Risk Assessment Criteria: 7 Essential Elements Explained

Risk assessment criteria are being tested before the gates open. Two hours before a festival starts, crews are still arriving, the bar contractor hasn't completed its briefing, and the heat plan is buried in an email. The organiser has listed hazards, but nobody has scored them, assigned an owner, or stated what should happen when conditions change.

That gap creates operational drift. One supervisor adds extra guards to a quiet entrance while another misses a growing queue at a barrier. A post-incident review then relies on personal recollection rather than a defensible record. Effective risk assessment criteria turn a hazard list into a decision system, so teams can compare exposure, choose controls and escalate consistently across events, venues, construction sites and corporate workplaces.

Why Risk Assessment Criteria Matter Before the First Shift

A hazard register only becomes useful when it answers practical questions. Who scores the risk? Which scale applies? What result requires treatment? Who can stop an activity? When must the score be reviewed? Without those answers, a risk assessment becomes a catalogue of concerns rather than a deployment tool.

Australian Commonwealth guidance uses risk registers that distinguish inherent, residual and target risks, with ratings such as low, medium, high and extreme. The Australian National Audit Office also describes risk identification through environmental scanning, consultation and root-cause analysis, showing that assessment starts with understanding the operating environment, not merely copying last year's checklist. Australian Government risk management guidance provides the relevant framework context.

Practical rule: If a supervisor can't explain what a score changes on the ground, the criterion isn't finished.

Consider the festival at sign-on. Crowd pressure might be acceptable while gates are closed, then become unacceptable when arrivals converge on one entry. Contractor activity can change when a loading dock remains open after public access begins. A tired guard may also interpret an ambiguous instruction differently from a fresh team member. The assessment must therefore connect each score to a control, an owner and an escalation trigger.

The seven elements that matter operationally are likelihood, consequence, matrix logic, hazard categories, treatment controls, dynamic re-ranking and documentation. Together, they create a common language for a 400-person concert, a licensed venue, a retail site or a major construction project.

Likelihood and Consequence Scoring Explained

The scoring model has two axes. Likelihood asks how probable the hazard is under current conditions and controls. Consequence asks how serious the outcome would be if the event occurred. Australian risk practice commonly uses a likelihood and consequence matrix, and AS ISO 31000:2018 requires organisations to define how both dimensions will be measured and combined.

A practical five-level scale can use rare, unlikely, possible, likely and almost certain for likelihood. Consequence can run from insignificant through minor, moderate and major to catastrophic. The labels matter less than the written indicators beneath them. “Likely” might mean repeated warning signs during the current shift, while “major” might mean serious injury, substantial disruption or a regulatory response.

Multiply the two ratings to produce the inherent risk score. This represents exposure before planned treatment. Then score the hazard again as residual risk after barriers, staffing, procedures or other controls are in place. The difference shows whether the treatment changes the risk or merely documents an intention.

For teams that use more detailed prioritisation methods, risk priority numbers for engineers offers useful context on combining assessment factors. Don't import an engineering formula blindly into event operations. Keep the calculation simple enough for a duty manager to apply under pressure, and document any weighting or override rule.

The Australian Government's risk guidance expects criteria to align with organisational policy, jurisdictional requirements and legislation. That means a score isn't a personal opinion. It should be reproducible by the planner on Wednesday and the supervisor on Saturday night.

Core Hazard Categories for Events, Venues and Sites

A useful register separates hazards by how they behave in the operating environment. The same likelihood label can mean different things across a crowd, a loading dock and a security operations centre, so categories need specific indicators rather than generic descriptions.

Crowd hazards include congestion, surge, crush potential, queue conflict and ejection flow. A festival may face pressure at a barrier, while a hotel may experience a concentrated queue in a single lobby. The control question isn't just whether “crowding” exists. It is whether density, movement and available egress have changed enough to require intervention.

Access and perimeter hazards cover credential checking, vehicle approach, contractor segregation, unsecured doors and delivery routes. These risks often rise during changeovers, when public movement and contractor activity overlap. A construction site may treat unauthorised plant access as more serious than a minor perimeter breach because the consequence includes equipment loss and unsafe interaction with machinery.

Environmental hazards include weather, temperature, lighting, noise and visibility. The National Climate Risk Assessment describes risk as an interaction between hazard, exposure, vulnerability and response, a useful model for outdoor events and temporary sites. A storm warning alone doesn't determine the score. Exposure, shelter, evacuation capacity and response time do.

Criminal hazards can include theft, assault, protest activity, terrorism and targeted intrusion. Relevant critical infrastructure operators may also need to account for obligations under the Security of Critical Infrastructure Act. The treatment should reflect credible intelligence and site exposure, not generic fear.

Psychosocial hazards deserve their own category. AHRI identifies high job demands, poor role clarity, weak change management, bullying, harassment, conflict and traumatic exposure as relevant workplace hazards, and recommends using consultation, surveys, absenteeism, turnover and complaints information when assessing them. Fire risk articles from Wisenet Security Ltd can provide additional hazard-assessment context, although Australian operators must apply local duties and site conditions.

Control Measures and the Hierarchy of Treatment

A residual score should lead to a decision, not a longer description. The hierarchy of controls helps the planner test stronger options before defaulting to instructions and personal protective equipment.

1. Elimination removes the hazard. Cancel a high-risk activation, close an unsafe access route, or relocate an entry away from a vehicle conflict point.
2. Substitution replaces the hazard with a lower-risk option. Use polycarbonate serviceware instead of glass in a high-conflict bar area, or move a task to a safer operating period.
3. Engineering controls separate people from danger. Bollards, vehicle barriers, improved lighting, fixed CCTV coverage and redesigned queue lines can reduce exposure without relying on perfect behaviour.
4. Administrative controls change how people work. Briefings, two-person patrols, traffic plans, radio protocols and fatigue-management arrangements can support a workable deployment.
5. PPE provides the final line of protection. High-visibility clothing, body-worn cameras, respirators and cut-resistant gloves may reduce harm, but they don't remove the underlying hazard.

The trade-off is operational. Engineering controls can require site changes and approval, while administrative controls are faster to deploy but depend on supervision and compliance. PPE can be useful, yet it often limits consequence only after the incident starts. A treatment plan should therefore rank controls from strongest to weakest, name the owner, identify required resources and set a review date.

For Australian operators, the treatment choice should also reflect the NSW hazardous-industry principles of avoiding avoidable risk, reducing major hazards wherever practicable, containing significant events and preventing new development from adding incremental risk. NSW hazardous-industry planning guidance provides that practical frame.

Worked Examples Across Festival, Venue and Site

The matrix only works when the inputs reflect the environment. The following scores use the same five-level logic, but the exposure changes across a festival, a hotel and a construction site.

At the festival, crowd surge receives the highest treatment priority because a large, moving audience can compress rapidly around a barrier or egress route. The control plan might include revised barrier layouts, traffic marshals, monitoring at pressure points and an incident-controller trigger when movement becomes restricted. Intoxication remains a significant concern because it can amplify aggression, poor decision-making and medical demand.

The hotel has less crowd exposure, but its single lobby makes access control a concentrated risk. A person can move from the entrance into guest areas quickly, so the access score stays high despite lower crowd pressure. The appropriate response might include reception coordination, credential checks, CCTV review and a clear response route for suspicious behaviour.

The construction site has minimal crowd-surge exposure, yet unauthorised access can create a serious interaction with plant, materials and restricted work zones. That is why its access breach score becomes extreme. Contractor sign-in, gatehouse control, perimeter checks and plant protection may be more important than event-style crowd controls.

The matrix stays constant. The evidence feeding it must change.

NSW event guidance requires risks to be analysed and rated using likelihood and impact. It also directs planners to consider duration, affected people, vulnerability, broader service delivery and ease of mitigation. NSW event risk assessment guidance supports the principle that both dimensions must appear in the working record.

Regulatory and Compliance Considerations in Australia

Australian risk assessment criteria sit inside a compliance framework, but compliance doesn't replace operational judgement. AS ISO 31000:2018 expects criteria to be set to the purpose and scope of the activity, aligned with organisational objectives and resources, and clear about how multiple risks will be considered.

A supervisor can use this three-part checklist:

• Use consistent terminology: Record context, identification, analysis, evaluation, treatment, monitoring and review in a way that aligns with the organisation's framework.
• Score before work starts: Date the register, record the assessor and preserve the reasoning behind the likelihood and consequence ratings.
• Assign treatment ownership: Name the supervisor responsible for each control, state the escalation route and set the next review point.

Safe Work Australia's guidance says a risk assessment is needed where there's uncertainty about how a hazard may cause injury or illness, where hazards may interact, or where workplace changes could affect controls. It also identifies mandatory assessments for certain high-risk work, including confined spaces, diving work and live electrical work. The relevant Safe Work Australia WHS risk management guide should be read alongside jurisdiction-specific duties.

NSW, VIC, QLD and the ACT apply additional event, licensing, workplace or land-use requirements depending on the activity. The Australian Government's best-practice guide to standards and risk assessments also stresses that an adopted framework must be suitable for the Australian context and supported by evidence of its value. For practical record preparation, an industrial compliance audit readiness guide can help teams think through evidence, ownership and traceability.

Dynamic Re-Ranking When Conditions Change Mid-Shift

A static register can be accurate at briefing and wrong by the time the crowd arrives. Live conditions alter exposure, so the original score should be treated as an input rather than a permanent conclusion.

Safe Work Australia's evidence updates highlight continuing gaps in exposure data, particularly for psychosocial hazards and dangerous substances. Its Australian Worker Exposure Survey was still in pilot or completion phases in 2026, which reinforces the need for operators to capture site-level observations rather than wait for a perfect national dataset. Safe Work Australia's 2025 evidence update explains that developing evidence base.

Re-score when the operating picture changes materially, such as:

• Crowd density increases in an egress path.
• Intoxication or aggression rises at an entry or service area.
• Contractor activity overlaps with public movement at a loading dock.
• CCTV coverage drops and creates a supervisor blind spot.
• Heat, weather or visibility changes the ability to work safely.
• Fatigue or missed breaks affect alertness and communication.

Each trigger needs a response code. Re-score the hazard, re-brief affected staff, redeploy controls or escalate to the incident controller. Don't wait for the scheduled review if the live exposure has changed.

A risk register that never changes during a changing shift is a filing system, not a control.

The register should capture the time of the change, the evidence observed, the revised likelihood and consequence, the decision-maker and the control deployed. This record protects operational clarity and gives the post-shift review something stronger than memory.

Psychosocial Criteria That Drive Operational Security

Psychosocial hazards often receive a low score because they don't always create a visible incident at the moment they arise. That approach misses their operational effect. Fatigue, unclear orders, repeated aggression and traumatic exposure can reduce reporting quality, weaken handovers and delay escalation.

Assess the conditions that affect how the team behaves:

• Role clarity: Can each guard explain the current post, authority and escalation route?
• Conflict exposure: Are staff repeatedly dealing with aggression, harassment or verbal threats?
• Fatigue: Has the roster created extended duty, missed breaks or overtime accumulation?
• Traumatic exposure: Is there a clear debrief and support process after a serious confrontation?
• Supervision: Can a supervisor observe and check high-conflict posts?
• Workload: Are deployment changes creating unmanageable task switching?

AHRI's 2025 psychosocial risk report recommends regular assessment using consultation, surveys, turnover, absenteeism and complaints data. In a live security operation, those inputs should connect to decisions, not sit in a separate HR file.

A poor psychosocial score may require two-person patrols, rotation away from a static conflict post, clearer radio protocols or more frequent supervisor checks. After traumatic events, the roster should provide a documented debrief path and a suitable recovery arrangement. The exact intervention depends on the hazard and duty, but the principle is consistent. If team condition affects control reliability, it belongs in the operational risk assessment.

Quick-Reference Likelihood and Consequence Matrix

A duty manager needs a matrix that can be read during a radio call. Keep the five likelihood levels across the top and the five consequence levels down the side. The cell must state the action, not just display a colour.

Use the colours as a decision shortcut:

• Green: Maintain standing controls and monitor the exposure.
• Amber: A supervisor reviews the score when conditions trend upward and confirms whether treatment needs strengthening.
• Red: Escalate to the incident controller, document treatment during the shift and create a post-shift review entry.

The top of the printed sheet should list dynamic triggers, such as crowd compression, contractor overlap, worsening visibility or a fatigue concern. The bottom should show escalation contacts and the time allowed for a re-brief. Don't rely on a colour alone. A red cell without an owner is still an incomplete control.

The NSW Government's event risk material also supports considering duration, the number and vulnerability of people affected, broader service impact and mitigation difficulty. Those factors help the supervisor choose the consequence descriptor rather than treating every incident as interchangeable.

Documentation That Closes the Risk Loop

Three artefacts keep risk assessment criteria connected to actual work.

The risk register records the hazard, location, affected people, inherent likelihood and consequence, inherent rating, existing controls, residual score, control owner and next review date. Add the evidence behind any changed score, especially when a supervisor re-ranks the hazard during a shift.

The treatment plan converts high or extreme residual exposure into action. Each item should state what will change, who will deliver it, what resources are needed, which trigger confirms completion and what happens if the control can't be implemented. “Increase security” isn't a treatment. “Place a supervisor and two guards at the west barrier while pressure remains high” is operationally testable.

The incident review form captures what happened, which controls worked, where communication failed and whether the criteria were calibrated correctly. Include near misses, not only reportable events. A near miss may reveal that a likelihood indicator or escalation threshold is too vague.

The documents form one loop:

1. Register the hazard and score it.
2. Treat the exposure and assign ownership.
3. Review the outcome and update the next register.

Without that loop, criteria become a paper exercise that is difficult to defend to a WHS regulator, insurer or client. The documents should be accessible to supervisors, version-controlled and reviewed after material changes.

Frequently Asked Questions for Duty Managers

How often should criteria be re-scored during a live shift?

Review them hourly during peak exposure windows and immediately after an incident, weather change, crowd change, contractor overlap or other material condition change. A scheduled review can't replace event-driven re-ranking.

What triggers escalation to senior management?

Escalate any residual rating of high or extreme, and any likelihood rating of almost certain. The incident controller should receive the revised score, evidence, treatment decision and resource requirement.

Who owns the register on a multi-contractor site?

The principal contractor or PCBU owns the overall register under the applicable WHS framework. Subcontractors must provide hazard information, control details and changes within their work area.

Can criteria differ between events, venues and construction sites?

Yes. The likelihood and consequence descriptors should remain consistent, while hazard categories, evidence and control emphasis change with the environment. Crowd movement dominates a festival, access and guest flow may dominate a hotel, and plant interaction or perimeter control may dominate construction.

GM GROUP Services provides security risk assessments that identify hazards, assess likelihood and severity, apply controls and document review actions across events, venues, businesses and construction sites in NSW, VIC, QLD and the ACT. If your next deployment needs a practical register and fit-for-purpose security plan, contact GM GROUP Services to discuss the site, workforce and operating conditions before sign-on.