Guide to critical risks: is your business ready?

Next year, the critical risk legal definition comes into force under the Health and Safety at Work Amendment Act 2026, raising two simple questions: Do you know what your critical risks are, and have you got good controls for each of them?  

From 1 April 2027, every New Zealand business (or PCBU, in the Act's language) will need to know it's critical risks.  

Smaller businesses, meaning those with fewer than 20 workers for at least nine months of a financial year, will have their primary duties narrow to critical risks. Not all duties narrow, but the keyworker safety duties become more focused. Larger businesses must still manage all risks, but critical risks come first. 

Many businesses are already getting ready. They're identifying their critical risks, checking that key controls are in place, and setting up the frameworks and reporting to prove it. Starting now gives these businesses time to close any gaps before the new legislation takes effect. 

Critical risk isn't just "could cause death" 

Under the new law, a critical risk is any risk likely to cause death, a notifiable injury, illness or incident, or certain occupational diseases.It also includes risks from certain hazards like asbestos and hazardous substances. Alongside hazards and risks that could realistically cause a fatal event, businesses need to understand: 

• What other lower levels of harm could trigger critical risk requirements (for example, hazardous substances, serious cuts or work at heights)? 

• Which of these are critical risks for your business, based on the work you actually do and what you know, or ought to reasonably know, about your hazards? 

Then: 

• For each critical risk, what controls are relied upon to prevent death or serious harm? 

• Who is responsible for those controls, and are the controls actually implemented? 

• How do you know they remain effective? 

Many businesses already have controls and procedures in place. This is the opportunity to check if they are working as expected, especially for critical risks. For example, a traffic management plan might exist, but is it actually keeping people and vehicles apart? 

A critical risk framework connects: 

The procedure on paper doesn't prove the control works. The harder question is: what gives me confidence that the controls to reduce the risk of serious harm are in place? 

What should businesses do now? 

1. Identify your critical risks 

Look at your actual work, incidents, near misses, industry risks and worker knowledge, not just your existing risk register. 

2. Identify the controls that matter most 

For each critical risk, establish which controls are most effective and relied upon to prevent the serious outcome. Not all controls are equal. Procedures, signs and training depend on people getting it right every time, so they are the weakest. Stronger controls are physical or engineered, such as a barrier keeping people and vehicles apart, an interlock that stops a machine when a guard is opened, or an automatic shutdown to protect the operator when something goes wrong. 

3. Test those controls in practice 

Walk the workplace, talk to workers, observe machinery and tasks. Don't just rely on what you are told or what comes through in the paperwork. 

4. Establish assurance 

Determine how often critical controls should be checked, who is responsible for checking them, and how failures are escalated and addressed. 

5. Give owners and board insight 

Business owners should understand the organisation's critical risks, where there are opportunities to further improve or implement additional controls, and what those plans are. Review the reporting that is in place and keep those responsible accountable for delivering. Officers also have a personal due diligence duty to verify that these controls are working.

The 60-second self-check 

Five questions to quickly let you check where you are at:

All five without hesitating? You are leading and in a good position. An independent check can confirm your controls are working as intended and help identify further opportunities for improvement. 

Missed one or two? Ask yourself which, and why. Those are the key gaps to start closing now. 

Struggled past the first? Now is the time to get things moving before the new legal requirements take effect on 1 April 2027. 

What next? 

Now is a practical time to review your arrangements, identify what's working, what's missing, and what needs to improve. 

The question isn't whether you have a critical risk register. It's whether you have clarity and confidence around your critical controls, and ongoing evidence to support it.

Findex works with business owners, boards and operational teams to identify critical risks, test critical controls in practice, and build the independent assurance to back it up. 

^Disclaimer 

^{Findex NZ Limited trading as Findex.} 

^{The views and opinions expressed in this article are those of the author/s and do not necessarily reflect the thought or position of Findex. This article contains general information and does not constitute legal or taxation advice. If you need legal or taxation advice, we recommend you speak to a qualified adviser.} 

^{November 2026}