HIRARC Malaysia: The Complete Guide to Hazard Identification, Risk Assessment & Risk Control

1. What is HIRARC and why it matters in Malaysia

HIRARC stands for Hazard Identification, Risk Assessment, and Risk Control. It is a systematic, three-stage process that helps employers identify things that could harm their workers, evaluate how likely and how severe that harm could be, and then put controls in place to reduce the risk to an acceptable level.

In Malaysia, HIRARC is not just best practice — it is a legal obligation. Under the OSH Act 1994 [Act 514], every employer must ensure the safety, health, and welfare of every person in their workplace. Section 15 of the Act places a general duty on employers to conduct risk assessment, and the DOSH HIRARC Guidelines 2008 provide the recommended methodology.

Why does this matter? Because if an incident occurs and you cannot show DOSH that you assessed the risk and implemented controls, you may face prosecution under Section 19 — with penalties of up to RM500,000 or imprisonment of up to two years, or both. A well-maintained HIRARC register is your first line of defence.

2. The legal basis: OSH Act 1994 and DOSH Guidelines

The legal foundation for HIRARC in Malaysia comes from two sources:

• OSH Act 1994 [Act 514] — Section 15 requires employers to provide a safe workplace. Section 29A (as amended in 2022) mandates the appointment of an OSH Coordinator for workplaces with five or more employees, who is responsible for assisting with risk assessment.
• DOSH HIRARC Guidelines 2008 — These guidelines set out the standard methodology for conducting hazard identification, risk assessment, and risk control. While guidelines are not statute law, DOSH inspectors expect employers to follow them, and deviations must be justified.

The OSH (Amendment) Act 2022 [A1648] increased penalties significantly and made HIRARC an explicitly mandatory requirement rather than an implied one. If your HIRARC register is incomplete, out of date, or missing entirely, you are exposed.

3. The 5-step HIRARC process

DOSH recommends a five-step process for HIRARC. Here is how it works in practice:

1. Plan the assessment. Define the scope (which work area, process, or activity), assemble a team that includes workers who actually do the job, and gather existing data: incident reports, near-miss logs, equipment manuals, and chemical safety data sheets.
2. Identify hazards. Walk the workplace. Look at every task, tool, substance, and environment. Talk to workers. List every hazard by work activity. A hazard is anything with the potential to cause harm — chemical, physical, biological, ergonomic, or psychosocial.
3. Assess risks. For each hazard, ask two questions: How likely is it that harm will occur? How severe would the consequences be? Multiply Likelihood (L) by Severity (S) to get the Risk score. This is where the DOSH 5x5 matrix comes in.
4. Implement controls. For every risk that is not tolerable, apply the hierarchy of controls. Eliminate the hazard if possible. If not, substitute it for something safer. If not, engineer controls. Then add administrative controls. Finally, provide PPE. Assign a Person In Charge (PIC) and a deadline for each action.
5. Review and monitor. Sign off the register. Communicate the findings to all affected workers. Review the register at least annually, after any incident, or whenever there is a significant change in processes, materials, or equipment.

4. Likelihood × Severity: how the risk matrix works

The DOSH risk matrix uses a 5×5 grid. Likelihood (how often the event could happen) is scored 1 (rare) to 5 (almost certain). Severity (how bad the outcome would be) is scored 1 (negligible) to 5 (catastrophic).

The Risk score is simply L × S. The resulting risk level is colour-coded:

• Low (1–4): Acceptable with existing controls. Monitor.
• Medium (5–12): Tolerable but should be reduced if reasonably practicable. Action within a defined timeframe.
• High (15–25): Intolerable. Immediate action required. Stop work if necessary until controls are implemented.

A common mistake is to score every hazard as "medium" to avoid accountability. This defeats the purpose. The scoring should be honest, based on evidence, and discussed with the team. If two experienced assessors independently score the same hazard and get very different numbers, that is a sign the hazard description is too vague.

5. Common workplace hazards by industry

While every workplace is different, certain hazards appear repeatedly across Malaysian industries:

• Manufacturing: Moving machinery (entanglement, crush), noise exposure, chemical fumes, forklift traffic, manual handling.
• Construction: Falls from height, falling objects, electrical hazards, trench collapse, hazardous substances (solvents, asbestos).
• Warehouse / Logistics: High-racking collapses, forklift-pedestrian interaction, repetitive strain, slips on spilled liquids.
• Offices: Ergonomic strain from prolonged screen use, fire evacuation gaps, stress from workload, poor indoor air quality.
• Chemical / Process: Toxic exposure, fires and explosions, pressure vessel failure, confined-space entry.

The key is to list hazards by work activity, not by general category. "Chemical hazard" is too vague. "Mixing solvent-based adhesive in the assembly bay without local exhaust ventilation" is specific enough to score and control.

6. The hierarchy of controls

The hierarchy of controls is not optional — it is a legal expectation. You must consider each level in order:

1. Elimination. Remove the hazard entirely. Example: Stop using a toxic chemical. This is the most effective control.
2. Substitution. Replace the hazard with something safer. Example: Swap solvent-based paint for water-based paint.
3. Engineering controls. Isolate the hazard from people. Example: Install machine guards, local exhaust ventilation, or barriers.
4. Administrative controls. Change how work is done. Example: Safe work procedures, job rotation, training, signage, permits to work.
5. Personal Protective Equipment (PPE). Protect the individual. Example: Safety helmets, gloves, respirators, safety shoes. PPE is the last line of defence and the least effective control because it relies on human behaviour.

A common Malaysian mistake is to jump straight to PPE and training. If you can engineer the hazard out, do that first. DOSH inspectors will ask why elimination or substitution was not considered.

7. HIRARC documentation and record-keeping

A HIRARC register is a living document. At minimum, it should contain:

• Work activity description
• Hazard identified
• Possible effect / consequence
• Existing risk controls
• Likelihood score (1–5)
• Severity score (1–5)
• Risk level (Low / Medium / High)
• Recommended additional controls
• Person In Charge (PIC)
• Target completion date
• Review date

The register must be signed by the person who conducted the assessment and countersigned by a senior manager or director. Keep it for at least the duration of employment plus three years. If DOSH visits, they will ask to see it.

To make this easier, Naja Safety provides a free downloadable HIRARC form (PDF) and a free Excel template with built-in risk scoring and conditional formatting.

8. Common mistakes and how to avoid them

After years of training Malaysian workplaces, we see the same mistakes again and again:

• Copying a generic template without a site walk. A HIRARC from another factory is not your HIRARC. Hazards differ by site.
• Scoring everything "medium." This avoids accountability but fails the audit test. Be honest.
• Writing vague hazards. "Fire" is not a hazard. "Welding sparks igniting flammable solvent vapours in the spray booth" is.
• Stopping at PPE. If you can eliminate or substitute, do so. PPE is the last resort.
• No worker consultation. The people doing the job know hazards management misses. Consult them.
• Never reviewing the register. A HIRARC from 2019 is useless if the process changed in 2022. Review annually.
• No follow-through on controls. If the register says "install guard" and the guard is still missing six months later, you are liable.

9. When to bring in a trainer vs doing it yourself

Can you do HIRARC without external help? Yes — if you have competent staff who understand the methodology, have time to do a thorough site walk, and can present the findings to management.

However, many organisations benefit from bringing in a HIRARC trainer for the first cycle:

• First-time HIRARC. A trainer ensures the register is built correctly from day one, avoiding costly rework.
• Complex sites. Chemical plants, construction projects, or warehouses with high-racking need deeper expertise.
• DOSH audit imminent. A trainer can review your existing register, spot gaps, and help you close them before the inspector arrives.
• Building internal capability. We train your team to do subsequent HIRARC cycles themselves, so the skill stays in-house.

Naja Safety delivers HIRARC training on-site across Malaysia. Participants leave with a draft register, templates, and the confidence to maintain HIRARC compliance independently.

References

1. Occupational Safety and Health Act 1994 (reprint as at 1 June 2024) [Act 514]. DOSH PDF ↗ (English · Bahasa Malaysia) (listing ↗).
2. OSH (Amendment) Act 2022 [Act A1648]. DOSH PDF ↗.
3. DOSH HIRARC Guidelines 2008. DOSH listing ↗.
4. CIS 25:2018 Construction Activities Risk Assessment (CARA / HIRARC). CIDB listing ↗.