The HSE-gateway

HSE risk assessment and safe job analysis (SJA)

The working environment legislation states that businesses must map hazards and problems and, on this basis, assess risks, as well as prepare related plans and measures to reduce the risk conditions. This must be documented in writing.

Main content

By mapping and risk assessing hazards and undesired events that may occur at the unit, one can implement measures to prevent such undesired events from happening, as well as measures to reduce the consequences of undesired events that do occur. In this way, risk assessments contribute to a safer working environment.

HSE risk assessments are a part of the systematic HSE work at UiB. HSE risk assessments must be repeated regularly (updated annually), in the event of changes that may have an impact on the risk conditions, and in connection with new machinery and equipment, which may have an impact on health, the working environment and safety.

All units shall

All units shall map hazards and problems and, on this basis, assess risks, as well as prepare related plans and measures to reduce the risk conditions. This must be documented in writing in accordance with the internal control regulations.

Each unit must have carried out HSE risk assessments that cover the unit's operations in their entirety. Some units will need to divide this into several risk assessments to cover all risk areas, due to activities with a higher level of risk, e.g. lab, workshop and clinic, violence and threats or e.g. field and tour.

In the HSE annual reporting for 2023, the units were asked to report on whether the unit carried out/updated an overall (overordnet) HSE risk assessment for the unit in the reporting year. The term overall has caused some confusion in the units. The meaning behind the term overall was to demonstrate that all units must have carried out at least one HSE risk assessment. And if only one HSE risk assessment is carried out, this must cover all risk areas within HSE/working environment at the unit.

It is the line manager's responsibility that HSE risk assessment, plans and measures are carried out and documented.

Additional requirements for risk assessments

Some areas have additional requirements for risk assessments, and it is recommended that those who are to carry out risk assessments linked to these areas familiarize themselves with these additional requirements. Risk assessments shall be carried out in accordance with the Regulations concerning the Performance of Work, in connection with:

  • the use and handling of chemicals
  • hot work
  • the risk of exposure to biological agents
  • exposure to mutagenic agents
  • exposure to noise and mechanical vibrations
  • exposure to artificial optical radiation
  • exposure to an electromagnetic field
  • the performance of work at height
  • the performance of excavation work
  • manual work that can entail a risk of harmful strain
  • work that may entail a risk of exposure to violence and threats of violence
  • work under water or under increased ambient pressure
  • the risk of avalanches


To map hazards and problems, the unit should:

  • Review work tasks, activities and locations at the unit
  • Review previous HSE nonconformities and risk assessments
  • Talk to unit staff​
    • The employees are a very valuable source of information about what is hazardous in everyday work
  • Map the organizational and psychosocial work environment with an HSE meeting annually, this can be replaced by ARK in the years that this is carried out
  • Map the physical working environment with the HSE round

Based on the mapping, it is possible to pinpoint the potential risks associated with the units activities. This then dictates what should be incorporated into the HSE risk assessment(s).

HSE risk assessment

The HSE risk assessment consists of asking a number of questions:

  • What could go wrong?
    • Identify hazards and undesired events
      • An example of an undesired event could be a chemical splash into the eye.
  • Why could it go wrong?
    • What are the causes of the undesired event?​
      • In the example of chemical splash into the eye, the causes could be, among other things, that one did not wear safety glasses, or that the safety glasses did not cover well enough.
  • How likely is it to go wrong?
    • Is often expressed in terms of frequency (how often)
      • This depends on the level of activity and the existing routines at the unit, but we can e.g. say this happens between once every year and once every 5 years.
  • What can happen if it goes wrong?​
    • Consequences for values such as "life and health", "operation, production and service"
      • The consequence for "life and health" can be anything from minor eye damage to permanent eye damage. It can also affect operations if a key person need sick leave.
  • What can we do to prevent things from going wrong?​
    • This is called preventive measures
      • For example wearing tight fitting safety glasses and work in fume hood.
  • What can we do to mitigate the consequences if things go wrong?​
    • This is called mitigating measures
      • For example have eyewash available in the laboratory. Have routines for going to the emergency room. 

At UiB, we have prepared templates for HSE risk assessments (see Factbox) that can be used in the work with the HSE risk assessment. These are based on templates from the Norwegian Labor Inspection Authority.

Probability, consequence and risk matrix

We use probability as a measure of how likely we think it is that an (undesired) event will occur, based on the knowledge we have available.

Consequence is a possible result of an undesired event, and can involve the loss of or damage to values we want to protect. At UiB, these values are "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation".

Risk can be presented in a risk matrix, with consequence along one axis and probability along the other axis. This gives a picture of the risk in two dimensions, probability and consequence. The matrix can have different sizes, but 5x5 cells are common.

To place probability and consequence in the matrix, criteria for probability and degree of consequence are used.

The probability is divided into numbers from 1-5, where each number represents a specified probability. For example the number 3 means "Likely" which indicates that the event could occur "Between once every year and once every 5 years". These are assessments made during the risk assessment based on the knowledge you have about a potential undesired event.

The table below shows the criteria for probability:

1Highly improbableOccurs less often than every 10 years.
2ImprobableBetween once every 5 years and once every 10 years.
3ProbableBetween once every year and once every 5 years.
4Very probableBetween once a month and once a year.
5Highly probableOnce a month or more often.

The degree of consequence is divided into letters A-E, where each letter represents one degree of consequence. For example the letter B represents a specified degree of consequence; "A certain hazard".

The degree of consequence will have different meanings for the various values "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation".

For the value "life and health", "B. A certain hazard" means: "Few or minor physical or mental injuries.", while for the value "operation, production and service", "B. A certain hazard" means: "Minor reduction of primary functions that can be solved by simple means within a short time." There is an overview of this in the criteria for probability and consequence.

The degrees of consequence for each value are divided into
A. Not hazardous
B. A certain hazard
C. Hazardous
D. Critical
E. Very critical

The numbers for probability (1-5) and the letters (A-E) for the degrees of consequence are used to find the placement of the undesired event in the risk matrix.

In order not to have to use 5 different risk matrices, one for each of the values "life and health", "environment", "operation, production and service", "economic and material values", "credibility and reputation". The value with the highest risk for the undesired event is what is presented in the matrix in the template.

The risk is higher, the further up and to the right the event is placed in the matrix. The risk matrix is divided into the colors red, yellow and green to convey the level of risk:

  • Red is not acceptable and risk reducing measures must be taken immediately.
  • Yellow indicates the need for the introduction of risk-reducing measures.
  • Green indicates acceptable risk. The introduction of measures should be considered if the effects will obviously be good.

(c) UiB 2023

The risk matrix provides a visual representation of risk that is very simplified, in addition, the risk matrix does not say anything about the uncertainty or degree of knowledge behind the assessments. The risk matrix is still a good aid as long as one is aware of the weaknesses associated with it.


Measures are all remedies that can be implemented to reduce the risk associated with an undesired event. 

Preventive measures:

Reduce the probability/likelihood of the undesired event from happening​. Also called probability-reducing measures.

  • An example of a preventive measure is to wear a reflective vest when cycling in the dark. Increased visibility reduces the likelihood of being hit by a car.

Mitigating measures:

Reduce the consequence of the undesired event if/when it happens.​ Also called consequence-reducing measures.

  • An example of a mitigating measure is the use of a bicycle helmet, since it will be able to reduce the consequence (damage to life and health) should you have an accident.


How do you carry out a risk assessment? This depends on the scope of the risk assessment. Some do risk assessments alone because they only risk assess their own work. But more overall risk assessments should be carried out in a group to ensure proper involvement. Below follows a description of how to carry out a risk assessment with several participants, but the description is also transferable if you carry out a risk assessment for your own work.


Good planning in connection with the risk assessment will make the job easier and improve the quality of the analysis.

Some things that should be thought through before carrying out a risk assessment are:

  • Why are you doing a risk assessment?
  • What are you doing a risk assesment of?
    • The mapping will provide a basis for assessing what should be risk assessed.
  • What are you not including in the risk assessment?
    • It may be a good idea to limit the scope of the risk assessment so that it does not become too large. Rather, divide into several smaller ones.
  • Who should be involved in the risk assessment?
    • In the sub-chapter below on Participants, you can read more about who should join.
  • Obtain information
    • E.g. look at previous HSE non-conformities and risk assessments, carry out inspections, talk to staff/colleagues.


Risk assessments shall be carried out in collaboration with the employees and their representatives.

One way to carry out the HSE risk assessment is by having a workshop meeting with relevant participants.

It is recommended to have 3-6 participants in the analysis:​

  • ​Line leader or it's representative (is usually the one who arranges the risk analysis)​
  • Employees with knowledge of what you are risk assessing
  • People with knowledge/education in the field/area
  • Employees who are affected shall be given the opportunity to participate
  • Safety delegates may participate where appropriate, but should be informed of all risk assessments performed at the unit

Workshop meeting

  1. Begin by agreeing on what should be included in the risk assessment.
    • People can often have different opinions, so it's a good idea to start with a clarification of expectations to avoid talking past each other.
    • In some cases, it may be worthwhile to divide the risk assessment into several risk assessments, if the scope becomes too wide.
  2. When you agree on what should be included in the risk assessment, you can start by identifying undesired events. For example an undesired event could be a chemical splash in the eye as in the example above.
    • One way to give everyone the opportunity to provide input is to start with 5-10 minutes where everyone individually notes down undesired events that they think may occur on post-it notes. One event per post-it note.
    • Then everyone sticks their notes on a board or wall, and you can collect and merge the undesired events that are similar.
    • If there are a lot of different undesired events, and you don't have the opportunity to analyze each event in detail, you can select the ones you consider most important and proceed with them.
  3. Note the undesired events you want to proceed with into the HSE risk assessment template.
  4. For each individual event:
    • Discuss what might cause the undesired event.
    • Identify consequences. One undesired event could have several consequences, note everyone.
    • Identify existing risk reducing measures (preventive and mitigating).
    • Specify the probability that the event may occur, using the criteria.
    • Specify the degree of consequence the event will have on our various values using the criteria.
    • Find the position in the risk matrix using numbers for probability and letters for consequence (in the Excel template this happens automatically).
    • How do we assess the risk based on what we have analyzed so far? Is there a need for new measures to reduce the risk?
      • Identify new measures, then specify probability and degree of concequence again.


You can use the action list to follow up and implement the measures, the action list is part of the risk assessment template.

More long-term measures can be included in the HSE action plan.

It is the line manager's responsibility to ensure that the risk assessments are followed up afterwards and that measures are introduced.

Safe Job Analysis (SJA)

Safe job analysis (SJA) can be used as a supplement for a single work task or activitiy where HSE risk assessments or established routines/procedures do not cover the work that is to be carried out. Anyone can do an SJA, but whoever is going to do the actual work task or activity must participate in the SJA.

You can find the template for SJA in the fact box.


  1. Divide the work task/activity into sub-tasks.
    • The sub-tasks must be in the order in which they would naturally be carried out.
  2. Identify undesired events that may occur related to each sub-task.
  3. Identify measures for the undesirable events associated with each sub-task to reduce the risk.

Below is a very simplified example of an SJA.

Example - SJA for building a chair
#Sub-tasksUndesired eventsMeasures

Carrying planks into the workshop

Splinter in hand, tear down things while carrying the planks, hit others with the planks

Use protective gloves, be two to carry.
2Cut the materials to sizeCut injuries. Eye damage due to foreign body into the eye.Using a push stick to push the plank in instead of by hand. Use safety glasses.
3Nail together the materialsHand injuries from hammer or nails. Eye damage due to foreign body into the eye.Use the correct procedure for hammering. Use safety glasses.
4Varnish the chairInhale varnishVarnish in a well ventilated area

After completion of the SJA and if measures have been introduced so that the task/activity can be carried out in a safe manner, the work can be started.

An SJA can, for example, be carried out if you are to carry out risky work and:

  • If the task / activity deviates from established routines or procedures.​
  • If the work requires collaboration between different units or professional groups.​
  • If the equipment you are going to use is not covered by current work instructions or routines.​
  • If the people who are working on the task do not have experience with this task / activity.​
  • ​If there has been undesired events in connection with this type of work in the past.