Risk Assessment Documentation: What Inspectors Actually Look For

Key takeaways

Korea rewrote the risk assessment rules this year. The amended Occupational Safety and Health Act (Act No. 21374, promulgated 19 February 2026) took effect on 1 June 2026, and for the first time it attaches administrative fines to risk assessment failures. The fines themselves are deferred 1 January 2027 for businesses with 50 or more full-time workers, 1 January 2028 for those under 50 but the duties are already live.
The fine schedule tells you what the ministry cares about. Failing to conduct the assessment draws the largest amount, but failing to involve workers and failing to communicate the results carry their own separate penalties. Documentation of participation and communication is no longer a nice-to-have; it is a distinct compliance object.
The statutory record has four required elements and a three-year retention minimum, and the clock runs from the date each assessment was completed not from year-end, and not from the date the file was uploaded.
Timing is where most foreign-invested entities are exposed. Korea recognises four assessment triggers initial, event-driven, annual review, and a continuous-mode alternative and an entity that runs one annual exercise has not satisfied the event-driven trigger.
Inspectors and prosecutors do not read the assessment to see whether it exists. They read it to see whether it functioned as the basis for controlling the work. An assessment that identified a hazard, and work that proceeded unchanged, is worse evidence than no assessment at all.

What changed on 1 June 2026, and why it matters more than it looks

For several years risk assessment in Korea sat in an odd position. Article 36 of the Occupational Safety and Health Act clearly required it. The Ministry of Employment and Labor published a detailed notice on how to do it. The Serious Accidents Punishment Act treated it as a central element of the management system. And yet there was no administrative fine attached to simply not doing it.

That gap closed with the 2026 amendment. The Act now defines risk assessment to cover the whole cycle identifying hazards, determining risk, and establishing and implementing improvement measures rather than the identification step alone. It makes worker participation an express duty and adds a specific obligation to guarantee participation where the workers' representative requests it. And it requires the employer to inform workers of the results through training, briefings, posting, or written or electronic means, with hazards capable of causing a serious accident to be communicated on an ongoing basis.

Then the Enforcement Decree amendment approved in July 2026 supplied the numbers.

Violation	First	Second	Third or more
Failure to conduct risk assessment	KRW 5,000,000	KRW 7,000,000	KRW 10,000,000
Failure to involve workers / guarantee workers' representative participation	KRW 1,500,000	KRW 3,000,000	KRW 5,000,000
Failure to inform workers of key matters	KRW 1,500,000	KRW 3,000,000	KRW 5,000,000
Failure to record and retain results	KRW 500,000	KRW 1,500,000	KRW 3,000,000

Applied from 1 January 2027 for businesses with 50 or more full-time workers, and from 1 January 2028 for businesses with fewer than 50.

The amounts are modest next to Serious Accidents Punishment Act exposure. Read them for signal rather than for size. Three of the four rows are about process and evidence rather than about the assessment itself, which tells you where inspection attention is being directed.

One further item belongs in the same frame. From 1 August 2026, employers with 500 or more full-time workers, and construction employers with annual construction contract value of KRW 120 billion or more, must publicly disclose their safety and health status each year including fatalities among the workers of contractors. For a multinational group this converts Korean safety performance from an internal compliance matter into a published figure that sits alongside your global ESG reporting. It is worth checking now whether the Korean entity crosses the threshold and who owns the disclosure.

The file an inspector opens first

Start with what the law requires the record to contain. Enforcement Rule Article 37 sets four elements, and the ministry notice fills in the fourth.

Required element	Source	What "adequate" looks like
Hazardous and risk factors subject to assessment	Enforcement Rule Art. 37(1)1	Identified by task and location, not by department. A line reading "office work — general" is not an identified hazard
Content of the risk determination	Enforcement Rule Art. 37(1)2	The judgment reached and the criteria used to reach it, consistent with the criteria fixed in your implementation rules
Content of measures taken following the determination	Enforcement Rule Art. 37(1)3	What was actually done, by when, by whom — not a proposed control with no completion evidence
Safety and health information gathered in advance	Notice Art. 14(1)1	The preparatory survey underlying the assessment: work standards, procedures, materials, equipment information
Other matters the workplace has determined to be necessary	Notice Art. 14(1)2	Discretionary, but once your implementation rules commit to something, the absence of it becomes a finding

Retention is a minimum of three years, and the notice is specific about when the clock starts: the minimum retention period is counted from the date on which the assessment for that particular trigger was completed. That matters more than it sounds. An entity keeping one folder per calendar year, purged annually, will find that an event-driven assessment completed in November has been destroyed before its three years have run.

We would recommend retaining longer than the statutory minimum in any case. The Serious Accidents Punishment Act requires a check at least once every half year that hazard identification and improvement procedures are working, and the evidence that the check was meaningful is the underlying assessment history. A file destroyed at exactly three years can leave you unable to demonstrate the pattern.

Timing: which assessment were you supposed to have done?

This is the section to read carefully if your Korean entity runs on a global EHS calendar.

Korea does not have a single risk assessment obligation on a single cycle. It has an initial assessment, event-driven assessments, an annual adequacy review, and an optional continuous mode that substitutes for two of them.

Type	When	Scope
Initial	Commence within one month of the date the business is established (actual construction start date for construction). For work lasting under one month, without delay after work begins	All hazards subject to assessment
Event-driven	Before the work starts, on any of: installation, relocation, alteration or demolition of buildings; new introduction or change of machinery, equipment or raw materials; maintenance or repair of buildings and equipment (excluding routine repetitive work already assessed); new introduction or change of work methods or procedures; employer judgment that one is needed	The newly arising hazard
Event-driven after an accident	Where a major industrial accident occurs, or an industrial accident requiring medical care involving absence from work, before work is resumed	The work in which the accident occurred
Annual review	Review the adequacy of the initial assessment result every year, taking account of equipment degradation over time, changes in worker knowledge and experience from turnover, new safety and health knowledge, and the continued effectiveness of existing controls	Existing assessment results, including event-driven results from the period
Continuous mode	Monthly hazard discovery through worker suggestions, near-miss review and site patrols with risk determination and controls; weekly discussion and implementation check led by the safety and health manager in overall charge, safety manager, health manager and supervisors; daily communication of required precautions through pre-work safety meetings	Performing all three substitutes for event-driven and annual assessments

Three practical observations for global HR teams.

First, the event-driven trigger is the one that catches office-based entities off guard. It is easy to assume that an entity with no production line has nothing to assess between annual cycles. But "new introduction or change of work methods or procedures" is not a manufacturing concept. An office relocation, a fit-out, a shift to a new shift pattern, the introduction of a new piece of equipment into a lab or a kitchen each is capable of triggering an assessment that has to be completed before the work starts.

Second, the accident trigger has a hard sequencing rule. Where an accident requiring medical care with absence from work has occurred, the assessment must be done before that work resumes. An entity that resumes work and schedules the assessment for the following week has failed the requirement in a way that is visible on the face of the timeline.

Third, continuous mode is genuinely attractive for entities with stable operations and a real supervisory rhythm, because it replaces two separate obligations with an operating routine. But it substitutes only if all three components are performed monthly, weekly, and daily. Partial performance does not partially substitute. An entity that adopts continuous mode, performs the monthly component, lets the weekly meeting lapse, and consequently skips the annual review has ended the year with neither.

Proof of participation: the new centre of gravity

Under the amended Act, worker participation is a standalone duty with a standalone fine. It is also the element that global systems document worst, because participation tends to happen and simply never gets written down.

The notice contemplates participation through site patrols, worker suggestions, surveys and interviews, and requires that site patrols be included absent special circumstances. The amendment adds the guaranteed participation of the workers' representative where they request it.

Two points deserve attention in a foreign-invested structure.

Who the workers' representative is. This is the representative of a trade union organised by a majority of workers, or where none exists, a person representing a majority of workers. A member of the labour–management council does not automatically hold this position. If your entity has never formally identified a workers' representative, the record of selection the notice, the vote or written consent, and the result — is itself something you may be asked to produce.

What participation evidence looks like. A signature sheet establishes attendance, not participation. The stronger file shows the advance notice of the assessment schedule, who attended, what was raised, and what happened to what was raised. A record showing a worker identified a hazard, the assessment adopted it, and a control followed is worth considerably more than a fully signed attendance list with no content.

Proof of communication

The employer must inform workers of four things: the hazardous and risk factors relating to the work they perform, the risk determination for those factors, the risk reduction measures with their implementation plan and whether they were implemented, and the matters workers must observe or take care of as a result.

Note the third item. The employer must communicate not only the plan but whether it was implemented. A posted assessment showing planned controls, with no follow-up communication of completion, is incomplete on the face of the requirement.

Separately, for hazards capable of leading to a serious accident, the notice asks employers to make workers continuously aware through pre-work safety meetings. This sits as an effort obligation in the notice, but the amended Act now speaks in terms of ongoing communication of serious-accident-capable hazards, and it is the sensible standard to work to.

For a multinational entity, the language question is unavoidable here. Communication is measured by whether workers were actually informed. Posting an English-language assessment in a workplace where a substantial share of workers read Korean does not discharge a duty framed around the worker's understanding of the hazards in their own work. Where a workforce is genuinely mixed, both language versions need to exist, with the Korean version treated as operative.

Where global systems fail this specifically

Multinational groups usually arrive with a mature risk assessment methodology. The methodology is rarely the problem. Four structural mismatches account for most of what goes wrong.

The annual cycle. Global EHS calendars are built around an annual assessment and audit. Korea layers an event-driven trigger on top of that, keyed to changes rather than to dates, and requires completion before the affected work begins. An entity synchronised to the global calendar will be compliant on the annual review and exposed on everything that happened in between.

The platform. Assessments completed in a global EHS system, in English, with controls auto-populated from a corporate library, produce a record that is difficult to defend on two fronts. The controls may not match Korean site conditions, and the record may not be producible in Korea, on request, with dates, without a headquarters administrator in another time zone. Practitioner commentary specifically identifies unmodified system-generated controls as a recurring weakness.

The separation of assessment from work control. This is the most serious one. Korean enforcement practice looks at whether the assessment result was shared before the work started and whether the work proceeded only after the identified hazards were controlled. Where hazard recognition sits in one system and work authorisation sits in another, the assessment is documentation rather than control — and after an incident, a document identifying the exact hazard that caused it, with no evidence that it gated the work, is a difficult record to explain.

Contractor scope. The entity is responsible for the hazards of the work carried out at its site, including work performed by contractors and their workers. Assessments that cover only direct employees leave the fit-out crew, the equipment engineer, and the facilities staff outside the file.

Common mistakes

Running one annual assessment and treating the year as covered. The event-driven trigger operates independently and requires completion before the affected work begins.
Resuming work after a lost-time accident and scheduling the reassessment afterwards. The sequence is fixed: assessment first, then resumption.
Adopting continuous mode and performing only part of it. The substitution requires the monthly, weekly and daily components together.
Treating an attendance sheet as participation evidence. What was raised, and what followed from it, is the part that carries weight.
Never formally identifying a workers' representative, then being unable to evidence the selection when the participation duty is examined.
Communicating the improvement plan but not whether it was implemented. The notice requires both.
Purging records on a calendar-year cycle. Retention runs three years from each assessment's own completion date.
Maintaining the assessment only in English in a mixed-language workplace.
Leaving contractor and dispatched workers' tasks out of scope because they are not on the payroll.
Assuming the fines are the exposure. They are the visible edge of it; the same file is what the Serious Accidents Punishment Act half-yearly check is measured against, and what is read after an incident.

How EAP supports employees and HR

The 2026 amendment moved participation and communication from good practice into enforceable duty. That change makes an operational assumption that is worth examining: it assumes workers will raise hazards when a channel exists.

They often do not, and the reasons are rarely procedural. A worker raises a hazard to the manager who assigns their work, in front of colleagues, sometimes in a second language, without knowing how the report will land. Where the hazard implicates workload, pace, or the way the work is organised, the difficulty is sharper still the concern is about the conditions the manager is responsible for. The channel exists, the participation record shows attendance and nothing raised, and the annual review has nothing to act on.

WHO guidance on mental health at work is explicit that organisational conditions rather than individual resilience determine outcomes, and identifies manager capability alongside worker-directed support as complementary interventions. ISO 45003 places psychosocial risk inside the occupational health and safety management system meaning the same framework carrying your Korean risk assessment obligations is the one expected to carry psychosocial hazards. Under the EAPA Core Technology, confidential problem identification and referral, and consultation with managers and organisations on employee and organisational issues, are core employee assistance functions.

An employee assistance programme contributes at three specific points in this cycle. It provides a confidential route, in Korean and English, that does not run through the line manager which is what makes a concern raisable when the reporting line is itself part of the problem. It gives supervisors somewhere to take a disclosure before it becomes an incident. And where a pattern emerges across a team rather than in one person, it produces organisational-level input that belongs in the annual adequacy review the difference between a review with nothing recorded and one with a real finding.

Risk assessment is not principally a mental health exercise. But the mechanism the amended Act relies on to surface hazards is a human one, and the documentation it now requires is only as good as workers' willingness to speak.

Related guides

Risk Assessment in Korea: Mandatory Implementation Steps for Employers (EN)
Safety and Health Management System Requirements: Checklist for Korean Entities (EN)
위험성평가 체크리스트 작성 시 담당자가 확인해야 할 항목 (KR)

FAQ

Q1. Our Korean office is a sales entity with 40 employees and no production. Does risk assessment apply?

Yes. The obligation under Article 36 applies to businesses within the scope of the Act and is not limited to manufacturing. What changes is the content, not the existence, of the duty the hazards of an office entity are different, not absent. On the fines, businesses with fewer than 50 full-time workers have until 1 January 2028 before the administrative fines apply, but the underlying duties have been in force since 1 June 2026.

Q2. We completed our annual assessment in March. We are moving offices in October. Is anything required?

Almost certainly yes. Installation, relocation or alteration of workplace buildings is an express trigger for an event-driven assessment, as is a change of work methods or procedures. The assessment must be commenced in relation to the new hazards and completed before the affected work starts which for a relocation means before the move and fit-out work begins, not after occupancy.

Q3. Can we use our global risk assessment methodology, or do we have to use the Korean one?

The methodology is not prescribed in a way that excludes a competent global approach. What is prescribed is the timing, the participation, the communication, the record content, and the retention. The practical approach is to keep the methodology and wrap the Korean requirements around it: Korean trigger points in the calendar, documented participation, bilingual communication, and a record containing the four statutory elements, retained locally for at least three years.

Q4. What is the single thing most likely to be found wanting?

The link between the assessment and the work. Enforcement practice looks at whether the result was shared before work started and whether the work proceeded only once the identified hazards were controlled. An assessment that exists and did not gate the work is the finding that is hardest to answer, and it is the one that matters most after an incident.

Next step

Pull your Korean entity's risk assessment file for the last twelve months and check four things in order.

Look at the dates first. Is there an assessment tied to every change that occurred every relocation, equipment introduction, procedure change, and lost-time accident and does each one predate the work it relates to? Gaps here are the most common and the most visible.

Then look at the content of each record against the four statutory elements, and confirm the retention clock is being run from each assessment's own completion date rather than from year-end.

Then look for the participation trail: not attendance, but what workers raised and what happened to it. And finally, check what was communicated back to workers including whether the improvement measures were reported as implemented, and in what language.

Any row where the answer is "we have the assessment but not the trail" is a row that will be found in 2027 and read after an incident. Fix those before the fines commence on 1 January 2027.

If your organization needs a coordinated approach to employee mental health, manager capability, and confidential hazard disclosure alongside its statutory risk assessment programme, contact Nudge EAP to discuss an implementation model suited to your workforce.

NOTE: This article is intended for general informational purposes only. Specific legal, medical, clinical, or employment-related matters may require review by an appropriately qualified professional. Risk assessment findings interact with liability under the Serious Accidents Punishment Act, and positions taken on this subject should be confirmed with qualified Korean counsel.

👉 Go to Nudge EAP Implementation Consultation →

Sources

산업안전보건법 제36조 (위험성평가의 실시), 국가법령정보센터 — https://law.go.kr/lsLinkCommonInfo.do?lsJoLnkSeq=1025460941
산업안전보건법 시행규칙 제37조 (위험성평가 실시내용 및 결과의 기록·보존) — 기록 4개 항목 및 3년 보존, 국가법령정보센터 연계정보 — https://law.go.kr/lsLinkCommonInfo.do?lspttninfSeq=75593&chrClsCd=010202
사업장 위험성평가에 관한 지침 (고용노동부고시 제2023-19호, 2023. 5. 22.) 제13조 위험성평가의 공유, 제14조 기록 및 보존, 제15조 실시 시기 — 국가법령정보센터 — https://www.law.go.kr/LSW//admRulInfoP.do?admRulSeq=2100000251014&chrClsCd=010201
사업장 위험성평가에 관한 지침 개정 전문 (제9조 사전준비, 제10조 유해·위험요인 파악, 제13조~제15조 조문 수록), 한국위험관리센터 — https://www.greenwhistle.net/사업장-위험성평가에-관한-지침개정/safety/
2026년 개정된 산업안전보건법의 주요 내용은 — 위험성평가 근로자 참여·결과 공유 의무 및 과태료 신설, 2026. 2. 19. 공포 / 2026. 6. 1. 시행, 김동현 변호사, 서울경제 — https://www.sedaily.com/article/20055169
위험성평가 미실시 시 1,000만원 과태료 부과 — 산업안전보건법 일부개정안 국회 통과, 2026. 2. 19. 공포(법률 제21374호), 6월 시행, 제36조 개정 내용 및 제175조 과태료 체계 — https://m.cafe.daum.net/dbgodnlgja/svD7/39
근로자 500명·건설 1200억 이상 안전공시 의무화 — 안전보건공시제 2026. 8. 1. 시행 및 위험성평가 과태료 차수별 금액(500/700/1,000만원, 참여·공유 150~500만원, 기록·보존 50~300만원), 적용 시기(50인 이상 2027. 1. 1. / 50인 미만 2028. 1. 1.), 정보통신신문 — https://www.koit.co.kr/news/articleView.html?idxno=208080
500인 이상 기업 안전 공시 의무화 — 위험성평가 미실시 과태료 최대 1,000만원, 산업안전보건법 시행령 개정안 국무회의 의결, 아주경제 — https://www.ajunews.com/view/20260721093936824
안전보건 공시제 도입 — 공시 항목(안전보건관리체제, 산업재해 발생 현황, 전년도 활동 실적, 해당 연도 활동 계획, 안전보건 투자, 재발 방지대책), 안전저널 — https://www.anjunj.com/news/articleView.html?idxno=41589
위험성평가가 서류로 끝나는 순간, 중대재해는 반복된다 — 시행규칙 제37조 3년 보존, 감독·수사에서의 평가 기준(작업 전 공유 여부, 위험요인 통제 후 작업 여부), 형식적 평가의 리스크, 법무법인(유한) 율촌 — https://www.yulchon.com/ko/resources/publications/legal-update-view/43137/page.do
2026년 위험성평가 결과 주지·게시와 근로자대표 참여 — 근로자대표의 범위 및 선출 기록, 주지·게시 방법과 증빙 요건 — https://blog.silronomu.com/risk-assessment-worker-representative-notice-2026/
위험성평가 개정 신규 지침 요약 — 최초·수시·정기·상시 4가지 구분, 세이브티 — https://savety.kr/위험성평가-개정-신규-지침-요약-3-최초-수시-정기-상/
중대재해 처벌 등에 관한 법률 시행령 제4조 (안전보건관리체계의 구축 및 이행 조치) — 반기 1회 이상 점검, 영문 번역, 한국법제연구원 — https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=59953&type=sogan&key=6
World Health Organization, Guidelines on Mental Health at Work (2022) — https://www.who.int/publications/i/item/9789240053052
World Health Organization, Mental health at work fact sheet — https://www.who.int/news-room/fact-sheets/detail/mental-health-at-work
ISO 45003:2021, Occupational health and safety management — Psychological health and safety at work — https://www.iso.org/standard/64283.html
Employee Assistance Professionals Association, Definition and Core Technology of Employee Assistance Programs — https://eapassn.org/page/definitionandcoretechnology