The RA systematically evaluates equipment, materials, tools, work practices, and workspaces/facilities associated with a specific process. Hazard identification is a crucial element of the RA process. If hazards are not identified, the associated risks cannot be evaluated, eliminated, and/or reduced through the implementation of controls. Each identified hazard associated with an activity is subsequently evaluated using the following criteria:
- The likelihood of an incident occurring.
- The severity of any injuries or illnesses that result from the incident.
The following sections detail how the above is to be implemented and documented.
4.1 Risk assessment methodologies
Microsoft's Risk Assessment Framework is structured into two primary assessment methods. The choice of methodology is determined by the People Manager, Supervisor, or Lab Manager, in collaboration with Local OHS Manager familiar with the operations, based on the nature of the assessment:
- Site-Level Risk Assessment (Risk Register): If required, a register of site hazards and risks specific to the Microsoft location. It covers the general risks that all employees, contractors, vendors, and visitors may be exposed to by accessing the locations. This could include, but is not limited to:
- Parking areas, walkways, lobbies, offices, restrooms, breakrooms, etc.
- Site-specific hazards related to weather conditions, site, and building design.
The decision on the appropriate level of site RA (e.g., country, campus, building, labs, or specific operational areas) should be based on the risk level of the activities or spaces involved, as well as applicable local regulatory requirements. For example, a site-level RA can be focused on a specific operational area such as a Failure Analysis/Reliability lab, mechanical shop, hardware testing lab, or video production facility.
- Activity Level RA (Job Hazard Analysis): A comprehensive assessment that evaluates risks by breaking down tasks into steps, identifying hazards, and implementing controls. Used for work processes, machine operations, and task-specific risks. A Risk Assessment template is included in section 9.1 of this document.
Each RA follows a structured approach involving hazard identification, risk evaluation using a 5x5 Risk Matrix, and implementation of necessary control measures. The Risk Assessment template for each method includes:
- Description of work activities, tasks, chemicals, or areas.
- Identified hazards and potential effects.
- Existing control measures and risk rating.
- Additional control measures if the risk is high and risk rating after additional risk control.
- Assessment details (date, assessor's name, reviewer's name, and assessment scope).
4.2 Risk assessment team
The People Manager/Supervisor or Lab Manager in collaboration with Local OHS Manager determines the required composition of the Risk Assessment team based on the scope of the task or site. Additional team members may be included based on task complexity, expertise required, or specific regulatory considerations. Having a team with a variety of experience and expertise ensures a comprehensive evaluation of existing and predictable hazards and effective mitigation controls.
Recommended team members typically include workers who perform the task (providing firsthand knowledge of the work), their People Manager, Supervisor, or Lab Manager (to ensure operational alignment and accountability), Local OHS manager, and individuals with relevant technical or engineering expertise (to support hazard identification and control strategies).
The Risk Assessment team is responsible for overseeing, documenting, communicating, and implementing RAs.
4.3 Risk assssment process
- Define Scope of Work: Identify the task or activity to be assessed.
- Choose the RA Methodology: Most applicable to the scope (Risk Register or Job Hazard Analysis).
- Assess Initial Risk: Use a 5x5 Risk Matrix to determine risk levels.
- Implement Control Measures: Apply appropriate controls based on the hierarchy of controls (elimination, substitution, engineering, administrative, PPE).
- Assess Residual Risk: Reevaluate the risk after control measures are applied.
- Approve and Document: Record the findings, ensure management approval, and store the assessment in the designated system.
- Communication Findings: Share risk information with all affected personnel.
- Monitor and Review: Review at least annually, or sooner if there are significant changes in work conditions, processes, or hazards.
4.4 Risk evaluation
The evaluation of the relative risk for each identified hazard will be performed using the Risk Matrix listed below. The risk level associated with each hazard will be ranked as Low, Medium, or High using the following criteria:
Risk Matrix
|
|
| Severity
|
|
| Injuries or illnesses that do not require medical treatment
| Minor injury/illness that requires first aid
| Injury/illness requiring medical treatment beyond first aid
| Serious injury/illness requiring medical treatment and admittance to hospital
| Fatality or multiple life-threatening injury/illness case requiring hospitalization
|
Likelihood
| Insignificant
| Minor
| Moderate
| Major
| Catastrophic
|
1
| 2
| 3
| 4
| 5
|
Frequent
May be expected to occur frequently
| 5
| M
| M
| H
| H
| H
|
Probable
Likely to occur several times
| 4
| M
| M
| M
| H
| H
|
Occasional
Likely to occur sometime but multiple occurrences are unlikely
| 3
| L
| M
| M
| M
| H
|
Remote
Unlikely, but possible to occur
| 2
| L
| M
| M
| M
| M
|
Improbable
So unlikely, it can be assumed occurrence may not be experienced
| 1
| L
| L
| L
| M
| M
|
The hazard ranking will determine the selection of appropriate controls. The RA will be conducted on the work or task as it is currently performed with the existing controls in place. If the RA identifies that risks could be mitigated by implementing new or additional controls, those recommendations will be documented on the Risk Assessment template.
Actions required based on the assigned risk level are summarized below.
Risk Level
| Risk Acceptability
| Required Actions
|
Low
| Acceptable
| No additional risk control measures are needed. Frequent review and monitoring of hazards are required to ensure the assigned risk level is accurate and does not increase over time.
|
Medium
| Tolerable
| A careful evaluation of the hazards must be carried out to ensure the risk level is reduced to as low as reasonably possible within a defined period. Interim risk control measures, such as administrative controls or PPE, may be implemented while longer term measures are being established.
|
High
| Unacceptable
| High risk work cannot proceed and must be mitigated to at least Medium, unless unusual circumstances justify an exception approved in writing by the applicable CVP. There shouldn't be any interim risk control measures. Risk control measures should not be overly dependent on PPE or administrative controls.
|
4.5 Risk control selection
Hazard control selection will be based on the hierarchy of controls. The following list contains typical control types ranked by effectiveness:
- Elimination: Elimination of the hazard is the most effective means of hazard control. It involves the physical removal of the hazard.
- Substitution: Replacing something that produces a hazard (similar to elimination) with something that does not produce a hazard or reduces the overall risk.
- Engineering: Engineering controls do not eliminate hazards; they reduce the level of risk by preventing contact with the hazard. Engineering controls usually have capital costs and require periodic validation and preventative maintenance to ensure effectiveness.
- Administrative: Administrative controls involve changes to the way people work. Examples include written procedures, employee training, and installation of signs or warning labels. Administrative controls do not remove hazards; they limit the risk of those hazards by correcting unsafe behaviors.
- Personal protective equipment (PPE): PPE is the least effective means of controlling hazards because of its potential to become ineffective. Some PPE, such as respirators, increase the physiological effort to complete a task and, therefore, require medical examinations to ensure the worker can use the PPE without any detrimental risk to their health.
4.6 Risk communication
Effective risk communication ensures that all employees, vendors/contractors and their subcontractors, and approved visitors are aware of and understand potential hazards and necessary precautions. Once the RA is completed or revised, the People Manager, Supervisor, or Lab Manager of the work scope or area is responsible for making sure that all affected employees, vendors/contractors, and approved visitors have been informed of the associated hazards and required work controls related to the RA. Please refer to Appendix A for Risk Communication Email template. People Manager, Supervisor, or Lab Manager must make sure RA documents are maintained and accessible to employees to meet regulatory requirements for training and education.
Risk communication may occur in the following situations:
- During new employee onboarding training.
- Before the execution of tasks involving identified risks.
- Regular safety meetings.
- When updates to RAs occur.
- During work planning sessions/meetings.
Communication methods include meetings, digital platforms, signage, and training sessions. The Responsible People Manager, Supervisor, or Lab Manager must ensure timely and effective dissemination of risk-related information.
The RA will include any required training based on the hazard levels defined for the task. Once defined as part of the RA, training is required for all employees and external staff to perform the work.
Site RAs must be reviewed at least annually or following an incident related to the RA or whenever significant changes occur, such as:
- Modifications to work methods or procedures.
- Changes in equipment, chemicals, or surrounding conditions.
- Before implementation, RAs should be reviewed by the local OHS representative and approved by the direct manager of the task or area before implementation. Updates must be communicated to all relevant personnel.
Some content in this document is for Microsoft internal use only. Log in to view this content.