🎓 Lesson 20
D5
Writing an Audit-Ready HIRA Report
An audit-ready HIRA report is a clear, complete, and traceable document that shows exactly how hazards were found, how risks were measured, and how controls were chosen — so an external auditor can verify it all without confusion or gaps.
🎯 Learning Objectives
- ✓ Explain the mandatory structural elements required for regulatory audit compliance
- ✓ Analyze a draft HIRA report to identify missing evidence trails (e.g., unrecorded assumptions, unverified exposure durations)
- ✓ Design a traceable risk matrix entry by linking specific hazard scenarios to control effectiveness validation methods
- ✓ Apply ISO 31000 risk criteria to classify and prioritize five distinct blasting-related hazards
📖 Why This Matters
In mining and blasting operations, a poorly documented HIRA isn’t just incomplete — it’s a liability. Regulators (MSHA, OHS Canada, SafeWork Australia) routinely reject permits or issue citations when reports lack traceability, stakeholder sign-offs, or justification for risk acceptance. In 2023, 68% of enforcement actions in U.S. surface mines involved documentation failures — not technical errors. Writing an audit-ready HIRA report is your professional signature: it proves due diligence, protects workers, and safeguards your license to operate.
📘 Core Principles
Audit-readiness rests on three pillars: completeness, traceability, and defensibility. Completeness means every step of the HIRA lifecycle — hazard identification (e.g., flyrock, ground vibration, misfire), risk estimation (qualitative/semi-quantitative), risk evaluation (vs. ALARP or tolerability thresholds), and control selection — is explicitly recorded. Traceability requires time-stamped evidence: photos of hazard locations, calibrated instrument logs (e.g., seismograph readings), meeting minutes with participant names and roles, and version-controlled revisions. Defensibility demands transparent rationale — e.g., why a 15 m exclusion zone was chosen over 10 m, citing blast modeling outputs and historical incident data. Industry frameworks like ISO 45001:2018 Clause 6.1.2 and ICMM’s Risk Management Guidance mandate this rigor.
📐 Risk Priority Number (RPN) Calculation
While qualitative matrices dominate field use, the RPN provides auditable consistency when scoring likelihood and consequence dimensions. It multiplies Likelihood (L), Severity (S), and Exposure (E) — each scored on standardized scales — to generate a numeric priority index used to justify control sequencing and resource allocation.
Risk Priority Number (RPN)
RPN = L × S × EQuantitative prioritization index derived from Likelihood, Severity, and Exposure scores; used to allocate mitigation resources and demonstrate objective decision-making to auditors.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| L | Likelihood Score | dimensionless (1–5 scale) | Probability of hazard occurrence based on historical data, modeling, or expert judgment per ICMM guidance. |
| S | Severity Score | dimensionless (1–5 scale) | Potential consequence magnitude using standardized injury/impact categories (e.g., MSHA or ISO 45001 severity tables). |
| E | Exposure Score | dimensionless (1–3 scale) | Frequency/duration of personnel exposure to the hazard scenario (e.g., 1 = rare, 3 = continuous). |
Typical Ranges:
Low-risk blasting activity: 1–9
Medium-risk (e.g., confined site): 10–19
High-risk (e.g., proximity to infrastructure): 20–30
💡 Worked Example
Problem: During pre-blast HIRA for a limestone quarry, the hazard 'flyrock beyond exclusion zone' is assessed: Likelihood = 3 (occasional — based on 2 near-misses in last 12 months), Severity = 4 (major injury — per MSHA severity scale), Exposure = 2 (workers present <1 hr/day). Calculate RPN and interpret against typical range.
1.
Step 1: Confirm scoring scale alignment — Likelihood (1–5), Severity (1–5), Exposure (1–3) per ICMM Annex B.
2.
Step 2: Multiply scores: RPN = 3 × 4 × 2 = 24.
3.
Step 3: Compare to typical_ranges: RPN ≥ 20 triggers mandatory engineering controls (e.g., berms, buffer zones); 24 exceeds threshold — validate control design via blast modeling per SAE J1907.
Answer:
The result is 24, which falls within the high-priority range (20–30), requiring immediate implementation of engineered controls and verification via post-blast survey within 72 hours.
🏗️ Real-World Application
At Newmont’s Boddington Mine (Western Australia), a 2022 internal audit flagged non-compliance in a HIRA report for secondary fragmentation blasting: the report listed 'misfire' as a hazard but omitted test-fire records, failed to reference the latest blast design software (SHOE, v8.3), and lacked signatures from the designated Competent Person (as required under WA Mines Safety and Inspection Act 1994). The revised audit-ready version included: (1) annotated SHOE output showing predicted misfire probability <0.3%, (2) digital log of capacitor discharge testing on all detonators, (3) signed competency declaration with registration number, and (4) hyperlink to version-controlled risk matrix in SharePoint. This passed MSHA-equivalent external audit with zero findings.