IICP HSE Academy
QHSE Management

QHSE Risk Management: Identification, Evaluation and Matrix

Risk management is at the heart of the QHSE system. It includes hazard identification, risk assessment and implementation of control measures. This article presents methodology and risk matrix.

IICP HSE Academy Published on 18 October 2026 7 min read 10 views
Management des risques QHSE — Matrice d'évaluation

QHSE Risk Management: Identification, Assessment, and Matrix

QHSE risk management is at the core of the QHSE system. It comprises the identification of hazards, risk assessment, and the implementation of control measures. This article presents the methodology and the risk matrix.

Risk management is the core of the QHSE system. A systematic process of identifying, assessing, and controlling risks, it aims to prevent accidents, occupational diseases, and environmental harm. Its methodology is based on hazard analysis and the construction of a risk matrix.

Definition and Principles

According to ISO 31000:2018, risk management is the set of coordinated and directed activities to steer and control an organization in the face of risk. In QHSE, it encompasses safety (S), health (S), environmental (E), and quality (Q) risks.

Risk Assessment Process

Risk assessment follows a classic sequence:

  1. Identify hazards: enumerate sources of hazards (machines, chemicals, energy).
  2. Identify hazardous situations and exposed persons.
  3. Assess risks: combination of the probability of occurrence and the severity of harm (risk = P × S).
  4. Prioritize risks (risk matrix).
  5. Define proportionate control measures.

The Risk Matrix

The risk matrix is a graphical tool that crosses two axes:

  • Horizontal axis: probability (rare, unlikely, possible, likely, frequent).
  • Vertical axis: severity (minor, moderate, serious, critical, catastrophic).

Each cell contains a risk level and a color code:

  • Green — acceptable risk, monitoring.
  • Yellow — tolerable risk, control to be verified.
  • Orange — risk to be reduced, action plan to be defined.
  • Red — unacceptable risk, stoppage or immediate measure.

Hierarchy of Controls

The effectiveness of control measures follows a hierarchy recognized internationally (OSHA, INRS):

  1. Elimination: remove the hazard at the source (most effective).
  2. Substitution: replace with a less hazardous product or process.
  3. Engineering controls: collective — ventilation, isolation, guards.
  4. Administrative controls: procedures, training, signage, permits.
  5. PPE: last line of defense, least effective in itself.

Link with ISO 45001:2018 and ISO 31000:2018

ISO 45001:2018 mandates the implementation of a process for hazard identification and risk assessment (clause 6.1.2). ISO 31000:2018 provides the generic framework for risk management, applicable to any type of organization.

Tools and Traceability

Risk assessment is formalized in a Single Document for the Assessment of Occupational Risks (DUERP) — this formalization is a legal obligation in France (French Labour Code R4412-1 et seq.), with a mandatory annual update. In Morocco, the Labour Code (Law No. 65-99, Title IV articles 281 et seq.) mandates the assessment of occupational risks, but the precise format of the document must be verified within the applicable Moroccan regulatory framework.

Sources et références

  1. Code du travail marocain (Loi n° 65-99), Titre IV — articles 281 et suivants (obligation d'évaluation des risques professionnels au Maroc) ILO NATLEX : https://natlex.ilo.org/dyn/natlex2/r/natlex/fe/details?p3_isn=67319

  2. INRS — Évaluation des risques professionnels (URL plausible, à vérifier — pattern INRS similaire aux autres pages /risques/<slug>.html) https://www.inrs.fr/risques/evaluation-risques.html

  3. OSHA — Hierarchy of Controls (US NIOSH/OSHA, modèle reconnu) https://www.osha.gov/hierarchy-of-controls

Share
Back to blog