Occupational Risk Assessment: How to Conduct It, Review It, and Ensure It Withstands an Inspection

Occupational risk assessment is mandatory for any Spanish company that employs workers, regardless of its size or line of business. It is required by Article 16 of Law 31/1995, and it is not merely a document to be filed away: it is the foundation of all preventive planning, and the Labor Inspectorate places particular emphasis on ensuring that it is up to date and accurately reflects the actual conditions at each workstation.

This guide is intended for those who conduct or maintain actual assessments in the manufacturing, energy, or logistics industries. We review the requirements of the standard, the step-by-step process, which method to use, when to review the assessment, and what errors would invalidate it during an inspection.

What the Law Requires Regarding Occupational Risk Assessment

The legal framework is based on two documents that should be read together.

Law 31/1995 on Occupational Risk Prevention (Art. 16). Assessment is, along with the prevention plan and the planning of preventive measures, one of the essential tools for managing prevention. An initial assessment must be conducted, taking into account the nature of the activity, the characteristics of the positions, and the workers who hold them. An assessment must also be conducted when selecting work teams, chemical substances or preparations, or when adapting workplaces. The law also requires that the assessment be updated when working conditions change and reviewed when health hazards arise.

RD 39/1997, Regulation on Prevention Services (Articles 3 through 7). Here, the regulation goes into operational detail:

• Art. 3. Defines risk assessment as the process of estimating the magnitude of risks that could not be avoided, in order to decide which preventive measures to adopt.
• Art. 4. Requires that an initial risk assessment be conducted for each workstation. It also specifies when a reassessment is required: new equipment, substances, or technologies; changes to the layout of the worksite; or the hiring of a particularly sensitive worker.
• Art. 5. This article governs the procedure. It must ensure confidence in the outcome, be based on accurate information about the organization and job positions, and involve consultation with employee representatives. If specific regulations exist (regarding noise, chemical agents, vibrations, etc.), their methods must be applied.
• Art. 6. Establishes the circumstances under which a review is required, as outlined below.
• Art. 7. Specifies the minimum content of the documentation: job description, risks and affected workers, assessment results, resulting measures, and the criteria and methods used.

This documentation must be made available to the labor authority (Art. 23 of the LPRL). Failure to conduct the assessment, or to update and review it, constitutes a serious violation under Article 12.1.b of the LISOS.

Reform currently under consideration. In April 2026, the government approved a preliminary draft of the reform to the LPRL. It provides that the assessment must explicitly include psychosocial and climate-related risks and be conducted through on-site visits to workplaces. As of the date of publication, it remains under review and is not yet in effect, but it clearly indicates the direction in which the requirements are heading.

How to Conduct a Risk Assessment Step by Step

Every occupational safety and health service has its own procedure, but an occupational risk assessment that can withstand an inspection by the ITSS always follows the same four-phase process.

1. Identify Hazards by Workstation

The starting point is an accurate inventory of workstations and tasks. It should include who occupies each workstation, what equipment and substances they use, what shifts they work, and what non-routine tasks they perform (maintenance, cleaning, format changes). Much of the quality of the final result depends on this step. A job-specific risk assessment cannot be based on a generic list of hazards “from headquarters.”

To ensure nothing is overlooked, it is advisable to systematically review occupational risk factors: physical conditions (machinery, facilities, physical and chemical agents), human factors, and organizational factors. Direct observation of the workstation and conversation with the person who occupies it remain irreplaceable. Accident and incident records, along with health surveillance data, indicate where to look first.

2. Assessing Risk: Probability × Consequences

For each identified hazard, the magnitude of the risk is estimated by combining two variables:

• Probability that the harm will occur (low, medium, or high), taking into account existing control measures and whether they are effective.
• Consequences or severity of the harm (slightly harmful, harmful, or extremely harmful).

A common mistake is to estimate the probability as if the existing safeguards were perfect. If a machine’s guard is routinely removed to clear a jam, the probability is not low even though the guard is present.

3. Assessing Risk: From Trivial to Intolerable

The intersection of probability and consequences determines the level of risk and, with it, the priority and urgency of taking action:

Risk Level	What It Means
Minor	No specific action required.
Tolerable	No new measures are needed, but periodic checks are required to ensure that the control remains in place.
Moderate	It must be reduced, with measures implemented within a specified timeframe.
Significant	Work must not begin until the risk is reduced. If work is already underway, urgent action is required.
Unacceptable	Work must not begin or continue until the risk is reduced.

4. Move on to planning preventive measures

Every risk that is not trivial or tolerable must be addressed with specific measures. Each measure requires a person in charge, a deadline, allocated resources, and a way to verify its effectiveness. This is what preventive action planning entails, and the standard treats it as the mandatory follow-up to the assessment, not as a separate document. If the assessment and planning are not linked, any inspector will spot it within minutes.

Risk assessment methods: which one to use in each case

The standard does not prescribe a single method for risk assessment. What it requires is that the procedure ensure confidence in the result and that, when specific regulations exist, their criteria be applied. In practice, two levels are combined.

The INSST’s General Method

This is the standard method in Spain for the general assessment of occupational risks: the combination of probability and consequences that we have described, with five risk levels. It is simple and comparable, but it depends heavily on the assessor’s judgment, so it is advisable to document what is considered “high probability” or “extremely harmful” in your organization.

Specific Assessments: When They Are Necessary

When a general assessment identifies a risk that cannot be evaluated through simple observation, or when a specific regulation requires it, a specialized assessment must be conducted:

• Health and safety. Exposure to chemical agents (RD 374/2001), noise (RD 286/2006), vibrations (RD 1311/2005), or biological agents (RD 664/1997). They require sampling strategies and measurements. They are common in the chemical, metallurgical, and energy industries.
• Ergonomics. Manual handling of loads (RD 487/1997), repetitive movements, and awkward postures, using methods such as NIOSH, OCRA, REBA, or OWAS. These factors are critical in logistics, warehouses, and assembly lines.
• Psychosocial factors. Work organization, mental workload, shift work, or working alone, using validated methods such as the INSST’s FPSICO or CoPsoQ-istas21. Each has its own approach and involves worker participation in its own way; we discuss this in detail in the article on a healthy psychosocial work environment.

In complex facilities—such as process plants, substations, explosive atmospheres, or large automated logistics centers—the general method sometimes falls short. In such cases, techniques such as HAZOP, FMEA, bow-tie analysis, or fault trees are used. If you need to learn more about them, here is a guide to the risk assessment tools in ISO 31010.

Who Can Conduct the Assessment

It depends on the company’s preventive approach and the level of training of the person conducting the assessment. Basic assessments can be performed by individuals with a basic level of training. General assessments require an intermediate level of expertise. Those that require a measurement strategy or a non-mechanical interpretation of the results—such as nearly all health, ergonomic, and psychosocial assessments—are reserved for senior technicians in the relevant specialty. If your company has or is considering setting up its own in-house prevention service, our guide to in-house prevention services explains when it is mandatory and how to organize it.

When to Review the Risk Assessment

This is the part that is most often neglected and the one that receives the most attention during an inspection. The review of the risk assessment does not depend on the schedule, but rather on what is happening within the company.

Provisions of Article 6 of the RSP

The risk assessment for the affected positions must be reviewed when:

• Working conditions change. For example, a new machine, a layout change, a different substance, new technology, a shift change, or a new task. In manufacturing and energy, this includes plant shutdowns and facility modifications. In logistics, it includes warehouse automation or the arrival of new customers with different types of cargo.
• Health issues are detected. An accident resulting in sick leave, an occupational illness, or a pattern of repeated incidents necessitates verifying whether the risk assessment anticipated that risk and whether it was properly evaluated.
• The checks show that the measures are insufficient. This includes the results of health monitoring, periodic measurements, safety inspections, and audits.

Periodic Review

In addition, the assessment must be reviewed at intervals agreed upon by the company and the workers’ representatives, taking into account the deterioration of facilities and equipment. There is no single legal deadline: what matters is that an agreement exists, is documented, and is followed.

Errors That Invalidate a Risk Assessment Before the Labor Inspectorate

These are the errors that appear time and again in notices and reports from the ITSS:

1. A generic assessment that doesn’t address the specific position. If the document applies equally to any company in the industry, it doesn’t assess yours. The RSP requires that each position be assessed, along with its tasks and employees.
2. Failure to update the assessment after changes or accidents. This is the most common mistake and the easiest to prove. If the date of the assessment does not match the date of the accident or the installation of new equipment, the discrepancy becomes obvious.
3. Measures without a designated person in charge or a deadline. Phrases such as “it is recommended to improve organization and cleanliness” do not constitute a preventive measure. Without a designated person in charge, a date, and follow-up, there is no planning.
4. Failure to integrate it into planning. Assessment and planning are kept in separate files, with different codes, and no one is able to track a risk through to its corrective action.
5. Lack of consultation with and participation by workers. The procedure must be discussed with employee representatives (Art. 33 of the LPRL and Art. 5 of the RSP), and workers must be aware of the risks associated with their jobs. If there is no documented record of this consultation, the Labor Inspectorate will consider it to have never taken place.

They all have one thing in common: they aren’t technical calculation errors, but rather management errors. That’s why they keep happening when the assessment is stored in a Word or Excel file that someone updates “whenever they can.”

Risk Assessment in Spain vs. the IPER Matrix in Chile

If you work with operations in Chile, you’ll find that the equivalent tool there is the IPER matrix (hazard identification and risk assessment), which is linked to DS 44 and the company’s preventive management system. The logic is the same: identify hazards, estimate and assess risk, and define controls. What changes are the terminology, the assessment criteria, and the documentation requirements. If you manage operations in both countries, we recommend reading our guide to the IPER matrix in Chile to align criteria without mixing regulatory frameworks.

How to Keep Risk Assessments Up-to-Date, Traceable, and Auditable with EHSQ Software

What sets a solid occupational risk assessment apart from one that won’t stand up to an inspection is usually maintenance, not the method itself. In a Word or Excel document, it’s difficult to know which version is current, who changed an assessment and why, or whether the measure agreed upon six months ago was ever implemented.

EHSQ software like Prodity turns the assessment into a continuous process:

• Versions and change history. Each revision is recorded with the date, author, and reason (change in conditions, accident, or result of an inspection). When dealing with the ITSS, you can show not only the current assessment but also how and why it has evolved.
• Direct link to planning and corrective actions. Each assessed risk generates its own set of measures, including the person responsible, the deadline, and the status. If an action is delayed, it’s visible. If an accident affects a workstation, it’s linked to its assessment.
• Review notifications. You can schedule agreed-upon periodic reviews and receive alerts when a change, incident, or inspection result occurs that requires a review.

Prodity does not replace technical judgment or include regulations. Instead, it helps ensure that the safety technician’s work is organized, traceable, and integrated with the rest of the management system. You can see how it works in our occupational risk assessment software.

Move your Excel risk assessment to a self-managing system

If your occupational risk assessment relies on scattered documents, a single person who knows where everything is, and reviews that are always late, it’s worth checking out the alternative. Companies like Naturgy, Repsol, and Grupo Alsea already use Prodity to manage their risk assessments, preventive planning, and corrective actions all within a single system. Request a Prodity demo and we’ll show you, using your own workstations, what your assessment would look like and how traceable it would be in the event of an audit or inspection.

Frequently Asked Questions About Occupational Risk Assessment