WRAC Risk Assessment: How It Works and When to Use It

WRAC — Work Risk Assessment and Control — is one of the most widely used risk assessment methods in Australian mining, construction, and heavy industry. It’s a structured, team-based process for identifying hazards in a specific work activity, assessing the risks, and selecting the controls that will manage them before work starts.

Unlike HAZOP, which focuses on process deviations, or FMEA, which works through component failure modes, WRAC is designed for the day-to-day operational context — the tasks your workforce performs regularly, and the hazards those tasks present. It’s the risk assessment method that sits between the detailed analysis methods used by engineers and the quick field-level check done in a pre-start.

This guide explains what WRAC is, when to use it, and how to run one effectively.

What Is a WRAC?

A Work Risk Assessment and Control is a systematic process for:

Identifying the hazards associated with a specific work task or activity
Assessing the likelihood and consequence of harm from each hazard
Selecting controls from the hierarchy of controls to manage the risk to an acceptable level
Documenting the assessment and communicating it to the workers who’ll perform the task

The output is a WRAC document — sometimes called a WRAC form or WRAC worksheet — that records the task, the hazards, the risk ratings, and the controls. This document is the basis for work authorisation and is a key part of the audit trail.

WRAC is a team-based method. The best WRACs involve the people who’ll actually do the work — they know the hazards from experience, and their involvement in selecting controls improves both the quality of the assessment and the likelihood the controls will actually be used.

When to Use a WRAC

WRAC is most appropriate for:

Routine work tasks with known hazard profiles — work that occurs regularly enough to have a defined procedure, but with sufficient hazard exposure that a simple visual check isn’t adequate. Examples: crane lifts, confined space entry, work at height, hot work, isolation and de-energisation.

Work at a new location or with changed conditions — a task you’ve done before, but in a different environment, with different equipment, or by a different crew. Changed conditions can change the hazard profile significantly, and a WRAC captures those differences.

Planned work packages — when a supervisor or work planner is setting up a job in advance, a WRAC provides the documented risk assessment that forms part of the work package.

Non-routine or infrequent tasks — tasks that happen rarely enough that workers may not have recent experience with them, making a structured hazard identification step especially important.

WRAC is generally not the right tool for:

Major hazard facilities and critical risk assessments — these warrant more rigorous methods like HAZOP, HAZID, or FMEA conducted by specialist teams
Simple, low-risk tasks — a task with minimal hazard exposure and well-understood controls may only need a take-five or visual check
Novel processes with unknown hazards — where the hazard profile isn’t well understood, WRAC’s reliance on experienced identification can miss things a structured HAZOP would catch

The WRAC Process Step by Step

Step 1: Define the Task

Start by clearly describing the work activity being assessed. Be specific. “Crane lift” is too vague. “Lifting a 4-tonne pump unit from the laydown area to the second-level platform using the 25T crawler crane” is the right level of detail.

Include:

What is being done
Where it is being done
Who is doing it (roles, number of workers)
When and for how long
What equipment and materials are involved

The task definition sets the scope of the assessment. If the scope is too broad, the assessment becomes unwieldy. If it’s too narrow, you’ll miss hazards.

Step 2: Identify the Hazards

Walk through the task — ideally with the workers who’ll perform it — and identify every hazard associated with each step. A hazard is anything with the potential to cause harm: energy, substance, condition, or situation.

Use structured prompts to avoid missing hazard categories:

Energy types to consider:

Gravitational (working at height, suspended loads)
Kinetic (moving plant, rotating equipment)
Electrical (live conductors, stored charge)
Pressure (hydraulic, pneumatic, steam)
Thermal (hot surfaces, fire, extreme cold)
Chemical (toxic, corrosive, flammable substances)
Radiation (UV, noise, vibration)
Biological (pathogens, venomous animals)

Condition types to consider:

Environmental conditions (heat, poor visibility, wet surfaces)
Equipment condition (age, maintenance status, suitability)
Workplace layout (confined space, unstable ground, access/egress)
Organisational conditions (time pressure, unfamiliar crew, poor communication)

Don’t filter at this stage. The goal is to surface every hazard, including ones that seem obvious or low-risk. You’ll assess the risk in the next step — but if a hazard isn’t identified, it can’t be controlled.

Step 3: Assess the Risk

For each hazard, assess the risk using your organisation’s risk matrix. Most risk matrices rate risk on two dimensions:

Likelihood — how probable is it that the hazard will cause harm, given the current controls in place? Consider frequency of exposure, number of people exposed, and the reliability of existing controls.

Consequence — what is the worst credible outcome if the hazard results in harm? Rate on your standard scale: typically from minor (first aid) to catastrophic (fatality or multiple serious injuries).

The combination of likelihood and consequence gives you a risk rating — typically low, medium, high, or critical.

This inherent risk rating (before additional controls) tells you how much control effort the hazard warrants. A critical or high rating means you need to work down the hierarchy of controls until the residual risk is acceptable. A low rating may only need existing controls confirmed.

Step 4: Select Controls

Work through the hierarchy of controls for each significant hazard:

Elimination — can the hazard be removed entirely? Can the task be redesigned to avoid the exposure?
Substitution — can a less hazardous material, process, or method be used?
Engineering controls — physical barriers, guarding, isolation systems, ventilation, interlocks
Administrative controls — procedures, permits to work, training requirements, supervision arrangements, task sequencing
PPE — personal protective equipment as the last line of defence

The hierarchy matters because controls higher on the list are more reliable. Engineering controls work regardless of human behaviour. PPE depends on correct use every time. Effective WRACs don’t stop at administrative controls and PPE — they push toward engineering solutions where the risk warrants it.

For each hazard, document:

The controls selected
Who is responsible for implementing each control
How compliance will be verified

Step 5: Reassess the Residual Risk

After applying controls, reassess the risk rating. With the controls in place, what is the residual likelihood and consequence?

If the residual risk is acceptable (within your organisation’s risk tolerance), the hazard is adequately controlled. If it remains high or critical, you need additional or stronger controls before work can proceed.

This residual risk assessment is the documented basis for authorising the work. It’s also what the regulator will look at if something goes wrong — not the initial hazard identification, but whether the controls applied were adequate and whether the residual risk was genuinely acceptable.

Step 6: Communicate and Confirm

The best WRAC in the world provides no protection if the workers don’t know about it. Before work starts:

Brief all workers on the hazards and controls identified
Confirm that everyone understands the controls and their role in implementing them
Get sign-off from workers acknowledging they’ve been briefed and understand their responsibilities
Ensure supervisors know the critical controls and how to verify they’re in place

In high-hazard industries, this briefing step is not optional. It’s the point where the paper exercise connects to the actual work.

What a WRAC Template Should Include

A well-designed WRAC template captures:

Field	Purpose
Task description	Defines scope
Location / work area	Provides context
Date and time	Establishes currency
Prepared by (name, role)	Accountability
Workers involved	Sign-off record
Hazard (for each row)	What could cause harm
Risk rating (pre-control)	Inherent risk level
Controls	What manages the risk
Control owner	Who’s responsible
Residual risk rating	Risk after controls
Accepted by	Authorisation record
Worker sign-off	Confirms briefing

The template should be practical to complete in the field — not so complex that workers fill it in back at the office after the job. If your WRAC template takes 45 minutes to complete for a routine two-hour task, it will be back-signed. Design for the real work environment.

WRAC vs SWMS vs JSA

In Australian workplaces, WRACs are often used alongside — and sometimes confused with — Safe Work Method Statements (SWMS) and Job Safety Analyses (JSA).

SWMS (Safe Work Method Statements) are required by law in some jurisdictions for high-risk construction work. They’re more prescriptive documents that describe the work, the hazards, and the controls in sequence. A SWMS is often a more formal document than a WRAC, with specific legislative requirements for content and sign-off.

JSA (Job Safety Analysis, also called Job Hazard Analysis or JHA) is functionally similar to WRAC — a task-level hazard identification and control process. The terminology varies by industry and organisation. In mining, WRAC is common. In construction, JSA or SWMS may be preferred. The process is essentially the same.

The key distinction in all cases is the purpose: a task-level assessment for a specific activity, conducted before the activity begins, by the people who’ll perform it.

Where WRAC Assessments Break Down

Completing the WRAC after the job starts. This defeats the purpose. A WRAC is a planning tool, not a documentation exercise. If it’s completed after work is underway, it can’t prevent the hazards it identifies.

Copying the previous WRAC. Cut-and-paste WRACs are common and dangerous. A WRAC for the same task in a different location, with different equipment, or in different weather conditions should reflect those differences. Generic WRACs produce generic controls.

Stopping at administrative controls. Listing “follow the procedure” or “wear PPE” as the primary controls for a high-risk hazard is inadequate. Push further up the hierarchy.

Not involving the workers. A WRAC completed by the supervisor and handed to workers to sign is less effective than one developed with their input. Workers see hazards supervisors miss. Their involvement also builds ownership of the controls.

Not reviewing when conditions change. A WRAC done at 6am may not be valid at 2pm if conditions have changed — weather, equipment, personnel, access. Build in a trigger to review when significant changes occur during the job.

Managing WRACs in a Risk Management System

Individual WRACs are useful. WRACs connected to your broader risk management system are more powerful.

When a WRAC is linked to your risk register, you can see patterns: which hazards appear most frequently, which controls are most often selected, and where the gap between planned and implemented controls tends to appear. When incidents connect back to the WRAC for the relevant task, you can see whether the assessment identified the hazard that caused the incident — and if not, why not.

RiskSight’s risk management software includes structured templates for WRAC, HAZOP, HAZID, FMEA, SWIFT, and WRAC assessments — connected directly to your risk register and bowtie diagrams. Start your 30-day free trial with demo data included.