Stop Colouring, Start Controlling: Making Risk Assessments Actually Reduce Risk

You know the drill. Someone plugs a laptop into the projector, opens the template, and starts copying controls from the last job. ‘Just copy the controls from that one.’ The box goes green, the form gets filed, and the work is no safer than it was that morning.

In a recent myosh Academy webinar, Mark Alston of Investigations Differently made the case for risk assessments that control, not colour. He shared five practical shifts you can make straight away, and the first is deceptively simple: actually, know what risk is.

Risk is what you don't know

Ask a room of safety professionals to define risk and you'll hear ‘hazard’, ‘likelihood’, ‘consequence’. None of those is the definition. ISO 31000 defines risk as the effect of uncertainty on objectives, and uncertainty is the stuff you don't know or don't understand. You can't manage what you don't know, which means a good risk assessment isn't meant to restate what you already know; it's meant to discover what you don't.

“When's the last time something genuinely new came out of a risk assessment? Or are we just recording the things we already know?”

Context only comes from the people who do the work

Risk lives in the gap between the procedure (always a happy ending) and how the work is actually done, the production pressure, goal conflicts, trade-offs and workarounds. You can't find that from your desk. Mark's warning was blunt: facilitating a risk assessment without the people who do the work isn't just poor practice, it's now legally risky — he pointed to a Bundaberg case where a safety advisor was held to account for one. The fix is to get the right people in the room and brainstorm the real work, not fill in a form.

“Real context only comes from those who do the work. Be curious, not judgmental.”

What this means in practice

Three more shifts round out the five. Assess credible worst-case scenarios, plausible and reasonable, not every far-fetched what-if. Be honest about control effectiveness, which is where most of our real uncertainty now sits (Mark pointed to the ICMM's 2026 Critical Control Management guide for a strong definition of controls). And ditch the tool-worship: whether it's a T5, a JSA, a bowtie or a spreadsheet, the tool isn't the point, the conversation and the decision are. Better still, run the assessment before the decision is made, not after, so it informs the choice rather than rubber-stamping it. One practical move Mark suggested: a ‘work-task simulation’ workshop (which runs in myosh) that people actually want to attend, because it plans the real work step by step.

Key takeaways

• Risk is the effect of uncertainty. Use the workshop to discover what you don't know.

• Context (and legal defensibility) only comes from the people who do the work.

• Assess credible worst-case scenarios, not far-fetched what-ifs.

• Be honest about control effectiveness, that's where real uncertainty sits.

• The tool (T5/JSA/bowtie/spreadsheet) isn't the point; the conversation is.

• Do the risk assessment before the decision, not after, so it actually informs it.

Watch the full session

There's far more in the full hour, the Johari window, the ‘do you tolerate the risk of a fatality?’ conversation for leaders, and Mark's five tips in detail. Watch on demand.  

This session is part of the myosh Academy free webinar series. Explore the library and catch Mark's Investigation Series on demand.

Presenter: Mark Alston, Founder, Investigations Differently; author of Stop Blaming Bob. Tags/Categories: Workplace Safety, HSEQ, WHS, Risk Management, Risk Assessment. Internal links: ‘myosh Academy webinars’ → https://www.myosh.com/academy/webinars ; related — the Investigation Series.

‍