How often must the hazard matrix be updated?

At least once a year, and also whenever a fatal work accident or catastrophic event occurs, or when processes, facilities, machinery or equipment change (Article 2.2.4.6.15, paragraph 1, of Decreto 1072 de 2015).

Is the old risk factor overview still valid?

Decreto 1072 de 2015 provides that risk factor overviews are treated as hazard identification and risk assessment (Article 2.2.4.6.15), so they must meet the methodology, scope and annual update set by that article.

Does a small company also need a hazard matrix?

Yes. Resolución 0312 de 2019 includes it in the standards for every company; those with ten or fewer workers in risk classes I, II or III carry it out with the support of the ARL and must implement the resulting prevention and control measures (Article 3).

How does it relate to the Minimum Standards self-assessment?

Hazard identification is one of the standards scored in the annual self-assessment (standards 4.1.1 and 4.1.2 in the table of Article 27 of Resolución 0312 de 2019). Having the matrix up to date before the self-assessment makes it easier to gather the evidence.

CO · Expiry & renewal tracking

Keep your company's hazard identification matrix up to date

Colombian employers must document the SG-SST hazard identification and risk assessment and update it at least yearly, and also after a fatal accident, a catastrophic event or relevant changes (Article 2.2.4.6.15 of Decreto 1072 de 2015). There is no grace period; non-compliance is punished under Article 2.2.4.6.36.

Within the Occupational Safety and Health Management System (SG-SST), the employer or contracting party must apply a systematic methodology covering all routine and non-routine, internal or external processes and activities, machines and equipment, all workplaces and all workers, whatever their type of contract, in order to identify hazards and assess risks, prioritise them and set the necessary controls, taking environmental measurements where required (Article 2.2.4.6.15 of Decreto 1072 de 2015). Former risk factor overviews (panoramas de factores de riesgo) are treated as this hazard identification and risk assessment.

Hazard identification must involve all levels of the company, be documented and be updated at least once a year. It must also be updated whenever a fatal work accident or a catastrophic event occurs in the company, or when processes, facilities, machinery or equipment change (Article 2.2.4.6.15, paragraph 1). The employer must inform the Joint OSH Committee (COPASST) or OSH Monitor of the results of workplace assessments (paragraph 3), and internal or external changes require hazard identification and risk assessment before they are implemented (Article 2.2.4.6.26, management of change). The annual hazard identification is one of the documents the employer must keep available and up to date (Article 2.2.4.6.12(3)).

Resolución 0312 de 2019 (SG-SST Minimum Standards) checks this requirement in every company: those with ten or fewer workers in risk classes I, II or III must carry out the identification with the support of their occupational risk insurer (ARL) (Article 3); those with eleven to fifty workers must identify hazards, assess risks and set controls (Article 9); and those with more than fifty must define the methodology and update the identification at least once a year and after every fatal accident, catastrophic event or relevant change (Article 16; standards 4.1.1 and 4.1.2 in the table of Article 27).

Start free

At a glance

What it is	Hazard identification and risk assessment using a systematic methodology (Article 2.2.4.6.15 of Decreto 1072 de 2015)
Regular update	At least once a year (Article 2.2.4.6.15, paragraph 1)
Event-driven update	After a fatal work accident or catastrophic event, or when processes, facilities, machinery or equipment change (Article 2.2.4.6.15, paragraph 1)
Scope	All processes, routine and non-routine activities, machines and equipment, workplaces and workers (Article 2.2.4.6.15)
Participation	All levels of the company; assessment results go to the COPASST or OSH Monitor (paragraphs 1 and 3)
Who checks	Ministry of Labour; ARLs carry out delegated supervision (Article 2.2.4.6.36, paragraph; Article 35 of Resolución 0312 de 2019)

The rule sets an annual minimum, not a specific date in the year; the date of the latest documented update is the practical reference for tracking.

Who is responsible?

The employer or contracting party must carry out hazard identification with the participation of all levels of the company (Article 2.2.4.6.15, paragraph 1, of Decreto 1072 de 2015). In practice the SG-SST lead coordinates it, but responsibility is not transferred: senior management must check at least once a year that hazard identification and risk assessment are kept up to date (Article 2.2.4.6.31(19)). In companies with ten or fewer workers in risk classes I, II or III, the identification is done with the support of the ARL (Article 3 of Resolución 0312 de 2019).

If the deadline passes

Decreto 1072 de 2015 provides no grace period for the annual update. Non-compliance with the SG-SST chapter is punished under Article 91 of Decreto Ley 1295 de 1994, as amended by Article 13 of Ley 1562 de 2012 (Article 2.2.4.6.36), and non-compliance with the Minimum Standards on the same terms; where conditions endanger workers' life or safety, the workplace may be closed or tasks halted (Article 36 and paragraph 1 of Resolución 0312 de 2019).

An accident or a change brings the date forward

Besides the annual review, the matrix must be updated after a fatal work accident, a catastrophic event or any change in processes, facilities, machinery or equipment (Article 2.2.4.6.15, paragraph 1, of Decreto 1072 de 2015). If one of these happens, update the matrix and move the expiry date to one year from that update.

Tracking it with ExpirySuite

Add the company (or each workplace, if you keep a matrix per site) as a record and enter as the expiry date one year after the latest documented update of the matrix.
Email reminders arrive 60, 30, 14, 7 and 1 day before and on the day, in time to walk through the facilities, consult workers and present the results to the COPASST or OSH Monitor.
The SG-SST lead can upload the updated matrix through a secure link that is valid for 14 days and needs no account; then move the expiry date to one year from that update.
Assign the SG-SST lead as the responsible person; if the date passes without an update, managers get further reminders 3, 7 and 14 days later.

Frequently asked questions

How often must the hazard matrix be updated?: At least once a year, and also whenever a fatal work accident or catastrophic event occurs, or when processes, facilities, machinery or equipment change (Article 2.2.4.6.15, paragraph 1, of Decreto 1072 de 2015).
Is the old risk factor overview still valid?: Decreto 1072 de 2015 provides that risk factor overviews are treated as hazard identification and risk assessment (Article 2.2.4.6.15), so they must meet the methodology, scope and annual update set by that article.
Does a small company also need a hazard matrix?: Yes. Resolución 0312 de 2019 includes it in the standards for every company; those with ten or fewer workers in risk classes I, II or III carry it out with the support of the ARL and must implement the resulting prevention and control measures (Article 3).
How does it relate to the Minimum Standards self-assessment?: Hazard identification is one of the standards scored in the annual self-assessment (standards 4.1.1 and 4.1.2 in the table of Article 27 of Resolución 0312 de 2019). Having the matrix up to date before the self-assessment makes it easier to gather the evidence.

Sources

Last checked: Oct 11, 2026 · This page summarises official sources for general information and is not legal advice. Check the linked sources for current rules and fees.

Made for hazard identification and risk assessment matrix (Colombia)

A ready template for hazard identification and risk assessment matrix (Colombia) with sensible validity defaults, so you enter less and track more.

Reminders on time

Email alerts at 60, 30, 14, 7 and 1 day before each hazard identification and risk assessment matrix (Colombia) expires, plus overdue escalation to managers.

Assign an owner

Give each hazard identification and risk assessment matrix (Colombia) an owner and let employees update their own via a secure link — no login needed.