A common mistake when completing a workplace risk assessment is to identify a hazard and immediately suggest a new control.
But before deciding what needs to change, it is important to understand what controls are already in place and whether they are actually working.
An existing control might look appropriate on paper but may not work consistently in practice. It could be poorly maintained, ignored by workers, difficult to use, or no longer suitable because the activity has changed.
For learners developing NEBOSH GIC2 practical skills, reviewing existing controls is therefore an important part of understanding the difference between what a workplace currently does and what it may need to do better.
This article explains a practical way to review existing controls without turning the process into a ready-made assessment or report.
What Are Existing Controls?
Existing controls are the measures already being used to prevent or reduce exposure to a workplace hazard.
Depending on the situation, they might include:
- Physical guards or barriers
- Machine safety devices
- Local exhaust ventilation
- Safe working procedures
- Training and instruction
- Supervision
- Inspection and maintenance
- Restricted access
- Warning signs
- Personal protective equipment (PPE)
The important point is that an existing control should reflect what is actually present, not what you think should be present.
For example, if workers handling a particular substance are provided with gloves, the gloves are an existing control. They should not automatically be listed as a further action simply because PPE is involved.
The next question is whether that control is suitable and effective for the actual risk.
Why Review Existing Controls First?
Risk assessment is about understanding risk and deciding how it can be controlled. HSE guidance recommends identifying hazards, considering who may be harmed and how, evaluating risks, and reviewing whether controls remain appropriate.
Reviewing existing controls first can help you avoid two opposite problems:
Adding unnecessary actions when existing controls are already adequate.
Missing important improvements because an existing control appears effective but is unreliable or insufficient.
For NEBOSH learners, this distinction is particularly useful because practical assessment work should be based on what is actually observed in the workplace.
Step 1: Identify What Control Already Exists
Start with the workplace observation.
Ask:
What is already being done to control this hazard?
For example, suppose pedestrians and forklifts operate in the same warehouse.
Existing controls might include:
- Marked pedestrian walkways
- Forklift routes
- Warning signs
- Driver training
- Site speed limits
Do not immediately decide that these controls are sufficient or insufficient.
First, record what is actually there.
Step 2: Check Whether the Control Is Being Used
A control can exist without being consistently used.
For example, a workplace may have a designated pedestrian walkway, but workers may regularly step outside it to take shortcuts.
This creates an important distinction:
Control exists: A pedestrian route has been marked.
Control in practice: Workers consistently use the designated route.
The second question is therefore:
Is the control actually being followed during normal work?
This is where workplace observation becomes valuable.
Step 3: Check Whether the Control Is Reliable
A control should not be judged only by whether it exists.
Consider how reliably it performs its intended function.
For example, a physical guard on machinery may be a strong engineering control. But if the guard is damaged, loose, or routinely removed, its reliability is reduced.
Useful questions include:
- Is the control available when needed?
- Does it function as intended?
- Is it regularly inspected?
- Is it maintained?
- Can workers easily bypass it?
- Does it depend heavily on individual behaviour?
- Has its effectiveness changed over time?
These questions help you move from simply listing controls to actually evaluating them.
Step 4: Consider Maintenance
Some controls depend on regular maintenance to remain effective.
Examples include:
- Machine guards
- Emergency equipment
- Ventilation systems
- Lifting equipment
- Electrical protection
- Barriers and handrails
- Safety devices
If a control requires maintenance, consider whether there is evidence that maintenance is taking place.
A control that was effective when installed may become less reliable if it is damaged, poorly maintained or no longer suitable for the workplace.
Step 5: Look at Supervision
Supervision can influence whether administrative controls are followed.
For example, a workplace may have a procedure requiring workers to use a particular access route. If supervisors routinely observe and correct deviations, the control may be better supported than if the procedure simply exists in a document.
However, supervision should not automatically become the answer to every hazard.
Ask:
Why is supervision needed, and what part of the control does it support?
If a physical engineering solution can remove or reduce the risk, relying entirely on supervision may not be the strongest approach.
Step 6: Check Whether the Control Matches the Hazard
An existing control should address the actual source of risk.
Consider a cleaning activity involving chemical exposure.
An assessment might identify:
- Chemical product
- Potential exposure route
- Existing ventilation
- Existing storage arrangements
- Existing PPE
- Worker instructions
Simply stating that “PPE is provided” does not establish that the overall risk is adequately controlled.
You need to consider whether the controls address the relevant exposure and whether additional measures are reasonably needed.
This is where understanding the hazard → exposure → harm → control relationship becomes useful.
For broader background, see SFAST’s Hazard vs Risk guide.
Step 7: Consider How Much the Control Depends on People
Controls that rely heavily on people behaving correctly can be affected by:
- Lack of understanding
- Distraction
- Time pressure
- Poor supervision
- Inconsistent enforcement
- Worker turnover
- Changes in work activities
This does not mean administrative controls or training are ineffective. It means their limitations should be recognised.
For example, telling workers to avoid a hazardous area may be less dependable than physically preventing unnecessary access.
This is one reason the hierarchy of controls is useful when considering whether further action is needed.
You can explore this principle in more detail through SFAST’s Hierarchy of Controls guide.
Step 8: Ask Whether the Workplace Has Changed
A control that was appropriate previously may become less effective after a change.
Think about changes such as:
- New equipment
- New chemicals
- Different working methods
- Increased workload
- Changes in staffing
- Changes to workplace layout
- New contractors
- Changes in production or operations
For example, a pedestrian segregation arrangement may have been suitable when a warehouse had limited vehicle traffic. If vehicle movements increase significantly, the original arrangement may need to be reassessed.
Risk assessment should therefore reflect the current workplace, not an outdated version of it.
Step 9: Identify the Gap Before Suggesting an Action
Once you have reviewed an existing control, ask:
What is missing, unreliable or insufficient?
This is the key step.
Suppose you observe that a machine has a guard.
Instead of immediately writing:
“Install a machine guard.”
you should first establish that a guard already exists.
Then consider:
- Is it correctly fitted?
- Is it damaged?
- Is it suitable for the machine?
- Is it routinely removed?
- Is maintenance carried out?
- Can workers access the danger zone despite the guard?
The further action should respond to the actual gap, rather than assuming that no control exists.
Existing Control vs Further Control
These two concepts should not be confused.
| Existing control | Further control |
| Already implemented | Proposed additional improvement |
| Based on workplace observation | Based on an identified gap |
| Describes the current situation | Describes what should change |
| May be effective | Intended to reduce risk further |
| Should be evaluated | Should be specific and practical |
For example:
Existing control:
A marked pedestrian route is provided.
Observation:
Workers regularly cross through an active vehicle route instead.
Further-control thinking:
Consider what additional measure could improve physical separation or prevent unnecessary interaction between pedestrians and vehicles.
The point is not to copy this example into an assessment. It demonstrates the reasoning process you should apply to your own workplace.
Do Not Assume “Existing” Means “Effective”
One of the most important lessons is:
Presence does not equal effectiveness.
A workplace may have:
- A procedure that workers do not follow
- PPE that is unsuitable or poorly maintained
- A guard that has been damaged
- Warning signs that are ignored
- Training that does not address the actual task
- A designated route that is routinely obstructed
Therefore, when reviewing an existing control, consider both:
Is it present?
and
Is it working as intended?
Do Not Automatically Replace Existing Controls
Another common mistake is treating every existing control as something that needs to be removed.
The purpose of a risk assessment is not to produce as many new actions as possible.
Instead, consider whether the current arrangement:
- Addresses the hazard
- Is implemented in practice
- Is reliable
- Is maintained
- Is understood and followed
- Remains suitable for the current activity
If it is working effectively, it may simply need to remain in place and be monitored or reviewed as appropriate.
If there is a gap, then further action should address that gap.
Use the Hierarchy of Controls to Challenge Your First Idea
When you identify a need for further action, do not automatically jump to:
- More PPE
- More signs
- More training
- More supervision
Ask whether a stronger control is possible.
The hierarchy of controls generally prioritises approaches that eliminate or reduce the hazard at source before relying more heavily on administrative measures or PPE.
For example, if workers are repeatedly exposed to a hazardous process, consider whether the process itself can be changed before deciding that workers simply need additional protective equipment.
This approach can help learners develop better control-selection reasoning.
A Simple Existing-Control Review Checklist
For each hazard you observe, ask:
What exists?
What controls are already in place?
Is it being used?
Are workers actually using the control as intended?
Does it work?
Does it reduce exposure to the hazard?
Is it reliable?
Could it fail, be bypassed or become ineffective?
Is it maintained?
Does the control require inspection, testing or maintenance?
Is it understood?
Do workers know how and when to use it?
Has anything changed?
Is the existing control still suitable for the current activity?
What is the gap?
What specific issue remains after considering the existing controls?
What could improve it?
What practical further action could reduce the remaining risk?
This sequence helps prevent the common habit of jumping directly from hazard identified to new action required.
How This Helps With NEBOSH GIC2 Practice
For GIC2 practical preparation, learners need to develop the ability to connect workplace observations with sensible risk controls.
That means looking beyond labels such as:
“Manual handling”
or
“Machinery”
and examining what is actually happening in the workplace.
You should be able to distinguish between:
The hazard: What has the potential to cause harm?
The exposure: How are people coming into contact with it?
Existing controls: What is already reducing the risk?
The gap: What is not working or what remains insufficient?
Further control: What practical improvement could reduce the risk?
This is more useful than trying to memorise a list of controls.
SFAST’s NEBOSH Risk Assessment Practical Guide can be used alongside this article for the wider practical assessment process.
Avoid Writing Controls That Are Not Based on Your Observation
One of the easiest ways to weaken practical risk assessment work is to start with a generic list of controls and then try to fit them to the workplace.
Instead, work in the opposite direction:
Observe → identify → evaluate → improve.
Your workplace observation should drive the control recommendation.
If you did not observe a particular condition, do not automatically assume that it exists.
Likewise, if a control is already present, do not list it as a new action simply because it appears in a generic example.
Use Examples to Learn the Process, Not to Copy
Examples are useful for understanding how existing controls and further controls differ.
However, your own practical work should be based on the workplace you are assessing and your own observations.
NEBOSH’s official International General Certificate resources should be treated as the reference point for current qualification and assessment requirements.
A good learning approach is to use examples to understand how to think, rather than looking for completed entries to reproduce.
Final Thoughts
Reviewing existing controls before suggesting new actions helps make risk assessment more realistic.
Instead of assuming that every hazard needs a completely new control, look carefully at what the workplace already has.
Ask whether the control is present, whether people use it, whether it works, whether it is maintained, and whether it remains suitable for the current activity.
Then identify the actual gap.
This approach helps you develop stronger practical HSE judgement and makes it easier to suggest further controls that are specific, relevant and connected to the workplace.
For broader preparation, visit SFAST’s NEBOSH Risk Assessment Practical Guide and Risk Assessment Guide.
If you are preparing for NEBOSH GIC2 and want support understanding the practical assessment process, consider seeking guidance from an appropriate SFAST learning advisor after working through the relevant study resources.