A hazard is something that has the potential to cause harm. Risk is the likelihood that the hazard actually will cause harm, combined with how severe that harm could be. A hazard is an inherent property of a thing or situation, while risk depends on your exposure to it. This distinction matters because the strategies for dealing with each are fundamentally different.
Hazard: The Source of Potential Harm
OSHA defines a hazard as “the inherent capacity of a substance to cause an adverse effect.” The key word is inherent. A hazard exists because of what something is, not because of what you do with it. Bleach is a hazard because its chemical properties can burn skin and damage tissue. That’s true whether the bottle is sealed in a cabinet or splashing around without gloves. The hazard doesn’t change based on the situation.
The European Food Safety Authority uses a simple illustration: a shark in the ocean is a hazard. It has teeth, speed, and predatory instincts. Those properties exist whether or not you ever go near the water. Lightning is a hazard. A wet floor is a hazard. Heavy machinery is a hazard. In each case, the thing itself carries the potential for harm regardless of the circumstances.
This is why chemical safety labels under the Globally Harmonized System (GHS) classify substances based on their inherent properties alone. A chemical labeled as a carcinogen carries that classification no matter how it’s stored or handled. The label tells you what the substance is capable of doing, not what it’s likely to do to you on any given day.
Risk: Likelihood Meets Severity
Risk adds two dimensions to a hazard: how likely you are to be exposed to it, and how bad the outcome could be if you are. The international workplace safety standard ISO 45001 defines risk as “the combination of the likelihood of occurrence of a work-related hazardous event or exposure(s) and the severity of injury and ill health that can be caused by the event or exposures.” In plainer terms, risk answers the question: given this hazard, how probable is it that someone gets hurt, and how badly?
Back to the shark example. The shark in the ocean is the hazard. Swimming with the shark is the risk. If you’re sitting on the beach, the hazard still exists, but your risk is essentially zero because your exposure is zero. Lightning is a hazard. Standing under a tall tree during a thunderstorm is a risk, because your exposure and likelihood of being struck just went up dramatically.
OSHA captures this relationship in a compact formula: risk equals hazard multiplied by exposure. A highly toxic chemical (severe hazard) locked in a sealed container with no human contact (zero exposure) presents very low risk. That same chemical in an open container on a workbench where people spend eight hours a day presents high risk, even though the hazard hasn’t changed at all.
How Risk Is Measured
Safety professionals evaluate risk using two scales: severity and likelihood. Severity describes how bad the worst realistic outcome could be, ranging from negligible (minimal threat) up through marginal (minor injury or property damage), critical (severe injury or illness), and catastrophic (death or total loss). Likelihood describes how often the hazard is expected to cause that outcome, from improbable (rarely encountered, unlikely to occur) up through remote, occasional, probable, and frequent.
These two scales are combined in a risk assessment matrix. A hazard with catastrophic severity but improbable likelihood might land in a medium risk category. A hazard with only marginal severity but frequent likelihood could rank as serious. This matrix gives organizations a prioritized list so they address the most dangerous situations first rather than treating every hazard equally.
The practical value here is resource allocation. No workplace can eliminate every hazard simultaneously, so risk assessment tells you where to focus. A chemical that could cause cancer but is encountered only in trace amounts behind sealed equipment is a lower priority than a wet walkway that causes slip injuries every week.
Why Confusing the Two Causes Problems
The Federal Transit Administration flags a specific and common mistake in safety planning: confusing hazards with consequences. If a safety team identifies “derailment” as a hazard when the actual hazard is “track defect,” they may fix the aftermath of one derailment without addressing the underlying condition that caused it. The track defect persists and produces new consequences: another derailment, a collision, or a service disruption.
When a consequence is mistaken for a hazard, resources get directed at a single outcome while other equally dangerous outcomes go unnoticed. The transit agency might spend its entire safety budget on derailment recovery procedures without ever inspecting the tracks. Similarly, if a workplace labels “back pain” as the hazard instead of “repetitive heavy lifting,” the response might be painkillers and rest rather than redesigning the lifting process.
Accurate identification matters because it determines what kind of control you apply. You control hazards by eliminating or changing them. You control risk by reducing exposure or adding protection. Mixing up the two leads to the wrong intervention.
Reducing Hazards vs. Reducing Risk
OSHA’s hierarchy of controls lays out five strategies, ranked from most to least effective. The top two target the hazard itself. The bottom three reduce the risk by limiting exposure.
- Elimination removes the hazard entirely. If a toxic solvent is causing respiratory problems, stop using it. The hazard no longer exists.
- Substitution replaces a hazard with something less dangerous. Swap the toxic solvent for a water-based cleaner. The hazard is reduced at its source.
- Engineering controls keep the hazard in place but prevent it from reaching workers. Ventilation systems, machine guards, and enclosed processes all fall here. The hazard still exists, but exposure drops.
- Administrative controls change how people work around the hazard. Training programs, warning signs, job rotation to limit time near a hazard, and updated procedures all reduce risk without touching the hazard itself.
- Personal protective equipment (PPE) is the last line of defense: gloves, respirators, hard hats, safety glasses. The hazard is fully present, exposure is possible, and the equipment is the only barrier.
The hierarchy exists because strategies that eliminate the hazard are inherently more reliable than strategies that depend on human behavior. A machine guard works whether or not the operator remembers to wear safety glasses. PPE only works if someone puts it on correctly every single time.
A Quick Way to Keep Them Straight
When you’re trying to distinguish between hazard and risk in any situation, ask two questions. First: what is the source of potential harm? That’s the hazard. Second: given how people interact with that source, how likely is harm and how bad could it be? That’s the risk. A loaded gun in a locked safe is a hazard with very low risk. The same gun on a coffee table in a house with children is the same hazard with dramatically higher risk. The object didn’t change. The exposure did.
This framing works across contexts, from workplace safety and chemical handling to food safety, environmental policy, and everyday decisions. The hazard is fixed by the nature of the thing. The risk is something you can influence through the choices you make about exposure, protection, and control.