Open almost any HIRARC in Malaysia and you’ll find a control column full of single-word or short-phrase entries: “PPE,” “training,” “signage,” “supervision.” Each of these looks like a control measure. Most of them are categories — and the difference between a category and a control measure determines whether the HIRARC actually reduces risk on the floor.
What Makes a Statement a Control, Not a Category
A control measure has to be specific enough that it can fail. If a control statement can be satisfied by several different, inconsistent actions on the floor — and still be marked as “in place” in an audit — it isn’t specific enough to function as a real control.
“Respiratory protection — PPE” can be satisfied by a worker wearing a disposable dust mask, a half-face respirator with the correct cartridge, or, in practice, nothing at all if the supply box happens to be empty that week. All three states are technically compliant with a control statement that never specified which protection, at what filtration rating, replaced on what schedule, or checked by whom. A control that tolerates “nothing” as a compliant state isn’t reducing the hazard it’s assigned to.
The Four Questions a Real Control Answers
A control measure that can actually be verified, audited, and held accountable answers four specific questions. What exactly is provided or required — not a category, but the specific item, action, or specification. Who is responsible for ensuring it’s available, used, or performed. How often is compliance or condition checked, and by whom. What is the trigger for escalation, replacement, or corrective action when the control is found lacking.
A control written as “half-face respirator, P2 cartridge, replaced monthly, checked by the line supervisor during the daily floor walk, escalated to HSE if stock falls below two weeks’ supply” answers all four. “PPE” answers none of them — it names a category of solution without committing to what the solution actually is.
Why Vague Controls Survive Audits
A HIRARC document audit, internal or external, typically checks whether a control is listed against an identified hazard — not whether the control statement is specific enough to be meaningfully enforced. This is why vague controls persist for years without being flagged: the document passes a check for completeness while failing a check for functionality that most audits aren’t designed to apply.
The practical effect is a HIRARC that looks compliant on paper while leaving the actual exposure on the floor essentially unmanaged, because the people responsible for implementing “PPE” have no specification to implement against.
The Legal Dimension Under OSHA 1994
The Occupational Safety and Health Act 1994 requires employers to identify hazards and implement adequate controls to manage risk to employees. A HIRARC that lists controls in name only — vague enough to be satisfied by inconsistent or absent action on the floor — does not meet the intent of that duty, even if the document technically contains an entry in the control column for every identified hazard.
This matters specifically in incident investigations: a control that was “documented” but never specific enough to be implemented consistently offers little defence if the hazard it was meant to manage caused harm. Investigators and DOSH inspectors increasingly look past the existence of a control entry to ask whether the entry was ever specific enough to function.
A Practical Test for Your Own HIRARC
Read any control measure in your current HIRARC and ask: if I walked onto the floor right now, would I know exactly what I’m looking for to confirm this control is in place? If the answer requires guessing — which PPE, whose responsibility, what schedule — the control statement is a category, not a control.
This test is fast to apply and immediately reveals which parts of a HIRARC are doing real work and which parts are placeholders that have never been challenged.
Fixing This Without Rewriting the Whole Document
Rewriting every control in a HIRARC at once is rarely practical. A more effective approach is to prioritise the hazards with the highest risk ratings first, and apply the four-question test specifically to those. A “Low” risk hazard with a vague control is a lower-priority fix than a “High” risk hazard where the only thing standing between the hazard and an incident is a control statement nobody can actually verify on the floor.
Want your HIRARC to hold up against both an audit and a real incident investigation? Cikgu Barrier’s Risk Assessment That Works program teaches teams how to identify hazards accurately, score risk consistently, and write control measures specific enough to actually function. Available as a public workshop or in-house delivery across Malaysia.