Confused about how to tackle airborne health risks? Philippa Gibson offers a simple management model and notes some common errors.

The common refrain is that health risk management is hard – harder than safety risk management. I want to challenge that belief – it’s different but not harder. Good health risk management is a combination of activities that need to work together to be effective.

Under the HSW Act 2015, PCBUs must eliminate (and if not eliminate, minimise) all risks associated with carrying out work. This includes work involving airborne health risks.

Health risk management must consider a number of aspects – identification, assessment, control, review – with exposure monitoring being just one of them.

PCBUs must understand and manage the risks of hazardous or toxic substances at work, so any limitations in their knowledge about these risks needs to be recognised and acted on.

The information belolw outlines the key elements of a good health risk management model you can apply at your place of work.

When I talk to people who are struggling with health risk management, certain common factors often come up. For example, they might be focusing on just one part of health risk management, not the whole. Or they might be focusing on things they know (eg exposures or health monitoring data) and ignore the things they don’t know, such as uncertainties in monitoring data or the effectiveness of controls.

Following are some examples of classic mistakes I’ve encountered.


A common observation is some workplaces have safety data sheets (SDS), but don’t read them. I was involved in a health risk management prosecution where the business had pages and pages of health and safety risk information in its SDS, but did not use this information to identify its chemical health risks. (The pictograms alone – see the ‘exploding chest man’ –could have alerted them to risk.)

Another common identification problem is not identifying dusts as health risks, especially food-related dusts such as flour dust and other allergenic foods or food additives; while another is assuming that only liquids and gases are hazardous substances.

Good health risk management means:

  • Acknowledging the health risks Safety Data Sheets are telling you are present. Read the descriptions of what the substance can do to a person.
  • Researching the potential health risks that could arise because of the process or activity – they may not be covered by an SDS. Not assuming it isn’t hazardous just because it may not be covered by hazardous substances regulations (eg food additives, flour dust and green coffee bean dusts are allergenic and can cause asthma)

Poor health risk management means:

  • Ignoring what the SDS is saying about health risk, and just having an SDS because ‘you’re supposed to’.
  • Not considering what additional health risks arise from the work done (eg does heating of chemicals, or a chemical reaction, cause an additional health risk?)If substances not covered by an SDS, or not supplied with one, are not hazardous.
  • Not identifying all health hazards, including physical, chemical, biological, psychosocial and ergonomic hazards.
[image] black silhouetted figure with white star pattern in their torso, surrounded by a red border.
Class 6.5A – Health hazard – used for respiratory sensitisers, carcinogens, reproductive toxics, mutagens, acute health risks via inhalation, chronic health risks via inhalation

Risk assessment

The key to health risk assessment for workers is the exposure they actually experience, which requires understanding exposures as workers move around the workplace and do different tasks. The type of exposure they experience may vary with different activities, and in different locations inside and outside. Their level of exposure will vary as they move closer to or further away from the health risk.

Mistakes occur when only a single set of data is used to make judgements around risk in situations where exposure varies considerably from day to day, job to job, or season to season.

Other mistakes I have seen in risk assessment include using outdoor dust measurements meant for resource consent purposes (environmental monitoring) to make judgements about worker health risk. The problem is that the environmental samples do not reflect the exposure experienced by the worker.

Another mistake I’ve seen more than once is using a gas meter to measure levels of a substance that can’t be detected on that meter. When the results show – not surprisingly – no reading, it is assumed there is no exposure and therefore no risk.

Good health risk management means:

  • Considering all the ways exposure could occur – on the skin, through the skin, inhalation, ingestion, injection.
  • Considering if some workers are more at risk from inhaling the substance (eg a substance that can have effects on reproductive ability, reproductive capacity, or can affect foetal development. Or, for people with asthma, a substance that irritates the lungs).
  • Exposure monitoring – engaging a competent person to develop a sampling strategy that will provide an adequate picture of workers’ exposure profiles. This will include the variation in exposure that will occur from different work patterns, differing work conditions, different work locations.
  • Assessing the effectiveness of current controls, eg assess if the extraction ventilation system is effective, if respiratory protection is doing what you expect it to do (suitable type and fit).
  • Considering the things that you can’t be sure about (uncertainties), such as can we say we always know what levels of exposure are, or do some things beyond our control affect the level of exposure?

Poor health risk management means: 

  • Only thinking of it affecting the skin, not of the vapour being inhaled.
  • If if it doesn’t smell or doesn’t smell strongly there is nothing in the air.
  • If if you can’t see dust, gas, vapour, fibre or mist there is nothing in the air.
  • Ignoring susceptible workers, or those who may be more at risk than other workers.
  • Not considering level of exposure (exposure monitoring) in determining if there is risk, or if risk is suitably managed, or in determining what type of controls should be used.
  • Focusing on exposure monitoring when there is clearly an exposure that needs controlling – exposure monitoring doesn’t control the exposure, it just measures it.
  • Applying exposure monitoring results to exposure standards without understanding the health risk basis of the exposure standard, or understanding good sampling strategy, or understanding the variation in exposure across the work or place of work.
  • Assuming the controls are working effectively but doing nothing to assess them.
  • Focusing only on the things you ‘know’ about the risk, and not considering the limitations of that knowledge (eg our health monitoring is showing no negative changes in lung function, but is that testing going to show changes caused by respiratory disease before it’s too late to do anything about it?)


It’s not uncommon for extraction ventilation (LEV) to be designed by in-house engineers who may not have the appropriate skills, such as the correct design of capture hoods. This is something the PCBU is likely to have to get outside expertise or advice on. The law is clear that controls used for managing health risks must be effective and fit for purpose. This means the design, testing and maintenance of LEV etc. must ensure it does what it is meant to – control the airborne contaminant and effectively manage the health risk.

Good health risk management means:

  • Applying the hierarchy of control and provide the highest level of protection.
  • Being aware of the limitations of PPE, and not going straight to PPE as a control. It’s at the bottom of the hierarchy because of its limitations.
  • Designing control systems based on good risk assessment data.
  • Assessing and maintaining control systems to ensure they are working effectively.
  • Ensuring PPE when used fits correctly, is the right type for the exposure and provides a suitable level of protection compared to the level of exposure.
  • Providing training, information and supervision to workers to ensure controls are used effectively.

Poor health risk management means:

  • Going straight to PPE as the form of control without considering the need for higher levels of protection.
  • Assuming every worker can and should use respiratory protection – those with cardiovascular or respiratory disease, for example, should have a medical assessment before being cleared to use respiratory protection.
  • Not considering the limitations of PPE or the additional risks they can introduce (eg respiratory protection + physical work + hot work conditions = heat stress risk).
  • Designing and installing control systems (eg extraction ventilation, or isolation) without understanding good design for control of airborne substances, nor understanding how that substance behaves in air in that workplace or for that job or activity.
  • Assuming the control systems are working and effective without any verification, testing, or maintenance of those controls.


I have seen workplaces regularly gather exposure and health data that indicate controls are not working, or that workers may be getting harmed, but nothing is done in response to those red flags.

A common response I hear from PCBUs is something like: “Sure we have a number of workers with reduced lung function, but they are smokers – they are doing this to themselves, so it’s unfair to expect me to control exposure to respiratory health risks when they are wrecking their own lungs anyway.”

PCBUs might not have control over what workers do or expose themselves to out of work, but they do have complete control over the workplace (workers not following reasonable instruction aside) and have a responsibility for managing health risk at work. If health monitoring shows an adverse change in health, it is a red flag to review controls. If that review comes back showing all parts of the health risk management system are working effectively to manage risk, then that change in health is unlikely to be as a result of damage caused in that workplace.

Good health risk management means:

  • Regularly reviewing controls to ensure they are effective (eg testing ventilation systems).
  • Reviewing controls if anything indicates they are not working (eg worker complaints, health effects occurring).
  • Doing appropriate health monitoring, understanding its limitations, and treating it as a tool to prove that controls are effective rather than as a tool to show you if something is going wrong.
  • Doing exposure monitoring to verify that controls are effective at managing workers’ exposure.

Poor health risk management means:

  • Not reviewing controls or maintaining them.
  • Not responding to complaints or red flags that suggest exposure is not controlled.
  • Treating health monitoring as a way of identifying if something is going wrong, i.e. waiting for adverse effects to show up before doing something about controlling risk.


Philippa Gibson is principal scientist work-related health with WorkSafe New Zealand.

First published in the Jan/Feb edition of Safeguard magazine(external link).