Document {{ORG_PREFIX}}-004

Risk, Opportunity & Hazard Methodology¶

1. Purpose¶

This document defines the single methodology {{ORG_NAME}} uses to identify, record, assess, accept, treat and monitor risks, opportunities and hazards across both disciplines of the IMS. It is one methodology executing in two registers:

the Risk & Opportunity Register (Airtable) — quality and OH&S risks and opportunities, including the exposures carried by the role-holders, registers and programmes the system depends on; and
the Hazard Register (Airtable) — workplace hazards and the OH&S risks arising from them, fed by the worker-facing Hazard & Incident Report form.

Both registers apply the same 5×5 matrix, the same rating vocabulary and the same acceptance criteria, so a hazard-derived risk and a system-level risk are always comparable. That matters to {{ORG_NAME}}: a rating is only worth acting on if the next person to look would have reached it too, and rows raised months apart have to be rankable against each other when {{ROLE_TOP_MANAGEMENT}} decides where money and attention go. So the matrix, bands and acceptance criteria in 3.2 decide every row, whoever raises it, and the flows in 3.3 and 3.6 walk each row through the same fields to get there. Assessments run ahead of the work: 3.3 starts one when something is first spotted, before a planned change goes ahead, and again on the review cadence the row's band sets, so {{ORG_NAME}} deals with exposure before it hurts someone or spoils a job. This document is the controlled statement of that method and those criteria; it changes only through the lifecycle in section 4, and the register rows it governs hold what each assessment found.

2. Scope¶

In scope:

Quality risks and opportunities affecting {{ORG_NAME}}'s ability to deliver conforming services and satisfy clients, determined from the context issues and interested-party requirements established in context-interested-parties-compliance-obligations.
OH&S risks and opportunities: the risks to people that identified hazards create, and the exposures that would leave those hazards unwatched, such as a key role-holder lost, a register unavailable, or an inspection or audit programme that stops running.
Workplace hazard identification, assessment and control, for everyone whose work or presence {{ORG_NAME}} controls or influences (workers, contractors, visitors), across all activities within the IMS scope defined in ims-scope-statement.
Risk and opportunity evaluation of planned changes — this methodology supplies the assessment method that management-of-change-procedure invokes before any planned permanent or temporary change proceeds.

Out of scope:

Incident reporting and investigation — the Hazard & Incident Report form is shared, but confirmed incidents are handled under the incident reporting and investigation process, not this methodology.
Determination and evaluation of compliance obligations — done under the compliance obligations process; applicable obligations are an input to every assessment here.
Execution of change control and emergency response — those processes call this methodology; their own steps live in their own documents.

3. Content¶

3.1 Definitions¶

Term	Meaning in this IMS
Risk	A credible way {{ORG_NAME}} could miss a result it is relying on. A quality risk threatens {{ORG_NAME}}'s ability to consistently deliver conforming services and satisfied clients; a system-level risk threatens the management system's own operation.
Opportunity	A circumstance {{ORG_NAME}} could act on for beneficial effect — better performance, reduced risk, improved ways of working, or improvement of the management system itself.
Hazard	A thing, condition or way of working that could hurt someone or make them ill through {{ORG_NAME}}'s work: physical (a substance, a tool, an energy source), situational (where and when the work happens), or organisational (how the work is set up, paced and staffed).
OH&S risk	The likelihood that a hazard actually harms someone, paired with how serious that harm would be: the same pairing the Hazard Register's likelihood and consequence fields capture.
Inherent rating	The unmitigated likelihood × consequence rating, assessed as if existing controls were absent or had failed. It answers: "how bad is the raw exposure?"
Residual rating	The mitigated likelihood × consequence rating with current controls operating. It answers: "how bad is the exposure we actually carry today?" The gap between inherent and residual is the value of the existing controls.
Treatment	A planned further control that reduces a residual rating, always stated with its hierarchy-of-controls level (see 3.4).
Acceptance	The recorded human decision that a residual rating is (or is not) within the acceptance criteria in 3.2.4. Never auto-derived from the rating.

3.2 Risk matrix¶

One matrix serves both registers and both disciplines. It is applied twice to every risk row: once inherent, once residual; for hazard-derived OH&S rows the assessor is the {{ROLE_OHS_COORDINATOR}} (3.6). The exposures {{ORG_NAME}} carries in the IMS's own moving parts, such as losing a key integrated role-holder, a register platform going down, or an audit programme that stops running, are rated on this same matrix and indexed on the Risk & Opportunity Register rather than the Hazard Register, so they sit in top-level monitoring beside the delivery and safety risks they affect.

The descriptors below are indicative defaults. [ORG-DECISION: calibrate both the likelihood frequencies and the consequence descriptors to the organisation's actual operations, turnover and workforce at instantiation.]

3.2.1 Likelihood¶

Level	Index	Indicative frequency [ORG-DECISION: calibrate to operations]
Rare	1	Conceivable only in exceptional circumstances — not expected within 10 years
Unlikely	2	Could occur at some point — roughly once in 3–10 years
Possible	3	Might occur — roughly once in 1–3 years
Likely	4	Will probably occur — around once a year
Almost certain	5	Expected to occur — several times a year or more

3.2.2 Consequence¶

Level	Index	Quality consequence	OH&S consequence
Insignificant	1	Slip caught internally before delivery; no client impact; negligible rework	Discomfort or first-aid-only treatment; no lost time
Minor	2	Correction issued after delivery; client inconvenienced but relationship unaffected; contained rework cost	Injury or ill health needing medical treatment; little or no lost time; full and fast recovery
Moderate	3	Nonconforming service reaches the client; formal complaint; significant rework or partial re-performance of a job	Lost-time injury or illness; full recovery expected
Major	4	Systemic failure affecting multiple jobs or a key client; breach of a contractual or certification requirement; loss of a client	Serious injury or illness; hospitalisation; prolonged recovery or permanent partial impairment
Severe	5	Widespread loss of confidence in {{ORG_NAME}}'s services; loss of certification; damage threatening the viability of the business	Fatality, permanent disabling injury or illness, or multiple serious injuries

3.2.3 The 5×5 grid¶

Score = likelihood index × consequence index. The register rating fields (Inherent Rating, Residual Rating) compute the score and band automatically from the selected likelihood and consequence; they are formula fields and are never written by hand.

Likelihood ↓ / Consequence →	Insignificant (1)	Minor (2)	Moderate (3)	Major (4)	Severe (5)
Almost certain (5)	5 — Medium	10 — High	15 — High	20 — Extreme	25 — Extreme
Likely (4)	4 — Low	8 — Medium	12 — High	16 — High	20 — Extreme
Possible (3)	3 — Low	6 — Medium	9 — Medium	12 — High	15 — High
Unlikely (2)	2 — Low	4 — Low	6 — Medium	8 — Medium	10 — High
Rare (1)	1 — Low	2 — Low	3 — Low	4 — Low	5 — Medium

3.2.4 Bands, responses and acceptance criteria¶

Band	Score	Required response	Treatment authority	Review cadence	Acceptance criterion
Low	1–4	Manage through routine documented controls; no further treatment required	Row owner — {{ROLE_QUALITY_MANAGER}} for quality-sourced rows, {{ROLE_OHS_COORDINATOR}} for OH&S-sourced rows	Annual	Acceptable; owner records `Acceptance` = "Within criteria — accepted"
Medium	5–9	Treat where a proportionate treatment exists; otherwise accept with documented owner sign-off	Row owner (as above)	Six-monthly	Acceptable with owner sign-off — see risk appetite below
High	10–16	Treatment plan mandatory; interim controls applied immediately; escalate to {{ROLE_TOP_MANAGEMENT}}	{{ROLE_TOP_MANAGEMENT}}	Quarterly	Not acceptable as a residual state unless {{ROLE_TOP_MANAGEMENT}} explicitly accepts it or treatment is underway
Extreme	17–25	Stop, or do not start, the affected activity where exposure is immediate; treat without delay; escalate to {{ROLE_TOP_MANAGEMENT}} the same working day	{{ROLE_TOP_MANAGEMENT}}	Monthly until reduced below Extreme	Never acceptable as an ongoing state; {{ROLE_TOP_MANAGEMENT}} must decide to treat or stop

Risk appetite is [ORG-DECISION: default — a residual Medium is acceptable with the row owner's documented sign-off; a residual High or Extreme requires {{ROLE_TOP_MANAGEMENT}} acceptance or treatment].

No rating and no acceptance decision can make a legal or other compliance obligation optional: where a control is required by an applicable obligation, it is implemented regardless of band.

3.3 Assessment flow¶

The flow below mirrors the Risk & Opportunity Register fields exactly — each step names the field(s) it completes. The same flow applies on the Hazard Register (see 3.6 for how hazards enter it and the field-name differences). Assessment runs ahead of trouble: when a risk is first identified, before a planned change proceeds, and again each time a row's band brings its review cadence around. {{ORG_NAME}} does not wait for something to go wrong before it looks.

Inputs to identification (step 1). A register row never starts from a blank page: identification pulls from sources {{ORG_NAME}} already maintains, each with its own owner and cadence.

Source	What it feeds into identification
Hazard Register (3.6)	Identified hazards and the OH&S risks arising from them
Audit findings, incidents, nonconformities and worker reports	Weak points the system has already surfaced
`management-of-change-procedure`	Every planned change, temporary or permanent. The MoC gate invokes this methodology and the change proceeds only after the assessment is complete
`ims-scope-statement` and the context analysis behind it	The context issues, interested-party requirements and IMS boundary that frame what could go wrong or better
Compliance obligations process	The legal requirements and other obligations that apply to the work, kept current by that process
The management system's own operation	Risks and opportunities affecting the IMS itself, indexed on the Risk & Opportunity Register per 3.2

Workers shape the OH&S side of this planning through the arrangements in communication-consultation-participation-procedure, with that participation evidenced in docs/records/consultation/; other relevant interested parties are involved where a row affects them.

Identify the risk or opportunity from the inputs above. Anyone can raise one; the {{ROLE_QUALITY_MANAGER}} (quality) or {{ROLE_OHS_COORDINATOR}} (OH&S) confirms it warrants a register row.
Record it in the Risk & Opportunity Register: Title, Type (Risk or Opportunity), Source (Quality, OH&S, or Both), Description, and Owner Role. Status opens as Open. Opportunities now branch to 3.5.
Assess inherent exposure: set Inherent Likelihood and Inherent Consequence as if the existing controls were absent or had failed. Inherent Rating computes the score and band.
Document existing controls in Existing Controls — only controls that are actually in place and operating, not intentions.
Assess residual exposure: set Residual Likelihood and Residual Consequence with the current controls operating, honestly weighing how effective those controls really are. Residual Rating computes the score and band.
Compare the residual band against the acceptance criteria in 3.2.4.
Set Acceptance — a human decision by the treatment authority for the band: "Within criteria — accepted", "Treatment required", or "Escalated to Top Management".
Treat if unacceptable: plan further controls using the hierarchy of controls (3.4), record them in Treatment with each control's hierarchy level stated, and set Status to Treating. Actions are planned per 3.7.
Reassess residual once treatments are implemented: repeat steps 5–7. Iterate until the residual rating meets the acceptance criteria or {{ROLE_TOP_MANAGEMENT}} formally accepts the exposure.
Monitor per the band's review cadence: set Next Review, link any related hazards via Linked Hazards, and move Status through Monitoring to Closed when the risk no longer applies. Register health is a standing management review input.

Documented information. Two artefacts carry this planning on the record: this methodology document, which fixes the method and criteria, and the register rows it governs, which hold each risk, opportunity and planned action. Register health is a standing management review input (step 10), and that review is how {{ORG_NAME}} satisfies itself the process runs as designed. The register is the live index; point-in-time evidence is snapshotted into docs/records/ at review and audit points rather than by editing history.

3.4 Hierarchy of controls¶

Every treatment is selected by working down the following five levels in mandatory priority order — a lower level may only be chosen after the levels above it have been genuinely considered and found not reasonably achievable:

Elimination — remove the hazard or the failure source entirely.
Substitution — replace it with something less hazardous or less failure-prone.
Engineering controls — isolate people from the hazard or build the safeguard into equipment, tools or systems.
Administrative controls — procedures, training, supervision, signage, scheduling.
Personal protective equipment (PPE) — the last line, relied on only when higher levels cannot reduce the risk sufficiently.

Every treatment recorded in a Treatment field states its hierarchy level; on the Hazard Register, Control Level records the highest level achieved by the applied controls. Administrative or PPE controls alone cannot close out a High or Extreme residual rating — a higher-level control, or formal {{ROLE_TOP_MANAGEMENT}} acceptance, is required [ORG-DECISION: confirm or tighten this rule at instantiation].

3.5 Opportunities¶

Opportunities are identified through the same inputs as risks and recorded in the Risk & Opportunity Register with Type = Opportunity, but they are not likelihood × consequence rated: the four rating fields stay blank and the rating formulas return blank. Instead the owner records a short benefit / feasibility narrative in Description — what would improve, for whom, at what effort and cost — and the plan to realise the opportunity in Treatment, with Status tracking progress.

OH&S opportunities are recorded whenever {{ORG_NAME}} spots a chance to make work safer or easier: removing an OH&S risk outright, or shrinking it, rather than living with a controlled version of it; banking a safety gain from a change already in motion, since a move, a new tool or a restructure going through management-of-change-procedure is the cheapest moment to design a hazard out; rebalancing a workload, changing a roster, improving a workstation or site set-up or redesigning a task so the work fits the people doing it; and making the IMS lighter to run, such as automating a register chore. Quality opportunities include better methods, tools and service offerings. Opportunities whose realisation needs material resources or becomes a measurable improvement programme are promoted to objectives in ims-objectives-improvement-plan (see 3.7).

3.6 Hazard pathway¶

Hazard identification is ongoing and proactive, not an annual event. The standing channels are:

the Hazard & Incident Report form — the low-friction worker participation channel: any worker, at any time, reports a hazard by completing Hazard, Location / Activity, Description and Raised By, which creates a row directly in the Hazard Register;
workplace inspections and job planning [ORG-DECISION: set inspection cadence and scope to suit operations];
consultation forums run under communication-consultation-participation-procedure; and
reviews triggered by change (via management-of-change-procedure), incidents, and new information about hazards.

Hazard identification casts a deliberately wide net. Whoever is looking, whether a worker filling in the Hazard & Incident Report form, the {{ROLE_OHS_COORDINATOR}} on an inspection or job-planning pass, or a change review under management-of-change-procedure, works through the same prompts:

The people. Everyone the work can reach: the workers doing it, contractors working alongside them, visitors, and people nearby who never signed up for it.
The pressure. Workload, rostered hours, deadlines and the culture people work inside; the way work is set up and shared can harm as surely as any substance.
The day itself. The task done daily on autopilot, the one-off job nobody has done before, and the emergency {{ORG_NAME}} hopes never comes: situations count as much as tasks.
The set-up. How the workplace, the tools and the task are designed, and what that design does to the person doing it.
The last time. {{ORG_NAME}}'s own Incident Register, and what has gone wrong at other organisations doing similar work.
The news. Fresh information about a hazard: an updated safety data sheet, a regulator alert, something a worker has just learned.
The next change. Anything changing now or on the drawing board in equipment, staffing, process or premises, routed here by management-of-change-procedure.

The pathway for each reported hazard:

The {{ROLE_OHS_COORDINATOR}} triages each new Hazard Register row promptly. Reports that describe an event that has already caused (or nearly caused) harm are re-entered in the Incident Register and handled under the incident reporting and investigation process; genuine hazards continue below.
The {{ROLE_OHS_COORDINATOR}} assesses inherent risk (Inherent Likelihood × Inherent Consequence, controls assumed absent or failed), documents Controls and the highest Control Level achieved, then assesses residual risk — applying the matrix and acceptance criteria in 3.2 and taking account of applicable legal and other requirements and real control effectiveness. Assessment is done in consultation with the workers who do the work, including the {{ROLE_WORKER_REP}}, with consultation evidenced in docs/records/consultation/.
Hazards whose treatment or exposure is significant at system level are linked to a Risk & Opportunity Register row (via that register's Linked Hazards field) so the exposure appears in top-level risk monitoring.
Residual High or Extreme ratings are escalated to {{ROLE_TOP_MANAGEMENT}} per the band table in 3.2.4 — Extreme the same working day, with the affected activity stopped where exposure is immediate.
Status moves Reported → Assessed → Controlled → Closed as controls are implemented and verified; the reporter is told what was decided and why, closing the participation loop.

3.7 Action planning¶

Actions arising from steps 7–8 of the assessment flow are planned so that they actually change how work is done, not just what the register says:

Coverage. Nothing assessed is left uncovered. Obligation-mandated controls confirmed by the compliance obligations process are implemented whatever the band (3.2.4). Emergency-type risks take preparation and response actions cross-linked to emergency-preparedness-response-plan and feed that plan's scenarios. A risk row inside its acceptance criteria is carried by the documented controls already operating; a row outside them carries treatment actions; an opportunity row being realised carries its plan in Treatment (3.5).
Method. Treatment selection applies the hierarchy of controls (3.4) and draws on what the system already knows: audit results, incident and nonconformity trends, consultation input, and monitoring data.
Proportionality and constraints. Actions are sized to the band and to how much the exposure could cost in service conformity and in harm to people: a Low-band quality risk does not justify a re-engineered process, and a Severe-consequence hazard justifies substantial investment. Control choices also weigh what the business can carry financially, operationally and commercially, the technology {{ORG_NAME}} can actually buy and run, and what good practice would ask. When one of those limits the chosen control, the Treatment narrative says so honestly.
Where the action lands. Every action is built into the IMS process where the work actually happens: a procedure step, a training item, a checklist, an inspection, a register automation. Each action carries an owner and a due date, and actions never live only in the register row.
Checking it worked. Every action states, at planning time, how {{ORG_NAME}} will know it worked: normally a reassessment of the residual rating after implementation (assessment flow step 9) plus a defined check such as monitoring data, an inspection or an audit slice. A row only moves to Monitoring or Closed once that check has been done.

Interfaces: treatments that become measurable improvement programmes are promoted to objectives in ims-objectives-improvement-plan and carry the planning elements set out in its section 3.2.2; treatments that alter processes, equipment, materials, staffing or the system itself proceed through management-of-change-procedure before implementation (which in turn invokes this methodology on the change); emergency-preparation actions are implemented through emergency-preparedness-response-plan.

4. Ownership and Review¶

Aspect	Assignment
Owner	{{ROLE_OHS_COORDINATOR}}
Reviewer	{{ROLE_QUALITY_MANAGER}}
Approver	{{ROLE_TOP_MANAGEMENT}}
Status / Version	Draft, 0.1
Next review date	2026-08-15
Review trigger	Annual, or immediately upon any material change to IMS scope, organisational structure, sites, services, legal/regulatory requirements, or after a significant incident or nonconformity.

The Draft → Under Review → Approved lifecycle runs through GitHub pull requests as defined in the Document & Record Control Procedure.

5. Revision History¶

Version	Date	Author	Description of Changes	Reviewed By	Review Date	Approved By	Approval Date
0.1	2026-07-16	{{ROLE_OHS_COORDINATOR}}	Initial draft	—	—	—	—

6. Document Control

Document	`{{ORG_PREFIX}}-004`
Type	IMS Core Document
Version	0.1
Status	Draft
Owner	{{ROLE_OHS_COORDINATOR}}
Reviewer	{{ROLE_QUALITY_MANAGER}}
Approver	{{ROLE_TOP_MANAGEMENT}}
Next Review	2026-08-15
Classification	Internal

Held in the document frontmatter, mirrored to the Document Register.