2.1Assessing risks & the 9 prevention principles
The essentials in 30 seconds
- Set order: avoid first, then fight at the source and substitute, then collective before individual — PPE and training last.
- Rating: cross severity (minor to serious) with likelihood (rare to frequent) to rank and prioritize actions.
- Reflex: rate as a group with operators, then translate into a dated plan (action, owner, check) filed in the DUERP.
Threaded mini-case — Hakim screens the workshop
Hakim, QHSE coordinator in an industrial SME in Algiers, must update the risk assessment: wood dust, varnishing solvent, handling. His first reflex was to order masks and post an instruction. Re-reading the 9 principles, he restarts in order: can the solvent be avoided, captured at source, ventilated collectively — before PPE.
This same case runs through the lesson, the diagram, the script and the 48h challenge — and continues in 2.2, 2.3, 2.4 and 2.5.
1. The 9 principles: the order of prevention
Avoid → assess the unavoidable → fight at source → adapt work to people → take technology into account → replace the dangerous → plan (technology, organisation, conditions) → collective before individual → train. This order is not decorative: jumping to "training + PPE" without having avoided/replaced is preventing backwards.
2. Rating: making risks comparable
Severity (1-4: from minor injury to death) × likelihood (1-4: from unlikely to frequent) = criticality. Action thresholds: ≥ 12 = immediate, 6-9 = planned, ≤ 4 = monitored. Rating is done as a group (operators + supervisors): alone, you underestimate your own workstation.
3. From risk to action plan
Each priority risk becomes: action, owner, deadline, verification. Quarterly review: done / overdue / to reschedule. The DUERP (Level 1) + this plan = the prevention system running.
🔎 Concrete example — 🔎 Hands-on example — Solvent: the 9 principles in action
Reading: PPE comes 5th, not 1st.
1. Avoid: switch to a water-based product? (partly yes)
2. Source: enclosed fountain + extraction (CPE)
3. Replace: less volatile solvent for the rest
4. Collective: general ventilation checked
5. Individual: gloves + training (LAST)
→ criticality 12 → 4: traceable in the DUERPLesson: each step dated + owned.
Section vocabulary
- General prevention principles
- Priority order of actions: avoid, assess, fight at source, adapt work, substitute, plan, collective first, inform and train.
Simple example: Hakim removes part of the solvent before buying gloves.
What it is not: starting by handing out PPE without touching the process.
Reflex: faced with a risk: can I avoid it before protecting?
- Fighting at source / substitution
- Acting at the risk's origin and replacing what is dangerous with what is less so, before any protection.
Simple example: Enclosed fountain with extraction and less volatile solvent at Hakim's.
What it is not: leaving the station open and compensating with masks.
Reflex: look for the source and the substitute before the equipment.
- Severity × likelihood rating
- Estimating risk level by crossing harm severity with occurrence likelihood, to rank.
Simple example: Hakim and the varnishers place each risk in the matrix.
What it is not: handling risks in complaint arrival order.
Reflex: note severity and likelihood with the exposed themselves.
- Ranking
- Sorting risks from most to least critical to prioritize actions, since everything cannot be handled at once.
Simple example: Varnishing comes before reorganizing the archive room.
What it is not: wanting to fix everything at once with no priority.
Reflex: handle the serious and likely first.
- DUERP action plan
- Translating priority risks into dated actions with owner and check, filed in the single file.
Simple example: Extraction fitted, owner named, check noted in the DUERP.
What it is not: a risk observation with no action and no date.
Reflex: each priority risk = action + who + when + checked.
In practice — Hands on — Assess and rank risks
- For each identified risk, apply the principles in order: can it be AVOIDED/eliminated? fought at SOURCE? SUBSTITUTED (less dangerous)? protected COLLECTIVELY? (PPE/training last).
- RATE each risk by combining its SEVERITY (minor → fatal) and its LIKELIHOOD (rare → frequent) via a matrix, to obtain a risk level.
- RANK: order risks from the most critical (severe + likely) to the least critical, to prioritise actions.
- Turn them into an ACTION PLAN (in the single document): treat the most critical risks first, favouring avoidance and collective protection.
Ready-to-say script — starting group rating (1 min)
"Let's redo the varnishing station together: can we avoid this solvent, replace it, capture at source? Then we rate severity and likelihood, and note one action with an owner and a date. PPE comes last, not first."
Say it in the workshop, at the station, with the operators concerned.
Copy-paste template — risk card to action plan
RISK: _______________ | STATION: _______________
AVOID (eliminate?): _______________ | SOURCE / SUBSTITUTE: _______________
COLLECTIVE: _______________ | INDIVIDUAL (last): _______________
SEVERITY: _______________ | LIKELIHOOD: _______________ | PRIORITY: _______________
ACTION / OWNER / DEADLINE / CHECK: _______________Very small business / tight budget
With no software: a wall chart is enough — one risk per line, group rating with a marker, owner and date visible.
Workshop SME
Hakim rates with operators at their station, not in the office: real exposure changes likelihood.
Offices / services
Same method for falls, screens, mental load: avoid (re-layout), collective (lighting, tidying), then individual.
Plan review
Re-read the plan on a fixed date: done, late or to reschedule — and update the DUERP with every station change.
✓ Best practices
- Apply the 9 in order.
- Rate as a group, never alone.
- Quarterly review of the plan.
✗ Common pitfalls
- Starting with "training + PPE".
- Solitary rating at the desk.
- Plan with no owner or date.
Key takeaways
- Assessment relies on the GENERAL prevention principles (≈ 9) that give the ORDER: 1) AVOID risks (eliminate) 2) assess 3) fight at SOURCE 4) adapt work to PEOPLE 5) take technology into account 6) SUBSTITUTE 7) plan 8) COLLECTIVE protection first 9) inform/train.
- HIERARCHY: AVOID/ELIMINATE is ALWAYS the priority; fighting at source and substituting come next; PPE and training are the LAST resort (not the first reflex).
- ASSESSING a risk = combining its SEVERITY (minor → fatal) and its LIKELIHOOD (rare → frequent), sometimes × exposure frequency, to obtain a risk LEVEL (often a severity × likelihood matrix).
- The risk level lets you RANK and PRIORITISE (treat the most severe and likely first). Assessment feeds the single document's ACTION PLAN — it turns an inventory into prioritised actions.
48h Challenge — apply tomorrow
Take 1 real station (at Hakim's: varnishing), apply the order as a group and note 1 action with owner and date. 20 minutes is enough.
- I can name the order of principles without hesitation.
- I can explain severity × likelihood with an example.
- I have rated 1 station as a group and noted 1 dated action.
Frequently asked questions
How do you rate a risk with a severity × likelihood matrix, and why rank risks?
Rating a risk means estimating its LEVEL by crossing its SEVERITY and its LIKELIHOOD in a matrix, which lets you RANK risks and prioritise actions — because you cannot treat everything at the same time. The rating principle: (1) A risk has two dimensions: (a) the potential SEVERITY of the harm (if the event occurs, what consequences? from minor — a small injury — to catastrophic — death, permanent disability); (b) the LIKELIHOOD of occurrence (how probable is the harm? from rare/unlikely to frequent/almost certain), often linked to the frequency of EXPOSURE to the hazard. (2) A level is assigned to each dimension (for example a 1-to-4 scale: severity 1=minor … 4=fatal; likelihood 1=very rare … 4=frequent). (3) The two are CROSSED in a MATRIX (severity × likelihood grid): each cell gives a risk LEVEL (often the product or a combination), generally shown as coloured zones (green = low, yellow = medium, orange/red = high/critical). Example: a severe (4) and frequent (4) risk is CRITICAL (treat urgently); a minor (1) and rare (1) risk is LOW (acceptable); a severe (4) but very rare (1) risk, or a minor (1) but frequent (4) risk, is intermediate. How to rate in practice: (1) For each identified risk, estimate the SEVERITY (the worst plausible harm) and the LIKELIHOOD (given exposure and the measures ALREADY in place). (2) Place it in the matrix → you get its level. (3) Be consistent (same scales for all risks) and realistic (neither systematic catastrophism nor minimisation). (4) Involve the people concerned (they know the reality of exposure). (5) Rating is a DECISION-AID TOOL, not an exact science — it serves to compare and prioritise, not to give an absolute figure. Why RANK (the point): (1) You cannot treat EVERYTHING at once. Resources (time, budget, people) are limited. You must choose where to start. (2) Focus efforts where the risk is HIGHEST. Treating CRITICAL risks (severe AND likely) first protects most effectively — that is where the danger to people is greatest. Acting on a minor risk first while leaving a critical risk would be absurd. (3) Structure the ACTION PLAN. Ranking turns a list of risks into an ordered plan: first the critical ones (urgent), then the medium ones, while monitoring the low ones. Each action is justified by the risk level. (4) Decide on ACCEPTABILITY. Some low risks may be judged acceptable (monitored), while high risks must imperatively be reduced. The matrix helps set that threshold. (5) Make decisions objective and TRACEABLE (why a given risk was prioritised) — useful for the single document and for justifying the approach. Points to watch: (1) Rating depends on JUDGEMENT (severity and likelihood estimates) — doing it with several people, including those concerned, makes it more reliable. (2) Take into account the measures ALREADY in place (the residual risk) AND imagine their failure when judging severity. (3) Do not neglect low-likelihood but EXTREME-severity risks (a rare but fatal accident deserves attention). (4) Re-assess after implementing actions (the risk must fall). (5) The matrix is a prioritisation tool, not an end in itself: what matters is ACTING on priority risks. In short: rate a risk by crossing its SEVERITY (potential consequences, from minor to fatal) and its LIKELIHOOD (probability, linked to exposure) in a severity × likelihood MATRIX, which gives a risk LEVEL (low → critical). This lets you RANK risks and prioritise actions, because you cannot treat everything at once: you focus efforts on the HIGHEST risks (severe and likely), you structure the action plan, you decide on acceptability and you trace decisions. Rating is a decision-aid tool (done with those concerned, consistently and realistically) serving action: reducing critical risks first. It is the core method that turns risk identification into an effective ranked action plan.
Why should you seek to eliminate a risk before protecting against it, and what does "fighting the risk at source" mean?
Seeking to ELIMINATE a risk before protecting against it, and "fighting it at source", express the fundamental principle of the prevention hierarchy: acting as UPSTREAM and as RADICALLY as possible is always more effective than merely mitigating consequences. The prevention hierarchy (the order of actions): the general principles set a priority, from most to least effective: (1) AVOID/ELIMINATE the risk (make it disappear). (2) FIGHT the risk AT SOURCE (act on its origin). (3) SUBSTITUTE (replace the dangerous with the less dangerous). (4) Protect COLLECTIVELY. (5) Protect INDIVIDUALLY (PPE) and TRAIN. You move down this scale only when you cannot do better higher up. Why ELIMINATE first (rather than protect): (1) No risk = no possible harm. Eliminating a risk (no longer using a hazardous product, automating a dangerous task, removing a manual-handling operation) makes the hazard DISAPPEAR: no more need to protect, no more possible harm. It is the safest, most definitive solution. (2) Protection, by contrast, leaves the risk PRESENT. Putting protection in place (collective or PPE) does not remove the hazard: it stays there, controlled but present. Yet any protection can FAIL (collective protection can be defective, PPE forgotten or badly worn, instructions not followed). As long as the risk exists, harm remains possible if protection fails. Eliminating the risk removes that possibility. (3) Protection depends on conditions (maintenance, wearing, behaviour). Eliminating the risk removes that dependency. (4) Elimination is often more DURABLE and sometimes more ECONOMICAL in the long run (no protection to maintain, no residual accident). What "FIGHTING the risk AT SOURCE" means: (1) It means acting as close as possible to the ORIGIN of the risk, on its CAUSE, rather than on its effects or downstream. (2) Example: against harmful dust, extraction AT SOURCE (capturing dust where it is produced, before it spreads) is far more effective than handing out masks (end-of-chain protection, on the individual). Against noise, reducing noise at its source (quieter machine, enclosure) beats distributing earplugs. Against a fall risk, removing the need to work at height (working at ground level) beats a harness. (3) Acting at source treats the PROBLEM (the emission, the cause) instead of suffering its consequences and multiplying downstream protections. (4) It is more effective because it reduces the risk for EVERYONE, PERMANENTLY, at the origin, rather than protecting each exposed person against a maintained risk. The overall logic: (1) First seek not to create the risk, or to eliminate it (the best). (2) Failing that, act on its SOURCE (the origin) and SUBSTITUTE (less dangerous). (3) Failing that, protect COLLECTIVELY (everyone, permanently). (4) Only as a last resort, protect individually (PPE) and train. Rushing to "hand out PPE and train" without having sought to eliminate/reduce at source means choosing the LEAST effective solution while neglecting the most effective ones. A summary example: faced with a toxic solvent — (1) eliminate it (solvent-free process); failing that (2) replace it with a less toxic solvent (substitution); failing that (3) capture vapours at source (extraction) and ventilate (collective); as a last resort (4) respiratory mask (PPE) + training. Each level is less effective than the previous one. In short: you should seek to ELIMINATE a risk before protecting against it because elimination makes the hazard DISAPPEAR (no risk, no possible harm), whereas protecting leaves the risk PRESENT (so harm remains possible if protection fails — and protection can always fail). "Fighting the risk at source" means acting as close as possible to its ORIGIN/cause (capturing dust where it is born, reducing noise at the machine, avoiding working at height) rather than suffering its effects and protecting downstream — which reduces the risk for everyone, permanently, at the root. The prevention hierarchy therefore requires: avoid/eliminate first, fight at source and substitute next, protect collectively then individually last. Acting upstream and at source is always more effective than mitigating consequences — it is the founding principle of effective prevention.
Hakim wants to cut the solvent risk at varnishing. Where to start?