both everyday words re-purposed as professional terminology. The intention and meaning in a professional context can get conflated with the colloquial usage of those words. So what is the difference?

The CCOHS defines hazard as “any source of potential damage, harm or adverse health effects on something or someone”. We’re talking about elements that could contribute to a loss under the right circumstances, and not the incident itself or the chances of one occurring. If you want to draw the ire of safety sticklers, just include “slips/trips/falls” in the list of hazards. I still see this on a lot of hazard assessments – to be clear, that does not fit the definition. If a worker slips, the hazard in question is a slippery surface, not the event itself.

A hazard is an element that has the potential to contribute to an incident. Conversely, an incident, by one definition, is a hazard realized. Defining terms by their relationship gives a bit of a feel for what should fit in what category.

(Learn about The Hierarchy of Hazard Controls.)

Now that we have a handle on hazards, what is a risk?

Risk is a bit more speculative. According to CCOHS, risk is “the combination of the likelihood of the occurrence of a harm and the severity of that harm”. Essentially, risk is an estimation of the chances of an incident resulting from a given hazard. We have to look at how often a worker is exposed and how often similar incidents have occurred, but also assess how serious an incident would be if it were to occur. Risk is often expressed as a letter or number score, or a combination of the two. For example, we might assess the risk of an asteroid strike as extremely severe, but vanishingly remote. Depending on the ranking scheme, maybe you would assign a 5 (very serious) A (incredibly unlikely), meaning it is low priority for controls.

Establishing risk levels is an entire discipline in itself. The better methods use statistical data and mathematical models to come up with objective scores, but risk management professionals aren’t exactly on every organization’s payroll. Many workplaces assess risk in a simple way by estimating probability and severity with common sense. Doing so in groups gets better results because it corrects somewhat for subjective perception informed by each participant’s level of knowledge and experience.

(Read about Risk Mitigation Using Mobile Technology.)

To sum up - there is a level of risk that a hazard will result in an incident. The terms are related, but not interchangeable.