QHSE Risk Assessment: The Essential 2026 Guide to One Method for Quality, Safety and Environment

A QHSE risk assessment is a single, structured way to identify and rate the risks to quality, health and safety, and the environment, then decide what to do about them. Instead of three separate exercises run by three teams with three scoring systems, the organization keeps one method and one register.

The ISO standards already point in this direction. ISO 9001, ISO 14001 and ISO 45001 share the same high-level structure, and each requires planning that addresses risks and opportunities. Clause 6.1 is where that happens in all three.

This guide explains the method in six steps and shows how to keep the work practical. The example scores and scales are illustrative, so adapt them to your own operations.

Why a combined QHSE risk assessment works

Separate assessments tend to duplicate effort and contradict each other. A chemical store may be assessed by safety for exposure, by environment for spill risk and by quality for product contamination, each using a different form. Managers then receive three sets of actions with no sense of priority.

A combined QHSE risk assessment looks at the same activity once from each angle. One workshop, one register, one scoring scale and one action list make it easier to compare risks, to allocate resources and to show an auditor that the planning requirements are met across all three standards.

It also supports the wider management system. Risks feed objectives, training needs, operational controls and management review, which are covered in QHSE management system and QHSE management review.

Step one: define scope and activities

List the activities, processes and sites in scope. For each, note the inputs, outputs, people involved, equipment, materials, and the regulations that apply. A process map or a simple table is enough.

Include routine and non-routine work, contractors, visitors and changes such as new equipment or a new supplier. Non-routine activities, such as maintenance shutdowns, often hold the highest risk and the thinnest controls.

Agree a timeline and owners. A plant with thirty activities might split them across departments and assign each a risk owner who joins the workshop and is accountable for actions.

Topic	What you assess	Standard reference
Quality	Risks to meeting customer and product requirements	ISO 9001 clause 6.1
Health and safety	Hazards and OH&S risks to workers	ISO 45001 clause 6.1.2
Environment	Environmental aspects, impacts and compliance risks	ISO 14001 clause 6.1
Shared	Scoring scale, owners, treatment, review	Clauses 6, 8 and 9

Step two: identify hazards, aspects and quality risks

For safety, identify hazards: anything with the potential to cause injury or ill health, such as moving machinery, noise, manual handling, chemicals or work at height. For the environment, identify aspects: elements of your activities that interact with the environment, such as emissions, waste, energy use and spills. For quality, identify risks to conformity, such as unclear specifications, untrained operators or unreliable suppliers.

Use prompts. Walk the site, review incident records and complaints, check supplier performance and talk to the people who do the work. They know where shortcuts happen.

Record each item in a consistent format: activity, hazard or aspect, potential consequence and who could be affected. One row per scenario keeps later scoring clear.

Step three: rate each item in your QHSE risk assessment

Use one scale for all three areas. A simple five-by-five matrix with likelihood and severity works. Define severity across the three dimensions: injury or illness, environmental harm and quality impact on customers or product. A level four might mean a serious injury, a reportable release and a major customer rejection.

Score inherent risk first, then residual after existing controls. Keep definitions short and use examples so different assessors score in the same way. Scores should be discussed, not averaged blindly; the conversation often surfaces missing controls.

Flag legal requirements separately. Compliance with permits and safety regulations is not a matter of scoring; a breach is unacceptable whatever the matrix says.

Step four: apply the hierarchy of controls

For safety risks, the standard expects controls in order of effectiveness: eliminate the hazard, substitute with something less hazardous, use engineering controls, use administrative controls and, last, personal protective equipment. The same logic helps for environmental and quality risks: remove the cause before relying on procedures or inspection.

The approach is explained in detail in hierarchy of controls. Favor controls that do not depend on behavior. A guard that prevents access is more reliable than a sign asking people not to reach in.

Write each action as a specific task with an owner and a date, and link it to the risk it addresses. Vague actions like “improve awareness” rarely reduce risk.

Step five: record, communicate and train

Hold the assessments in one register that the whole site can see. Share results with the people affected through briefings, toolbox talks and updated procedures. Workers should know the risks of their tasks and the controls that protect them.

Update training needs and operating procedures from the results, and link them to your policy, as in QHSE policy. Keep the documentation light but complete, using the guidance in QHSE documentation.

Track indicators such as open actions, near misses and audit findings. See QHSE KPIs for measures that link the assessment to performance.

Step six: review and improve

Review the assessment at planned intervals and whenever something changes: a new process, an incident, a complaint, a legal change or an audit finding. Incident lessons are especially valuable, as described in QHSE incident investigation.

Use internal audits to test whether the controls work in practice. A combined approach saves time, as shown in combined internal audit, because one audit visit can look at quality, safety and environmental controls together.

Bring the top risks to management review. Leaders should see the same short list each time and decide whether resources, objectives or policy need to change. Our explanation of QHSE vs HSE clarifies scope for teams new to the integrated approach.

A short QHSE risk assessment example

Consider a metal fabrication shop. The welding activity has a fume hazard, scrap metal and gas cylinders for the environment and possible weld defects for quality. Inherent scores are 15, 9 and 12. The team adds local exhaust ventilation, a scrap segregation and recycling process, and in-process inspection with operator certification.

After controls, residual scores fall to 6, 4 and 4. The actions have owners and dates: install the extraction by the end of the quarter, add bins and labels this month and update welding procedures after the next audit. The numbers are invented, yet the pattern shows how a single QHSE risk assessment covers three angles with one set of actions.

Note how one control, operator certification, supports both quality and safety. That overlap is where the combined method pays off.

Common mistakes in a QHSE risk assessment

The first mistake is treating the assessment as paperwork done by the QHSE manager alone. The people who do the work know where the real hazards and quality traps are, so they must be in the room. The second is using different scales for each discipline, which makes priorities impossible to compare. The third is scoring without looking at the controls that actually exist on the floor, rather than those described in procedures.

Another frequent error is stopping at identification. A long register with no actions looks thorough but changes nothing. Each high residual risk needs an owner, an action and a date. Finally, avoid freezing the register. A QHSE risk assessment that is not reviewed after incidents, complaints and changes quickly stops reflecting reality, and auditors notice the lack of updates.

Keep a short list of triggers for review: new equipment, a new chemical, a change of supplier, an accident or near miss, a customer complaint and a change in law.

Roles in the QHSE risk assessment process

Top management provides direction and resources and reviews the top risks. The QHSE lead maintains the method and register and facilitates the workshops. Process owners are accountable for the risks in their area and for the actions. Workers and their representatives take part in identifying hazards and testing controls, which ISO 45001 specifically expects through consultation and participation.

Using a ready-made QHSE risk assessment

Building the forms, registers, procedures and templates for all three standards takes a long time. A prepared bundle gives you aligned documents to adapt rather than invent.

The QHSE Documentation Bundles offers 1,395 templates aligned with ISO 9001, ISO 14001 and ISO 45001, so your team can start from tested structures. Read the broader context in QHSE manager if you are setting up the role.

Whichever route you take, agree the scoring scale and register format first, then run a pilot on one process before extending to the site. The standards overview at ISO management system standards explains the shared structure.

QHSE risk assessment FAQ

What is a QHSE risk assessment?

It is a combined method for identifying and rating quality risks, safety hazards and environmental aspects using one scale and one register.

Do ISO 9001, 14001 and 45001 require risk assessment?

Each requires planning that addresses risks and opportunities in clause 6.1, and ISO 45001 and ISO 14001 add specific hazard and aspect identification.

Can one matrix cover quality, safety and environment?

Yes, if severity is defined for each dimension so scores are comparable.

How often should it be reviewed?

At planned intervals and whenever processes, equipment, suppliers, regulations or incidents change.

Who should be involved?

Process owners, workers who do the job, and the QHSE lead, with management reviewing the top risks.