JSA vs Risk Assessment: What’s the Real Difference?

Ask five EHS professionals what separates a Job Safety Analysis from a Risk Assessment, and you’ll probably get five different answers; we’ve heard most of them ourselves. Some people use the two terms like they mean the same thing. Others think one document can just cover for the other one, which it rarely does well.

So what’s the actual difference between JSA vs RA? Let’s find out.

They’re related, and that’s probably why they get confused so much. But they cover different scopes, get used at different points in a project, and involve different people. When a site mixes the two up, it ends up with real gaps in how it manages risk.

A Job Safety Analysis takes one task and breaks it into steps. Then, for each step, you work out the hazards and set the controls needed to do that step safely. You’ll also see it called a Job Hazard Analysis (JHA); the two terms generally mean the same thing.

That’s the whole idea behind JSA safety: before a worker starts the task, somebody has already thought about what could go wrong at each stage and put a control in place for it.

A well-built JSA usually has:

The narrow scope is on purpose. A JSA for, say, “a manual transfer of a corrosive chemical from drum to mixing tank” covers that one task, not the whole storage yard.

In the US, you’ve got OSHA’s general industry PPE standard (29 CFR 1910.132(d)), and that’s the one that applies here. It requires employers to assess the workplace for hazards that require PPE, and then they have to confirm that assessment with a written certification. That certification names the workplace evaluated, the person certifying it, and the date of the assessment, so three things in total. The certification must identify the workplace evaluated, the person certifying the assessment, the date or dates of the assessment, and the document as a certification of hazard assessment. A JSA is a useful way to identify task-specific PPE needs, but it does not automatically satisfy every requirement of the standard.

Most sites also use JSAs for:

Most often a risk assessment works at a bigger level than that. It looks at a broader activity, a process, or a whole work area, and it identifies the hazards across all of it, then evaluates them and works out which ones to prioritize. So the questions are things like what could cause harm and how likely it is to happen. And how bad would it be if it did, and what would bring that risk down to an acceptable level?

It sits more at the management and planning level; honestly, that’s the main difference. A risk assessment is the document a site uses to decide where the money goes, whether that ends up being controls, engineering changes, or extra supervision on the job.

A workplace risk assessment generally includes:

So what triggers a risk assessment? Usually it’s one of these:

People also get tripped up by “task risk assessment.” Some organizations use it loosely for a JSA, since both zoom in on one task. But the terms aren’t universally interchangeable, and a task risk assessment can follow a different method. What matters more than the label is that the assessment covers the right scope and lands on controls that work.

A lot of organizations rate risk as likelihood times severity. The 5×5 matrix is one common format for this: you give likelihood a score from 1 to 5 and severity a score from 1 to 5, multiply the two together, and then band the result into Low, Medium, High, and Critical. Pretty simple, really. Nothing forces you to use this exact matrix, though, so whatever you go with, your site’s risk procedure should spell it out. And when the RA and the JSA share one scoring method, they speak the same language, and that’s what you want.

This is the workflow we’d recommend. It’s good practice, not a regulatory sequence:

Let us look at the common mistakes.

Using a JSA in place of a site-wide RA happens more than it should. A site can have dozens of well-written JSAs and still be blind to systemic risk, because nobody has ever assessed the whole operation, so that’s dozens of JSAs and not one look at the full picture.

So the risk assessment reads like a list of hazard categories, with no specific controls and no owners. A risk assessment like that won’t hold up in an audit, and it won’t change anything on site either, which makes it pretty useless.

ISO 45001 puts a lot of emphasis on worker consultation and participation. OSHA guidance recommends involving workers too, in hazard identification and in job hazard analyses. And that makes sense because their practical knowledge can reveal hazards that a desk-based review might miss; the people doing the job see things you won’t spot from a desk.

Let us take chemical storage and handling at a site and look at it at both levels.

Risk Assessment sheet: Chemical Storage and Handling at Site

The risk assessment covers the full activity: receiving drums, storage, dispensing, transfer, spill response, and waste disposal. One line item in it reads:

Manual/pump transfer of corrosive chemicals between containers (e.g. drum to mixing tank), rated High risk, with a note pointing to a linked JSA for task-specific controls.

JSA sheet: Manual Transfer of Hydrochloric Acid from Drum to Mixing Tank

The JSA picks up that one line and expands it into sequential steps, from the pre-task equipment check to PPE removal and handwashing. Every step covers its own hazard and control. We also scored each step here, but that’s a procedure choice, not a must for every JSA.

Illustrative example only. These sheets show how a risk assessment and a JSA connect. They are not an approved procedure for transferring hydrochloric acid at your site.

Our web-based and mobile-ready HSE software solutions are a comprehensive platform for small, mid-size, and large enterprises to streamline EHS processes and standardize information management.

Solve your EHS challenges and streamline safety operations with our help.