Critical Risk: The Short Answer
A critical risk under the Health and Safety at Work Amendment Act 2026 is a risk linked to a hazard listed in the new Schedule 1A. It also covers any other hazard that, if it occurs, is likely to result in death, a notifiable injury or illness, a notifiable incident or an occupational disease listed under the Accident Compensation Act 2001. The definition comes into force on 1 April 2027 and a critical risk needs deliberate identification, strong direct controls, active monitoring and clear officer oversight. It can't be managed through paperwork alone.
If your board can't clearly articulate your organisation's critical risks and how they're controlled, you likely have a governance exposure.
What Makes a Risk Critical
The Amendment Act puts that definition into law for the first time. The test is about how serious the harm is likely to be if the risk occurs, not how often you expect it to happen. Schedule 1A lists hazards that are automatically critical, drawn from existing regulations, such as asbestos, hazardous substances, amusement devices and mining and quarrying operations. A mental health risk can also be critical where it's likely to lead to one of those serious outcomes, for example a fatigued driver crashing a vehicle.
A critical risk isn't simply a “high” risk on a generic matrix.
It's a risk that:
Has the potential for fatal or life-altering harm
Can overwhelm existing controls
Requires deliberate and layered management
Demands officer visibility and assurance
This aligns with the energy-based view of serious harm, including the CHASNZ definition of high-energy hazards where exposure to approximately 1,500 joules or more can result in serious or fatal harm.
In simple terms:
Critical risks are the risks that can kill people.
Everything else on the list is secondary to those.
Why Most Organisations Misunderstand Critical Risk
In board workshops I regularly see three patterns:
1. Inconsistent director interpretation
One director rates a hazard high, another calls it moderate and another focuses on reputational risk instead of physical harm.
Until the board's language is aligned, priorities stay fragmented.
2. Administrative distraction
I've seen inspection reports filled with:
Test and tag issues
Sign-in breaches
Minor housekeeping
All while contractors were doing unsafe work at height directly above reception.
Policy creation doesn't compensate for uncontrolled fatal risk.
3. Risk delegation drift
Risk is quietly pushed:
Down the management chain
Across to contractors
Into “that department’s problem”
The legal duty doesn't get delegated that easily.
Critical risk needs ownership at governance level.
What Is a Critical Risk? The Energy Perspective
The CHASNZ High Energy Hazard guidance provides a practical lens.
It identifies ten energy sources commonly associated with fatal harm:
Gravity
Mechanical
Motion
Sound
Pressure
Radiation
Temperature
Chemical
Biological
Electrical
This energy wheel approach reframes the conversation.
Instead of asking:
“What hazards do we have?”
We ask:
“Where are we exposed to uncontrolled high energy?”
That shift changes how a board thinks.
Critical Risk Is About Direct Controls, Not Paper Controls
The CHASNZ guidance distinguishes between:
Direct controls: targeted at the energy source and still effective if human error occurs
Alternate controls: training, PPE, signage and procedures.
Most organisations rely heavily on alternate controls.
Critical risk management needs direct controls at the source.
For example:
Work at height isn't controlled because you wrote a policy.
It's controlled when:
Physical edge protection is installed
Fall prevention systems are engineered
Exclusion zones exist
Verification occurs
A piece of paper doesn't stop gravity.
Engineering does.
What Critical Risk Looks Like in Practice
In my experience across manufacturing, construction and multi-site operations, critical risks often include:
Work at height
Driving exposure
Mobile plant interaction
Excavation
Confined spaces
Hot works
Fatigue
Psychosocial harm in high-pressure environments
Notice that driving is almost always on that list and almost always underestimated. That's because it feels normal.
Familiarity reduces perceived risk, it doesn't reduce consequence.
The Governance Blind Spot Around Critical Risk
I've seen:
Boards set all tolerances to “low” without understanding operational feasibility
Other boards set all tolerances “very high” and create false confidence
New H&S managers introduce critical risk language without onboarding alignment
Executive reports polished before reaching decision makers
The result is disconnection between the board and the operation.
Once officers properly understand their due diligence duties and how they intersect with critical risk, the conversation changes.
It becomes:
What does good look like for us?
Where are we most exposed?
Do we have direct controls?
How do we know?
That's what governance maturity looks like.
Critical Risk and Officer Due Diligence
Under section 44 of HSWA, officers must take reasonable steps to:
Acquire and keep up-to-date knowledge
Understand operations and associated risks
Ensure appropriate resources and processes
Verify implementation
Critical risk sits at the centre of these duties. From 1 April 2027 the amended section 44 restates them around three ideas (understand, ensure and verify) and applies them to the officer's governance role only.
If officers can't:
Name their critical risks
Explain the control strategy
Describe verification processes
Show evidence of review
They aren't meeting the spirit of due diligence.
What Good Critical Risk Management Looks Like
Good practice includes:
A clear definition aligned to the Amendment Act and Schedule 1A
Identification of fatal and life-altering risks
Direct control mapping
Critical risk registers separate from general hazards
Officer-level reporting
Independent verification
Continuous review
Done well, critical risk management is focused.
Not cluttered.
Not reactive.
The Evidence Column Test for Critical Risk
Most boards can tell you their critical risks. Far fewer can tell you when someone senior last checked, in the field, that the control standing between each one and a death actually works.
In Raise the Standard I call this the Evidence Column Test. Write down your three most likely killers, the one control that matters most for each and the date someone last physically checked it. Where that column is blank, the silence is your audit.
That column is where an officer's due diligence gets tested. The free Officer Due Diligence Check is a quick way to see how your own evidence would stand up.
Frequently Asked Questions About Critical Risk Under the Health and Safety at Work Amendment Act 2026
What is a critical risk under HSWA?
From 1 April 2027 a critical risk is one linked to a Schedule 1A hazard or to any other hazard that, if it occurs, is likely to result in death, a notifiable injury or illness, a notifiable incident or a listed occupational disease. HSWA had no statutory definition before the Amendment Act, however these were always the risks that demanded the most attention.
How is critical risk different from general risk?
General risks can still cause harm, however critical risks are the ones likely to cause death or serious harm if they occur. They need direct controls and governance oversight.
Does risk appetite override legal duty?
Risk appetite never overrides the legal requirement to do what is reasonably practicable.
Are policies enough to manage critical risk?
No, direct engineering or system controls are required because policies and training alone aren't enough.
How often should critical risks be reviewed?
The law doesn't set a calendar. Under regulation 8 of the General Risk and Workplace Management Regulations 2016 you must review a control measure when it doesn't control the risk, before a change that could create a new or different risk, when a new hazard or risk is identified, when worker engagement shows a review is needed or when a health and safety representative asks. For critical risks a board should also expect verification on a set cycle.
If you are an officer or director, the question is not whether critical risk exists in your organisation.
The question is whether you can clearly articulate it.
Can you name your critical risks, explain your control strategy, demonstrate verification and show evidence of review?
If not, you're relying on optimism.
Critical risk doesn't wait for your board to get aligned.
About the Author
Matt Jones is the founder of Advanced Safety and a HASANZ-registered health and safety consultant. He's a Professional Member of NZISM and holds a Graduate Diploma in Occupational Safety and Health.
He advises boards, directors and executives on officer due diligence and critical risk under the Health and Safety at Work Act 2015. His book Raise the Standard: Why Good Organisations Go Blind and How Leaders Restore Visibility sets out G.A.P.E.™, F.E.E.D.™ and S.A.F.E.T.Y.™, a leadership architecture framework for high-risk organisations.
He created the Compliance Compass audit and hosts the Health & Safety Unplugged podcast.
Keep reading
Governance Advisory
Is the health and safety report your board reads actually true?
Your officers carry a personal due diligence duty under the Health and Safety at Work Act 2015. Governance Advisory puts an independent view over your critical risk reporting every month and a short paper in front of your board every quarter, giving the people who sign off a true picture of what’s going on.
Start with the free Officer Due Diligence Check or read the Colliers Project Leaders case study.
Latest update: 5 November 2026
