Formal vs field level hazard assessment: the difference auditors care about

The one line version

The formal assessment is the thinking. The field card is the checking. One decides what the controls for a task should be, and the other confirms those controls are actually in place this morning, on this site, with this crew.

If you want both documents defined properly, with a side by side comparison of who writes each one, how often, where it lives and what an auditor checks on each, that is on the hazard assessment overview. The FLHA page goes deeper on the card itself. This page is about the part almost nobody builds: the connection between the two.

Why auditors care about the link, not the documents

An auditor can read a competent formal hazard assessment, then read a competent field level card, and still write a finding. That surprises people. Both documents were fine. The system was not.

The question being answered is not "do you have hazard assessments". It is "does your hazard assessment process work as one process". A formal assessment nobody ever references is a document written for a binder. A field card that references nothing is a daily guess by whoever showed up. Both can look tidy on their own.

Here is what gets checked, specifically:

• Does the field card cite the formal assessment it came from? A reference number and a version, written on the card. This is usually a blank line or an absent line, and it is the fastest tell in the whole program.
• Do the hazards on the card correspond to the ones the formal assessment identified? If the assessment for a task lists a set of hazards and the card lists unrelated ones, the crew is not working from the assessment. They are working from memory, and the assessment is decoration.
• When a card raised something new, did the formal assessment get reviewed? The auditor will pull cards, find one where somebody wrote down a hazard the assessment never anticipated, then go looking for the review that should have followed. Most of the time there is nothing to find.

Several of your certifying partner's audit elements draw evidence from the same small set of documents. So a weak link between the formal assessment and the field card does not cost you in one place. It costs you in more than one, for what is really a single missing habit. Fix this before you touch anything else, because it is cheap and it moves more than one number.

The loop most programs never close

This is the full cycle. Read it once and you will know exactly where your own program stops.

1. The formal hazard assessment is written with the workers who actually do the task. Not alone at a desk. An auditor reads the participant list first, and a document written in isolation is obvious from across the room.
2. Controls are decided using the hierarchy. Eliminate, substitute, engineer, administer, then personal protective equipment. The task is rated before controls and again after, so the residual risk is visible.
3. The assessment gets a reference number, a version and a date. Without those, there is nothing for a card to point at.
4. The field level card references it. Task, reference number, version. The crew has the controls in front of them and their job is to confirm each one is in place today.
5. The crew finds something the assessment did not anticipate. New guard, frozen ground, another trade in the same space, a different pump, wind. This happens constantly and it is the entire reason field level assessments exist.
6. The card records it, along with whatever control the crew used to keep working safely, or the decision to stop.
7. That record triggers a review of the formal assessment. Somebody reads the card, sees the new hazard, and opens the assessment for that task.
8. The assessment is updated and dated, and the change is communicated to everybody who does that task.
9. The next card references the updated version. The loop is closed and the program has learned something.

Step seven is where it breaks, almost every time. The crew does the hard part. They notice the thing, they write it down, they hand the card in. Then the card goes in a folder and the formal assessment is untouched.

In an audit, that gap reads as a program that generates paper but does not respond to it. The auditor can point at the exact card and the exact assessment and show that one did not affect the other. On site the cost is worse: the next crew rediscovers the same hazard from scratch, and the crew that reported it learns that writing things down changes nothing. That is how a card becomes a signature exercise.

Which document answers which question

A worked example of the loop working

A small crew is doing a routine pump change at a facility. The task has a formal hazard assessment written with the operators who do it, listing the isolation steps, the lifting method, and manual handling as a rated hazard with a two person lift as the control.

They pull the card, write the assessment reference and version on it, and walk the site. Then they find something. A guard was installed on the adjacent skid over the winter, and it now sits exactly where one worker used to stand to take the weight. The two person lift the assessment describes is no longer physically possible in that space.

They stop, talk it through, and use a come along and a sling instead of lifting by hand. They write it on the card: new guard on the adjacent skid, normal lifting position blocked, mechanical lift used instead. Everybody signs. Job done, nobody hurt.

The supervisor reads the card that evening, which is the step most programs skip. He flags it, and the formal hazard assessment for the pump change is opened the following week. The lifting hazard is re rated, the control changes from a two person manual lift to a mechanical lift with a named piece of equipment, the required equipment list is updated, and the assessment is versioned and dated. Everybody who does that task is told at the next toolbox talk.

The next pump change card references the new version, and the crew arrives with the come along already on the truck instead of discovering the problem again. That is the whole loop. When an auditor later asks how a hazard found in the field changed the program, that company has a card, a dated revision and a training record that line up. It is a far stronger answer than a policy sentence saying reviews happen when required.

What to fix first if this is broken in your program

In this order, because each step depends on the one before it.

1. Fix the formal assessments so they name your real tasks. Generic assessments from a purchased binder are identified immediately and nothing downstream can reference them honestly. Start with your highest risk and most frequent tasks, not with all of them.
2. Add the reference field to the field card. Task name, assessment number, version. It is one line and it closes the visible half of the gap.
3. Give one named person the job of reading the cards. Not filing them. Reading them, weekly, looking for anything the assessment did not anticipate. Without this, nothing else in the loop can fire.
4. Create the trigger that turns something new on a card into a dated review. Write down who decides, how fast, and where the review gets recorded.

Be honest about that last one. The first three steps are paperwork and can each be done in an afternoon. Step four is a process problem, and it is the one that actually fails. It asks somebody to change what they do every week, forever, and no template will do it for them.

The COR audit readiness checklist walks the rest of your program the same way, and what documents a COR auditor asks for shows what a weak version of each document looks like next to a strong one.

Both templates

Direct downloads, no email required, in print ready PDF and editable DOCX.

The card has a formal hazard assessment reference field on it for exactly the reason described above. It sits under the job details so that filling the card out properly forces the link to exist. The full template library has the rest, including the corrective action tracker you will need once you start acting on what the cards tell you.

Neither document is difficult, and most companies already have both in some form. What is missing is the wiring between them, because no form asks for it and no software enforces it. It has to be somebody's job. Decide whose, write it down, and you have fixed the most common weakness in an otherwise decent safety program.