A DOSH audit at a factory in Selangor. The auditor asks for the HIRARC. It’s presented — printed, bound, signed, and dated. The auditor reviews it. No findings raised. Audit passed.
Three months later, a worker is injured by the exact hazard listed in Row 14 of that HIRARC.
The control measure written in the document: “PPE required.”
Nobody specified which PPE. Nobody verified it was available at the point of use. Nobody confirmed workers knew how to wear it correctly. The HIRARC said the risk was controlled. The risk was not controlled.
The Gap Between Compliant and Working
This is the gap that costs lives. Not the gap between having a HIRARC and not having one — the gap between a HIRARC that passes an audit and one that actually controls the hazards it documents.
A compliant HIRARC satisfies the auditor. Under OSHA 1994, employers are required to conduct and document hazard identification, risk assessment, and risk control. DOSH will check that the document exists, that it covers the workplace’s hazards, and that the format is correct.
A working HIRARC is specific enough that a new worker — on their first day, with no prior site knowledge — could read it and know exactly what to do. Not “PPE required” but “chemical-resistant gloves (Ansell Sol-Vex 37-175), inspected before each use, replaced monthly — stored in red cabinet at Station 4.”
The difference is not how long the document is. It is whether the control described is real enough to be verified — and specific enough to be trained to.
Why Vague HIRARCs Get Written
Most vague HIRARC documents aren’t the result of carelessness. They’re the result of a process designed to produce a document rather than to control risk. When HIRARC is treated as a compliance exercise, the goal is to complete it, not to make it useful. The person writing it fills in the required columns and describes controls in terms general enough to cover the hazard without creating obligations they might not be able to meet.
“PPE required” covers the column. “Chemical-resistant gloves (Ansell Sol-Vex 37-175), inspected before each use, stored at Station 4” creates a specific, verifiable standard — and accountability. If the gloves aren’t at Station 4, the control measure isn’t in place, and the risk isn’t controlled.
The Three Most Common HIRARC Gaps in Malaysian Workplaces
1. Vague Control Measures
Control measures described at a category level (“PPE required,” “training provided,” “SOP in place”) rather than at the level of specificity needed to implement and verify them. A control measure that can’t be audited in the field isn’t a control measure — it’s a description of a category of controls.
2. Wrong Risk Rating After Controls
The residual risk rating — the risk level after controls are applied — is often set too low relative to the actual reliability of the controls in place. “PPE required” as a sole control for a severe chemical exposure hazard does not justify a residual risk of Low. The rating should reflect what the control can actually deliver, not what the team wants the residual risk to be.
3. Missing Hazards
HIRARCs that cover the obvious hazards and miss the non-routine ones: maintenance tasks, start-up and shutdown procedures, emergency scenarios, and activities that happen irregularly but carry significant risk. DOSH enforcement focus has shifted toward non-routine operations since the OSH (Amendment) Act 2022.
How OSHA 2022 Raises the Bar
The OSH (Amendment) Act 2022 expanded the scope of employer duty significantly. Employers must now conduct risk assessments that cover a wider range of workplace activities, and the duty of care extends to contractors, visitors, and others who may be affected by workplace operations — not just employees.
This means the HIRARC must cover more than the core production activities. It must address the hazards associated with every person who enters the workplace — and the controls must be specific enough to apply to people who may have no prior knowledge of the site. A HIRARC adequate for OSHA 1994 compliance may not meet the expanded obligations under the 2022 amendment.
Making Your HIRARC Work in the Field
The practical test for any control measure in a HIRARC: can a supervisor, on the day of the work, verify that this control is in place — without interpretation, without additional training, and without needing to ask anyone?
If the answer is no, the control measure needs to be more specific. Name the exact PPE type and specification. Identify where it’s stored and its inspection interval. Name the procedure reference number rather than just writing “SOP in place.”
Ini realiti di tapak kerja Malaysia — HIRARC yang ada dalam fail bukan bermakna hazard terkawal. The document in the file is not the same as the hazard being controlled.
HIRARC Training That Produces Documents That Work
Cikgu Barrier’s HIRARC training in Malaysia is built around this gap — the distance between the compliant document and the working one. Participants learn how to conduct hazard identification that surfaces the non-routine and overlooked hazards, how to set risk ratings that reflect the actual reliability of controls, and how to write control measures specific enough to implement and verify in the field.
Delivered in half-day and full-day formats, with in-house options for teams who need to apply the methodology to their specific workplace.
Learn more about HIRARC Training Malaysia →
Or contact us to discuss in-house delivery for your workplace.