How to Write an AHA (Activity Hazard Analysis): EM 385-1-1 and OSHA Step by Step
I spent 27 years with the Anne Arundel County Fire Department. Today I run KP2 Safety Consulting and work with contractors on large commercial and airport projects, and much of that work is writing and reviewing AHAs. Here is how to write an AHA that a reviewer will accept and a crew will actually use.
What an AHA Is and Who Requires It
An activity hazard analysis breaks one activity into job steps, lists the hazards in each step, and lists the controls that bring the risk down to an acceptable level. On USACE work, EM 385-1-1 requires one before each work activity, task, or definable feature of work (DFOW) begins (2-6.d(1)). NAVFAC jobs and many GCs on commercial work ask for the same thing, usually through the contract specs.
OSHA 1926 does not use the term AHA, but on an OSHA job the 1926 standards still drive what goes in it. EM 385-1-1 accepts a JSA or JHA as a substitute if it collects the same data (2-6.d(1), Note).
How to Write an AHA, Step by Step
Paragraph 2-6.d(4) lists what every AHA must include. Whether you start from a blank page or an AHA template EM 385 reviewers already know, these are the items they check.
1. Fill in the header. Activity name, contractor name, contract number, project location, date, the preparer's name and title, and the name and title of the acceptance authority (2-6.d(4)(a)).
2. Break the work into steps, in order. Write the steps the way the crew will actually do them, with enough detail that a reader understands how the job gets done, including equipment and heights or depths (2-6.d(4)(b)). "Excavate trench" is not a step list. "Locate utilities, set up spoils area, excavate first 50 feet of run, slope walls, set ladder" is.
3. List the hazards for each step. Every step gets its own hazards (2-6.d(4)(c)): cave-in, struck-by, falls, utilities, water, atmosphere, and whatever else actually fits that step.
4. List the controls for each step. Use the hierarchy of controls from 2-6.b: elimination or substitution, engineering controls, administrative controls, then PPE. If one layer of control is not enough, add more until the risk is acceptable, which the manual describes as low or medium where possible (2-6.d(4)(d)).
5. Assign a RAC to each step. RAC stands for Risk Assessment Code. Under 2-6.d(4)(e), the step RAC is the residual risk that remains after your controls are in place. You rate severity as catastrophic, critical, moderate, or negligible, and probability as frequent, likely, occasional, seldom, or unlikely (2-2.w). The risk matrix combines the two into one of four codes: E for extremely high, H for high, M for medium, and L for low (2-2.u).
6. Assign the overall RAC. The overall RAC must not be lower than the highest step RAC on the AHA (2-6.d(4)(f)). If one step is High, the whole AHA is at least High.
7. List equipment, training, and inspections, and name your people. Identify the equipment, the training each person needs, and the required inspections. Then designate any required competent persons (CPs) and qualified persons (QPs) by name, in writing, and provide proof of competency or qualification (2-6.d(4)(g)).
8. Review it with the crew and get signatures. Every involved employee reviews the AHA before starting the task and signs it or a signature sheet (2-6.d(2)). Keep the current AHA with the crew while the work is going on (2-6.d(3)).
9. Get acceptance before work starts. Work that requires an AHA must not begin until the AHA with its RAC has been reviewed and accepted by the proper acceptance authority (2-6.d(4)(h)). Your Accident Prevention Plan must name that authority for each level of residual risk (2-6.c(2)).
EM 385-1-1 AHA Example: Trench Sloping and Benching
Job step: Excavate the trench and slope the walls.
Hazard: Cave-in of trench walls burying a worker.
Controls:
- The competent person classifies the soil before work starts using at least one visual and one manual test (EM 385-1-1, 25-8.i(2)(a); OSHA 1926 Subpart P, Appendix A).
- If the soil is not classified, slope no steeper than 1-1/2 horizontal to 1 vertical, which is 34 degrees from horizontal (EM 385-1-1, 25-8.i(1); OSHA 1926.652(b)(1)).
- Cut the slope back as you dig. Nobody enters an unprotected section.
- Excavations over 20 feet deep get sloping or benching designed by a registered professional engineer (EM 385-1-1, 25-4.c(4)).
- The competent person inspects the excavation before each shift and after rain (EM 385-1-1, 25-5.a; OSHA 1926.651(k)).
RAC: High. Even with good controls, a cave-in can kill, so the severity stays catastrophic. That keeps this row, and therefore the overall AHA, at High.
Chapter 25 adds its own items: a CP develops the excavation AHA, and it must show egress methods and locations and the CP's identification and credentials (25-6).
Common Mistakes I See
- "Wear PPE" as the only control. The manual says PPE should not be the only protection against a hazard (2-6.b(4), Note).
- Generic steps. If the steps fit any job on any site, expect it back.
- Missing competent person names. "CP on site" is not a name.
- Outdated paragraph numbers. The 2024 EM 385-1-1, dated March 15, 2024, supersedes the 2014 edition and changed the paragraph numbering. Old 2014 numbers tell a reviewer the AHA came from an old file.
One more note: ENG Form 6206 is a non-mandatory outline for an AHA (note at the end of 2-6.d; 2-10.b). The content required by 2-6.d(4) is what counts.
Save Time With a Pre-Built AHA
The KP2 AHA Library has over 200 pre-built AHAs written to OSHA 1926 or EM 385-1-1, customized with your project info. If you want to see the format first, download a free sample AHA. Questions? Call me at 410-216-4424 or email [email protected].
Frequently Asked Questions
What is an activity hazard analysis?
An activity hazard analysis (AHA) breaks one work activity into steps, with the hazards and controls for each step. On EM 385-1-1 jobs, each step also gets a Risk Assessment Code (RAC) for the residual risk after controls.
Is an AHA required by OSHA?
OSHA 1926 does not use the term AHA. EM 385-1-1 requires AHAs on USACE work, and many contracts and GCs require them. On an OSHA job, write it to the 1926 standards that apply.
What does RAC mean on an AHA?
RAC means Risk Assessment Code. It combines severity (catastrophic, critical, moderate, or negligible) and probability (frequent, likely, occasional, seldom, or unlikely) into E for extremely high, H for high, M for medium, or L for low. The overall RAC cannot be lower than the highest step RAC.
Is ENG Form 6206 required?
No. EM 385-1-1 calls ENG Form 6206 a non-mandatory outline. Any format works if it includes everything paragraph 2-6.d(4) requires.
When do I need to update an AHA?
Update it when site conditions, operations, or the competent or qualified persons change. If the change raises the RAC, resubmit it for acceptance before work starts (2-6.d(5)).