OHS Compliance & Risk Management7 min readPublished 24 August 2026

Baseline vs Issue-Based Risk Assessment: When Is Each Useful?

Compare baseline and issue-based risk assessments so management can choose a review that matches the workplace, change or problem requiring a decision.

Why this decision matters

This guide is written for employers, operational managers, SHEQ practitioners and project leaders. It focuses on whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. That framing matters because a broad request for “compliance” or “safety support” can hide several different decisions, each requiring different information, competence and accountability. A useful engagement begins by defining the workplace or project, the people affected, the operating constraints and the result management needs to use.

Selecting the right assessment level helps teams find material exposure without burying urgent decisions in an exercise that is too broad or too narrow. Prevention is not a promise that incidents will never occur. It is the disciplined work of identifying credible exposure, strengthening controls, recording decisions and checking whether action was effective. That approach protects people while also supporting continuity, cost control and defensible management decisions.

Information to prepare

  • Confirm the workplace, process or change being considered. Record the source, current owner and any uncertainty so that an adviser or provider does not have to fill gaps with assumptions.
  • Confirm existing baseline assessments and risk registers. Record the source, current owner and any uncertainty so that an adviser or provider does not have to fill gaps with assumptions.
  • Confirm incident, inspection and monitoring evidence. Record the source, current owner and any uncertainty so that an adviser or provider does not have to fill gaps with assumptions.
  • Confirm people exposed during normal and abnormal work. Record the source, current owner and any uncertainty so that an adviser or provider does not have to fill gaps with assumptions.
  • Confirm the management decision and review deadline. Record the source, current owner and any uncertainty so that an adviser or provider does not have to fill gaps with assumptions.

A practical five-step process

01
Define the decision boundary

Use this step to support the decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Identify who has authority, what evidence will be considered, what must happen next and how the result will be checked. Step 1 should leave a clear record without creating unnecessary paperwork.

02
Review the existing risk picture

Use this step to support the decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Identify who has authority, what evidence will be considered, what must happen next and how the result will be checked. Step 2 should leave a clear record without creating unnecessary paperwork.

03
Identify the trigger for focused work

Use this step to support the decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Identify who has authority, what evidence will be considered, what must happen next and how the result will be checked. Step 3 should leave a clear record without creating unnecessary paperwork.

04
Select a proportionate assessment method

Use this step to support the decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Identify who has authority, what evidence will be considered, what must happen next and how the result will be checked. Step 4 should leave a clear record without creating unnecessary paperwork.

05
Integrate the result into risk governance

Use this step to support the decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Identify who has authority, what evidence will be considered, what must happen next and how the result will be checked. Step 5 should leave a clear record without creating unnecessary paperwork.

Four questions to test the plan

Planning questionWhat to confirmWhy it matters
What is in scope?the workplace, process or change being considered and incident, inspection and monitoring evidence.It prevents different parties from acting on different assumptions.
What decision is required?The organisation must decide whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern.It keeps the work connected to a usable management outcome.
Who owns follow-through?the management decision and review deadline, including authority, resources and escalation.Advice has limited value when nobody can implement or verify action.
What evidence is enough?existing baseline assessments and risk registers together with people exposed during normal and abnormal work.Reliable evidence supports proportionate decisions and transparent limitations.
A concise brief should make each answer clear before work begins.

Plan the next step

For “Baseline vs Issue-Based Risk Assessment: When Is Each Useful?”, turn the five planning inputs into a short written brief before requesting a proposal. State what is known, what remains uncertain and which decision is time-critical. Ask the provider to identify assumptions, exclusions, information dependencies and the evidence that will be delivered. This makes proposals easier to compare and reduces costly scope changes after work begins.

Diba BES can discuss whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern and define an appropriate next step through its existing service pathway. The enquiry should describe the operating context rather than presuppose an outcome. The agreed scope should then state Diba BES's role, the client's responsibilities, any third-party or regulated-provider dependencies, and how recommendations or service records will be handed over.

Frequently Asked Questions

What is the main purpose of baseline vs issue-based risk assessment?

The purpose is to help employers, operational managers, SHEQ practitioners and project leaders make a defined decision about whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. It should connect evidence, responsibility and practical follow-through rather than produce activity with no clear management use.

What should be prepared before contacting Diba BES?

Prepare the workplace, process or change being considered, existing baseline assessments and risk registers and incident, inspection and monitoring evidence. Add the location, timing, key contacts and any uncertainty that may change the scope or require another competent or authorised party.

Does consulting or service support guarantee compliance?

No. A scoped service can support assessment, planning, capability or improvement, but it cannot guarantee compliance, certification, approval, incident prevention or the performance of duties held by another party.

How does this approach help protect cost and continuity?

Selecting the right assessment level helps teams find material exposure without burying urgent decisions in an exercise that is too broad or too narrow. The value comes from timely decisions and effective controls, not from quoting a universal savings number or promising that every interruption can be avoided.

How should a provider's scope and evidence be checked?

Ask for the exact role, proposed method, deliverables, exclusions and evidence relevant to whether the organisation needs a broad view of its risk profile or a focused assessment of a specific task, change, incident or emerging concern. Verify current credentials or regulated status at source where required, and keep this limitation in view: The assessment label does not determine quality; scope, competence, participation, evidence and review must fit the actual work and applicable requirements.

NR
Written by Nandipha Rambau
CEO and Director

Diba BES provides occupational health and safety consulting, workplace training and commercial workplace services for South African organisations. Its prevention-focused approach helps clients identify gaps, plan action and protect operational continuity.