Form 04 is the one people fill in last and should fill in first. It is the site-specific risk assessment in the SafeWork NSW Housing Industry Site Safety Pack, and it is meant to be the document that finds the hazards which everything else then deals with.
Done properly it makes the SWMS easier to write, because the high risk items are already identified. Done as a formality it produces a page of generic hazards that helps nobody and makes the rest of the pack look like paperwork.
Complete it in the NSW WHS Form 04 site-specific risk assessment. For how the three forms move together, see the HIISP site pack guide, and for the high risk method itself, when is a SWMS required in NSW. Browse NSW building forms for the rest of the pack.
What is a site-specific risk assessment?
It is the record of what is hazardous about this particular site, at this point in the job. Safe Work Australia frames risk management as identifying hazards, assessing risks, controlling risks, and reviewing controls, and the risk assessment is where the first two happen in a form you can hand to someone.
The word doing the work is "site-specific". A generic residential construction hazard list applies to every job in the state, which means it describes none of them. The value is in what is true about this address: the neighbour's carport two metres from the boundary, the service pit under the temporary access, the fact the block falls away sharply at the rear.
That specificity is also what makes the document defensible. A risk assessment naming real conditions demonstrates that someone looked. One naming hazard categories demonstrates that someone had a template.
Walk the site first
The single biggest difference between a useful Form 04 and a filed one is whether anybody walked the ground before writing it.
Things worth noting on the walk: access and egress including how materials get in, ground conditions and levels, overhead and underground services, neighbouring structures and boundaries, existing structures and their condition, weather exposure, and what other trades are doing or about to do.
Take photographs. They cost nothing, they anchor the assessment to a moment in time, and they are useful when a condition changes and someone asks what it looked like before.
Bring the people who will do the work if you can. They notice different things, and a hazard identified by the person who has to work around it is more likely to be controlled in a way that actually happens.
Writing hazards that mean something
The recurring failure is hazards written as categories rather than conditions.
The same applies to the ones people write on autopilot. "Manual handling" appears on almost every risk assessment in the country and almost never says what is being handled, how heavy it is, or where it has to go. If the assessment cannot answer those, it is not assessing anything.
A short assessment full of real conditions beats a long one full of categories. Nobody reads the long one anyway.
Controls that will actually happen
A control is what you will do about the hazard, which means it has to be something achievable on this site with the people and equipment available.
The hierarchy matters here. Eliminating or engineering out a hazard beats relying on people to behave correctly, and PPE is the last line rather than the first answer. An assessment where every control is "wear PPE" and "be careful" has identified hazards and controlled none of them.
Name who is responsible and when it happens. A control with no owner is an intention. "Edge protection installed by the builder before roof work starts, confirmed by site supervisor" is a control someone can be held to.
Where a control depends on someone else, that is worth recording explicitly. A lot of residential site risk sits in the gap between what a subcontractor can do and what the principal contractor has to arrange.
How Form 04 feeds Form 05 and Form 06
The three forms are designed to move together, and the chain is what makes the pack coherent.
The risk assessment finds the hazards. Where those hazards involve high risk construction work, they become the subject of a SWMS, which sets out how that specific activity will be done safely. The toolbox talk record then documents that the crew was actually told about both.
Reading the three together should tell a consistent story. A SWMS covering a high risk activity that appears nowhere in the risk assessment suggests one of the documents was written in isolation. So does a risk assessment identifying a serious hazard that no SWMS or control ever addresses.
Keeping the organisation and site details consistent across all three is a small discipline that makes the pack readable as a set rather than three unrelated pages.
When should you update it?
Whenever the site changes in a way that changes the hazards.
New stage, new trades, plant arriving, access altered, weather turning, excavation opened, scaffold erected or struck. Each of those changes what is dangerous about the site, and a risk assessment that predates the change is describing somewhere else.
The practical habit is to revisit it at stage changes rather than on a calendar. Sites do not become more hazardous on the first of the month, they become more hazardous when something physical changes.
Where an update happens, keep the earlier version rather than overwriting it. The sequence shows the site was being actively managed, which is a better position than a single document dated at the start of a nine-month job.
What good looks like
A useful Form 04 can be read by someone who has never been to the site and gives them an accurate picture of what to be careful of.
It names conditions rather than categories. Its controls are specific, owned, and achievable. It connects to the SWMS for the high risk work and to the toolbox talk that communicated it. And it has been updated at least as often as the site has changed.
None of that takes long once the walk has happened. Almost all of the effort is in the walk.
Who should be involved?
A risk assessment written by one person in an office describes what that person imagined about the site.
The people who will do the work notice different hazards, because they are thinking about how they will physically get the job done rather than about categories. A carpenter looking at the same elevation as the site supervisor will see the access problem first. Getting even one of them on the walk changes what ends up on the page.
On residential sites the principal contractor and the subcontractors each hold part of the picture. The builder knows the program and what is coming next week. The subcontractor knows what their own task actually involves. A risk assessment built without both tends to miss the hazards that live in the handover between trades, which is where a good share of residential incidents happen.
Record who contributed. It is a small field and it is the difference between a document that shows consultation and one that asserts it.
Where the form helps
The NSW WHS Form 04 follows the pack layout, with hazards, risk ratings, and controls captured as separate entries so the assessment comes out structured rather than as a block of text.
Organisation and site details are saved and reused across the pack, which is what keeps Form 04, Form 05, and Form 06 consistent without retyping. The form flags missing entries before download, you preview the entries mapped onto the official layout, then download the finished PDF for the site file and the principal.
Tradie Forms maps your entries onto that layout. The PCBU remains responsible for identifying the hazards, deciding the controls, implementing them on site, and checking the downloaded PDF before it is relied on.
Official references
Check the SafeWork NSW Housing Industry Site Safety Pack for the current forms, SafeWork NSW construction work for the construction duties, Safe Work Australia on identifying, assessing and controlling hazards for the risk management process, and the model Code of Practice on managing WHS risks for the hierarchy of control. Requirements vary by state and change over time, so confirm what applies to your site.
