How to Conduct a Construction Site Risk Assessment, Step by Step

A risk assessment is a way of asking “what could go wrong here, how badly, and what are we doing about it” before the work starts, and writing the answers down so they outlast the conversation.

Published: October 16, 2026

A construction site risk assessment identifies the hazards in a job, rates how likely and how severe the harm would be, and sets controls to eliminate the hazard or bring the risk down. The method is the same whether the form is called a risk assessment, a job safety analysis (JSA), a job hazard analysis (JHA) or a field-level hazard assessment (FLHA), and the same whether the regulator is OSHA, a Canadian province or a general contractor’s own site rules.

This guide walks through the process in five steps, with a worked example from a jobsite, and explains what the record needs to contain so it stands up when an inspector, an auditor or a client asks for it. Corfix is a safety management and worker enablement platform for construction contractors across North America, and hazard assessments are a core form on the platform, so this is written from what we see work on real sites and from the primary sources listed at the end.

What is a construction site risk assessment, and how does it differ from a JSA, JHA or FLHA?

A construction site risk assessment is the process of identifying hazards, analyzing the risk each one presents, and deciding how to control it. The Canadian standard CSA Z1002 defines risk assessment as the overall process of hazard identification, risk analysis and risk evaluation, and the Canadian Centre for Occupational Health and Safety (CCOHS) summarizes the working formula as risk equals probability multiplied by severity. OSHA’s Job Hazard Analysis guide (OSHA 3071) describes the same activity from the other direction: a technique that focuses on job tasks as a way to identify hazards before they occur, looking at the relationship between the worker, the task, the tools and the work environment.

The names overlap more than the forms do. A job safety analysis (JSA) and a job hazard analysis (JHA) are the same thing under two names: a task-by-task breakdown of one job, with the hazards and controls listed per step, usually prepared ahead of time and reused each time that job is done. A field-level hazard assessment (FLHA), also called a field-level risk assessment, is completed by the crew at the start of a shift for the specific conditions that day, on top of whatever formal assessment already exists. A site risk assessment is the broader document that covers a work site or a scope of work, which the JSAs and daily FLHAs sit underneath. We’ve written separately about the difference between an FLHA and a JHA; this guide covers the method they share.

When does a construction site need a risk assessment?

Before work begins, and again whenever the work or the site changes. Alberta’s Occupational Health and Safety Code states it plainly in Part 2: an employer must assess a work site and identify existing and potential hazards before work begins at the work site or prior to the construction of a new work site, prepare a written report of the results, and repeat the assessment at reasonably practicable intervals and when a new work process is introduced or the site changes. CCOHS lists the same triggers in general terms: before new processes or activities, before changes to existing ones, when new information about a hazard becomes available, before working in a new environment, and before routine and non-routine tasks.

In the United States, OSHA’s construction standards don’t contain one rule titled “risk assessment,” but the obligation arrives through several doors. The general duty clause requires a workplace free from recognized hazards; 29 CFR 1926.21 requires employers to instruct each employee in the recognition and avoidance of unsafe conditions; and specific standards require a competent person to assess conditions for excavations, scaffolds, fall protection and more. OSHA’s own guidance frames job hazard analysis as the practical way to meet those duties, and in Canada the provincial acts work the same way: Ontario’s Occupational Health and Safety Act requires an employer to take every precaution reasonable in the circumstances for the protection of a worker, and a documented assessment is how an employer shows it knew what the precautions needed to be.

A workable structure has three levels. A site or project assessment at mobilization. A JSA for each high-risk or recurring task. And a daily FLHA at the tailgate, which catches what changed overnight: a delivery blocking the access route, a wind warning, a subcontractor who started excavating next to the crane pad.

Who should conduct it?

A competent person leads it and the workers who do the task take part in it. Both halves matter. OSHA 3071 puts worker involvement first in its list of where to begin, on the grounds that the people doing the job have a unique understanding of it, and Alberta’s Code makes it a requirement: an employer must involve affected workers in the hazard assessment and in the control or elimination of the hazards identified, and must make sure those workers are informed of the hazards and the controls. CCOHS recommends assembling a team that includes supervisors and workers familiar with the process, and consulting the health and safety committee or representative.

“Competent” has a defined meaning on both sides of the border. OSHA’s construction standards (29 CFR 1926.32) define a competent person as one who is capable of identifying existing and predictable hazards in the surroundings or working conditions, and who has authorization to take prompt corrective measures to eliminate them. In Ontario it means a person who is qualified by knowledge, training and experience to organize the work, is familiar with the Act and regulations that apply, and knows the actual or potential dangers in the workplace. On a construction site that means the site supervisor or foreman for the FLHA, the safety manager or a safety coordinator for the site assessment, and whichever of them knows the task best for the JSA. Where a specialist is needed, for a confined space entry plan or a critical lift, the specialist assesses that task and the site supervisor owns the rest.

How do you conduct a construction site risk assessment, step by step?

The five steps below follow the sequence that OSHA 3071 and CCOHS both describe. Each one produces something that goes on the form.

Step 1: Break the job into tasks

List the steps of the job in the order a worker does them. OSHA’s advice is to watch the worker perform the job and record each step as they take it, with enough detail to describe the action without turning the list into a procedure manual. A roofing job might break into: unload materials, set up access, install edge protection, carry materials to the roof, install, clean up and remove access. If you have thirty steps, you’re writing a method statement; if you have three, the hazards are probably hidden inside the steps.

Start with the jobs that matter most. OSHA’s priority list is the jobs with the highest injury rates, the jobs that could cause a severe or disabling injury even with no history of one, the jobs where a single human error leads to serious harm, the jobs that are new or recently changed, and the jobs complex enough to need written instructions. For a site assessment, the equivalent is the list of activities on the schedule, with the high-risk ones (work at height, excavation, lifting operations, energized work, confined space, mobile equipment) assessed first.

Step 2: Identify the hazards in each task

For each step, ask what could go wrong, what the consequence would be, how it could arise, what else contributes and how likely it is. OSHA 3071 suggests describing each hazard as a scenario with an environment, an exposure, a trigger and a consequence, rather than a one-word label. “Fall” tells you nothing; “worker on an unguarded leading edge of the second-floor deck, stepping backward while receiving a sheet of plywood from the hoist, falling three metres to the slab” tells the next person exactly what the control has to stop.

Use more than one source. CCOHS lists inspection results, incident records, near-miss and hazard reports, feedback from the workers doing the task, the manufacturer’s documentation for equipment, the safety data sheet for any product, and the legislated requirements for the task. OSHA’s appendix of common hazard types is a useful prompt list: chemical, electrical, ergonomic, excavation collapse, falls and slips, fire and heat, mechanical and caught-between, noise, struck-by, struck-against, temperature extremes, visibility and weather. Walk the list against each step and the gaps tend to show up.

Include what isn’t routine. CCOHS is specific that the assessment should cover non-standard situations: maintenance, shutdowns, power outages, emergencies and extreme weather. On a construction site that means the task as it will be done at 4:30 on a Friday with the crane booked until 5, not only as it’s written in the procedure.

Step 3: Rate the risk

Rate each hazard on two scales, probability and severity, and combine them. CCOHS’s qualitative example uses three levels of each. High severity is a fatality, permanent disability or major fracture; medium is a sprain, strain, burn or an injury with limited days off; low is first aid only. High probability is harm an individual might experience once a year or more; medium is once in five years; low is once in a working lifetime. Where the two meet on the matrix gives you the rating, and the rating gives you the priority.

Each rating carries an action. CCOHS’s example: immediately dangerous means stop the process and put controls in before it restarts; high means investigate and implement controls immediately; medium means keep going with a control plan developed and implemented as soon as possible; low means keep going and monitor; very low means keep monitoring. Some contractors use a five-by-five numbered version of the same matrix, which scores one to twenty-five and reads the same way. The format matters less than the discipline of rating every hazard rather than only the obvious ones, and of agreeing the scale definitions before the assessment so two foremen don’t rate the same hazard two ways.

Rate the hazard as the task is currently planned, with whatever controls are already in place, and say so on the form. A leading edge with a guardrail already installed is a different rating from the same edge without one, and the record should show which you assessed.

Step 4: Choose controls, starting at the top of the hierarchy

Work down the hierarchy of controls and stop at the first level that brings the risk to an acceptable rating. The order, as CCOHS lists it, is elimination, substitution, engineering controls, administrative controls and personal protective equipment. Alberta’s Code writes the same order into law: eliminate the hazard if reasonably practicable, control it with engineering controls if it can’t be eliminated, then administrative controls, then PPE, and combinations of these where one level isn’t enough.

Elimination means the hazard is gone: prefabricating at ground level so the work at height doesn’t happen. Substitution swaps the hazard for a smaller one: a battery tool for a gas one indoors. Engineering controls keep the hazard away from the worker without relying on the worker: guardrails, trench boxes, exhaust ventilation, machine guards. Administrative controls change how the work is done: permits, exclusion zones, rotation to limit exposure, training, signage. PPE protects the individual and is last for a reason: it fails if it isn’t worn, isn’t fitted or isn’t inspected, and it does nothing to reduce the hazard itself. OSHA 3071 makes the same point in different words: the more reliable the control, or the harder it is to get around, the better.

Write the control next to the hazard it controls, with an owner. “Guardrail installed on north leading edge before decking starts, foreman to confirm” is a control. “Be careful near edges” is a hope.

Step 5: Record it, communicate it and review it

The record is the deliverable. CCOHS says records should show that you conducted a good hazard review, determined the risks, implemented controls suitable to the risk, and reviewed and monitored the hazards. At a minimum the form carries the job and site, the date, who conducted the assessment and who took part, the tasks in order, the hazards per task, the rating per hazard, the controls per hazard with an owner, and the signatures of the workers who were briefed. Alberta requires the written report and the date it was prepared or revised; other jurisdictions require the records be kept for a set period, so check yours.

Communicate it to everyone who does the work, in a language they read. Alberta’s Code requires that workers affected by the hazards be informed of the hazards and the controls; CCOHS puts it as workers must be aware of every hazard associated with their job and the controls in place. The tailgate talk before the task starts is where that happens, and the sign-in sheet or signature capture is how you show it did.

Review it when something changes and on a schedule when nothing does. OSHA 3071 is specific that a JHA should be reviewed after an injury or illness on that job, and after a close call, and that any revision means retraining the workers affected. The daily FLHA is the built-in review for site conditions; the JSA and the site assessment need a review date of their own.

What does a completed risk assessment look like?

Here is one task from a JSA for installing roof trusses on a two-storey wood-frame build, in the format the five steps produce. The ratings use the three-level scale above.

Two things to notice. The rating for step 2 is the rating as the task was first planned, which is why it reads “immediately dangerous”; the controls are what bring it down, and the next assessment of that step, with anchors installed and the lift in use, would rate lower. And each control names the person who confirms it, which is the difference between a form that gets filed and a form that gets used.

What goes wrong in construction risk assessments?

The same patterns come up in assessments that fail an audit or, worse, fail on site.

• Generic forms copied site to site. Alberta’s guidance allows one assessment for multiple sites only where the hazards and the procedures are identical, and requires the employer to confirm that a new site doesn’t differ. An assessment that doesn’t mention the overhead line, the slope or the shared access road wasn’t done for that site.
• Hazards named without a scenario. “Falls” as a hazard, “fall protection” as a control. Neither tells the crew which edge, which anchor or which task. The scenario form in Step 2 fixes this.
• Controls that stop at PPE. A harness listed as the control for a leading edge, where a guardrail was practicable. Regulators and auditors read the hierarchy in order, and so should the form.
• Workers signing a form they didn’t take part in. The signature says they were briefed; it doesn’t say the assessment was right. OSHA and the provincial codes both expect worker input into the assessment itself, and the crew is where the near misses live.
• No review after a change. The JSA was written for the original sequence; the schedule moved the roofing ahead of the mechanical rough-in and nobody re-read it. Any change in sequence, equipment, subcontractor or weather window is a review trigger.
• A record nobody can find. The assessment was done and signed, and it’s in a truck. When the record lives with the project, dated and attributed, the office can see which tasks have a current assessment and which don’t before an inspector asks. Our safety features page covers how hazard assessment forms are stored and flagged in Corfix.

FAQ

What is the difference between a risk assessment and a JSA?

A JSA, or job safety analysis, is a risk assessment of one job, broken into steps with the hazards and controls listed per step; it’s the same document as a JHA. A construction site risk assessment is broader: it covers a site or a scope of work and sets the context the JSAs sit inside. The method is identical for both: identify hazards, rate probability and severity, choose controls in hierarchy order, and record the result.

How often should a construction site risk assessment be done?

Before work starts on a site, before any new task or process begins, and again whenever conditions change: new equipment, a new subcontractor, a change in sequence, new information about a hazard, or an incident or near miss. Alberta’s Code also requires repeating it at reasonably practicable intervals. A field-level hazard assessment at the start of each shift covers the daily changes, with the site assessment and JSAs under scheduled review.

Is a construction site risk assessment required by law?

In Canada, yes in substance: Alberta’s OHS Code requires a written hazard assessment before work begins, and the other provincial acts require employers to identify hazards and take every reasonable precaution, which a documented assessment demonstrates. In the United States, OSHA has no single standard called “risk assessment,” but the general duty clause, the training requirement in 29 CFR 1926.21 and the competent-person requirements across the construction standards amount to the same obligation.

What is a risk matrix and how do you use one?

A risk matrix is a grid with probability on one axis and severity on the other. You rate each hazard on both scales, find where they meet, and read off a risk level: very low, low, medium, high or immediately dangerous in CCOHS’s three-by-three example, or a score from one to twenty-five on a five-by-five version. Each level is tied to an action, from “keep monitoring” to “stop work until controls are in place.” Agree the scale definitions first.

Who is responsible for a risk assessment on a construction site?

The employer is responsible for ensuring it’s done, and a competent person conducts it with the workers who perform the task taking part. In practice the foreman or supervisor leads the daily field-level assessment, the safety manager or coordinator owns the site assessment, and specialists assess specialist tasks such as critical lifts or confined space entries. Alberta’s Code makes worker involvement a requirement; OSHA’s guidance puts it first in its list of where to begin.

Sources

• OSHA, Job Hazard Analysis (OSHA 3071): what a JHA is, which jobs to prioritize, worker involvement, hazard scenarios, the order of hazard controls, and review triggers.
• OSHA, 29 CFR 1926.32, Definitions: the construction-industry definition of competent person at 1926.32(f).
• OSHA, Hazard Identification and Assessment, from the Recommended Practices for Safety and Health Programs.
• CCOHS, Hazard and Risk: Risk Assessment: definitions from CSA Z1002, when to assess, the eight-step method, the qualitative and semi-quantitative risk matrices, field-level risk assessment, and documentation.
• Government of Alberta, Occupational Health and Safety Code, Part 2: Hazard Assessment, Elimination and Control: sections 7 to 9 on assessment before work begins, the written report, worker involvement and the control hierarchy.
• Government of Alberta, Hazard Assessment and Control: a handbook for Alberta employers and workers, including the formal and site-specific templates.
• Government of Ontario, Occupational Health and Safety Act, R.S.O. 1990, c. O.1: the definition of competent person in section 1 and the employer’s duties in section 25, including 25(2)(h).

Where to go from here

A risk assessment that works has four properties. It was done for this site and this task. The hazards are written as scenarios rather than labels. The controls start at the top of the hierarchy and name an owner. And the record is dated, signed by the people who do the work, and findable when someone asks.

Corfix is a safety management and worker enablement platform for construction contractors across North America. Hazard assessments, FLHAs and JSAs are completed on the worker’s phone, work offline, capture photos and signatures, and are stored by project, date and worker, with uncontrolled hazards flagged to the office as the form comes in. Customer Success rebuilds your existing assessment forms during onboarding, which is included. To see your current hazard assessment as a mobile form, request a demo, and for the wider case for moving safety processes off paper, see our guide to pen and paper versus Corfix. Pricing is on the pricing page.