Risk assessment that survives an audit
One day converting a downloaded generic assessment into one that describes your actual task.
- Duration
- 1 day, 7 contact hours
- Level
- Implementation
- Covers
- Operational HSE risk and ISO clause 6.1 system risk
- Prerequisites
- None
- Assessment
- A completed assessment for a real task, marked against a guide, plus a check
- Certificate
- ITF certificate of completion
A one-day practical course on assessing risk: hazard identification, likelihood and severity, risk matrices and their limits, control selection, residual risk and review triggers. It covers operational HSE risk and management system risk under ISO clause 6.1 together, because the method is the same.
- 01 Enquiry
- 02 Needs analysis
- 03 Programme design
- 04 Scheduling
- 05 Delivery
- 06 Assessment
- 07 Certification
- 08 Records
Risk assessment that survives an audit sits at step 5 of the delivery cycle. You receive course materials and an attendance record.
Scoring the control instead of the exposure
Residual risk gets scored low because the control is written down, not because it is installed. This is the defect in most risk assessments in circulation.
It happens quietly. The assessor lists a control, moves the score from 15 to 4, signs it and files it. Nobody asks whether the guard was fitted, whether the procedure is followed on nights, whether the training in the control column has actually happened. The number went down on paper and the exposure did not move at all.
The second defect is calibration. Two people in the same team score the same hazard 9 and 16. Neither is wrong by any rule you can point to, because nobody defined what a likelihood of 3 means on this site. So the register cannot be sorted, prioritised or trusted, and it becomes a filing exercise.
The day attacks both. Delegates assess a real task from their own work in stages with feedback, and there is a calibration exercise where the room scores the same hazard independently and then has to reconcile. The reconciliation is where the learning is, and it usually gets uncomfortable.
The day, hour by hour
Bring two of your existing generic assessments. The practical converts one of them.
| Session | What is covered | Time |
|---|---|---|
| The vocabulary, done properly | Hazard, risk, likelihood, consequence, control, residual. Most bad assessments are bad because these terms are used interchangeably. | 0:45 |
| Methods, and when each fits | Task-based, job safety analysis, what-if, HAZOP awareness, bow-tie awareness, and the 5x5 matrix with an honest account of what a matrix cannot do. | 0:45 |
| The practical | Delegates assess a real task from their own work, in stages, with feedback at each stage rather than at the end. | 1:30 |
| Control selection and residual risk | Including the habit of scoring residual risk low because the control is written down rather than installed. | 0:45 |
| People factors | Competence, fatigue, heat, language, night shift, new starters and lone working. The variables that move a score and are usually absent from the form. | 0:45 |
| Dynamic risk assessment | Point-of-work checks for maintenance and field teams, where the task changes while it is being done. | 0:45 |
| Management system risk | ISO clause 6.1, the 2026 split of risks and opportunities in ISO 9001, context-driven risk, and linking the register to objectives and to management review. | 1:00 |
| Review triggers | Change management, and the assessment that silently expired two years ago. | 0:45 |
Templates that survive a handover
Task-based and dynamic assessment templates
Two different forms because they are two different jobs, and using one form for both is why field teams stop filling it in.
A risk and opportunity register aligned to clause 6.1
Including the 6.1.2 and 6.1.3 split introduced in ISO 9001:2026, with a link field to objectives.
A review trigger checklist
Event-driven rather than date-driven, so an assessment is reviewed when something changes rather than annually by habit.
Your own converted assessment
One of the generic assessments you brought, rewritten as a task-specific one during the practical.
A ITF certificate of completion
Per delegate, with the marked assessment recorded.
What a signatory can do afterwards
- 01
Use the four words precisely
Hazard, risk, likelihood, consequence. Everything downstream depends on this and most training skips it.
- 02
Pick a method rather than default to the matrix
Task-based, what-if or a structured technique, chosen for the situation instead of because it is the form we have.
- 03
Complete a task-based assessment for a real activity
Assessed on hazard completeness, control hierarchy and whether the residual score is honest.
- 04
Score residual risk against what is installed
The single highest-value habit change on this course.
- 05
Write a dynamic assessment for a changing task
For maintenance and field work, where the fixed assessment stopped describing the job an hour ago.
- 06
Build a clause 6.1 register that management review can use
Linked to objectives, not a parallel document maintained for the auditor.
Two assessments a hospital sent back
A facilities contractor maintaining a hospital in Khobar holds a risk register of several hundred rows, most copied from a template, and the hospital's facilities manager has rejected its assessments for roof access and for work on live medical gas lines as generic.
The practical used those two tasks. Delegates walked the roof access route before the session, then built the assessment in stages: the hazards actually present, controls in hierarchy order, and residual scores justified by what is physically installed.
The calibration exercise used the medical gas task, scored independently by five supervisors and then reconciled into a scoring guide for the site. The clause 6.1 session linked the register to the contractor's ISO 9001 objectives.
The contractor ended up holding two rewritten task assessments, a site scoring guide, a review trigger checklist, and a certificate per delegate.
Who signs, and who should
Whoever puts a name on the assessment
Supervisors and managers who sign risk assessments, often for tasks they did not observe and controls they did not verify.
- Judge whether an assessment in front of you is adequate before signing
- Score residual risk against the installed control
- Know which signature you are actually giving and what it means
People who own the register
HSE coordinators maintaining a risk register that has grown to several hundred rows nobody reads.
- Calibrate a team so two assessors reach the same number
- Sort a register by something meaningful
- Set review triggers that fire on change
Clause 6.1 register owners
Quality and food safety staff writing a clause 6.1 risk and opportunity register, usually as a separate document from the HSE one.
- Build one register instead of two disconnected ones
- Handle the ISO 9001:2026 split of risks and opportunities
- Link risk to objectives and to management review
Work that changes as it runs
Project and maintenance managers whose activities do not sit still long enough for a fixed assessment to stay true.
- Use dynamic assessment properly rather than as an excuse
- Handle people factors: fatigue, heat, night shift, new starters
- Reassess on change rather than on completion
Questions buyers actually ask
Is this HSE risk or business risk?
Both, deliberately. The method is the same and splitting them into two courses is how organisations end up with two disconnected registers, one for the safety auditor and one for the quality auditor, neither of which drives a decision.
We have risk assessments already. They are generic.
That is the usual starting point: downloaded templates with the company name changed. The practical is built to convert one of your generic assessments into a task-specific one, so bring two or three of the worst.
Does a risk matrix need to be 5x5?
No. The course covers why the size matters far less than whether everyone scores the same way, and how to calibrate a team so two assessors reach the same number on the same hazard.
Who should sign a risk assessment?
The person competent in the task and the person accountable for the area, which are often not the same person. The course covers the signature chain and what each signature is actually attesting to.
Is the certificate recognised?
It is an ITF certificate of completion, and it records that the participant attended and met the assessment criteria on the day. It is not an accredited qualification. It is the kind of evidence a management system asks for under ISO 9001 clause 7.2 and its equivalents. If your buyer or regulator names a certificate issued under an accreditation scheme, tell us at enquiry and we will say plainly whether ours fits.
Can you run it in Arabic?
Yes. Arabic, English, or Arabic delivery with English material, which is the usual request for a mixed room. Confirm the language when you book, because it decides which trainer and which handouts are scheduled.
Do you come to our site?
Yes, and it is the default. On your site the exercises run on your own documents and processes, and the participants lose no travel time. We need a room, a screen, and the participants released from the floor for the whole session.
How many people can attend?
Awareness courses work up to about 20. Courses with assessed practical work cap at about 12 to 15, so every person does the exercise rather than watching it. These caps are our teaching judgement, not an external rule.
Who delivers it?
Practising auditors. The people teaching these courses spend their working weeks inside factories, warehouses, kitchens and offices carrying out audits, and the examples in the room come from that work. The standard every trainer meets is set out on the trainers page.
What if someone misses a day, or does not pass?
There is no certificate for partial attendance or a failed assessment. The participant can join the missed day or retake the assessment on a later run, and we tell you which person and why. We would rather report a gap than issue a record that says something untrue.
Usually bought alongside
Root cause analysis
For when the risk materialised and the investigation has to find out why the control was not there.
Read moreImplementationCOSHH chemical risk assessment
The substance-specific case, with its own method and its own form.
Read moreAwarenessISO 45001 safety awareness
The management system the operational assessments feed.
Read moreAwarenessISO 9001:2026 awareness
Where clause 6.1 now splits risks from opportunities and what that asks of the register.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Bring your worst assessment
A generic risk register usually sits beside a corrective action log with the same problem, which is that neither describes anything specific enough to act on. Bring two or three and the day converts them.