ISO 45001 Risk Assessment Checklist for Qatar Workplaces

An ISO 45001 risk assessment checklist is a structured prompt sheet that helps an organisation in Qatar identify workplace hazards, judge the resulting health and safety risks, and record the controls and evidence that a certification audit expects. It supports the requirements in Clause 6.1.2 of ISO 45001:2018, the international standard for occupational health and safety management systems. Used properly, it makes your hazard identification more complete and easier to defend. It does not replace a site-specific assessment carried out by competent people, and it does not replace legal review of your duties under Qatar law.

What an ISO 45001 risk assessment checklist should actually do

A good checklist keeps three connected ideas separate and clear: hazards, risks, and opportunities.

ISO 45001 defines a hazard as a source with the potential to cause injury and ill health. A risk is the combination of how likely that harm is and how serious it could be. An opportunity is a chance to improve health and safety, for example by redesigning a task, introducing safer equipment, or widening worker consultation. Clause 6.1.2 of the standard is built around all three: 6.1.2.1 covers hazard identification, 6.1.2.2 covers assessing occupational health and safety (OH&S) risks, and 6.1.2.3 covers assessing OH&S opportunities.

The checklist's job is to make the hazard identification process ongoing and proactive, not a form filled in once a year. It should push the assessor to look at how work is really done, to talk to the people who do it, and to capture the conditions that only appear during breakdowns, maintenance, or emergencies.

Treat the checklist as a thinking aid. A generic list can remind you what to consider, but the answers must reflect your actual sites, tasks, equipment, and workforce. An auditor can tell within minutes whether a risk assessment describes the real workplace or a template that was copied and left unchanged.

Which activities and workers your assessment must cover

Before you tick a single box, set the boundaries. An assessment with an unclear scope is one of the most common reasons hazard identification is judged incomplete.

Define the activities in scope: every process, task, and location under your control, plus work that affects people even when you do not fully control it, such as shared access roads, neighbouring sites, or client premises. Include work that happens off the main site, such as deliveries, servicing, and remote or mobile work.

Define the people in scope. Your duty of care and your hazard identification reach further than your direct payroll. Cover:

• Direct employees across all shifts, including night and lone workers.
• Contractors, subcontractors, and agency staff.
• Visitors, clients, and delivery drivers on your premises.
• Anyone in the vicinity who could be harmed by your activities.

Also decide how you will handle routine and non-routine work. Routine activities create hazards through normal day-to-day operations. Non-routine activities are occasional or unplanned, such as maintenance, cleaning, plant breakdowns, commissioning, and emergency response. The same machine can present very different risks when it is running normally and when a worker is clearing a jam or servicing it. Both states belong in the assessment.

The ISO 45001 hazard identification checklist

Work through each area below for every activity and location in scope. Record what you find, who is exposed, the existing controls, the remaining risk, and any action needed. The table maps the factors that Clause 6.1.2.1 asks you to consider onto practical Qatar workplace examples.

The most important point that follows from this table is that completeness comes from coverage, not length. A short assessment that genuinely reflects every area above is stronger than a long one that ignores non-routine work, contractors, or human factors.

Assessing risks and choosing controls

Once hazards are identified, ISO 45001 requires you to assess the risks and decide how to control them. The standard does not force one method, so a simple likelihood-and-severity scoring matrix is acceptable, as long as it is applied consistently and matched to the level of risk.

Set your risk acceptance criteria in advance, based on your context, your legal obligations, and the level of risk your organisation is prepared to tolerate. This tells everyone which risks must be reduced and which are tolerable with existing controls.

Then reduce risk using the hierarchy of controls, working from most to least effective:

1. Elimination: Remove the hazard, for example by prefabricating at ground level instead of working at height.
2. Substitution: Replace it with something less dangerous, such as a lower-hazard chemical.
3. Engineering controls: Isolate people from the hazard with guarding, ventilation, or barriers.
4. Administrative controls: Change how people work through procedures, permits, training, and scheduling.
5. Personal protective equipment (PPE): Use PPE as the last layer, not the first answer.

The goal is to reduce risk to a level that is as low as reasonably practicable. For every significant risk, record the owner responsible for the control and a target date. Assigning ownership is what turns a risk register into an active management tool rather than a document.

Local hazards and legal duties to build into a Qatar assessment

ISO 45001 requires you to identify and account for your legal and other requirements (Clause 6.1.3). In Qatar, that starts with Labour Law No. 14 of 2004, which places a clear duty on the employer to protect workers from occupational injury and disease, to provide protective equipment and clothing at no cost to the worker, and to maintain safe, hygienic, and well-ventilated workplaces with suitable lighting and drinking water. Your risk assessment and your controls should show how these duties are met in practice.

One legal control belongs in almost every outdoor Qatar assessment: the summer midday work ban. Reporting on the Gulf rules indicates that Qatar prohibits outdoor work during the hottest part of the day, generally from 1 June to 15 September, with work stopped between 10:00 and 15:30, enforced by Ministry of Labour inspection teams (Morgan Lewis, 2026). Because the exact dates and hours can be confirmed each year, treat them as a control to verify at the start of every summer rather than a fixed rule.

This is where ISO 45001 construction safety in Qatar becomes concrete. Outdoor and site-based work concentrates high-consequence hazards: heat stress, working at height, excavation, lifting operations, mobile plant, and confined spaces. A construction assessment should treat heat as a named hazard with its own controls, including shaded rest areas, water, acclimatisation for new arrivals, and adjusted schedules around the work-ban window.

Climate and heat also feature in the standard itself. A 2024 amendment to ISO 45001 asks organisations to consider whether climate change is a relevant issue for their management system, which for Qatar workplaces reinforces the case for treating extreme heat as a core risk rather than a seasonal inconvenience.

What certification auditors look for as evidence

Passing the certification audit checks for ISO 45001 depends less on owning a checklist and more on being able to show that the process behind it works. When a certification body assesses your OH&S management system, its auditors typically look for:

• A documented, current hazard identification and risk assessment process that covers the areas above.
• Evidence that assessments are reviewed after incidents, changes, and new activities, not only on a fixed date.
• Records of worker consultation and participation in identifying hazards and reviewing controls.
• A legal register aligned with Qatar's requirements, kept up to date.
• A clear line from risks to controls, owners, objectives, and monitoring.

Remember that ISO develops the standard but does not certify organisations. Certification is granted by an independent certification body, which is in turn assessed by an accreditation body that is a member of the International Accreditation Forum. A consultancy can help you prepare the assessment and the evidence, but it cannot issue the certificate.

Where hazard identification usually fails

Most weak assessments fail for the same handful of reasons. Checking your work against them before an audit saves time and reduces non-conformities.

• Using a generic template unchanged. A downloaded checklist that does not name your real tasks, sites, and equipment is easy to spot and does not satisfy the standard.
• Ignoring non-routine work. Maintenance, breakdowns, and emergencies are where serious incidents cluster, yet they are often left out.
• Leaving out contractors. On multi-contractor sites, gaps between parties are a frequent source of harm.
• Weak worker participation. Assessments written only by managers miss the hazards that front-line workers see daily.
• Letting the register go stale. A change of process, supplier, or law without a matching review is a common audit finding.
• Stopping at PPE. Reaching for PPE before considering elimination, substitution, or engineering controls produces weaker, less durable protection.

Turning your checklist into audit-ready evidence

A checklist is a starting point. The value comes from a process that is genuinely site-specific, kept current, and backed by records your workers helped create. Build the boundaries first, work through every hazard area, control risks using the hierarchy of controls with named owners, and align everything with your duties under Qatar law.

If you want a clear view of where your hazard identification and audit evidence stand before a certification body sees them, Qdot International can help. Request an ISO 45001 HIRA and audit-evidence gap review to find the gaps between your current assessments and what the standard and your auditors expect, and see how this connects to broader ISO 45001 certification support in Qatar.