What Are Acceptable Risk and Residual Risk?

Acceptable risk: what does the regulation say?

The aim of a risk assessment is not zero risk; in most jobs zero risk is not an achievable goal anyway. The aim is to eliminate every hazard and, where that is not possible, to reduce the risk to an acceptable level. This concept is defined in the legislation. Under Art. 4/1-b of the Regulation on Occupational Health and Safety Risk Assessment, the acceptable risk level is "the level of risk consistent with legal obligations and the workplace's prevention policy that will not cause loss or injury".

In practice, the three elements of the definition mean the following:

• Consistency with legal obligations. If a measure explicitly required by legislation has not been taken, the risk cannot be considered acceptable whatever the score. For example, the risk of a forklift whose periodic inspection has not been carried out is not acceptable, even if its score looks low.
• The workplace's prevention policy. The workplace draws the acceptance line itself and puts it in writing. Two factories can use the same method and set different thresholds; what matters is that the threshold is justified and consistent.
• Not causing loss or injury. The accepted risk is at a level that will not lead to harm under reasonably foreseeable conditions.

The regulation links this to a cycle: after risk control measures have been implemented, the risk level is determined again; if the new level is above the acceptable level, the control steps are repeated (Art. 10/3). For the order of the control steps, that is elimination, substitution and combating risks at source, see our article on the hierarchy of controls.

What is residual risk, and is it different from remaining risk?

Residual risk is the risk that remains after measures have been implemented. In practice it is used with the same meaning as "remaining risk". Although the regulation does not name this concept with a separate term, it requires its equivalent in the documentation: the risk assessment document includes the corrective and preventive control measures, the dates they were carried out and the risk level determined afterwards (Art. 11/1-ğ).

Residual risk has three sources:

1. A hazard that cannot be eliminated. The press ram, the hot furnace and the electrical panel stay where they are; the measure reduces the risk but does not remove the hazard.
2. The limits of the measure itself. When hearing protection is not worn correctly, or a light curtain is installed at the wrong distance, protection is lower than expected.
3. A new risk brought by the measure. The regulation requires that the measures applied do not cause new risks (Art. 10/2). A guard added to a machine that makes maintenance access difficult and creates a new risk is an example.

For the basic distinction between hazard and risk, see our article on the difference between hazard and risk.

Re-scoring residual risk: an example calculation

A common mistake in re-scoring is to lower all the factors because a measure has been taken. The right approach is to ask which factor the measure actually changes. The examples below are calculated with the Fine-Kinney method (probability × frequency × severity; R < 20 acceptable, 20–70 possible, 70–200 significant, 200–400 high, 400 and above intolerable).

Lessons from the table:

• Severity rarely changes. The fact that a person struck by a forklift could die does not change with the measure; what changes is the probability of the event and how often people are exposed to the hazard. If you claim to have reduced severity, for example because a speed limiter really has reduced the impact energy, write down the justification.
• The first round is not always enough. In the forklift example, the first measure reduced the risk from 1,200 to 200; this is a big gain but not acceptable. This is where the repetition required by the regulation comes in.
• "Training was given" does not lower the score on its own. Training is necessary; but if training is the only measure, it reduces probability only to a limited extent.

Risk acceptance criteria: who sets them, and where are they written?

The employer sets the acceptance criteria, but not alone. The risk assessment is carried out by a team set up by the employer, made up of the OHS specialist, the workplace physician, the employee representative, support staff and employees who know the departments (Art. 6). The criteria are discussed within this team, approved by the employer and written into the document. The regulation requires the method used in the analysis to be stated in the document (Art. 11/1-f); the acceptance threshold is an integral part of the method.

Well-written acceptance criteria include:

1. The method used and the threshold. For example, R < 20 in Fine-Kinney, or 1–6 points in a 5x5 L-type matrix, is acceptable.
2. Which side the class boundaries belong to. Is 70 points "possible" or "significant"? Ambiguity leads to the same risk being classified differently by different people.
3. The action and time frame for each class. In which class is work stopped, and in which class must a measure be taken within how many days?
4. A severity rule. Every row carrying a possibility of death or permanent harm is reviewed separately, whatever its score.
5. A legal requirement rule. If a measure explicitly required by legislation is missing, the risk is not considered acceptable regardless of the score.

Once written, the criteria are applied in the same way in all departments. Treating 60 points as "monitor" in one department and "urgent" in another undermines the reliability of the document.

Tolerable risk: the zone between the two extremes

In practice, another intermediate zone between acceptable and unacceptable is discussed: tolerable risk. For risk in this zone, the measures that can reasonably be applied at present have been taken, but opportunities for further reduction continue to be sought. In most workplaces, the "possible" and "significant" classes in Fine-Kinney and the "medium" class in the matrix correspond to this zone.

Tolerable risk is not indefinite acceptance. For proper management:

• Why the risk cannot be reduced further for now is written down (investment, technical feasibility, production constraint).
• The interim measure and how it is checked are defined.
• The date of the next review is set; in investment budget periods, these rows are taken up again as a priority.

Changes that require the risk assessment to be renewed, such as new equipment, a workplace accident, a near miss or measurement results, can also invalidate residual risk scores (Art. 12/2). We explained what to do when there is a change in our article on change management.

Communicating residual risk to employees

Residual risk is precisely the risk the employee needs to know about, because it is where the measures end and the employee's attention begins. Art. 16 of the regulation requires employees, employee representatives, and employees and employers coming from other workplaces to be informed about the risks that may be encountered in the workplace and the corrective and preventive measures. Art. 16 of Law No. 6331 on Occupational Health and Safety sets out the same obligation in general terms.

Do not think of informing as simply pinning a copy of the document to the noticeboard. The approaches that work are:

• A short risk card specific to the workstation: A one-page sheet with a few points and pictures, headed "The residual risks on this machine and what you need to do about them".
• Incorporating it into instructions: The rule to be followed against the residual risk appears as a clear step in the safety instruction.
• Job-specific risk training: The fourth topic group of basic training covers risks specific to the workplace; the residual risk list is the natural content of this training.
• Toolbox talk: A short reminder of the residual risk when conditions change.

When informing is done, it is recorded. Seeking the employee's views is also part of the process; the regulation requires employees to take part in every stage of the risk assessment and for their views to be sought (Art. 7/2).

Common mistakes

• Writing "care will be taken" in the measure column and lowering the residual risk.
• Lowering the severity score because PPE has been issued.
• Leaving the residual risk column blank or copying the initial score.
• Not writing the acceptance threshold in the document; leaving it to the reader to work out what "low" and "medium" mean.
• Keeping the residual risk only in the document and not explaining it to employees on site.

We support production businesses in Bursa and the surrounding provinces in setting up the risk assessment team and writing the acceptance criteria through our risk assessment service. For the whole process, see our article on how to carry out a risk assessment.

Frequently Asked Questions

Who sets the acceptable risk level?

The employer sets and approves it together with the risk assessment team. The threshold is written into the risk assessment document together with the method used and is applied in the same way in all departments.

Are residual risk and remaining risk the same thing?

Yes, in practice the two terms are used with the same meaning: the risk that remains after measures have been implemented. The regulation requires the risk level determined after the measures to be included in the document.

What happens if the risk is still high after a measure has been taken?

Under Art. 10/3 of the regulation, the control steps are repeated: a new measure is chosen, implemented and the risk is re-scored. This cycle continues until the risk falls to an acceptable level.

Is risk considered acceptable once PPE has been issued?

Not on its own. PPE is the last step, coming after collective protection measures. First, why the higher steps cannot be applied is assessed, and then the residual risk is re-scored realistically.