Risk Assessment – Methods and Tools

Risk estimation: Machine safety is one of the cornerstones of modern manufacturing. Although standards and legal requirements impose an obligation to carry out a risk assessment, in practice this procedure is crucial for protecting employees’ health and lives, as well as for optimising technological processes. Proper risk estimation helps prevent accidents, reduces unplanned downtime, and supports a positive company image. This article provides a comprehensive discussion of:

• Why risk assessment is so important.
• Which standards need to be taken into account.
• What the step-by-step process looks like.
• Which methods are available—including the risk scoring approach, risk matrices, FMEA analysis, and others.
• How to link risk assessment results with machine documentation and employee training.

We will also present practical examples and the most common mistakes encountered by engineers and occupational health and safety specialists. All of this in line with EN ISO 12100, EN ISO 13849-1, EN ISO 13850, EN 62061, and other standards.

Risk estimation: Why is risk assessment so important?

Some engineers treat risk assessment purely as an obligation arising from the Machinery Directive 2006/42/EC or the Machinery Regulation 2023/1230/EU. It is worth remembering, however, that a properly conducted assessment delivers tangible benefits:

1. Fewer accidents: Identifying hazards and implementing appropriate measures reduces the risk of injuries and occupational illnesses.
2. Regulatory compliance: These actions meet legal requirements, protecting the company from administrative penalties and civil liability.
3. Improved efficiency and quality: Stable processes and the absence of “emergency” stoppages have a positive impact on productivity and employee satisfaction.
4. Building a safety culture: Hazard awareness makes employees place greater emphasis on following procedures and on preventive actions themselves.

Keep in mind that risk assessment is not a one-off activity. Any machine modification, process change, or introduction of a new technology can create entirely new hazards. That is why systematic and ongoing updates to documentation, audits, and training are so important.

Legal basis and standards

Within the European legal framework, the most important act is the Machinery Regulation 2023/1230 (DM 2006/42/EC is being replaced). Under it, the manufacturer (or its authorised representative) must carry out the risk assessment process, implement safety measures, and document these actions. In Poland, the provisions of the Directive were transposed into national law through relevant regulations. Regulation 2023/1230 is an EU Council regulation, so it applies directly across the entire EU.

The key standard describing the general principles of designing safe machinery is EN ISO 12100. It explains the process of hazard identification, risk analysis, and risk evaluation; introduces common terminology; and indicates the hierarchy of risk reduction measures. It is complemented by, among others:

• EN ISO 13849-1 – in the context of safety-related control systems.
• EN 62061 – addressing electrical/electronic machine control systems.
• EN ISO 13850 – relating to emergency stop functions and emergency stop devices.

It is worth becoming familiar with all of these standards, as they complement one another and form coherent guidance for design, operation, and modernisation of machinery.

Risk estimation: Stages of risk assessment

1. Hazard identification

The first—and most important—step in the risk assessment process is to carefully identify all potential flashpoints, i.e., sources of hazards. The most common are:

• Mechanical hazards: moving machine parts, rotating shafts, belt pulleys, rotating components, belt conveyors.
• Thermal hazards: hot heating elements, furnaces, combustion zones.
• Electrical hazards: wiring, control cabinets, static electricity.
• Chemical hazards: contact with harmful substances, fumes, leaks.
• Radiation hazards: laser, UV, X-ray used, for example, for quality control.
• Ergonomic hazards: incorrect posture, repetitive movements, excessive physical effort.

All phases of use need to be reviewed: normal operation, start-up, maintenance, cleaning, changeover, and even disposal. It is worth gathering input from both designers and operators, who usually know the machine “from the inside” best.

Example: At a plastics moulding plant, the health and safety team noticed that employees often carry hot semi-finished parts (approx. 180–200°C). There was a risk of burns to hands and forearms. The earlier assessment did not cover this phase because it focused mainly on the injection moulding machine’s mechanical hazards. Adding this hazard to the list forced the company to introduce additional thermal guards and protective gloves with appropriate performance parameters.

2. Hazard analysis

At this stage, we break down each identified hazard into its component parts:

• What could cause it to occur?
• How could it happen in practice?
• What would be the consequences of an unwanted event (from minor cuts up to loss of life)?
• Can the operator avoid or reduce this hazard in any way?

It is worth using existing accident statistics, inspection reports, or information from machine service and maintenance. When introducing a prototype, it is a good idea to draw on experience from similar solutions.

Example: In a food packaging process, operators used knives to cut open film. No one paid attention to the fact that minor cuts occurred fairly often. A closer review showed that the work was done “in a rush” and the knives had no safety features. The company considered purchasing knives with retractable blades and training operators in safe cutting techniques, which significantly reduced the number of incidents.

3. Risk estimation

Risk estimation is the point at which we assign each hazard a “weight” based, among other things, on the likelihood of occurrence and the consequences of the event. The most commonly used methods are:

a) Risk matrix (Risk Matrix)

We create a table: the columns define consequence categories (e.g., minor injury, injury requiring hospitalisation, permanent disability, death), and the rows define likelihood categories (e.g., negligible, low, moderate, high, very high). At the intersection of these categories, we read the risk level (e.g., low, medium, high, unacceptable).

Advantages: simple and visually clear; useful in discussions with management.
Disadvantages: subjectivity in selecting categories; sometimes too high-level and generic.

b) Risk Scoring (Point-based risk rating)

The point-based method is an extension of the matrix. Instead of describing categories in words, we assign each category a numerical score. This produces a more precise result called a risk score. Example formula: Risk Score=P×S×E

where:

• P (Probability) – likelihood of the hazard occurring (e.g., a 1–5 scale).
• S (Severity) – severity of consequences (e.g., a 1–5 scale).
• E (Exposure) – frequency or duration of exposure (also a 1–5 scale).

Sometimes, factors other than E are used, such as the ability to avoid the hazard (Avoidance) or the level of detectability (Detection). The overall index (e.g., from 1 to 125) provides a numerical measure of risk. The company then defines value ranges (e.g., 1–20 = low risk, 21–60 = medium, >60 = high), which makes it easier to decide on investments in safety.

Advantages:

• Greater precision than a standard risk matrix.
• Clear, point-based rules reduce subjectivity.
• A good comparative tool across different hazards.

Disadvantages:

• Requires a clear scoring scale and consistent application across the organisation.
• Some subjectivity still remains (the assessment of probability or exposure may vary depending on the expert).

c) Risk graph (Risk Graph)

Often used when designing control systems compliant with EN ISO 13849-1. It is based on a logical diagram in which we assess, in sequence:

1. Severity (S – severity).
2. Frequency of exposure (F – frequency).
3. Possibility to avoid (P – possibility to avoid).
4. Probability (W – probability).

As a result of this assessment, we obtain the required Category and Performance Level (Performance Level, PL) or SIL (Safety Integrity Level – in the context of EN 62061).

4. Risk acceptability evaluation

After determining the risk level (in a matrix, as a risk score, or via PL/SIL categories), we compare it against the company’s acceptability criteria. Each organisation may apply slightly different criteria. For example, in some plants, any situation that, in the worst case, could result in death or permanent disability is deemed unacceptable regardless of likelihood. Others allow some level of risk (e.g., minimal risk during maintenance work), but only on the condition that specific protective measures are implemented.

Example: At a printing company, it was agreed that a Risk Score above 50 is unacceptable and corrective actions must be implemented immediately. Minor hazards in the 30–50 range were classified as “conditionally tolerated”, meaning their reduction must be planned within a reasonable timeframe, e.g., by the end of the quarter.

5. Selecting and implementing risk reduction measures

Once risks have been identified and estimated, it is time for practical action. According to EN ISO 12100, the following hierarchy applies:

1. Designing “inherently safe” solutions (Inherently Safe Design) – eliminating the hazard at its source, e.g., removing protruding parts, reducing the speed of moving components, using low voltage.
2. Technical protective measures – e.g., fixed guards, safety light curtains, emergency stop devices, interlocking systems, sensors.
3. Organizational and personal protective measures – work instructions, training, personal protective equipment (gloves, safety glasses, coveralls).

Example: In a metalworking plant, automatic guards with magnetic sensors were installed to prevent the press brake from starting when the guard is raised. This reduced the risk of hand crushing from high to low (after recalculating, the risk score dropped from 64 to 16, classifying the hazard as acceptable).

Methods and tools for risk estimation

1. Risk Matrix

Use: a quick, straightforward method for initial hazard screening.
Procedure: define probability categories (e.g., A–E) and consequence categories (e.g., 1–4), then use the table to determine the risk level (e.g., L – Low, M – Medium, H – High).

Example: An operator may put a hand into the cutting zone, resulting in a serious injury. The probability is assessed as “moderate” and the consequences as “severe”. The matrix indicates a high risk level, requiring immediate action such as guards or interlocks.

2. Risk Score (Point-based rating)

Use: in companies that prefer a numerical, more detailed measure of risk.

Example formula: Risk Score=P (Probability)×S (Severity)×E (Exposure)

P, S, and E are defined on a scale such as 1–5, where 1 is the lowest value and 5 the highest. The overall result (1–125) is then divided into risk ranges.

Example: A burn hazard from a hot component. Assume:

• P = 3 (a moderate chance of contact because the operator frequently works in that area),
• S = 4 (the injury may be severe—extensive burns),
• E = 3 (the operator is exposed several times a day).

This gives Risk Score = 3 × 4 × 3 = 36. If the company policy states that above 30 enters the medium-risk zone (additional protective measures required), it is clear they must be implemented here.

3. Risk Graph

Use: designing control systems in accordance with ISO 13849-1 or EN 62061.
Procedure: answer questions about injury severity (S), frequency of exposure (F), possibility of avoidance (P), and probability (W). The diagram indicates the required safety category (PL a, b, c, d, e) or safety integrity level (SIL1, SIL2, SIL3).

4. FMEA (Failure Mode and Effects Analysis)

Use: analyzing system components in terms of potential failures and their consequences.
Procedure: for each potential failure, define its severity (Severity), occurrence (Occurrence), and detectability (Detection), creating the so-called RPN (Risk Priority Number). A high RPN indicates areas that should be addressed first.

5. HAZOP (Hazard and Operability Study)

Use: especially in the chemical industry and wherever key process parameters (pressure, flow, temperature) must remain within specified ranges.
HAZOP study: a team of experts considers various deviations (too high, too low, none, delay, etc.) and analyzes what could happen if a given anomaly occurs.

Documentation and training as an integral part of risk assessment

Risk assessment is only beneficial when the results are captured in documentation and understood by employees. The recommendations of EN ISO 12100 indicate that the machine manufacturer should develop instructions that include, among other things:

• Detailed information on potential hazards.
• A description of the safety measures used (guards, emergency stop devices, warning signals).
• Procedures for safe operation, maintenance, and cleaning.
• Recommendations regarding personal protective equipment.

The next step is training. Even the best documentation is of little value if operators and maintenance personnel do not understand or are not familiar with the implemented solutions. It is worth conducting:

• Onboarding training for new employees.
• Periodic refreshers for everyone whenever changes are made to the process.
• Hands-on workshops covering emergency stop buttons, LOTO (Lockout-Tagout) procedures, interpretation of warning signals, and the use of personal protective equipment.

Example: At a carbonated beverage plant, new robots were introduced for palletizing. The production manager organized short, practical workshops where operators learned how to use the control panels, reset alarms, and perform an emergency stop. As a result, the number of operating errors and potential robot-related incidents was reduced.

Risk estimation: Sample risk assessment scenario using point-based methods

Suppose that in a small furniture company, the owner purchased a new panel saw. He decided to carry out a risk assessment, involving an occupational health and safety specialist and an operator with many years of experience. He also wants to introduce a point-based risk score.

1. Hazard identification:
   • Hand contact with the cutting blade.
   • Kickback of the material.
   • Wood dust that may cause respiratory problems.
   • Risk of electric shock if a cable is damaged.
2. Hazard analysis:
   • During cutting, the employee often holds narrow pieces close to the blade.
   • The machine does not have a dust extraction system at an adequate level.
   • The condition of the hall’s electrical installation has not been inspected for a long time.
3. Risk estimation (Risk Score):
   • Hand laceration hazard: P = 4 (fairly high, the operator frequently comes into contact with the blade), S = 5 (amputation is possible), E = 4 (exposure several dozen times a day). Risk Score = 4 × 5 × 4 = 80 (very high).
   • Material kickback: P = 2 (rare, but possible), S = 3 (bruises, possibly fractures), E = 3. Risk Score = 2 × 3 × 3 = 18 (medium).
   • Wood dust: P = 3 (depending on the type of wood and exposure time), S = 2 (usually irritation, occasionally asthma-related issues), E = 4 (all day). Score = 3 × 2 × 4 = 24 (medium).
4. Acceptability evaluation:
   • The company considers results above 50 to be high risk requiring immediate action.
   • Therefore, the focus should be on the hand laceration hazard (score 80). Wood dust and kickback have scores in the 18–24 range, so they fall into the medium category.
5. Implementation of risk reduction measures:
   • Install a guard over the blade with an interlocking system (cutting cannot start unless the guard is closed).
   • Introduce push sticks and guides so hands do not get close to the blade.
   • Add an additional dust extraction system and provide training on the need to use filtering masks.
6. Reassessment (Risk Score):
   • Hand laceration: Now P = 2 (guard + push sticks), S = 5, E = 3. New score = 2 × 5 × 3 = 30 (down from 80 to 30).
   • The risk was deemed medium, and under the company’s policy this level is acceptable after implementing instructions and further safeguards.
7. Documentation and training:
   • The company owner documents the implemented changes and describes them in the operating instructions.
   • Operators receive training on the new accessories (push sticks, masks) as well as on proper servicing of the extraction system.

Risk estimation: Good practices and the most common mistakes

Good practices:

1. Cross-functional involvement: engineers, occupational health and safety specialists, operators, and maintenance technicians take part in the risk assessment process.
2. Periodic updates: the process changes, you modify a machine—always update the risk assessment.
3. Complete documentation: a risk assessment report that is clear to all stakeholders.
4. Regular training: one-off training is not enough; refreshers and hands-on workshops also matter.
5. Applying the hierarchy of safety measures: first eliminate hazards through design, then apply technical measures, and finally organizational measures.

Most common mistakes:

1. Treating the risk assessment as a mere formality: when copying entries from other projects, it is easy to miss hazards specific to the situation.
2. Underestimating probability: operators often work under less-than-ideal conditions, which can dramatically increase risk.
3. Ignoring practitioners’ input: an engineer in the office may not be aware of operators’ day-to-day “workarounds” that create unforeseen hazards.
4. Lack of oversight of implemented safeguards: if a guard or interlock makes the job harder, employees may remove it or bypass it, undermining the effect.
5. Failing to reassess after an accident: every incident is a warning sign. It is worth revisiting the process and the conclusions from previous analyses.

Risk assessment is not just a formal requirement—it is, above all, a practical tool that protects people and improves production quality and efficiency. Standards such as EN ISO 12100, EN ISO 13849-1, EN ISO 13850, EN 62061, as well as the essential requirements themselves, define the general framework, but each organization must adapt them to its own specific context. The choice of a particular method (risk matrix, Risk Score, Risk Graph, FMEA, HAZOP) depends on process complexity and the preferences of the assessment team.

Do you need help with machine risk assessment?

We provide comprehensive risk assessment services and risk assessment training, based on many years of experience and applicable standards. We help you select the most suitable risk estimation methods (such as Risk Score, a risk matrix, or Risk Graph), recommend practical technical solutions, and advise on preparing documentation that meets the requirements of the regulations currently in force.

If you want to streamline the risk assessment process at your facility, get in touch with us. Together, we will choose an action plan, arrange training, and implement best practices. Our goal is to ensure the highest level of safety—so that people work in safe conditions and the company avoids the costly consequences of any potential shortcomings.