CR10 Compliance Made Simple: From Risk Assessment to Fall Protection Plan

The South African Risk Assessment Method: Job Steps, Hazards and Risk Rating

The standard method used on South African sites follows three stages. First, the task is broken down into its sequential job steps — the sequence of actions a worker actually performs, from arriving at the work area to packing away on completion. Second, against each step, the assessor identifies the hazards (the source of harm — an open edge, a fragile roof sheet, a wet surface) and the risks that follow from them (a fall from height, a dropped object, a slip). Third, each risk is quantified against a rating scale, typically likelihood multiplied by severity, sometimes with an exposure or frequency factor added. The resulting risk rating determines priority and dictates how robust the control response needs to be.

None of this is unique to work at height — it’s the same structure used for any occupational risk assessment under the General Safety Regulations. What makes it work-at-height specific is the hazard vocabulary (fall risk positions, anchor points, fragile surfaces, suspended equipment) and the fact that OHSA Section 8(2)(b) specifically requires the employer to eliminate or mitigate any hazard “as far as reasonably practicable” — the exact standard the risk rating and control selection are trying to satisfy.

The Hierarchy of Controls: Why Every Tier Ends in a Policy

Once a risk is rated, the assessor selects a control from the standard hierarchy: engineering controls, isolation or lockout, administrative controls, and — only as the last line of defence — personal protective equipment (PPE). In theory these are four separate tiers. In practice, no control at any tier functions without an administrative control underneath it.

Take a straightforward example: a worker in a fall risk position who could lose consciousness and fall due to a pre-existing medical condition. The logical control is to ensure workers are medically fit for work at height. But “medically fit” isn’t self-enforcing — it only becomes a real control once there’s a policy specifying who requires a medical certificate, how often it must be renewed, what the certifying practitioner must assess, and who holds the records. Take away the policy, and the control is just a good intention.

The same is true higher up the hierarchy. A worker exposed to an open edge is protected by an engineered anchor point and a harness — an engineering control and PPE working together. But the anchor point is only a real control if it’s inspected and certified annually to SANS 50795, and the harness is only a real control if its procurement, issue, storage, inspection, and retirement are governed by a written procedure. Add training into the mix — what training, delivered by whom, how often refreshed, recorded where — and you can see that every tier of the hierarchy, from engineering controls down to PPE, ultimately resolves into the same question: who, what, when, how often, and who keeps the record.

A properly run risk assessment doesn’t stop there, though. Fall-arrest PPE doesn’t eliminate the fall — it manages the outcome of the fall. The moment a harness arrests a worker, a new hazard exists: a person suspended, possibly injured or unconscious, with suspension trauma setting in within minutes. That is a hazard like any other, and it demands the same treatment — hazard identified, risk rated, control selected. The control is a rescue procedure, and underneath it sits exactly the same administrative question as every other control on this list: who is trained to perform the rescue, what equipment is available on this specific site, how quickly can they respond, and who verifies and records that rescue competence.

This is precisely why a risk assessment that is done properly — one where every control decision is followed through to its administrative-control policy, including the residual risk the control itself introduces — ends up generating the entire Fall Protection Plan as a by-product, rather than as a separate compliance exercise bolted on afterwards.

Mapping the Risk Assessment to CR10(2): What the Regulation Actually Requires

Construction Regulation 10(2) sets out exactly what a Fall Protection Plan must include. Read alongside a properly completed risk assessment, the overlap is direct:

CR10(2) Requirement	Where It Comes From in the Risk Assessment
(a) A risk assessment of all work from a fall risk position, and the procedures and methods used to address all risks identified per location	This is the risk assessment itself — job steps, hazards, risk ratings, and the selected controls, per location
(b) Processes for evaluating employees’ medical fitness for a fall risk position, and records thereof	The administrative control policy behind any medically-related control measure (e.g. fainting, epilepsy, vertigo risk)
(c) A training programme for employees working from a fall risk position, and records thereof	The administrative control policy behind PPE and equipment-use controls (harness use, anchor point connection, rope access technique)
(d) The procedure for inspection, testing and maintenance of fall protection equipment	The administrative control policy behind engineering controls and PPE (SANS 50795 anchor point inspection, harness inspection intervals)
(e) A rescue plan detailing the procedure, personnel and equipment for rescuing a person after a fall incident	The administrative control policy addressing the residual risk the fall-arrest control itself introduces — suspension trauma after arrest — assessed and controlled the same way as any other identified risk

All five statutory requirements are things a thorough risk assessment produces, provided the assessor follows every control through to its administrative policy — including the policy needed for the risk the control itself creates — rather than stopping at “provide PPE” or “install anchor point” as the final answer.

Closing the Loop: Why the Rescue Plan Is the Same Chain, One Link Further

CR10(2)(e) isn’t a separate compliance box sitting outside the risk assessment — it’s the same hazard/risk/control logic applied to the control itself. Fall-arrest equipment doesn’t eliminate the fall; it transfers the risk from “worker hits the ground” to “worker is suspended in a harness.” That transfer creates a new hazard in its own right, with its own likelihood and severity, and it has to be run through the same rating and control process as the open edge that caused the fall in the first place. Run it through properly, and the control that comes out the other end is a rescue procedure — with the same who, what, when, how often, and who-keeps-the-record questions as the medical fitness policy and the harness training programme.

Because a risk assessment must be site-specific, the rescue plan that falls out of it is automatically site-specific too — the actual access route, the actual equipment on hand, the actual trained personnel on that project, and the actual response time available. That’s exactly what CR10(2)(e) requires: not a generic rescue clause, but a plan built around this site.

So why is the rescue plan the most commonly missed element on real Fall Protection Plans? Not because it sits outside the logic — because most assessors stop one link short. The assessment identifies the fall hazard, selects fall-arrest PPE as the control, and treats that as the end of the exercise. It never asks the follow-up question: now that the worker is arrested in a harness, what new hazard have we just created, and what controls it? A risk assessment that is actually carried through to completion asks that question as a matter of course — and the rescue plan comes out the other side as naturally as the medical fitness policy did.

Turning the Risk Assessment Into a Compliant Fall Protection Plan

In practice, the path from risk assessment to compliant FPP looks like this:

Complete the risk assessment properly, job step by job step, with every control decision followed through to a named administrative policy — not left as a one-line entry reading “PPE” or “training.”

Extract the medical fitness policy, the training programme, and the equipment inspection/testing/maintenance procedure directly from the risk assessment — these map straight onto CR10(2)(b), (c), and (d).

Push the analysis one link further for every fall-arrest control: treat the arrest event itself as a hazard, rate the residual risk of suspension trauma, and extract the rescue procedure, personnel, and equipment requirement from that analysis — the same way you extracted the medical fitness and training policies. This is what maps onto CR10(2)(e).

Have the whole document compiled or reviewed by a competent person, as CR10 requires — not assembled from a generic template.

Done this way, the Fall Protection Plan stops being a document written after the risk assessment, and becomes the natural, structured output of a risk assessment done to the standard OHSA Section 8 already demands. For the full breakdown of what a compliant FPP must contain and who carries the obligation, see our Construction Regulation 10 & Fall Protection Plans guide, and for the underlying legal duty, see OHSA Section 8 & Work at Height.

Frequently Asked Questions

Does a risk assessment automatically satisfy CR10?

Yes, provided it’s carried all the way through. A thorough risk assessment — one where every control is followed through to its administrative policy, including the residual risk the control itself introduces — generates all five requirements under CR10(2): the hazard/risk/control breakdown, medical fitness process, training programme, equipment inspection procedure, and the rescue plan. The rescue plan is the element most often left out in practice, not because it falls outside the risk assessment, but because most assessors stop at “harness fitted” instead of treating the arrest event as its own hazard.

What is the hierarchy of controls used in South African fall protection?

Engineering controls, isolation or lockout, administrative controls, and personal protective equipment (PPE) as the last resort. In practice, every tier depends on an administrative control — a policy specifying who does what, when, and how records are kept — to function as a real control rather than a theoretical one.

Who is allowed to compile a risk assessment and Fall Protection Plan?

CR10 requires the Fall Protection Plan to be compiled by a competent person — someone with demonstrable knowledge, training, experience and qualifications specific to work at height, verifiable against the relevant SAQA unit standards.

How often must fall protection anchor points be inspected?

Anchor devices compliant with SANS 50795 must be inspected at least every 12 months, in addition to any inspection and maintenance procedure specified in the Fall Protection Plan itself.