Risk Identification Methods

Why Risk Identification Methods Matter for the CSP Exam

Risk identification is the foundation of the entire risk management process. If a hazard is never identified, it can never be assessed, prioritized, or controlled. The BCSP Certified Safety Professional (CSP) exam blueprint places heavy emphasis on the Risk Management domain, and within it, your ability to recognize, select, and apply the correct risk identification technique for a given situation. You will not simply be asked to define a method; you will be asked to choose the best method for a scenario, to interpret what a method produces, and to understand where identification fits within standards such as ANSI/ASSP Z590.3 (Prevention through Design), ANSI/ASSP Z10, ISO 45001, ISO 31000, and OSHA's Process Safety Management rule (29 CFR 1910.119).

Practically, this topic matters because safety professionals are expected to be proactive. Waiting for injuries to reveal hazards is a lagging approach. The CSP exam rewards candidates who understand the full toolbox of proactive (leading) methods and know how to combine them with reactive data sources to build a complete picture of organizational risk.

What Risk Identification Is

Risk identification is the systematic process of finding, recognizing, and describing hazards, the exposures to those hazards, and the potential consequences. Key definitions you must have locked down:

- Hazard: A source or condition with the potential to cause harm (energy, chemical, biological, ergonomic, psychosocial, etc.).
- Exposure: Contact or proximity of people, property, or the environment to a hazard.
- Risk: A combination of the likelihood (probability) of a hazardous event and the severity of its consequences. Risk exists only when a hazard and an exposure coincide.
- Risk identification vs. risk assessment: Identification answers what could go wrong and how? Assessment answers how likely and how bad? Evaluation answers is the risk acceptable? Treatment answers what controls will we apply? Exam questions frequently test whether you can place an activity in the correct step.

In ISO 31000 terms, risk identification is the first sub-step of risk assessment (identification, analysis, evaluation), which sits inside the larger risk management process (establishing context, assessment, treatment, monitoring and review, communication and consultation, recording and reporting).

How Risk Identification Works: Classifying the Methods

Before memorizing individual techniques, understand the ways they are categorized, because exam distractors are often built around these distinctions.

1. Proactive (leading) vs. Reactive (lagging): Proactive methods find hazards before harm occurs (inspections, JHA, HAZOP, design reviews). Reactive methods learn from events that already happened (incident investigation, OSHA 300 log review, workers' compensation trend analysis). A mature program uses both, but the CSP exam favors proactive methods when asked for the best approach.

2. Inductive vs. Deductive: Inductive (bottom-up, forward-looking) methods start with a component failure or initiating event and reason forward to possible outcomes. Examples: FMEA, Event Tree Analysis, What-If, HAZOP. Deductive (top-down, backward-looking) methods start with an undesired top event and reason backward to find the combinations of causes. The classic example is Fault Tree Analysis.

3. Qualitative vs. Quantitative: Qualitative methods describe risk in words or rank it on ordinal scales (checklists, JHA, basic risk matrices). Quantitative methods assign numerical probabilities and consequences (quantified FTA, LOPA, Quantitative Risk Assessment). Semi-quantitative methods blend the two (FMEA Risk Priority Numbers).

4. Life-cycle phase: Some methods are designed for early concept and design (Preliminary Hazard List, Preliminary Hazard Analysis, Prevention through Design reviews), others for operations (JHA, inspections, HAZOP revalidation), and others for change (Management of Change, Change Analysis) or decommissioning.

The Core Methods You Must Know

1. Workplace Inspections, Walk-Throughs, and Audits
Direct observation of the workplace, equipment, and behaviors. Inspections look at physical conditions; audits evaluate the management system against a standard. Strengths: simple, immediate, engages workers. Weaknesses: finds only what is visible at that moment; misses latent and low-frequency hazards. Exam cue: questions mentioning periodic, routine, or unsafe conditions observed.

2. Checklists
Pre-written lists of hazards, regulatory requirements, or best practices. Strengths: consistent, fast, good for less experienced personnel, ensures known hazards are not overlooked. Weaknesses: limited to what is on the list; can produce a false sense of completeness. Exam cue: known hazards, regulatory compliance, standardized.

3. Job Hazard Analysis / Job Safety Analysis (JHA/JSA)
The job is broken into sequential steps, hazards are identified for each step, and controls are specified for each hazard. Typically performed by a team including the worker performing the task. Best for routine, repetitive, task-level work. Prioritize jobs with high injury rates, high severity potential, new jobs, and jobs with recent changes. Exam cue: steps of a task, worker involvement, task-based.

4. What-If Analysis and Structured What-If Technique (SWIFT)
A brainstorming method in which a team asks What if...? questions about deviations, failures, or human errors. SWIFT adds structure through guide words and checklists. Strengths: flexible, inexpensive, applicable to processes and procedures. Weaknesses: quality depends heavily on team experience; unstructured versions may miss hazards. Often paired with a checklist (What-If/Checklist) under PSM. Exam cue: brainstorming, team asks questions, loosely structured.

5. Hazard and Operability Study (HAZOP)
A highly structured, team-based method that systematically applies guide words (No, More, Less, Reverse, Part Of, As Well As, Other Than, Early, Late, Before, After) to process parameters (flow, pressure, temperature, level, composition) at defined nodes on a P&ID to identify deviations, causes, consequences, and safeguards. Originally developed by ICI for chemical processes. Strengths: thorough, well-suited to continuous processes. Weaknesses: time-consuming, requires complete design documentation and a skilled facilitator. Exam cue: guide words, deviations, nodes, process parameters, chemical process.

6. Failure Modes and Effects Analysis (FMEA) and FMECA
An inductive, component-by-component method. For each component or process step, identify the ways it can fail (failure modes), the effects of each failure, causes, and existing controls. FMECA adds a criticality ranking, often as a Risk Priority Number (RPN) = Severity x Occurrence x Detection. Strengths: excellent for equipment and hardware reliability. Weaknesses: examines single failures and does not handle combinations of failures or human factors well. Exam cue: single component failure, failure mode, RPN, severity, occurrence, detection.

7. Fault Tree Analysis (FTA)
A deductive, top-down graphical method. Start with an undesired top event (for example, worker struck by falling load) and work backward through AND gates and OR gates to the basic events that could cause it. Can be qualitative (identifying minimal cut sets) or quantitative (calculating top-event probability). Strengths: handles combinations of failures and common-cause analysis. Weaknesses: resource-intensive; one tree per top event. Exam cue: top event, deductive, Boolean logic, AND/OR gates, cut sets, backward.

8. Event Tree Analysis (ETA)
An inductive, forward-looking method that begins with an initiating event and branches through the success or failure of each safeguard or barrier to show all possible outcome sequences. Strengths: visualizes how layers of protection influence outcomes; quantifiable. Weaknesses: binary branches can oversimplify. Exam cue: initiating event, sequence of outcomes, success/failure branches, forward.

9. Bow-Tie Analysis
Combines a fault tree (causes on the left) with an event tree (consequences on the right) around a central top event, with preventive barriers on the left and mitigative barriers on the right. Excellent for communicating risk to management and workers. Exam cue: preventive and mitigative barriers, visual communication, threats and consequences around a central event.

10. Preliminary Hazard List (PHL) and Preliminary Hazard Analysis (PHA)
Early life-cycle tools from system safety (MIL-STD-882). The PHL is a simple inventory of potential hazards; the PHA expands each with causes, effects, initial risk ranking, and recommended controls. Performed in the concept or early design phase when changes are cheapest, a core element of Prevention through Design (ANSI/ASSP Z590.3). Note that in OSHA PSM language, PHA means Process Hazard Analysis, which is a different, broader requirement. Exam cue: early design, concept phase, before detailed design, system safety.

11. Change Analysis and Management of Change (MOC)
Compares the current (or proposed) situation to a known baseline to identify hazards introduced by changes in equipment, materials, personnel, procedures, or environment. Many incidents trace to unmanaged change. Exam cue: new equipment, process modification, temporary change, replacement in kind (which is NOT a change under PSM).

12. Energy Trace and Barrier Analysis (ETBA)
Based on the energy-release theory of accidents (Haddon). Identifies each energy source (gravitational, kinetic, electrical, thermal, chemical, pressure, radiation), traces its path to potential targets, and evaluates barriers between them. Exam cue: energy source, barrier, target, unwanted energy transfer.

13. Task Analysis, Human Factors, and Ergonomic Assessment
Methods such as Hierarchical Task Analysis, Human Error Analysis, RULA, REBA, NIOSH Lifting Equation, and Strain Index identify human performance and musculoskeletal risk. Exam cue: human error, repetitive motion, posture, cognitive workload.

14. Industrial Hygiene Surveys and Exposure Assessment
Walk-through surveys, qualitative exposure assessments, similar exposure groups (SEGs), and air, noise, and radiation monitoring identify health hazards that are invisible to ordinary inspection. Exam cue: chemical exposure, noise, health hazard, SDS review.

15. Reactive Data Sources
Incident and near-miss investigations, OSHA 300/300A logs, first-aid logs, workers' compensation loss runs, property damage reports, maintenance records, and industry data (BLS, NIOSH, insurer loss data, Chemical Safety Board reports). These identify hazards that have already produced events and reveal trends. Exam cue: trend analysis, loss history, lagging indicators.

16. Worker Participation Methods
Hazard reporting systems, safety committees, safety perception surveys, interviews, toolbox talks, behavioral observations, and stop-work authority. Both ANSI/ASSP Z10 and ISO 45001 require worker participation in hazard identification. Exam cue: employee involvement, consultation, front-line knowledge.

17. Expert Judgment Methods
Brainstorming, Delphi technique (anonymous iterative expert consensus), and nominal group technique. Useful when data are scarce or the system is novel. Exam cue: no historical data, new technology, expert consensus.

18. Related Analysis Tools Often Grouped with Identification
Layer of Protection Analysis (LOPA) is a semi-quantitative method that evaluates whether independent protection layers reduce risk sufficiently; it follows identification. Cause-and-effect (fishbone/Ishikawa) diagrams and the 5 Whys are root cause tools that also surface hazards. Risk registers document identified risks and track them. Know what each is so you can rule them out when a question is really about identification.

Selecting the Right Method

Exam scenarios test method selection. Consider:
- Complexity of the system: Simple tasks call for JHA or checklists; complex chemical processes call for HAZOP; critical equipment calls for FMEA; catastrophic potential calls for FTA or bow-tie.
- Life-cycle phase: Concept or design equals PHL/PHA and design reviews; operations equals JHA, inspections, audits; modification equals MOC/change analysis.
- Available information: HAZOP needs complete P&IDs; FMEA needs component data; brainstorming or Delphi works when data are lacking.
- Resources and time: Checklists and What-If are quick; HAZOP and FTA are costly.
- Regulatory requirements: OSHA PSM (1910.119(e)) requires a Process Hazard Analysis using What-If, Checklist, What-If/Checklist, HAZOP, FMEA, FTA, or an appropriate equivalent methodology, revalidated at least every five years.
- Nature of the hazard: Health hazards need IH assessment; human-error-driven hazards need task analysis; multi-failure scenarios need FTA.

No single method finds everything. The expected professional answer is usually a combination of complementary methods, documented in a risk register, feeding into risk assessment and the hierarchy of controls (elimination, substitution, engineering controls, warnings, administrative controls, PPE).

How to Answer Exam Questions on Risk Identification Methods

CSP questions in this area generally fall into five patterns:

Pattern 1: Match the description to the method. The stem describes a technique without naming it. Hunt for signature vocabulary. Guide words and deviations point to HAZOP. Top event and AND/OR gates point to FTA. Initiating event and branching outcomes point to ETA. Failure mode and RPN point to FMEA. Task steps point to JHA. Preventive and mitigative barriers around a central event point to bow-tie.

Pattern 2: Choose the best method for a scenario. Read for the system type, life-cycle phase, and goal. A new chemical process design during detailed engineering with complete P&IDs is HAZOP. A concept-stage new facility is PHA. A forklift operator's daily routine is JHA. Determining how multiple independent failures could combine to cause a tank rupture is FTA. Predicting the range of outcomes after a flammable release depending on whether detection and suppression work is ETA.

Pattern 3: Classify the method. Inductive or deductive, qualitative or quantitative, proactive or reactive, top-down or bottom-up. Memorize: FTA is the deductive, top-down exception; most others are inductive.

Pattern 4: Identify the step in the risk management process. Decide whether the activity described is establishing context, identifying, analyzing, evaluating, treating, or monitoring. Ranking likelihood and severity is analysis, not identification. Comparing against acceptance criteria is evaluation.

Pattern 5: Strengths, limitations, and prerequisites. Know that checklists miss novel hazards, FMEA misses combinations of failures, HAZOP is resource-intensive and needs design documentation, FTA produces one tree per top event, and inspections miss latent conditions.

Exam Tips: Answering Questions on Risk Identification Methods

1. Build a keyword map. Before exam day, write each method beside its two or three unmistakable trigger words. During the exam, underline those words mentally in the stem and match.

2. Prefer proactive over reactive. When asked for the best or most effective approach to identify hazards before harm occurs, eliminate options that rely solely on injury data or incident reports.

3. Prefer worker participation and team-based approaches. BCSP exam philosophy aligns with ANSI/ASSP Z10 and ISO 45001. An answer that includes consulting the affected workers or using a multidisciplinary team usually beats one performed by the safety professional alone.

4. Match method complexity to hazard complexity. Do not pick HAZOP for a simple manual task or a checklist for a complex reactive chemistry process. The exam penalizes both overkill and underkill.

5. Watch the life-cycle clue. Words like conceptual, design phase, or before construction point to PHL/PHA and Prevention through Design. Words like modification, upgrade, or temporary bypass point to MOC/change analysis.

6. Know the direction of logic. If the stem says the analysis starts with an undesired outcome and works backward, it is deductive (FTA). If it starts with a failure or initiating event and works forward, it is inductive (FMEA, ETA, What-If, HAZOP).

7. Do not confuse the two meanings of PHA. In system safety (MIL-STD-882), PHA is Preliminary Hazard Analysis. In OSHA PSM, PHA is Process Hazard Analysis. Read the context.

8. Remember the PSM-approved methods. What-If, Checklist, What-If/Checklist, HAZOP, FMEA, FTA, or an equivalent. If a question asks which is NOT an accepted PSM methodology, look for an option like JHA or bow-tie.

9. Separate identification from analysis. If an option involves assigning probabilities, calculating RPNs, or plotting on a risk matrix, it belongs to analysis, not identification. This distinction is a favorite distractor.

10. Recognize that combinations are often correct. If one answer choice proposes using multiple complementary methods and documenting them in a risk register, it is frequently the best professional answer.

11. Eliminate absolute language. Options stating that a single method identifies all hazards or eliminates the need for other methods are almost always wrong.

12. Apply the hierarchy of controls last, not first. Questions may tempt you to jump to PPE or training. Identification must come before control selection; make sure the stem is really asking about identification.

13. Use process of elimination with classification. If you cannot recall a method precisely, eliminate options by category. A question asking for a quantitative, deductive tool leaves only FTA among common choices.

14. Practice with scenario stems. Write your own short scenarios (a welder in a confined space, a new ammonia refrigeration system, a redesigned packaging line) and decide which methods you would use and why. This mirrors how the exam frames questions.

Quick Self-Check Examples

Example 1: A team systematically applies the words No, More, Less, and Reverse to flow and pressure at each node of a piping diagram. Which method? Answer: HAZOP.

Example 2: An analyst wants to determine all combinations of equipment failures and human errors that could lead to an uncontrolled crane load drop. Which method? Answer: Fault Tree Analysis (deductive, top-down).

Example 3: A safety professional is asked to identify hazards associated with a new product line while it is still in the conceptual design stage. Which method? Answer: Preliminary Hazard Analysis as part of Prevention through Design.

Example 4: Which method is most appropriate for identifying hazards in a routine, repetitive manual task performed by warehouse workers? Answer: Job Hazard Analysis with worker participation.

Example 5: A reliability engineer examines each pump component, lists how it could fail, the effect of that failure, and scores severity, occurrence, and detection. Which method? Answer: FMEA (FMECA when criticality ranking is included).

Example 6: Which of the following is a lagging approach to hazard identification? Reviewing OSHA 300 logs, conducting a HAZOP, performing a JHA, or completing a design review. Answer: Reviewing OSHA 300 logs.

Summary

Risk identification is where safety management begins. For the CSP exam, master the vocabulary of each method, know how methods are classified (proactive/reactive, inductive/deductive, qualitative/quantitative), understand which life-cycle phase and system type each suits, and keep identification distinct from analysis, evaluation, and treatment. Read every stem for signature keywords, favor proactive and participative approaches, and remember that the strongest real-world and exam answer typically combines complementary methods and documents results for use throughout the risk management process.