Section 18B OSHA 1994: Risk Assessment Duty, HIRARC and Specialists

What does section 18B OSHA 1994 require?

Two things. Section 18B(1) requires a risk assessment of the safety and health risks your undertaking poses to anyone who may be affected at the place of work. Section 18B(2) requires you to implement the controls the assessment shows are needed to eliminate or reduce those risks.

Section 18B(3) defines risk assessment as “the process of evaluating the risks to safety and health arising from hazards at work and determining the appropriate measures for risk control”. Section 15 still requires every employer to ensure, so far as is practicable, the safety, health and welfare of employees.

Who must comply with section 18B, and since when?

Every employer, self-employed person and principal, with no minimum headcount. Act A1648 added section 18B, in force since 1 June 2024 under P.U. (B) 128/2024. The Act covers all places of work in Malaysia, including the public services and statutory authorities.

Only First Schedule work is excluded: domestic employment, the armed forces and work on board ships under the Merchant Shipping Ordinances. The five-employee threshold belongs to the OSH coordinator duty in section 29A; see our OSH coordinator guide.

How do you carry out a section 18B risk assessment with HIRARC?

Follow the DOSH Guidelines for HIRARC 2008, the general method listed on the DOSH risk assessment page. The employer assigns a trained person to lead a team that knows the process, and the team works through the four steps below.

1. Classify work activities by area, process stage or task (HIRARC 4.3.1).
2. Identify hazards in routine and non-routine work, using inspections, incident records and worker complaints (4.3.2).
3. Estimate the risk: likelihood (1 to 5) times severity (1 to 5), allowing for existing controls (4.3.3).
4. Control it: eliminate or substitute first, then engineering and administrative controls, with PPE last (section 5).

The DOSH FAQ describes the same sequence, and the DOSH Guidelines for HIRARC 2008 include the form and worked examples.

When is HIRARC not enough for section 18B?

When the hazard is a health hazard. DOSH states that the HIRARC 2008 method is intended for physical hazards, and that health hazards need guidelines designed for them. Noise and chemicals also carry their own legal assessment duties, so your HIRARC should lead to those assessments, not replace them.

These regulations, made under section 66 of Act 514, carry their own penalties: failing to identify excessive noise carries a fine of up to RM10,000, up to a year in prison, or both (regulation 3(3)). CHRA and exposure monitoring are Fifth Schedule activities reserved for registered competent persons (section 31B).

Your own staff can run an initial ERA after the Ergonomic Trained Person course. PRisMA asks employers to appoint a Psychosocial Trained Person; the guideline calls for appropriate training, not registration.

How should you document and review a section 18B risk assessment?

Section 18B lists no documents or review interval, so follow DOSH guidance. HIRARC 2008 says each assessment must be fully documented, signed by the person in charge of the area, endorsed by management, shared with employees and reviewed every three years or when processes change.

Keep one file per site: the HIRARC, specialist reports, an action plan with owners and dates, and proof that controls were carried out. It shows what you found and what you did, the substance of section 18B(1) and (2).

What is the penalty for breaching section 18B?

Under section 19, a fine of up to RM500,000, imprisonment of up to two years, or both. Act A1648 raised the maximum fine from RM50,000. Directors and managers can be charged together with the company under section 52 unless they can prove a defence. For a specific case, consult the Act or DOSH.

How do you choose who carries out the specialist assessments?

Check four things: the person’s DOSH registration for the activity, the scope against your HIRARC, the deliverables, and whether related work can share site visits. For CHRA and exposure monitoring, registration is a legal requirement under section 31B.

• Registration: the name and myKKP number of the person who signs the report, checked on the DOSH register.
• Scope: the areas, processes and hazards from your HIRARC, not a generic package.
• Deliverables: a written report with findings, recommendations and the follow-up the regulation requires.
• Sequencing: noise, chemical and ergonomic work at one site, planned together to cut repeat visits.

OSHMED Solutions Sdn Bhd in Kajang, Selangor, serves employers across Malaysia. OSHMed scopes and coordinates NRA, CHRA, CEM and ERA, carried out by a DOSH-registered assessor where the law requires one; every report names the assessor and their myKKP number. OSHMed also runs the DOSH-registered ETP course (SL/22/22/181036) and psychosocial risk assessment training for HR and OSH teams. See our assessments and training.

Before you decide: three common objections

Three objections come up when employers plan section 18B work: we already have a HIRARC, we are too small or just an office, and our safety officer can do it all. Each is checked below against the Act, the HIRARC guideline and the regulations.

"We already have a HIRARC, so we are covered."

Only for physical hazards, which is what DOSH says the method is for. Noise, chemical, ergonomic and psychosocial risks need their own assessments, and section 18B(2) requires controls to be implemented, not only listed.

"We are a small company, or just an office."

Section 18B has no headcount threshold. An office may have fewer hazards, but sitting work, workstation design and workload still belong in the assessment.

"Our safety and health officer can do it all in-house."

Your officer can lead the HIRARC. CHRA and exposure monitoring need a person registered for that activity (section 31B), and DOSH guidance expects trained people for ERA and PRisMA.

Frequently asked questions

Your next step

Run the self-check above against your HIRARC. Every hazard that needs its own DOSH method should get a specialist assessment, an owner and a date.

Then send OSHMed your HIRARC, chemical register or site layout on WhatsApp for one combined scope. If chemicals are on your list, start with our CHRA guide.

Sources and references

Disclaimer: This article is general information for employers and is not legal advice. Requirements depend on your workplace, processes and the current law. For a decision on your premises, speak to a DOSH-registered competent person or contact DOSH (JKKP).