Workplace hazard assessment in Canada: what has to be in writing

There is no Canadian DUERP — there are fourteen regimes

If you have arrived here from a European framework, the first thing to unlearn is the idea of the risk assessment document. Europe generally has one: a single named, mandatory record that carries the whole assessment. Canada has no such thing, and no federal power to create one.

Occupational health and safety in Canada is a provincial matter for roughly 94% of the workforce. Ten provinces and three territories each have their own OHS act, their own regulations, their own regulator and their own inspectorate. The federal government legislates only for federally regulated work — banking, telecommunications, broadcasting, interprovincial rail, road, air and marine transport, ports, grain elevators, uranium, most First Nations band council operations, federal Crown corporations — which is about 6% of employees.

The practical consequences are immediate:

• Two guides can both be right. An Alberta employer owes a written hazard assessment report. An Ontario employer of the same size and trade does not owe that document at all, and owes several others instead.
• A multi-province employer owes the union of the duties, not the average. There is no “Canadian baseline” you can comply with; there is only each jurisdiction you operate in.
• Buying a “Canadian” template is the classic error. What is sold as one is almost always Alberta’s or Ontario’s, and it is wrong somewhere else in ways that are invisible until an inspection.

What is common across all fourteen is the reason you write anything down at all, and it has a name.

What every Canadian jurisdiction does share

The internal responsibility system

Every Canadian regime is built on the premise that health and safety is managed jointly by the people at the workplace rather than delivered by the regulator. That is the internal responsibility system, and its machinery is the joint health and safety committee, the worker representative, and the worker’s right to know, right to participate and right to refuse unsafe work.

This matters to hazard assessment for a reason that is easy to miss: in most jurisdictions the committee or representative must be involved in the assessment, not merely shown the result. An assessment produced by a consultant and filed without worker participation is a procedural defect in its own right, independently of whether its content is any good.

The general duty and “reasonably practicable”

Every act contains a general duty on the employer to take every precaution reasonable in the circumstances for the protection of workers — Ontario’s wording, at s. 25(2)(h) of the OHSA, and the most-cited version. Others say “reasonably practicable”. These clauses are open-ended on purpose: they catch the hazard nobody wrote a specific regulation for.

An open-ended duty is impossible to discharge by following a checklist, which is precisely why the written assessment matters even where no regulation demands one.

Due diligence, which is the whole game

Canadian OHS offences are strict liability. The prosecution does not have to prove intent; it proves the act or omission. The employer’s answer is the due diligence defence, established for regulatory offences in R. v. Sault Ste. Marie (1978): that they took all reasonable care in the circumstances.

Due diligence has a recognisable shape, and courts look for the same elements every time:

1. Foreseeability — was the hazard identified, or should it have been?
2. Preventability — was a control reasonably available?
3. Control — was it implemented, communicated, trained, supervised?
4. Verification — did anyone check that it was still working?

Every one of those four is an evidentiary question, and every one of them is answered by a document or not answered at all. This is the honest reason to keep a written hazard assessment in a province that does not require one: due diligence that was never written down is nearly impossible to demonstrate two years later, in front of someone who was not there.

And the stakes are not only regulatory. Section 217.1 of the Criminal Code — added in 2004 by Bill C-45, the “Westray amendment” — imposes on everyone who directs work a legal duty to take reasonable steps to prevent bodily harm, and breach of that duty can support a charge of criminal negligence. Prosecutions are rare; the exposure is personal and it does not stop at the corporation.

Federally regulated work: the hazard prevention program

If you are federally regulated, you have the closest thing Canada has to a single mandatory assessment document, and it is the most prescriptive regime in the country.

Part XIX of the COHSR requires a hazard prevention program, developed and implemented in consultation with the policy committee — or, where there is none, the workplace committee or the health and safety representative. Its components are set out section by section:

Three details in there are the ones that get missed:

• 19.3 requires you to write down the method, not just the results. How hazards are identified, what data sources are used, how severity and likelihood are judged. Most programs jump straight to a hazard register and have no documented methodology behind it.
• 19.7 is a triggered duty as well as a periodic one. Three years is the floor; the program must also be evaluated when conditions change and whenever new hazard information becomes available to the employer. That last phrase is wide — a manufacturer’s bulletin, an updated SDS, an incident elsewhere in the group.
• 19.7 names the evidence the evaluation must rest on: workplace and work activity conditions, first aid records, injury statistics, and the observations of the committees or the representative. An evaluation that does not reference the committee’s views is incomplete on its face.

The provinces: what actually has to be in writing

Ontario

Ontario has no general written hazard assessment requirement, and that surprises people. What s. 25(2)(j) of the OHSA does require, where more than five workers are regularly employed, is a written occupational health and safety policy reviewed at least annually, and a program to implement it. The policy is a short statement of commitment; the program is the substance, and the Act does not prescribe its contents.

Where Ontario is prescriptive is hazard by hazard, and the specific written assessments are easy to miss because they live in different places:

• Workplace violence — s. 32.0.3 requires the employer to assess the risks of workplace violence, taking into account the nature of the workplace, the type of work and the conditions of work, and to advise the committee or representative of the results in writing if there is one.
• Workplace harassment — s. 32.0.6 requires a written program, developed in consultation with the committee, and reviewed at least annually.
• Confined spaces — O. Reg. 632/05 requires a written assessment and entry plan for each confined space.
• Construction — O. Reg. 213/91 carries written requirements of its own, including fall protection procedures and a notice of project.
• Designated substances and WHMIS carry their own written obligations.

Governance sits alongside: a joint health and safety committee at 20 or more regularly employed workers, with at least two certified members; a health and safety representative at 6 to 19.

Quebec

Quebec has changed more than anywhere else in Canada, and the deadline is imminent as this is written. The Règlement sur les mécanismes de prévention et de participation en établissement came into force on 1 October 2025 under the LMRSST reform, extending to all sectors what used to apply only to higher-risk ones. Employers were given one year to comply — all Quebec employers must have their mechanisms in place by 1 October 2026.

What is required, by establishment size:

Two features have no equivalent elsewhere in Canada:

• Psychosocial risks are explicitly in scope. Since October 2025 the programme de prévention or plan d’action must identify and address risks such as chronic workload, harassment and workplace violence. This is the closest thing in Canada to the European treatment of psychosocial risk, and it is a documentation duty, not a wellness initiative.
• You report to the regulator. Every three years from the date the programme de prévention takes effect, the employer must send the CNESST its action priorities, the progress of planned measures, and the follow-up on measures already in place. No other Canadian jurisdiction has a routine filing of this kind.

Quebec’s regulatory language is French, and the instruments keep their French names even in an English-language workplace. Do not look for an English “prevention program” in the statute; look for the programme de prévention under the LSST.

Alberta

Alberta is the jurisdiction whose duty looks most like the European model. Part 2 of the OHS Code requires the employer to assess a work site and identify existing and potential hazards before work begins, and to prepare a report of the results in writing, specifying the methods used to eliminate or control each hazard. The report must be available to workers.

The repeat triggers are the useful part:

• at reasonably practicable intervals to prevent unsafe or unhealthy conditions developing;
• when a new work process or operation is introduced;
• when a process or operation changes;
• before the construction of significant additions or alterations to a work site.

There is no stated calendar interval, which is a trap in both directions: an annual review is not automatically sufficient for a high-hazard process, and it is more than is needed for a stable low-hazard one. Note also that the OHS Code was amended with effect from 31 March 2025, so a document citing the previous edition is now citing a superseded text.

Workers involved in the work must be involved in the hazard assessment and control process — participation is written into the duty, not added to it.

British Columbia

BC frames the obligation as a program rather than an assessment. Under s. 3.1 of the OHS Regulation a formal occupational health and safety program is required where the employer has 20 or more workers and at least one workplace that is not low risk, or 50 or more workers. Below those thresholds the employer must still maintain a less formal program based on regular monthly meetings with workers on health and safety matters — which is a real, documentable duty that small BC employers routinely overlook.

Section 3.3 sets out what the formal program contains: a statement of the employer’s aims and the responsibilities of each level of the organisation, provision for regular inspection of premises and equipment, appropriate written instructions, provision for periodic management meetings reviewing health and safety activities and incident trends, and provision for prompt investigation of incidents.

BC has no single general written hazard assessment either, but it has a long list of specific risk assessments scattered through the Regulation — working alone, violence, ergonomics (musculoskeletal injury), exposure control plans for designated substances, and more. In practice a BC employer builds one assessment and lets it feed those specific obligations.

Everywhere else

Saskatchewan, Manitoba, Nova Scotia, New Brunswick, Newfoundland and Labrador, PEI and the three territories each have their own act, and most now require a written OHS program above a size threshold, typically 20 workers. The substance converges; the wording, the thresholds and the committee rules do not. Read the act for the jurisdiction, and treat any national summary — including this one — as the map rather than the territory.

How to actually do the assessment

The legal frame differs. The work does not. What follows is jurisdiction-neutral, and it is what every regime above will accept as the substance behind whatever document it names.

1. Identify

Work from more than one angle, because each one is blind to what the others find:

• By task — walk the process, step by step, at the pace the work is actually done. A job hazard analysis on the real sequence, not the SOP.
• By area — the physical walkthrough. Catches housekeeping, access, lighting, storage, guarding.
• By record — incident reports, first aid log, near misses, worker concerns, committee minutes, WCB claims, absence patterns, maintenance work orders.
• By source — SDSs, equipment manuals, manufacturers’ bulletins, regulator alerts, industry association guidance.
• By person — ask the people doing the job what they work around. This is the only method that finds the informal workaround, and the informal workaround is where injuries live.

A hazard register that came from one method is missing roughly the categories that method cannot see.

2. Assess

Rate severity and likelihood on a small, described scale. Four levels each is enough; ten gives an illusion of precision and produces unresolvable arguments between a 6 and a 7.

Risk = Severity × Likelihood, from 1 to 16, then apply a control factor for what is already in place: 1.0 nothing, 0.7 procedure or PPE only, 0.4 engineered control in place and verified, 0.2 hazard eliminated.

Worked example. Maintenance access to the top of a mixing tank in a food plant, via a fixed ladder, twice a week, no guardrail at the platform edge, no anchor point.

• Severity: 4 m fall to concrete — fatality or permanent disability → 4
• Likelihood: twice weekly exposure → 3
• Raw risk: 4 × 3 = 12
• Controls: fall protection training in 2024, harness available but no anchor → 0.7
• Residual risk: 12 × 0.7 = 8.4

After installing a permanent guardrail around the platform: severity if a fall occurred is unchanged, but the fall is now prevented at source — likelihood drops to 1 and the control factor to 0.2, giving a residual 0.8. The register carries both figures and the date of the change, and that pair demonstrates the value of the work far better than an injury rate does.

One rule that beats any threshold: anything scored severity 4 escalates regardless of likelihood. A rare fatal risk is not offset by its rarity, and no Canadian regulator will accept that arithmetic.

3. Control, in order

Every Canadian jurisdiction expects the hierarchy, and several — Alberta’s Part 2, COHSR 19.5, the LMRSST — write it into the regulation. In descending order: elimination, substitution, engineering controls, administrative controls, then PPE.

The order is not advice. A control chosen out of order is a defect an inspector can name: if a guard was reasonably available and you issued gloves instead, the gloves are evidence against you rather than for you. When you do stop at a lower tier, record why the higher ones were rejected. “Substitution examined, no compatible alternative for food-contact surfaces — engineering control selected” is a line that does real work in an investigation two years later.

4. Verify

This is the step that separates a program from a binder, and the one that is missing most often. For each control: who checks it, how often, against what, and where the result is recorded. COHSR 19.7 makes it explicit federally; Ontario and BC reach it through the inspection provisions; Alberta reaches it through the repeat triggers.

The question after an incident is never only “was the hazard identified?” It is “did anyone confirm the control was still in place?” — and that second question is the one most registers cannot answer.

Sector specifics

Construction

The highest-hazard sector and the most heavily prescribed. Assessment is per-project, not per-company: the company program sets the method, and each site gets its own. Expect notice of project filings, site-specific fall protection procedures, excavation and trenching plans, traffic protection plans, and a prime contractor or constructor who carries overall coordination duty for everyone on site.

Two jurisdiction-specific items that catch people:

• Ontario Working at Heights training under O. Reg. 297/13 is valid for three years, after which an approved refresher is required. An expired worker must stop working at height. Track this as an expiry date, not as a completed course.
• BC and Alberta prime-contractor duties differ in scope from Ontario’s constructor. On a multi-employer site, who owes what is a written question settled before mobilisation, not after.

Coactivity is the risk the company hazard assessment structurally cannot cover, because it describes your workers and not the other trades’. That is what the site-specific plan and the coordination meeting are for.

Manufacturing and industrial

Machine guarding and lockout are the centre of gravity. A hazard register line for a machine that does not reference its energy isolation procedure is incomplete. Add: confined space entry (tanks, hoppers, pits, silos — each needing its own written assessment), combustible dust, chemical exposure and exposure control plans, noise, forklift and pedestrian traffic separation, ergonomics on repetitive stations, and hot work permits.

The most dangerous window in a plant is the maintenance shutdown — unfamiliar work, contractors on site, guards removed, production pressure — and it is the window least often described in the assessment. Treat turnaround as its own assessment with its own document.

Oil, gas, mining and resource

Layered regimes: OHS plus provincial energy or mines regulators, plus in some provinces a distinct mining OHS regulation. Expect formal hazard identification before each job (the field-level hazard assessment or FLHA, done and signed at the work face), critical-task procedures, H₂S and gas detection, ground control, emergency response planning at distance from services, and heavy dependence on contractor prequalification.

This is also where COR certification does the most work commercially — see below on Alberta.

Transportation and warehousing

Often the boundary case for jurisdiction: interprovincial carriers are federally regulated and owe COHSR Part XIX, while a warehouse serving one province is provincial. A single company can be both, and the assessment has to say which sites fall where.

Substance: motor vehicle incidents are the leading cause of workplace fatality in Canada and belong in the assessment as an occupational hazard rather than a commuting one — routes, hours of service, vehicle condition, distraction, winter driving. Then dock and trailer work, falls from vehicles, forklift traffic, racking integrity, cold storage, night work, and order-picking ergonomics.

Healthcare and long-term care

Musculoskeletal injury from patient handling, workplace violence — which in Ontario carries the specific s. 32.0.3 risk assessment duty, and in Quebec is inside the psychosocial scope — needle-stick and biological exposure, hazardous drugs, cleaning chemicals, shift work and fatigue, and lone work in community care.

Home and community care is the hard case, as it is everywhere: the workplace is someone’s home and the employer does not control it. The assessment then attaches to the visit rather than the premises, with a per-client risk screen and a check-in protocol.

Office and professional

An office is not exempt and its assessment should not be three lines. Real content: psychosocial risk — workload, autonomy, remote management, client-facing emotional demand — and in Quebec this is now explicitly documented; ergonomics and workstation setup, including home-based work, which most jurisdictions still treat as a workplace for OHS purposes; violence and de-escalation at reception; fire safety and evacuation, including personal evacuation plans; indoor air quality; lone work for after-hours staff; and driving for anyone who visits clients.

What an inspector asks for

Roughly in the order the questions come:

• The document exists and it is dated. Whatever your jurisdiction calls it — program, policy, hazard assessment report, programme de prévention.
• It matches the jurisdiction you are in, not a template from another province.
• It is current relative to the last change — new equipment, new process, last incident, last SDS received.
• The methodology is written down (federally, this is a discrete duty under 19.3; elsewhere it is what makes the ratings defensible).
• Workers and the committee or representative were involved, and the minutes prove it.
• Governance is in place for your size: JHSC or representative, certified members where required, meeting minutes posted.
• Each significant hazard has a control, and the control sits at the right tier of the hierarchy — with the reasoning recorded where it does not.
• Each control has a verification step with a named owner and a frequency.
• The specific written assessments exist: confined space, violence, harassment, working alone, exposure control plans, fall protection.
• Training records match the hazards and none of the expiries have passed.
• Prior versions can be produced. Federally the evaluation report is kept six years; elsewhere it is due diligence rather than a stated retention.
• Someone on site can explain the ratings. This is the one that separates a real program from a purchased one.

What to write

A hazard register line that survives being read a year later. Six questions, in order: who is exposed, to what, in which task, with what possible outcome, under which existing controls, and what happens next.

Area / task: Blend room — top-of-tank access for sampling Hazard: Fall from 4 m platform, no guardrail at edge, no anchor point Exposure: Two operators, twice weekly, approx. 10 min each access Possible outcome: Fatality or permanent disability Existing controls: Fall protection training (03/2024), harness issued, no anchor available at the access point Rating: S4 × L3 = 12, control factor 0.7 → 8.4 Control selected: Permanent guardrail to platform perimeter — elimination of the fall hazard. Anchor point rejected as it retains the fall. Owner: Maintenance Manager — Due: 2026-03-31 Verification: Included in monthly area inspection checklist from completion; guardrail integrity confirmed at each inspection

Phrases to stop writing, and what to write instead.

The note to the committee, in three paragraphs. What changed since the last version. What the change moved up in priority, and why. What is being proposed, with a cost and a date. A committee handed sixty pages without this reviews the formatting, and it is right to.

The due diligence file. Not a document — a habit. For every significant hazard, keep together: the assessment entry, the decision and why the higher control tiers were rejected, the purchase or work order, the training records, the communication to workers, and the verification results. That bundle is what the four elements of due diligence look like in evidence, and assembling it after an incident is not possible.

The expensive mistakes

Using another province’s document. The single most common failure, and the hardest to see, because the document reads perfectly well. An Ontario program in Alberta has no written hazard assessment report; an Alberta report in Quebec has no programme de prévention, no comité, and no psychosocial section.

Treating a Quebec establishment as covered by a national program. The 1 October 2026 deadline is not a soft one, the psychosocial component is substantive work, and the three-yearly filing to the CNESST has no equivalent elsewhere, so nothing in a pan-Canadian program will have produced it.

Assuming federal or provincial without checking. Interprovincial trucking, telecoms, ports, banking and rail are federal; the warehouse next door probably is not. Getting this wrong means complying carefully with the wrong regulation.

Stopping at PPE. In a strict-liability system with a written hierarchy of controls, choosing the bottom tier without recording why the others were rejected converts your own document into the prosecution’s evidence.

No verification loop. Foreseeability and preventability are usually easy to show. Control and verification are where due diligence fails, because nobody recorded the check. A monthly inspection sheet with initials on it is worth more in an investigation than a hundred pages of policy.

And the reason to do this even where no regulation names the document: the same file that answers an inspector is the file that answers your insurer, your client’s prequalification audit, and the safety-record threshold on the next bid. It is the cheapest evidence you will ever produce, and the only moment you cannot produce it is the moment you need it.