The Energy Wheel and the Hierarchy of Controls: the Two Halves of a Risk Assessment

Ask a crew what the hazards are on a job and you will get a good list. Ask them again after they have walked through ten categories of energy and you will get a longer one, and the additions will be the ones that could kill somebody.

That is not a criticism of the crew. It is a finding. In observational research led by Dr Matt Hallowell and the Construction Safety Research Alliance at the University of Colorado Boulder, workers readily identified only around 45% of the hazards present. More than half went unrecognised, and the ones people miss are disproportionately the ones with the energy to cause a fatality rather than a first aid case.

The tool that came out of that research is the energy wheel, and field studies put the improvement in hazard recognition at roughly 30%. It is a wheel with ten segments printed on a card. That is the whole technology.

Why hazard identification is the weak link

Most organisations put their effort into the middle of the process. The risk matrix gets debated. Likelihood and consequence get argued over. The residual risk score gets a column of its own.

Almost nobody audits step one.

A control for a hazard you never identified is not a control. It is an absence. Every hour spent refining a matrix is spent on hazards that already made it onto the page, and none of it helps with the ones that did not. If your identification step is “what can the crew think of on the day”, your risk assessment is capped by memory and attention on a cold morning, in the rain, at the end of a long week.

The energy wheel changes the question being asked. Instead of what looks dangerous here, it asks what energy is present here, and what happens if it gets out.

The reframe: it is not the object, it is the energy

This is the part that lands with crews, because it is obviously true once said out loud.

A steel beam sitting on the ground is not a hazard. The hazard is gravity, and it arrives the moment the beam is above someone.

An excavator parked with the key out is not a hazard. It becomes one the moment it can move.

A hydraulic line at rest is not a hazard. The pressure inside it is, and only when it is released in a way nobody planned.

The object is the thing you can see. The energy is the thing that hurts you. Traditional hazard identification looks at objects, which is why it produces lists like “working at heights” and “operating plant” rather than the specific way energy gets from where it is to where a person is.

One hazard, several risks

Before going further, a distinction worth being pedantic about, because getting it wrong is the reason a lot of risk assessments read as a jumble.

The hazard is the thing with the energy. The risks are the several different ways that energy reaches a person.

Take working outdoors. The hazard is the sun. Singular. What the sun produces is a spread of risks that look nothing like each other: sunburn today, heat exhaustion by lunchtime, dehydration across the shift, and skin cancer in twenty years. Four risks, four different mechanisms, four different timeframes. One hazard.

That matters because you control the hazard, and you assess the risks. An assessment that lists “sunburn” as a hazard has skipped a step, and it will produce controls aimed at one outcome while the others go unmanaged. It is also why the long-latency risk is the one that falls off the page: it does not feel like today’s problem, so it never gets written down as one.

On the wheel, the sun sits in two categories at once, radiation and temperature, which is a useful thing to notice early. Energy sources are not mutually exclusive, and a hazard that appears in two segments usually deserves more attention rather than less.

The ten energy sources

Ten categories. Most crews can hold that in their head after one toolbox talk.

How to use it: the second pass

The method is deliberately unglamorous, and the value is in where it sits in the sequence.

Do not replace your hazard identification with the wheel. Add a second pass after it.

1. Build the SWMS or risk assessment exactly as you do now. Break the work into steps, identify hazards, assess, control.
2. Then go back to the top and walk the wheel. Category by category, ask one question: what could arise here from gravity? From motion? From pressure? Ten questions, once, for the whole document.
3. Anything new goes in. Anything already covered gets tagged with its energy category, which takes a moment and proves the thinking happened.
4. Keep the wheel itself on the last page of the document as a reference, so the crew reviewing it on site can run the same pass.

The second pass takes minutes on a document that took hours. In our experience it is the single highest-yield ten minutes in the whole process, because it is the only step that systematically looks for what is missing rather than refining what is already there.

It also survives an audit better than the alternative. “We identified the hazards” is a claim. “We identified the hazards, then tested that list against ten energy categories, and here is the record” is a method.

The back end: the hierarchy of controls

The wheel improves what goes into the assessment. It does nothing about what comes out of it. That is the other half.

We use the sequence set out in ISO 45001 clause 8.1.2, because it is the agreed international expression of the hierarchy, it is what a certification auditor is reading, and it travels across the jurisdictions our clients work in. The standard requires a process for the elimination of hazards and the reduction of OH&S risks, using the following hierarchy.

It is worth setting out in full, because the version printed on most site posters has six rungs, and that is not what the standard says.

The five items, in order:

1. Eliminate the hazard. Remove it entirely. Do not do the task, or design it out before it reaches site.
2. Substitute with less hazardous processes, operations, materials or equipment. Same job, less energy available to do harm.
3. Use engineering controls and reorganisation of work. Physical change to the plant or the process, and change to how and when the work is arranged: guarding, interlocks, ventilation, extraction, suppression, barriers, exclusion zones, separation of people from plant, sequencing and rostering.
4. Use administrative controls, including training. Procedures, permits, instruction, supervision, signage.
5. Use adequate personal protective equipment. The last line, and the only one that fails quietly.

Items 1 to 3 control the hazard. Items 4 and 5 control the person, and depend on human behaviour holding up on the worst day rather than the best one. That is why it is a sequence rather than a menu.

Notice where reorganisation of work sits. It is at item 3, with engineering controls, not down at item 4 with administrative controls. That is a meaningful difference and it is easy to miss. Changing when or how work is done ranks above writing a procedure about it. Moving a task into the cool part of the day, or rostering people out of an exposure, is a higher-order control than a policy telling them to be careful in the heat.

If you are quoting Australian regulation, the carve-up is slightly different. Model WHS Regulation 36 requires elimination so far as is reasonably practicable, then minimisation by substitution, isolation or engineering controls, used singly or in combination and not ranked against each other, then administrative controls, then PPE. Isolation is named there and is not named in the standard, where it sits inside engineering controls and reorganisation of work. Same intent, different grouping.

Use the standard’s five in your documents if you are certified, and keep the regulation in mind as the duty a court applies. The failure mode is citing one while your auditor reads the other, so know which you are quoting.

A control at item 4 or 5 is not wrong in itself. It becomes wrong when the record does not show that the items above it were considered and ruled out. That distinction is most of what an auditor is looking for.

Run the sun back through the five and the sequence stops being abstract.

• 1. Eliminate. Do the job indoors, in the shed, or off site. If the task does not have to happen under the sun, the hazard is gone and so are all four risks at once. This is the item everybody skips, because it usually means talking to somebody about scheduling or design rather than buying something.
• 2. Substitute. Little to offer here, since the sun has no lower-energy alternative. Saying so in the document is better than leaving a blank, because it shows the item was considered.
• 3. Engineering controls and reorganisation of work. This is where most of the real gain sits. Engineering: a shade structure, a canopy, an enclosed and cooled cab, a temporary roof over the work face. Reorganisation: move the task to early morning or late afternoon, rotate people out of the exposure, sequence the outdoor work around the peak UV window.
• 4. Administrative controls, including training. A heat policy with a trigger temperature, scheduled breaks in shade, a water station, and training so people recognise heat illness in themselves and each other.
• 5. PPE. Long sleeves, a broad-brim hat, sunglasses, sunscreen.

Most outdoor jobs land on items 4 and 5. Hat, sunscreen, “have a drink”. That is not necessarily the wrong answer, but if the record does not show that shade and rescheduling were considered first, the document cannot demonstrate the sequence was followed, and the sequence is the obligation rather than the outcome.

Notice too that the controls do not line up neatly against individual risks. Shade addresses sunburn, heat exhaustion and skin cancer. The water station addresses dehydration and almost nothing else. Working the hazard rather than the risk list is what stops you chasing four separate control sets for one problem.

The detail most SWMS miss: one hazard, several items

The sun example is clean because it is familiar. Here is the same structure in a document you would recognise, and here is where it goes wrong.

A single hazard almost always has controls sitting at several items of the hierarchy at once. Take respirable crystalline silica during cutting or drilling. The controls typically in place are:

• Water suppression or on-tool extraction: item 3, engineering
• Exclusion of anyone not doing the task, and sequencing the cut away from other trades: item 3, reorganisation of work
• Fit testing, health monitoring and the training that make a respirator meaningful: item 4, administrative
• Respiratory protection itself: item 5, PPE

Four controls across three of the five items, listed in most SWMS as an undifferentiated block of text. Which means nobody reading the document can tell whether elimination was considered and rejected, or never considered.

Tag every control with its item number. It costs a word per line. What it buys is the ability to look down a column and see, immediately, whether a hazard is being managed by engineering or being managed by hope. A hazard whose only controls are administrative and PPE is not necessarily wrong, but it should be a deliberate decision with a reason recorded, not an accident of drafting.

What a control changes: likelihood, consequence, or both

Here is the part that decides whether your residual risk score means anything.

Controls do not reduce “risk” as a single undifferentiated quantity. They act on likelihood, on consequence, or on both, and a good assessment says which.

Take skydiving. Jump with no parachute and the consequence is fatal and the likelihood is close to certain. Now add the controls: a parachute, a licensed operator, a tandem instructor strapped to you, documented packing procedures, an altitude check, a reserve canopy.

Look at what those controls did. Almost every one of them attacks likelihood. The consequence of the whole system failing at three thousand metres is exactly what it was before. That is precisely why a reserve canopy exists: it is a second likelihood control, because the consequence cannot be engineered down.

Mapped onto the five items, the pattern holds across most work:

• Item 1, elimination, removes both, which is why it sits at the top.
• Item 2, substitution, genuinely reduces consequence. A lower working height, a lighter load, a lower operating pressure: there is simply less energy available to do harm.
• Item 3, engineering and reorganisation of work, mostly reduces likelihood of contact, though guarding and separation can do both.
• Item 4, administrative controls, almost always reduces likelihood only. A procedure does not change what happens when it is not followed.
• Item 5, PPE, is the interesting one. A hard hat, a harness or a respirator usually reduces consequence at the point of contact while doing nothing at all to likelihood.

Which is why a residual score should rarely show both columns falling equally. If likelihood drops several bands and consequence holds steady, that is usually an honest assessment of a well-controlled hazard. If both drop several bands and the only controls added were a procedure and a toolbox talk, somebody has reverse-engineered a green cell.

Reduced to what, though?

Skydiving is a useful example for a second reason. Run all those controls and the residual risk is genuinely low, and plenty of people look at that number and jump out of the aeroplane on a Saturday for fun.

I would not. My risk appetite is lower than that, and I am not embarrassed about it.

That is the point. Once you have done the arithmetic honestly, “acceptable” is a judgement rather than a calculation, and reasonable people land in different places. The organisational version of that judgement is risk appetite: the level at which your business has decided, in advance and in writing, that a residual risk can be accepted, and by whom. We have covered that separately in risk appetite and consequence criteria. Without it, every residual score in your system is being judged against a threshold nobody has written down.

The question an auditor will ask

If we were assessing your risk assessments tomorrow, three things would decide how the conversation went.

Can you show hazard identification was systematic? Not thorough, systematic. A long list proves effort. A method proves repeatability, and repeatability is what a management system is for.

Where a hazard is controlled by PPE, can you show why the items above it were not reasonably practicable? Clause 8.1.2 is a sequence, and so is regulation 36. If the record does not show the sequence being worked through, the assumption available to an auditor or a regulator is that it was not.

Can you show how the residual risk score was calculated? This is the most common finding we raise on otherwise good documents. A pre-control score, a post-control score, and no visible logic connecting them to the matrix in the management system. Per the section above, the useful evidence is not a better matrix but a record of which column each control moved. Often the SWMS uses one matrix and the integrated management system uses a different one, and nobody has noticed. If two documents in the same business score the same risk differently, at least one of them is wrong, and an auditor only has to open both.

Where ISO 45001 puts this

None of the above needs a certified system to be worth doing. If you run one, it maps cleanly.

• Clause 6.1.2.1, hazard identification. The standard requires a process that is ongoing and proactive. The energy wheel is a defensible answer to “how do you know your process finds hazards rather than confirming the ones you expected”. Clause 6.1.2.2 then covers assessment of the OH&S risks arising from them, which is the hazard-versus-risk distinction made earlier in this article, expressed as two separate sub-clauses.
• Clause 8.1.2, eliminating hazards and reducing OH&S risks. The five-item hierarchy used throughout this article is the standard’s own text, so tagging each control with its item number is not an embellishment. It is evidence against a requirement you already carry.
• Clause 9.2, internal audit. Sampling a handful of live SWMS against the wheel and the hierarchy is a short, cheap audit that produces genuinely useful findings, which is more than can be said for a lot of internal audit programmes.

The pattern we see most often is an organisation that simplified its risk assessments because the previous version was unusable, and simplified past the point of usefulness. There is a version that is both short and rigorous. It is short because the method is structured, not because the content was cut. The same question applied to machinery is covered in your plant risk assessment is a document, is it a control.

Frequently asked questions

What is the difference between a hazard and a risk?

The hazard is the source of harm. The risk is the chance of harm occurring, and its consequence. One hazard usually carries several risks: the sun is a single hazard, and sunburn, heat exhaustion, dehydration and skin cancer are four separate risks arising from it. You control the hazard and you assess the risks. Listing a risk in the hazard column is the most common structural error we see in a SWMS, and it leads to controls aimed at one outcome while the others go unmanaged.

Is the energy wheel a legal requirement in Australia?

No. It is a hazard identification technique, not a regulatory obligation. What is required is that you identify hazards and manage risks so far as is reasonably practicable, and apply the hierarchy of control measures under WHS Regulation 36. The wheel is one credible way of demonstrating the first part.

Does it replace our current SWMS process?

No, and it works better if it does not. It is a second pass over an assessment you have already built. Replacing your process would mean retraining everyone and losing the site knowledge already embedded in your documents.

What is the difference between the energy wheel and HIRAC?

HIRAC describes the sequence: hazard identification, risk assessment, control. The energy wheel is a tool for the first step and the hierarchy of controls is a tool for the third. HIRAC tells you the order. These two tell you how to do two of the three parts well.

Five levels or six? Which hierarchy should we use?

Use the five in ISO 45001 clause 8.1.2: eliminate; substitute; engineering controls and reorganisation of work; administrative controls including training; adequate PPE. It is the agreed international expression and it is what a certification auditor reads. Australian model WHS Regulation 36 covers the same ground with a different carve-up, naming isolation separately and treating substitution, isolation and engineering controls as one minimisation tier rather than ranking them. The six-rung ladder on most site posters is a simplification of the regulation and matches neither exactly. Pick one, state which in your documents, and apply it consistently.

How long does this take to introduce?

A toolbox talk to explain the ten categories, a line added to your SWMS template, and a column added for the control item number. The work is not in the rollout. It is in reviewing the SWMS you already have, which is the part worth doing properly and the part most organisations skip.

Where Streamline fits

Most of the risk assessment work we are asked to look at is not bad. It is unexamined. The document was written once, it has been reissued since, and nobody has tested whether it finds the hazards that matter or shows the reasoning behind the controls.

Streamline reviews SWMS, plant risk assessments and the risk framework behind them, and builds and maintains ISO 45001 safety management systems for Australian organisations. You deal directly with a practising ISO Lead Auditor, which means the review is the one an auditor would run rather than a rewrite in different words. Where you would rather your own people held the knowledge, ISO mentoring does the same work with your team doing the building, and a gap analysis is the usual place to start.

A short test you can run this week without us: take your most-used SWMS, walk the ten energy categories against it, and count what you add.

Get in touch if the count surprises you.