Risk assessment & JHA

Every risk assessment claims the risk came down. This one makes you say what by.

Initial and residual risk on one configurable matrix, with the reduction refused unless the controls behind it are written down — and a review date the platform actually chases.

Bring us your worst register Book a 20-minute walkthrough

#21 · Work at Height

Contractor roof work — HVAC replacement

Initial15CriticalL3 × C5

Initial risk for Contractor roof work — HVAC replacement: likelihood 3 by consequence 5.
Likelihood down, consequence across	1	2	3	4	5
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15 — Initial risk, Critical
2	2	4	6	8	10
1	1	2	3	4	5

Likelihood down the side, consequence across. Initial sits at L3 × C5, ringed above.

Residual10HighL2 × C5

Residual risk for Contractor roof work — HVAC replacement after the recorded controls: likelihood 2 by consequence 5.
Likelihood down, consequence across	1	2	3	4	5
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10 — Residual risk, High
1	1	2	3	4	5

Likelihood down the side, consequence across. Residual sits at L2 × C5, ringed above.

Illustrative data — not a customer.

The two failure modes an auditor finds in twenty minutes

A residual rating with nothing behind it

Initial risk 25, residual risk 1, controls field empty or reading “care to be taken”. It is not fraud — it is a form being filled in at the end of a Friday. And it is the assessment that gets read out in an inquiry, because the drop from 25 to 1 is a claim the organisation made in writing and cannot support.

And then the date

Almost every register has a review date column and almost no system does anything with it. The assessment was right when the line ran a different product, before the guard was modified, before the crew turned over. Nobody decided to let it lapse; nothing was watching.

The refusals

Three things the platform will not record, however the form is filled in

Quoted as the product says them, because a refusal you can read is one a sceptic can test.

01A reduction with nothing behind it

This brings the risk down from 25 to 2 without recording a single control. Write down what does it — existing controls, further controls required, or both. A reduction nobody can name is the first thing an auditor asks about.

Initial risk 25, residual risk 1, controls field empty or reading “care to be taken”. It is not fraud, it is a form being filled in at the end of a Friday — and it is the assessment that gets read out in an inquiry.

02A residual worse than where you started

The residual risk (25) is higher than the initial risk (1). Residual risk is what remains after the controls, so it can’t be worse than where you started — check the likelihood and consequence aren’t the wrong way round.

Nearly always a transposed pair, and it leaves the worst-looking residual risks on site being ones nobody assessed as bad.

03A square that does not exist

Likelihood must be between 1 and 5 — the site’s risk matrix is 5×5. Got 99.

Nor is zero a score, which used to be stored happily and then rendered as an em-dash.

And it can’t be slipped in afterwards: the rule is checked against the record as it will be, not just the fields in the request, so adding a residual in a second save still needs the controls.

One scale

A score of 15 has to be called the same thing everywhere

A risk matrix is a shared vocabulary. The moment two parts of a system band the same number differently, the vocabulary is gone.

So the bands are defined once, server-side, and published — the register, the exported PDF, the notification and the field app all ask for them rather than carrying a copy.

They are expressed as fractions of the matrix maximum, so a site running 4×4 or 3×3 gets a scale that reaches Critical instead of one calibrated for somebody else’s grid.

Band thresholds computed from the matrix size, for 3×3, 4×4 and 5×5 grids.
Matrix	Medium	High	Critical	Max
3×3	2	4	6	9
4×4	4	7	10	16
5×5This site	5	10	15	25

Every number in that table is computed from the matrix size rather than typed, and the build fails if the function and the printed scale ever disagree. On a scale hardcoded for 5×5, a 3×3 site could never reach the top band at all — which was a real bug rather than a hypothetical one.

And while we are being precise about vocabulary

The hierarchy of controls, in the order that matters:

EliminationTake the hazard out of the job. The only one that cannot fail.
SubstitutionUse something less harmful to do the same work.
EngineeringGuard it, enclose it, ventilate it, interlock it. Works while nobody is thinking about it.
AdministrativeProcedures, permits, training, rotation. Depends on people doing it every time.
PPEThe last line, protecting one person, and only while it is worn correctly.

This platform is on none of those rungs. It records which controls were chosen, who owns the ones still outstanding, and whether the reduction they claim is supported. Software does not guard a machine.

Worked example

Contractor roof work: 15 before, 10 after, and that is the honest answer

The one that stays amber, which is exactly why it is the one on this page.

Initial · L3 × C5 = 15

Contractor removing and replacing roof-mounted air handling units. Four on the roof, staff below the lift zone.

Controls

Contractor pre-qualified and inducted; method statement and lift plan accepted before mobilisation. Perimeter guardrail to the work area. Exclusion zone below, barriered and marshalled during lifts. Permit issued daily and closed each evening.

Further controls required

Certified fall-arrest anchor points — the current plan relies on temporary guardrail alone.

Owner: Derek Coleman · Target: 30 Jun 2026

Residual · L2 × C5 = 10

High

The consequence didn’t move, and it shouldn’t have

Nothing on that list changes what happens when somebody comes off a roof. The controls change how likely it is to happen — likelihood 3 down to 2, consequence unmoved at 5.

A register where every residual lands on green is a register that has stopped modelling anything. Here, 8 of 14 are still Medium or above after every control on the record — and the ones that stay amber after every reasonable control are precisely the ones worth a manager’s attention.

Before controls

Low: 0
Medium: 4
High: 5
Critical: 5

What the register counts at the top · n = 14

After controls

Low: 6
Medium: 6
High: 2
Critical: 0

What is actually left · n = 14

Worth knowing which one you are reading: the counters at the top of the register band by initial risk — the risk before anybody did anything. Fair to count, misleading on its own, so both are on this page.

Risk register

Likelihood × consequence, with residual risk after controls

Illustrative data — not a customer

By initial risk — before any control

Low0

Medium0

High0

Critical0

Risk type

Review

Fourteen risk assessments with their initial and residual scores and their next review date.
ID	Title / hazard	Type	Initial	Residual	Next review
#26	Lone working — night shift roundsSingle operator patrolling the plant on nights	Occupational Health	Medium9	Low4	194d left
#25	Arc flash — MCC 2 switchingRacking breakers and switching on the 480 V motor control centre	Electrical	High10	Medium5	252d left
#24	Diesel spill to storm drain — bulk fillRefuelling site plant from the bulk tank	Environmental	Medium9	Low4	216d left
#23	Ergonomics — inspection benchRepetitive visual inspection and small-part assembly	Occupational Health	Medium6	Low4	227d left
#22	Legionella — cooling towerOperation and maintenance of the evaporative cooling tower	Occupational Health	High10	Medium5	54d left
#21	Contractor roof work — HVAC replacementContractor removing and replacing roof-mounted air handling units	Work at Height	Critical15	High10	40d overdue
#20	Hot work — maintenance bay pipe repairWelding and grinding on process pipework in the shop	Fire & Explosion	High12	Low4	due in 23d
#19	Manual handling — drum stock rotationMoving and up-ending 205 L drums in the store	Manual Handling	Medium8	Low4	262d left
#18	Noise exposure — compressor houseRoutine attendance in the compressor house during running	Occupational Health	High12	Medium6	275d left
#17	Lockout/tagout — packaging line 3Clearing jams and changing format parts on the bagger	Mechanical	High12	Low4	284d left
#16	Forklift and pedestrian interaction — Warehouse APallet movements across the pick face during shift handover	Vehicle & Traffic	Critical16	Medium8	20d overdue
#15	Confined space entry — effluent sump S-2Inspection, cleaning and lining repair inside the effluent sump	Confined Space	Critical15	High10	due in 12d
#14	Overhead crane lifts across the pick faceMoving finished coil from the bay to the despatch pad	Lifting Operations	Critical15	Medium5	303d left
#13	Caustic transfer — bulk IBC to day tanksDecanting 32% sodium hydroxide from the bulk IBC	Chemical	Critical16	Medium8	86d overdue

#26
Lone working — night shift roundsSingle operator patrolling the plant on nights
Type
Occupational Health
Initial risk
Medium9
Residual risk
Low4
Next review
194d left
#25
Arc flash — MCC 2 switchingRacking breakers and switching on the 480 V motor control centre
Type
Electrical
Initial risk
High10
Residual risk
Medium5
Next review
252d left
#24
Diesel spill to storm drain — bulk fillRefuelling site plant from the bulk tank
Type
Environmental
Initial risk
Medium9
Residual risk
Low4
Next review
216d left
#23
Ergonomics — inspection benchRepetitive visual inspection and small-part assembly
Type
Occupational Health
Initial risk
Medium6
Residual risk
Low4
Next review
227d left
#22
Legionella — cooling towerOperation and maintenance of the evaporative cooling tower
Type
Occupational Health
Initial risk
High10
Residual risk
Medium5
Next review
54d left
#21
Contractor roof work — HVAC replacementContractor removing and replacing roof-mounted air handling units
Type
Work at Height
Initial risk
Critical15
Residual risk
High10
Next review
40d overdue
#20
Hot work — maintenance bay pipe repairWelding and grinding on process pipework in the shop
Type
Fire & Explosion
Initial risk
High12
Residual risk
Low4
Next review
due in 23d
#19
Manual handling — drum stock rotationMoving and up-ending 205 L drums in the store
Type
Manual Handling
Initial risk
Medium8
Residual risk
Low4
Next review
262d left
#18
Noise exposure — compressor houseRoutine attendance in the compressor house during running
Type
Occupational Health
Initial risk
High12
Residual risk
Medium6
Next review
275d left
#17
Lockout/tagout — packaging line 3Clearing jams and changing format parts on the bagger
Type
Mechanical
Initial risk
High12
Residual risk
Low4
Next review
284d left
#16
Forklift and pedestrian interaction — Warehouse APallet movements across the pick face during shift handover
Type
Vehicle & Traffic
Initial risk
Critical16
Residual risk
Medium8
Next review
20d overdue
#15
Confined space entry — effluent sump S-2Inspection, cleaning and lining repair inside the effluent sump
Type
Confined Space
Initial risk
Critical15
Residual risk
High10
Next review
due in 12d
#14
Overhead crane lifts across the pick faceMoving finished coil from the bay to the despatch pad
Type
Lifting Operations
Initial risk
Critical15
Residual risk
Medium5
Next review
303d left
#13
Caustic transfer — bulk IBC to day tanksDecanting 32% sodium hydroxide from the bulk IBC
Type
Chemical
Initial risk
Critical16
Residual risk
Medium8
Next review
86d overdue

Showing 14 of 14. Every row carries both numbers, because the residual on its own is a claim with nothing to compare it to — and the drop between them is the thing an auditor asks you to justify.

The risk register showing fourteen assessments with their type, initial risk score, residual risk score and status. — Both scores on every row, in the product. Illustrative data — not a customer.

The review clock

An assessment nobody revisits is the finding an auditor opens with

Every assessment and every JHA carries a next review date. The platform reads it.

Overdue for review

The worst of them is #13 Caustic transfer — bulk IBC to day tanks, 86 days past its date at an initial rating of 16. Nobody decided to let that lapse.

Due within 30 days

Both counts are filters on the register above, not a report somebody runs monthly.

30 days out
The owner is told once, when it comes into the window. Not before, because a reminder that arrives three months early is one nobody acts on.
On the date
The record starts counting days rather than showing a date, and the register’s overdue filter picks it up.
Monthly while overdue
Once a month, not every fifteen minutes until they mute it. The row stays overdue whether or not anybody is still being told.
On edit
Changing the review date resets the chase, because that is what reviewing it means.

JHA

The analysis, not the cover sheet

A job broken into steps in the order it is done, each with what could hurt somebody and what stops it.

Job hazard analysis · Baton Rouge — Drum Storage

Replace the mechanical seal on caustic transfer pump P-101

7 steps, in the order the job is done · owner Marcus Delgado

The 7 steps of Replace the mechanical seal on caustic transfer pump P-101, each with its hazards and the controls against them.
Step number	Step	What could hurt somebody	What stops it
1	Isolate and lock off P-101, prove dead	Stored energy; unexpected start-up	Personal lock applied by each person working; try-start test at the panel before any tool is picked up.
2	Drain and flush the casing to the closed system	Residual process fluid under head; caustic burns	Drain to the closed catch pot, never to the bund; face shield and chemical gauntlets; stand upwind of the vent.
3	Break the flanges	Trapped pressure behind the seal; jet release when the joint cracks	Crack the joint on the far side first and let it vent; nobody in line with the split; tray under the joint.
4	Lift the pump head clear to the bench	Manual handling; dropped load in a narrow aisle	Gantry lift with two people, aisle barriered at both ends, nobody under the load at any point.
5	Withdraw and replace the mechanical seal	Sharp edges on the shaft sleeve; residual caustic in the seal chamber	Gauntlets stay on until the chamber is flushed and swabbed; cut-resistant gloves for handling the sleeve.
6	Rebuild, torque to sequence, refit the coupling guard	Guard left off; incorrect torque leading to a leak under pressure	Torque wrench and the sequence card at the job; the guard goes back before the isolation comes off, not after.
7	Remove locks and prove seal integrity at pressure	Jet release on first pressurisation	Area cleared before the start; watch from outside the spray line for the first two minutes; the permit stays open until it holds.

PPE required

Chemical splash goggles and face shield
Chemical gauntlets
Cut-resistant gloves (step 5 only)
Chemical-resistant apron
Safety footwear
Hard hat (step 4, under the gantry)

“Isolate, drain, purge, open” is a different job from “open, drain, purge, isolate”. The steps come back in the sequence they were written, and are reorderable when the job changes — not sorted by anything the database finds convenient. Illustrative data — not a customer.

Where it is read

At the job, on a phone, by the crew about to do it

A JHA in a binder in the site office is a document. A JHA the fitter opens at the pump is a control.

The risk assessment register on the field app, showing fourteen records with their location and date.

A risk assessment open on the field app, showing the hazard, the existing controls and the additional controls still required.

The step that turns out to be missing

It is discovered standing in front of the work, thirty seconds before the first spanner — so it gets added there, rather than remembered later and not added at all. Both directions on the same record the office sees.

And a control we would argue with

Read #26 on the phone above. Its controls include app check-in with escalation on a missed round — and that is a control, an administrative one: the control is the requirement to check in and what happens when you do not. The platform is only how it is administered.

The line on that record we would push back on is fall detection on the handset. A detector tells somebody after. It belongs in the emergency response section, not in the column claiming the risk came down.

Further controls are on the record, not in a plan somewhere else

“Two dead spots on the north perimeter still have no signal — repeater quoted.” — with a named owner and a target date, which is the difference between an outstanding control and an intention.

End to end

Seven steps, and the last one starts the first again

Assess
The activity, who is at risk, and likelihood × consequence before anybody does anything about it.
Control
What is already in place, what still has to be done, who owns it and by when.
Rate what’s left
Residual risk — refused unless the controls behind the reduction are named on the record.
Sign off
Optional named approval before it goes live, on the same workflow every other sign-off runs on.
Break it into steps
The JHA the crew actually works from, in the order the job is done.
Brief it
As a toolbox talk, with the crew signing on — the briefing is a record, not an announcement.
Review
On the date, chased, and the cycle restarts. Editing the date resets the chase.

Sign-off runs on the same workflow every other approval on the platform uses — named signers, in order, nobody signing their own request.

Approvals & e-signatures

Hazard reports run their own 4×5 severity × likelihood scale with an Extreme top band. Different register, different question — a hazard is something somebody saw, an assessment is an activity somebody rated.

Hazard reporting

Compliance map

What an auditor asks, and what you hand them

Clause by clause, the record this module produces — not a claim that it makes you compliant.

ISO 45001:2018 clauses this module produces evidence for, plus ISO 31000 and the OSHA PPE hazard-assessment rule.
Clause	What it asks for	What the assessment hands over
6.1.2	Hazard identification & risk assessment	The register itself — every activity, who is at risk, and both ratings
8.1.2	Hierarchy of controls	Controls recorded against the hierarchy, with the residual rated after them rather than instead of them
8.1.3	Management of change	Re-assessment when the job, the plant or the people change — and a review date that chases it
7.5	Documented information	Every version retained, with who changed what and when
9.1	Monitoring, measurement & analysis	Overdue-review counts and the residual-risk profile, as a monitoring output
ISO 45001 9.3	Management review	The residual-risk profile and the overdue count as a review input, with both numbers stated
ISO 31000:2018	Risk management guidelines	The assess / treat / monitor cycle this module implements, end to end
OSHA 29 CFR 1910.132(d)	Hazard assessment for PPE	PPE recorded on the JHA against the step that needs it, not as a blanket list

6.1.2
Hazard identification & risk assessment
What the assessment hands over
The register itself — every activity, who is at risk, and both ratings
8.1.2
Hierarchy of controls
What the assessment hands over
Controls recorded against the hierarchy, with the residual rated after them rather than instead of them
8.1.3
Management of change
What the assessment hands over
Re-assessment when the job, the plant or the people change — and a review date that chases it
7.5
Documented information
What the assessment hands over
Every version retained, with who changed what and when
9.1
Monitoring, measurement & analysis
What the assessment hands over
Overdue-review counts and the residual-risk profile, as a monitoring output
ISO 45001 9.3
Management review
What the assessment hands over
The residual-risk profile and the overdue count as a review input, with both numbers stated
ISO 31000:2018
Risk management guidelines
What the assessment hands over
The assess / treat / monitor cycle this module implements, end to end
OSHA 29 CFR 1910.132(d)
Hazard assessment for PPE
What the assessment hands over
PPE recorded on the JHA against the step that needs it, not as a blanket list

Sentinel supports evidencing these requirements. Certification is an audit of your organisation, not of software. The matrix, its bands and the review periods are yours to configure — your own risk criteria are the authority, not this page.

Objections

The seven things you are already thinking

Set the size and the bands scale with it — they are fractions of the maximum rather than fixed numbers, so a 4×4 site gets Medium at 4, High at 7 and Critical at 10 instead of a scale calibrated for somebody else's grid. That matters more than it sounds: on a scale built for 5×5, a 3×3 site could never reach the top band at all, which is exactly the bug this replaced.

Then it is not residual risk — it is a different activity with its own assessment. Residual is what remains after the controls on this record, so it cannot be worse than where the same activity started. In practice this refusal catches a transposed likelihood and consequence about nine times out of ten, and the tenth is a job that had quietly changed into a different job.

Yes, and expect some rows to fail the residual rule on the way in. Those are the ones worth your afternoon — a row that drops from 20 to 2 with an empty controls field is not an import problem, it is the assessment you would least like read out in an inquiry, and the import is the cheapest time you will ever find it.

Whoever holds the permission, with every change attributed and retained. Where a change needs signing off before it takes effect, put an approval workflow on the record — that is a separate module and it applies here the same way it applies to a permit or a corrective action.

To open a JHA on the phone at the job, yes. To be briefed on it as a toolbox talk and sign on, no — the briefing records attendance without every attendee needing a login, which matters when half the crew is a contractor’s.

No. It tells the owner, keeps telling them monthly while it is overdue, and shows it in the register under an overdue filter. Locking a document people need at the job is how people stop using the system and start keeping a copy in a drawer, and a copy in a drawer is the failure this module exists to prevent.

Yes, including on your own infrastructure. The harder question, and the one worth more of your time, is which of your people can change a live assessment and whether that change is attributed — which is the permissions and audit answer above rather than a hosting region.

14 assessments, a 5×5 matrix banding Medium at 5, High at 10 and Critical at 15, and a 7-step JHA — all illustrative, from a demonstration register rather than a customer.

Bring us your worst register.

Send the sheet you’d least like an auditor to open. We’ll load it and show you which rows claim a reduction with nothing behind them, and which ones lapsed. That conversation is the demo.

Book a walkthrough A day on site

Forty-five minutes, your register, no slides.