Oil & gas contractors get cited not because the hazard wasn't identified—because nobody documented how they identified it.
Here's what actually happens during a third-party ISO 45001 audit at an upstream drilling contractor: the auditor asks to see the hazard identification and risk assessment (HIRA). The safety coordinator pulls up a spreadsheet—sometimes a nice one, color-coded by risk level—and slides it across the table. The auditor looks at it, nods, and then asks one question: "How did you get here?" That's where the audit gets uncomfortable.
The spreadsheet exists. The hazards are listed. Dropped objects on the drill floor, H₂S exposure during well servicing, struck-by from pipe handling, confined space entry into production vessels. All of it is there. But the process that produced that list? Nobody can explain it. There's no methodology documented. No record of who participated. No evidence that the rig crew—the derrickhand, the floorhands, the company man—had any input at all. Just a document that appeared, was signed by a safety manager, and got filed.
That's the citation. Not the missing hazard. The missing process.
ISO 45001 Clause 6.1.2 doesn't just ask organizations to produce a list of hazards. It requires a systematic, documented methodology for identifying hazards—one that's proactive, not reactive, and that considers how work is actually performed, not how it's supposed to be performed on paper.
For a pipeline contractor running inline inspection crews or a well servicing company managing coiled tubing units, that means the HIRA process has to account for:
Most organizations have a HIRA output. Very few have documented evidence that they followed a repeatable, participatory process to generate it. That gap is exactly what auditors are trained to find—and it's exactly what OSHA inspectors leverage when they show up after a well site incident and ask to see your hazard identification program.
Most safety coordinators at upstream drilling contractors assume the citation risk is in identifying the wrong hazards. That's the wrong assumption. The real problem is that the hazard identification process itself has no paper trail—and without a paper trail, the process legally doesn't exist.
Picture a three-well pad in the Permian Basin. The well servicing crew has been on this operator's locations for two years. They know the hazards. The lead operator can walk you through every one of them. But during a post-incident OSHA inspection after a floorhand takes a struck-by from a traveling block, the compliance officer asks for records showing that hazard was formally identified, assessed, and that controls were verified. What they find: a HIRA spreadsheet that hasn't been updated in 18 months, no sign-in sheet or meeting record showing crew participation in the assessment, and a JHA template that was filled out but never tied back to the HIRA.
That's a Serious violation. Under current OSHA penalty structure, a Serious violation runs up to $16,131 per instance. If it's a Willful or Repeat classification—and if the prior audit showed the same gap—that number climbs to $161,323. The H₂S monitor was in place. The SDS was in the gang box. The hazard was "identified" in someone's head. None of that matters without the documentation proving the process was followed.
For an oil and gas contractor operating across multiple wellsites with rotating crews, a defensible HIRA process has specific, traceable elements:
The HIRA and the JHA are not the same document. The HIRA is the strategic-level hazard register. The JHA is the task-level tool. Both need to exist, and they need to visibly connect to each other. Auditors look for that thread. When it's missing, that's the finding.
Upstream drilling and pipeline operations are not static environments. A workover rig that was running tubing replacement last month is running a perforation job this month with completely different explosive and pressure hazards. If the HIRA review cycle is annual and it doesn't trigger on operational changes, it's already out of date.
ISO 45001 requires the hazard identification process to be proactive and to reflect actual conditions. A static HIRA that hasn't been touched since last year's audit is not a compliance document—it's a liability document. The absence of a dated review record, even a simple one, is what turns a paperwork gap into a citation.
Clause 6.1 of ISO 45001 covers hazard identification, risk assessment, and determining opportunities for improvement. For upstream drilling, pipeline, and well servicing contractors, it's the backbone of the entire occupational health and safety management system. Without a documented, participatory process for identifying hazards, the rest of the safety program has no defensible foundation—and auditors, clients, and OSHA inspectors will all find that gap eventually.
The standard requires documented information showing that hazard identification considered routine and non-routine tasks, human factors, changes in operations, and historical incident data. Participation records, a written methodology, and evidence of periodic review tied to operational changes are the minimum. A color-coded risk matrix without any of those supporting records is not sufficient.
OSHA doesn't cite ISO 45001 directly, but a failed or undocumented hazard identification process creates direct exposure under OSHA's General Duty Clause and specific standards (PSM, confined space, etc.). After a serious incident, the absence of a documented HIRA process is exactly the kind of finding that elevates a citation from Other-Than-Serious to Serious or Willful classification.
ISO 45001 doesn't specify an interval—it requires review at planned intervals and whenever there's a change that could affect OHS risks. For upstream operations, that means whenever equipment changes, new crews come on, well conditions shift, or any near-miss or incident occurs that suggests a hazard wasn't adequately controlled. Annual review alone is rarely defensible in an active drilling environment.
If maintaining the documentation trail for your hazard identification program is eating hours your safety coordinator doesn't have, that's the part we handle. Talk to EHS, Inc. — we keep the records current so the process is always audit-ready, whether the auditor is a third-party ISO body or an OSHA compliance officer standing at your gate.
Aaron West
Founder, EHS, Inc. — 18+ years in EHS compliance and contractor safety
Aaron West has spent over 18 years helping contractors and businesses navigate OSHA compliance, ISNetworld® certification, and workplace safety management. He founded EHS, Inc. to make enterprise-level EHS accessible to companies of all sizes — serving contractors and businesses nationwide — without long-term contracts or enterprise overhead.
Our team handles the complexity so you can focus on running your business. No long-term contracts, no learning curve.
Talk to EHSUtility safety managers learn the hierarchy of controls from a standard. Here's what they miss by never learning it from the field.
Turnover and subcontractor layering don't just thin your workforce—they silently collapse the near-miss data your triangle depends on.
Most refinery turnaround contractors self-assess at Independent. OSHA's inspection results tell a different story.
Framework to achieve zero incidents
Stop hitting paywalls
54 topics in English & Spanish