What is HIRARC and how do you do it?
HIRARC in Malaysia stands for hazard identification, risk assessment and risk control. It is a structured way to list the work activities in a workplace, find what could cause harm in each, rate how likely and how severe that harm is, and put controls in place, starting with removing the hazard altogether.
Short course with a Certifyd certificate of completion. Not a DOSH or NIOSH competency certification.
What does HIRARC involve?
HIRARC involves three linked stages: identify hazards, assess the risk each one creates, and control that risk. A hazard is anything with the potential to cause harm; risk combines how likely the harm is with how severe it would be.
In Malaysia, national guidelines on HIRARC are published by the Department of Occupational Safety and Health. Read the current guidance there before setting up your own method.
The Hazard Identification, Risk Assessment & Risk Control (HIRARC) course covers the method with workplace examples.
How do you identify hazards?
Break the work into activities, then look at each activity for anything that could cause harm. Walk the workplace and talk to the people who do the work, because they know the shortcuts and near misses.
- Physical: noise, heat, moving machinery, working at height
- Chemical: cleaning agents, fumes, dust
- Biological: bacteria, viruses, mould
- Ergonomic: lifting, repetitive work, poor workstation set-up
- Psychosocial: workload, working alone, violence
Also check incident and near-miss records, maintenance reports and equipment manuals.
How do you assess the risk?
Rate each hazard for likelihood and severity, combine the two into a risk level, and use that level to decide priority. Most methods use a simple matrix with clear descriptions for each rating.
Consider who could be harmed, including contractors and visitors, and the controls already in place. Record the rating and the reasoning so someone else could reach the same result.
How do you choose risk controls?
Choose controls from the top of the hierarchy of controls first, and move down only when a higher control is not practicable. Lower controls depend more on people doing the right thing every time.
In practice, several controls are often combined, for example a machine guard plus a safe work procedure plus gloves. Give each control an owner and a target date, and check after it is in place that the risk has actually come down.
| Control | What it means | Example |
|---|---|---|
| Elimination | Remove the hazard | Stop a task that is not needed |
| Substitution | Replace with something less harmful | Use a safer cleaning chemical |
| Engineering | Isolate people from the hazard | Machine guards, local exhaust |
| Administrative | Change how the work is done | Safe work procedure, job rotation, training |
| Personal protective equipment | Protect the individual worker | Gloves, safety glasses, ear protection |
When should a HIRARC be reviewed?
Review the HIRARC whenever something changes and on a regular schedule. A HIRARC that sits in a file unchanged soon stops matching the real work.
- After an accident, incident or near miss
- When new equipment, chemicals or processes are introduced
- When the layout or the team changes
- When a control is found not to work
Share the results with the people doing the work and with the safety and health committee, if your workplace has one. A HIRARC also supports wider systems such as ISO 45001.
What are the steps?
Classify work activities
List the tasks and areas in the workplace, including routine and non-routine work.Identify hazards
For each activity, find anything that could cause harm, by observation, records and talking to workers.Assess the risk
Rate likelihood and severity, taking existing controls into account, and set a risk level.Decide and apply controls
Choose controls from the top of the hierarchy first, assign owners and target dates.Record the assessment
Document hazards, ratings, controls and owners in a register people can read.Review and update
Review after incidents, changes and on a set schedule, and update the register.
Where can you go next?
Courses, checks and reading on the same work.Frequently asked questions.
Short answers to what people ask first.Who should carry out a HIRARC?
A small team that knows the work, usually a supervisor, workers who do the task and someone familiar with safety. Involving the people who do the work gives a more accurate result.
Is HIRARC the same as a risk assessment?
Risk assessment is the middle stage of HIRARC. HIRARC adds the hazard identification before it and the risk control after it, so it covers the full cycle.
Does completing a HIRARC course make me a safety officer?
No. A course builds knowledge of the method but does not give any statutory competency or registration. Check the Department of Occupational Safety and Health for the requirements of any statutory role.
Which sources does this page use?
Updated 20 October 2026. General information from the Certifyd team, not legal, tax or safety advice for your workplace.