HIRARC in Malaysia: the four steps, the matrix and the form
The HIRARC method in four steps, the risk matrix and the form, as DOSH describes it.
HIRARC stands for Hazard Identification, Risk Assessment and Risk Control.
It is the method DOSH publishes so an employer can meet his general duty under the Occupational Safety and Health Act 1994. This page walks through the four steps, the risk matrix and the form. TopBorneo supplies the equipment that ends up in the control column.
HIRARC in numbers
Why work with TopBorneo
Tell us the job, the site and the crew. We work out what fits instead of sending a catalogue back.
MSA, KStrong and Bullard straight from an official distributor, with lighter lines alongside them.
Gas detectors, breathing apparatus and cylinders are serviced by our own technicians.
The same people handle your enquiry, your order and your servicing.
Read more
Open a section to read the detail behind it.
The words, as the guideline defines them
DOSH publishes the guideline in Malay, so the Malay term is what you will meet on a Malaysian form.
| Term | Malay | What it means |
|---|---|---|
| Hazard | Hazard | A source or a situation that could cause injury, ill health, damage to property, damage to the environment, or a combination of those |
| Hazard identification | Pengenalpastian hazard | Working out which unwanted events could happen, and by what mechanism |
| Risk | Risiko | Likelihood combined with severity |
| Likelihood | Kemungkinan | How probable the event is in a given period or under given conditions |
| Severity | Keterukan | How bad the outcome is for people, property or the environment |
| Hazard control | Kawalan hazard | The steps taken to reduce the risk that goes with a hazard |
| Hierarchy of control | Hierarki kawalan | The order of preference for the type of control measure used |
The four steps
The guideline sets out four steps, and a flow chart that puts consultation with worker representatives alongside them.
- Classify the work activities, grouped by similarity: by area, by stage in a process, by planned or unplanned work, by task.
- Identify the hazards in each activity. The guideline lists workplace inspection, job safety analysis, preliminary investigation, failure analysis and accident investigation as techniques for this.
- Carry out the risk assessment: estimate the likelihood and the severity of each hazard.
- Decide whether the risk is acceptable, and apply control measures if it is not.
The employer appoints trained staff to lead a team drawn from the process being assessed. The guideline says a HIRARC is planned and carried out where a hazard is a major threat. It is also carried out where nobody is sure the existing controls are enough, and before corrective or preventive measures are put in.
Likelihood and severity, the DOSH ratings
| Likelihood | Rating | The guideline's description |
|---|---|---|
| Paling mungkin | 5 | The hazard or event is the most likely to happen |
| Mungkin | 4 | It could happen and would not be unusual |
| Dapat dijangka | 3 | It could happen at some point in the future |
| Jarang sekali | 2 | Not known to have happened in years |
| Tidak dapat dijangka | 1 | Practically impossible and never known to happen |
| Severity | Rating | The guideline's description |
|---|---|---|
| Mala petaka | 5 | Many deaths, damage to property, and production that cannot be recovered |
| Fatal | 4 | About one death, and major damage to property, if the hazard occurs |
| Serius | 3 | Non fatal injury, permanent disability |
| Ringan | 2 | Causes disability but no permanent injury |
| Sedikit sahaja | 1 | Small abrasions, bruises, cuts, first aid type injuries |
The risk matrix, and what each band asks of you
Risk is calculated as L multiplied by S: likelihood times severity. That gives a number from 1 to 25, and the guideline sorts those numbers into three bands.
| Risk | Band | What the guideline says to do |
|---|---|---|
| 15 to 25 | High | Immediate action to control the hazard, following the hierarchy of control. The action taken is documented in the risk assessment form, with the date it was completed |
| 5 to 12 | Medium | A planned approach to controlling the hazard, with temporary measures if needed. Also documented in the form |
| 1 to 4 | Low | Acceptable, and no further reduction is required. If it can be fixed easily and effectively anyway, do it and record it |
The jump from 12 to 15 is not a printing mistake. No pair of ratings from one to five multiplies to 13 or to 14, so the bands leave nothing out.
The hierarchy of control, with personal equipment last
The guideline groups controls by where they sit between the hazard and the person.
| Level | What it is | Example from the guideline |
|---|---|---|
| Elimination | Remove the hazardous work, tool, process, machine or substance | A recycler stops buying and cutting scrap fuel tanks because of the explosion risk |
| Substitution | Do the same job in a less hazardous way | Replace a hazardous chemical with a less hazardous one |
| Engineering control | Redesign, isolate, automate, guard or absorb, at or near the source | An insulated, air conditioned control room that keeps operators away from toxic chemicals |
| Administrative control | Safe work procedures, training and supervision, job rotation, housekeeping and maintenance, hygiene | Rotating people through repetitive work to prevent cumulative trauma injury |
| Personal protective equipment | Used when the other controls cannot be applied, or when extra protection is needed | Last in the order, not first |
The guideline is direct about that last line. Personal protective equipment is used when other control measures cannot be applied. Workers have to be trained to use and maintain it, they have to know its limits, and precautions have to be taken to make sure the equipment actually works. Otherwise, in the guideline's own words, the equipment can put the worker's health at risk.
That is where equipment paperwork meets a HIRARC form. A gas detector written into the control column is only a control while it is in calibration, and a harness is only a control while it passes inspection. See portable gas detector calibration and safety harness inspection. For the notification side of DOSH, see borang JKKP and the DOSH offices.
The HIRARC form, and how long it lives
The form in the guideline is one table with three groups of columns: hazard identification, risk analysis, and risk control. Its columns are the work activity, the hazard, what the hazard could cause, and any existing risk control. Then come likelihood, severity, risk, the recommended control measure, and the officer responsible with a completion date and status. The header carries the company, the process or location, who prepared it, who approved it, the date, the review date and the next review date.
Three rules go with the form. One form per work process is recommended. The completed form is signed by the person responsible for that area, and management or the employer confirms and approves the result. Assessment reports are kept for at least three years, and the HIRARC is reviewed every three years or whenever a process or an activity changes.
Common questions
What is HIRARC in Malaysia?
HIRARC is Hazard Identification, Risk Assessment and Risk Control, the method in the DOSH guideline of the same name. It supports the employer's general duty under the Occupational Safety and Health Act 1994 to provide a safe workplace. TopBorneo supplies safety equipment that appears in the risk control column of that form.
What is the latest HIRARC guideline?
The 2008 edition is still the latest. TopBorneo checked the risk assessment page of dosh.gov.my on 22 August 2026. It still linked the same document, Garis Panduan bagi Pengenalpastian Hazard, Penaksiran Risiko dan Kawalan Risiko, dated 2008. If you are offered a newer form, check which document it comes from first.
How is the HIRARC risk value calculated?
You multiply likelihood by severity, each rated from one to five, which gives a risk value from 1 to 25. From 15 to 25 the guideline asks for immediate action, from 5 to 12 for a planned approach, and from 1 to 4 the risk may be accepted. Existing controls count when you rate the two.
How often must a HIRARC be reviewed?
A HIRARC is reviewed every three years, or sooner whenever a process or an activity changes. It is reviewed again after control measures have been put in place, because the guideline asks for another round of HIRARC at that point. Assessment reports are kept for at least three years, longer if other legislation says so.
Who should carry out a HIRARC?
A team carries it out, led by trained staff appointed by the employer and drawn from the people who actually run the process or activity. The guideline asks for consultation with the safety and health representative where that is practical, because the people doing the work spot hazards a visitor does not.
Ask for the equipment behind your controls
TopBorneo supplies, rents and services safety equipment across Malaysia. If a control measure on your form needs a detector, a harness, breathing apparatus or a calibration certificate, email the item and the quantity to crm@topborneo.com. You get a written quotation back.