What are Critical Risks and Why Do They Matter?

A critical risk is any workplace hazard or activity where a failure of controls could reasonably result in a fatality, a permanent disabling injury or illness, or multiple serious injuries. Unlike standard operational hazards, critical risks focus strictly on potential severity rather than how frequently an incident might occur.

• Severity over frequency: A critical risk may occur rarely; however, when a failure happens, the consequences are fatal or catastrophic.
• Formal legislative context: Critical risk is formally defined within New Zealand's health and safety regulatory framework, including updates under the Health and Safety Amendment Bill.
• High-risk sectors: Critical risks are particularly prevalent across industries like construction, forestry, manufacturing, mining, civil, and agriculture.
• Real-world impact: Historical events like the Pike River Mine disaster demonstrate the catastrophic cost of unmanaged critical risks and highlight why safety controls cannot exist merely on paper.
• Officer liability: Under the HSWA, business officers carry direct personal liability for ensuring that critical risk management systems are actively monitored and effective on-site.

‍

What Are Critical Controls and How Do They Work?

Critical controls are specific safeguards essential for preventing a fatal or catastrophic event or mitigating its consequences if an incident occurs. If a critical control is absent or fails, the risk of severe harm increases significantly, regardless of how many secondary or administrative controls are present.

• Crucial safeguard function: A critical control directly prevents the top-level incident or mitigates its worst outcomes.
• The acid test: Ask the fundamental question: If this single control failed tomorrow, would that failure alone be enough to seriously hurt or kill someone?
• Addressing multiple threats: Critical controls often address several potential threat vectors, preventing multiple potential events or reducing multiple severe consequences simultaneously.
• Worker confidence: A task should not proceed if a critical control is missing, as individual workers would not feel safe undertaking high-risk tasks without it in place.
• Control independence: These controls must remain robust independently, ensuring that their failure cannot be compensated for by lower-level administrative procedures alone.

‍

The Critical Control Framework and Hierarchy of Controls

The Critical Control Framework is a structured process used to systematically identify high-consequence hazards, establish reliable controls, and verify that those controls remain active and effective. This process relies heavily on the Hierarchy of Controls to ensure businesses apply the most effective safeguard reasonably practicable.

1. Identify critical risks: Assess workplace operations to pinpoint activities with potential for fatal or life-altering outcomes based on historical incident data, severity, and exposure.
2. Apply the hierarchy of controls:
   
   • Elimination: Completely remove the hazard so the risk no longer exists (e.g., stopping hazardous work or eliminating dangerous chemicals).
   • Substitution: Replace the hazard with a safer alternative (e.g., using less hazardous materials or safer equipment).
   • Engineering Controls: Isolate workers from the hazard through physical modifications (e.g., machine guarding, isolation barriers, or local ventilation).
   • Administrative Controls: Change work procedures, provide specialized training, mandate permits, or alter processes to minimize risk.
   • PPE: Use personal protective equipment (e.g., safety glasses, harnesses, or hearing protection) as the last line of defense.
3. Select critical controls: Isolate the essential controls within the hierarchy that directly prevent catastrophic failure.
4. Monitor effectiveness: Implement routine, measurable verification processes to ensure controls remain active on-site every single day.

‍

Do I still need critical risks under the Health and Safety Amendment Bill?

Yes, you do. Critical risks will become the primary legal focus of New Zealand's health and safety legislation.

Under the Health and Safety at Work Amendment Act 2026, which officially comes into force on 1 April 2027, critical risk management transitions from being an industry best practice to a formal legislative requirement.

• Refocused legal purpose: The updated Health and Safety at Work Act (HSWA) explicitly refocuses the health and safety system on identifying and managing critical risks - hazards capable of causing death, serious injury or illness, or notifiable events - rather than treating all low-level workplace risks equally.
• Small business rules (fewer than 20 workers): Smaller PCBUs will have a narrower set of duties. They are legally required to focus their primary health and safety compliance efforts specifically on critical risks, alongside providing basic welfare facilities.
• Larger business rules (20+ workers): Larger businesses must continue managing all workplace risks, but the new law mandates that critical risks must be formally prioritized above everyday hazards.
• Explicit statutory definition: The law introduces a clear statutory definition for critical risk, shifting the focus to whether serious harm would result if an incident occurs, rather than how likely the incident is to happen in the first place.

Instead of reducing your responsibilities, the April 2027 reform requires businesses to move away from generic tick-box paperwork for low-level hazards and establish clear, living controls for high-consequence critical risks.

‍

Practical Implementation: Moving from paper to living evidence

Practical critical risk management requires businesses to transition away from static paper documents and annual check-boxes toward real-time, living evidence of safety compliance. Digital mobile platforms like health and safety apps allow site workers and managers to close the gap between what is documented on paper and what is verified in the field.

‍

What to consider when switching from a paper to digital health and safety solution:

• Dynamic risk verification: Replace annual, static hazard registers with real-time digital hazard checks that update as job site conditions change throughout the day.
• Bridging the execution gap: Eliminate the dangerous gap between "documented controls" and "active controls" by verifying that safeguards are functioning on-site before work commences.
• Streamlining operations: Use a single, unified digital system for hazard identification, control verification, and audit trail collection rather than managing multiple disconnected systems.
• Defensible compliance: Provide company officers and directors with an automated, transparent, and defensible audit trail without placing excessive administrative burdens on frontline workers.
• Instant accessibility: Store custom digital forms, inductions, and critical task check-lists in one searchable platform accessible via mobile or desktop.