Critical Risk is in the spotlight. Does your team have the capability to meet new legislation and keep workers safe? IMPAC can help.
The Health and Safety at Work Amendment Act has provided the most significant changes to the Act in the last decade. A key feature of this is pushing "critical risk" into the spotlight, or those that can kill, seriously injure, or permanently change Kiwi workers’ lives.
While not particularly well drafted the intent is useful according to Tom Reeves, Founding Director of IMPAC, but it also exposes a capability gap in many organisations: there's a good chance that Kiwi businesses will now need to know how to identify critical risks, define critical controls, implement them, and verify those controls protecting their people are effective.
To build that capability IMPAC can upskill and empower through a new programme of learning - Critical Risk for Governance, Critical Risk Management Fundamentals and Critical Control Verification, drawing on our experience with New Zealand businesses and ongoing innovation in risk management and control verification.
Committing to health and safety, sadly, has the potential to create clutter in any business, distracting from the most important goal – to keep people safe.
Too many forms. Too many measures. Too many reports. Too many conversations about activity — and not enough clarity about what actually keeps workers safe. Because this is not just a technical issue. It is a people issue.
This is why the ongoing shift toward critical risk is important.
The purpose of better critical risk management is not to create more process. It is to make sure the controls standing between your people and life-changing harm are understood, implemented, checked, and trusted.
Critical risk is not a new concept. Mature organisations have been thinking this way for years. What has changed with the revamped legislation is that, now the signal is loud and clear (well, clear-ish, it's legalese after all): Organisations must focus or at least prioritise the risks that can kill people, seriously injure them, or change lives permanently.
That makes capability increasingly important. It is not enough to have a critical risk framework on paper; organisations need trained people who can apply it confidently and consistently in practice.
As Tom Reeves, sees it, this change isn't about adding another layer of compliance. It's about forcing organisations to be very clear on the critical few risks that can cause death or permanent significant disability to their people - and be demonstrably confident that the critical controls around those risks are genuinely working.
Critical risk is where the stakes are highest
For all the jargon that gets thrown around in this space, critical risk is actually simple.
It is about identifying the hazards in your organisation that, if they are not properly controlled, could result in death or significant life-changing harm for people.
Things like work at height, confined space, hazardous energy, mobile plant, fixed plant, electricity, hazardous substances, firearms, specialist sector risks - the exact list will vary depending on your business. But the principle does not.
You identify the critical risks.
Then you ask: how do these risks actually show up in our operation?
Then you ask: what are the controls that must be in place to stop them leading to death or serious harm?
Reeves has spent decades working across high-risk industries where the consequences of weak critical controls are not theoretical. That is why his view is blunt: critical risk is where health and safety gets real.
A business can have full dashboards, regular meetings, tidy paperwork and decreasing reported injury stats — and still have poor visibility of whether critical controls are genuinely in place and working.
A system can look busy and still be weak. And that's where the real risk to organisations and people lies.
It's not an obligation to do more. It's an opportunity to sharpen your focus
While some may view this legislative highlighting of critical risk as just another thing to load on top of an already cluttered pile of H&S activity, it's not.
Bringing critical risks to the fore actually gives organisations permission to de-clutter and have more confidence their people are protected.
Because once you stop treating every issue as equally important, the real questions come into view:
- What are the few risks here that can kill someone or leave them seriously harmed?
- What controls are we relying on to prevent that?
- Which of those controls are genuinely critical?
- How do we know they are in place and working?
- What should our board, executives and operational leaders be looking at before anything else?
In Reeves’ view, permission to de-clutter is one of the most important parts of the shift. Not because minor issues don't matter, but because too many organisations are drowning in admin, noise and lower-order distraction.
However, permission to shift focus is one thing, actually shifting is another, and therein lies the gap that leaves workers unprotected.
Do you have people across your organisation who know how to identify critical risks? Can they define the right controls and identify which are critical, verify they are in place and working, and provide and interpret effectiveness reporting? Or do their skills need to shift in line with the legislative change of focus?
Given the answers we're hearing to these questions from businesses across the country, we've come to see this not as a compliance issue, but as a capability issue.
Capability, not commentary
The smartest and safest organisations will not treat critical risk as a phrase to add to the reporting pack. They will treat it as a capability to build.
Boards need to know what good oversight looks like, and senior leaders need to know what questions to ask.
H&S professionals need a practical framework for building or strengthening a critical risk programme.
Operational teams need confidence in what critical controls look like, what failure warning signs look like, and how effective verification actually works.
Reeves argues that too many organisations are still mistaking safety activity for safety effectiveness. The reporting may look tidy. The system may look busy. But if leaders cannot say with confidence that their critical controls are in place and working, the real risk to their people is still there.
That is where practical training becomes much more than a side offering. It becomes part of the solution.
How IMPAC is helping organisations build capability
IMPAC’s new Critical Risk training suite is designed around that real-world need.
Rather than treating critical risk as a vague concept, the programme builds capability at different levels of an organisation.
There are three key courses in the suite:
- Critical Risk Programme Governance helps directors, board members, chief executives and senior leaders understand how a critical risk programme works, how to interpret critical risk and control effectiveness reporting, and how to confirm that critical controls are functioning as intended.
- Critical Risk Management Fundamentals is aimed at the people responsible for building or improving the organisation’s approach. It gives health and safety managers, executives and operational leaders practical grounding in critical risk identification, assessment, control selection, documentation and programme design.
- Critical Control Verification focuses on the people who need to test whether controls are genuinely in place and working. It builds practical verification capability for H&S teams, advisors, supervisors, subject matter experts and others involved in checking control effectiveness.
A better conversation starts here
The point of the legislative shift is to sharpen attention on the things that matter most; to give organisations permission to cut through fluff and move away from form filling and box-ticking.
But at its core, this is about the most human question in health and safety: what are we doing to make sure our people go home safe, even when the work they do carries serious risk?
That's why, for Reeves, it's not just a technical H&S issue. It is a leadership issue.
Boards and executives should be asking much sharper questions about critical risks, critical controls, and what evidence actually underpins their confidence that they remain effective.
Less talk, more action.
Those businesses that build the capability to respond will make the most of this opportunity, come out stronger and with better protections for their workers.
If your organisation is trying to make sense of what this new era means in practice, here it is:
- Clearer priorities
- Better questions
- Stronger controls
- More credible capability across the business; and
- Better protected Kiwi workers.
And as Reeves sees it, that is the real opportunity in front of Kiwi businesses now: less theatre, less clutter, and much stronger confidence in the controls that help their people get home safely.