HIRA for a food factory: how to identify hazards and assess risks under ISO 45001 and the OHS Act

A hazard identification and risk assessment (HIRA) is the record of what could hurt the people in your food factory and what you are doing about it. It lists every task on site, including cleaning, maintenance and contractors’ work, names what could hurt someone during each one, scores the risk, applies controls from elimination down to PPE, and records who owns each action. In South Africa the Occupational Health and Safety Act makes it a legal duty, ISO 45001 sets out how to run it as a system, and the chemical, ergonomic and noise regulations each add their own assessment and review interval.

If you are the person who has to build or fix the HIRA, the Hazard Identification, Risk Assessment and Incident Investigation course (about 5 hours online, R1,495) takes you through the method with South African law in every lesson.

What does South African law require from a food factory?

Section 8(1) of the Occupational Health and Safety Act 85 of 1993 requires every employer to provide and maintain, as far as is reasonably practicable, a working environment that is safe and without risk to the health of employees. Section 8(2) spells out what that means. Paragraph (b) requires the employer to take reasonably practicable steps to eliminate or mitigate any hazard before resorting to personal protective equipment. Paragraph (d) requires the employer to establish, as far as is reasonably practicable, the hazards to health or safety attached to any work, article, substance, plant or machinery, the precautions needed, and to provide the means to apply them. That is a HIRA in all but name.

Section 16(1) requires the chief executive officer to ensure, as far as is reasonably practicable, that those duties are properly discharged. The CEO may assign duties to others under section 16(2), but that does not relieve the CEO of responsibility, which is why the signed HIRA should sit with senior management and not only with the safety officer.

Three sets of regulations made under the Act add their own assessments that a food plant usually needs:

• Regulations for Hazardous Chemical Agents, 2021 (regulation 5). Assess exposure to cleaning chemicals, sanitisers, refrigerants, laboratory reagents and dusts, after consulting the health and safety representatives or committee, record the result, and repeat it at intervals not exceeding two years or sooner when a process, method or piece of equipment changes.
• Ergonomics Regulations, 2019 (regulation 6). A competent person must assess ergonomic risks before the work starts, after consulting the health and safety committee or representatives, covering manual handling, repetitive work and awkward postures, and repeat it at intervals not exceeding two years, or sooner after a change, an incident or an adverse finding from medical surveillance.
• Noise Exposure Regulations, 2024 (regulations 7 to 12), which replaced the Noise-Induced Hearing Loss Regulations, 2003 on 6 September 2026. A competent person must assess noise exposure before exposure starts and at intervals not exceeding 24 months. Areas at or above the noise-rating limit of 85 dBA over 8 hours, or the 82 dBA action level where workers are also exposed to ototoxic chemicals or whole body vibration, must be demarcated as noise zones, with hearing protection, monitoring and medical surveillance.

Heat and cold stress at ovens and blast freezers fall under the Physical Agents Regulations, 2024, machine guarding under the Driven Machinery Regulations, and entry into silos and tanks under the confined space rules of the General Safety Regulations.

What does ISO 45001 add to the legal minimum?

ISO 45001 turns the duty into a process that has to keep running. Clause 6.1.2.1 requires hazard identification to be ongoing and proactive, and to take in routine and non routine activities, emergency situations, everyone with access to the workplace (workers, contractors and visitors), how work is organised and social factors, including workload, working hours, harassment and bullying, past incidents and changes to the site or the process. Clause 6.1.2.2 asks for a method to assess the risks, and clause 8.1.2 sets the order of controls: eliminate the hazard, substitute something less hazardous, use engineering controls and reorganise the work, use administrative controls and training, and only then rely on PPE.

Clause 5.4 requires workers, and non-managerial workers in particular, to be consulted and to take part, including in hazard identification. A HIRA that holds up at audit is built on the floor with the operators and the cleaning crew.

Amendment 1:2024 added climate change to the context clauses. The revision was balloted as a draft from June to September 2026, names psychosocial hazards explicitly in draft clause 6.1.2.1, and is expected in 2027 with a transition period. Build on the 2018 edition now. Our post on running ISO 9001, ISO 14001 and ISO 45001 on the same records shows how it fits with the systems you already have.

Which hazards are typical in a food factory?

Walk the process from receiving to dispatch, and again at night. Typical hazards are:

• Machinery: mixers, slicers, mincers, conveyors, fillers and palletisers, especially during cleaning, jams and changeovers when guards are open.
• Manual handling: 25 kg bags of flour, sugar and starch, crates, carcasses and pallets.
• Chemicals: caustic and acid cleaners, chlorine sanitisers and peracetic acid, including spray mist and the chlorine gas released when a chlorine sanitiser meets an acid, and ammonia in refrigeration, where a large inventory can bring in the Major Hazard Installation Regulations.
• Dust: flour, enzyme improvers and other powders such as sugar and starch, which can cause occupational asthma and, as a cloud near an ignition source, explode.
• Heat and cold: ovens, fryers, steam, hot water, and work in cold rooms and blast freezers, including the risk of being locked in.
• Slips and falls: wet floors, fat and oil, ladders, and work on top of tanks and silos.
• Confined spaces: entry into silos, tanks, mixers and pits, and gas build up from fermentation carbon dioxide or nitrogen used in packaging.
• Noise: compressors, bottling and canning lines, grinders and slicers.
• Vehicles: forklifts and trucks in yards and warehouses.
• Work organisation: long shifts, night work, pressure on the line, and harassment or bullying, which clause 6.1.2.1 already lists as social factors.

How do you score risk on a HIRA risk matrix?

Use one scale across the site, with the definitions on the form. A five by five matrix works for most plants. Likelihood runs from 1, rare, to 5, almost certain. Severity runs from 1, first aid only, through 4, a lost time injury or permanent partial impairment such as noise-induced hearing loss or occupational asthma, to 5, a fatality, amputation or permanent total disability. Multiply them. On a common banding, 1 to 4 is low, 5 to 9 medium, 10 to 16 high and 20 to 25 very high. Anything rated high needs interim controls, an owner and a due date before work carries on, and a task that could kill, such as reaching into moving machinery, stops until it can be done safely. A matrix is a ranking aid, not a measurement: 1 x 5 and 5 x 1 score the same but are not the same, so treat every severity 5 hazard as a priority.

Score each risk twice, as it is today and with the planned controls in place, so management sees what each control buys.

Want your team to score the same way? Enrol your supervisors and health and safety representatives in the HIRA and incident investigation course so they work from one method.

What is the hierarchy of controls in a food factory?

Follow the order in section 8(2)(b) of the Act and clause 8.1.2 of the standard, and check every control against food safety before you sign it off. A safer chemical must still be approved for food contact surfaces, and your cleaning and disinfection risk assessment should record that check. A new guard must still be cleanable and must not shed paint or plastic into the product. A dust extraction hood must not become a source of contamination itself, and its ducting and filter must be earthed and protected against a dust explosion. Hearing protection worn near open product should be detectable and corded.

A worked South African example: a Gauteng bakery

How often should you review the HIRA?

Treat two years as the outer limit, because that is what the chemical, ergonomic and noise regulations allow. Review sooner after any incident or near miss, a new machine, product or chemical, a change in layout or shift pattern, a new contractor activity, or a finding from medical surveillance. Contractors should work under a written section 37(2) agreement, with their tasks in your HIRA or a reviewed contractor risk assessment (clause 8.1.4.2). Link the HIRA to your management of change procedure (clause 8.1.3) and your incident investigation procedure (clause 10.2), so that no change reaches the floor without someone asking what it does to people as well as to the product. After an incident, find the real cause, not operator error, and reopen the HIRA row it points to.

Our guide to risk assessment and hazard analysis explains how the food safety side uses the same words differently, and the 24 risk assessments a GFSI audit expects shows where the HIRA sits beside them.

What do auditors and inspectors find wrong with HIRAs?

• A generic template with no link to the real tasks on site.
• Cleaning, maintenance, contractor and night shift work left out.
• PPE listed as the only control for high risks.
• No residual score, no owner and no due date.
• Chemical, ergonomic and noise assessments older than two years.
• No link to the legal register (clause 6.1.3), so assessments the regulations require are missed.
• Incident investigations closed without updating the HIRA (clause 10.2).
• No evidence that workers or health and safety representatives took part.
• No review after the last incident.

Questions we are often asked

Is a HIRA a legal requirement in South Africa?

Yes. Section 8(2)(d) of the OHS Act requires employers to establish the hazards in their work and the precautions needed, and the chemical, ergonomic and noise regulations require their own risk assessments.

Is our HACCP plan enough?

No. HACCP deals with hazards to the consumer through the food. A HIRA deals with hazards to the people doing the work. The two should talk to each other, but one cannot replace the other.