vaayaa Inclusive Education
Technical risk assessment

Thermal Systems and HVAC Engineering Risk Assessment: Equipment, Refrigerant and Control Hazards

A worked example of how an engineer finds, scores and controls the risks in heating, ventilation and cooling systems, from refrigerant, electrical and combustion hazards to sizing errors, poor commissioning and supplier dependence.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the Thermal Systems and HVAC Engineering course

Executive summary

This assessment shows how an engineer can find, rate and control the risks in a building heating, ventilation and cooling system. Eight risks were chosen because they are plausible in everyday design, commissioning and operation. Refrigerant release, legionella growth and electrical or combustion hazards carry the highest natural severity, while sizing mismatch and maintenance backlogs are more likely but cause steady harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the proposed controls are in place, but electrical and combustion hazards stay at Medium because their impact remains serious. The first actions are isolation procedures, carbon monoxide sensing, a water treatment routine and a witnessed controls test. The building is a teaching example, so every score illustrates method, not a real plant.

Focus area
Thermal systems, heating, ventilation and air conditioning engineering
Setting
Design, installation and operation of building heating, ventilation and cooling plant managed by an in-house facilities team
Method
Five by five likelihood and severity risk register

Scope

This assessment covers the design, commissioning, operation and maintenance of a building heating, ventilation and air conditioning system, including gas boilers, air cooled chillers, air handling units, ductwork, controls and refrigerant circuits. It looks at risks to people, equipment, air quality, energy use and occupancy. It does not describe any real building, plant or jurisdiction. Location, applicable codes, plant size and contractor arrangements are assumptions made for teaching.

Context

The example building has a mechanical services engineer, a facilities manager, two maintenance technicians, an outsourced controls contractor and an external commissioning agent. Plant includes gas fired boilers, chillers with refrigerant circuits, air handling units with heat recovery, and a building management system that schedules and monitors all plant. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls proposed. Specialist review by a licensed engineer is needed before any real design or work is carried out.

Objectives, assets and stakeholders

The objective is to keep occupants, staff and the public safe, provide reliable comfort conditions, control energy use and meet the legal duties that apply to plant. The assets in scope are the boilers, chillers, air handling units, ductwork, refrigerant circuits, water systems, electrical panels and the building management system. Stakeholders include maintenance staff, occupants, the building owner, the controls contractor, the commissioning agent, suppliers and the local authorities that enforce building and environmental rules. Clear roles matter: every risk has one owner role, and the facilities manager keeps the register current and reports to the owner each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 H05 H07 Likelihood 4, impact 4, score 16, high: H01
3 Possible Likelihood 3, impact 4, score 12, high: H08 Likelihood 3, impact 5, score 15, high: H02 H03 H06
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H07
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 Likelihood 2, impact 3, score 6, medium: H01 H04 H08 Likelihood 2, impact 4, score 8, medium: H02 H03 H06
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Refrigerant leak and release from chiller circuits 16 High 6 Medium Facilities manager
H02 Electrical shock and arc flash at plant panels 15 High 8 Medium Electrical services supervisor
H03 Combustion gas and carbon monoxide from gas boilers 15 High 8 Medium Mechanical services engineer
H04 Plant sizing and specification mismatch 12 High 6 Medium Mechanical services engineer
H05 Poor commissioning and controls misconfiguration 12 High 4 Low Controls engineer
H06 Legionella growth in cooling towers and humidifiers 15 High 8 Medium Facilities manager
H07 Maintenance backlog and reliability failure of key plant 12 High 6 Medium Maintenance manager
H08 Dependence on single suppliers and long component lead times 12 High 6 Medium Procurement lead
H01

Refrigerant leak and release from chiller circuits

Environmental Before 16 After 6

Joints, valves or heat exchangers in refrigerant circuits leak gradually or suddenly, releasing refrigerant into plant rooms and the atmosphere and reducing cooling capacity.

Who or what is affected: Maintenance staff, occupants and the local environment

Causes

Vibration, corrosion at joints, ageing seals and repeated top ups without investigation.

Consequences

Loss of cooling, harm to people in plant rooms, environmental damage and costly refrigerant replacement.

Existing controls

  • Refrigerant circuits are pressure tested at commissioning.
  • Leak detectors are fitted in plant rooms.

Control gaps

Leak checks are done only at annual service, and top up records are not reviewed against past volumes.

Additional controls

  • Prevent: Schedule leak checks and keep a refrigerant inventory recorded by circuit.
  • Detect: Alarm refrigerant concentration and pressure drop to the controls team at once.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Facilities manager Target: Within 60 days Early warning: Repeated top up of refrigerant charge on the same circuit within a quarter.
H02

Electrical shock and arc flash at plant panels

Safety Before 15 After 8

Work on live electrical panels, motor starters and variable speed drives exposes staff to shock, burns or arc flash when isolation is incomplete or equipment is faulty.

Who or what is affected: Electrical and mechanical technicians and nearby staff

Causes

Rushed repairs, incomplete isolation, worn cables and missing arc rated protective equipment.

Consequences

Serious injury, fatality, equipment damage and loss of plant for an extended period.

Existing controls

  • Panels are labeled and doors are locked.
  • Only qualified electricians open live panels.

Control gaps

Permit to work records are not checked against actual panel access, and drive faults are not logged.

Additional controls

  • Prevent: Use isolation, lockout and proving dead procedures before any panel work starts.
  • Respond: Keep trained first aiders and a written shock response plan at each plant room.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Electrical services supervisor Target: Within 30 days Early warning: Panel doors opened without a permit to work or an isolation record.
H03

Combustion gas and carbon monoxide from gas boilers

Safety Before 15 After 8

Incomplete combustion, blocked flues or poor combustion air supply release carbon monoxide into plant rooms or occupied spaces, and gas leaks create fire or explosion risk.

Who or what is affected: Occupants, maintenance staff and neighbors near flue outlets

Causes

Blocked flues, nesting animals, poor burner setup and building alterations that starve the boiler of air.

Consequences

Carbon monoxide poisoning, gas explosion, emergency evacuation and legal action.

Existing controls

  • Flue and combustion checks are done at each service.
  • Carbon monoxide alarms are fitted in plant areas.

Control gaps

Alarm tests are done only at service and sensor readings are not trended.

Additional controls

  • Prevent: Keep combustion air openings clear and inspect flue integrity each heating season.
  • Detect: Connect gas and carbon monoxide sensors to the building management system with alarms.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Mechanical services engineer Target: Within 30 days Early warning: Carbon monoxide reading above the alarm setpoint during a boiler test or normal running.
H04

Plant sizing and specification mismatch

Operational Before 12 After 6

Chillers, boilers or air handling units are sized from wrong load assumptions, so zones overheat or overcool, energy use rises and equipment cycles too often.

Who or what is affected: Building occupants, the operations team and the energy budget owner

Causes

Assumed occupancy, changed building use, optimistic diversity factors and late design changes.

Consequences

Occupant discomfort, complaints, high running costs and early plant wear.

Existing controls

  • Load calculations are checked by a second engineer.
  • Design changes are logged on a design register.

Control gaps

Design assumptions are not revisited after occupation, so mismatch is found only by complaint.

Additional controls

  • Prevent: Check design loads against measured occupancy and internal heat gains before purchase.
  • Detect: Compare building temperature and energy data with design targets each quarter.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Mechanical services engineer Target: Within 90 days Early warning: Zones unable to reach set point for longer than the agreed period during peak load.
H05

Poor commissioning and controls misconfiguration

Technology and data Before 12 After 4

Control sequences, setpoints or sensor calibrations are wrong or altered without a record, so plant runs unsafely, wastes energy or fails to respond to faults.

Who or what is affected: Occupants, operators and the controls contractor

Causes

Rushed handover, remote edits by several parties and sensors that drift out of calibration.

Consequences

Unsafe running, energy waste, repeated faults and disputes over contract responsibility.

Existing controls

  • Functional tests are signed off before handover.
  • Control sequences are documented in a written matrix.

Control gaps

Setpoint overrides are not reviewed, and backups are not tested by restoring them.

Additional controls

  • Prevent: Require a witnessed control sequence test and a change log for every setpoint edit.
  • Recover: Restore controller settings from the last verified backup after any unexplained fault.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Controls engineer Target: Within 45 days Early warning: Manual overrides left in place for more than an agreed number of days.
H06

Legionella growth in cooling towers and humidifiers

Safety Before 15 After 8

Warm, stagnant water in cooling towers, humidifiers and dead legs supports bacterial growth, and aerosols carry the bacteria to people nearby.

Who or what is affected: Occupants, visitors and maintenance staff who work near water systems

Causes

Dosing failures, long shutdowns, dirty strainers and dead legs in pipework.

Consequences

Serious illness in people exposed to aerosols, closure of the building and legal liability.

Existing controls

  • A written water treatment plan is in place.
  • Cooling towers are inspected each month.

Control gaps

Dosing is checked by reading logs, not by independent testing, and dead legs are not mapped.

Additional controls

  • Prevent: Keep treatment dosing and sampling on a scheduled routine with signed records.
  • Detect: Test water samples from towers and humidifiers at agreed intervals and act on results.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Facilities manager Target: Within 30 days Early warning: A missed water treatment dose or a missed sampling date.
H07

Maintenance backlog and reliability failure of key plant

Operational Before 12 After 6

Overdue servicing of compressors, fans and pumps leads to bearing failure, belt slip and refrigerant or oil loss, causing unplanned outages in cooling or heating.

Who or what is affected: Occupants, maintenance staff and tenants relying on comfort conditions

Causes

Staff shortages, deferred work during busy periods and poor records of parts condition.

Consequences

Unplanned outages, emergency repair costs and occupant complaints.

Existing controls

  • The planned maintenance schedule is kept in the asset system.
  • Operators report abnormal noise or vibration.

Control gaps

Deferred tasks are not reviewed by risk, and vibration trends are not recorded.

Additional controls

  • Prevent: Rank overdue tasks by risk and assign a named technician to each critical item.
  • Respond: Keep a hire plan and critical spares for compressors and fan motors.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Maintenance manager Target: Within 60 days Early warning: Overdue planned maintenance tasks on plant marked critical in the asset register.
H08

Dependence on single suppliers and long component lead times

Supplier Before 12 After 6

A critical component such as a compressor, controller or refrigerant is available from one supplier with long lead times, so a failure cannot be fixed quickly.

Who or what is affected: Building operators, occupants and the procurement team

Causes

Standardized equipment from one manufacturer, cost focused buying and limited stock holding.

Consequences

Extended outages, higher emergency costs and failure to meet occupant needs.

Existing controls

  • An approved supplier list is reviewed each year.
  • Critical spares are listed in the asset register.

Control gaps

Lead times are not tracked against outage allowances, and second sources are not tested.

Additional controls

  • Prevent: Qualify a second source for key compressors and controllers and record their lead times.
  • Recover: Agree service level terms with suppliers and a temporary plant hire arrangement.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 90 days Early warning: Quoted lead time for a critical component longer than the outage allowance in the plan.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and severity runs from Negligible to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls are working. Severity for people is judged first, then damage to plant, environmental harm, energy waste and legal exposure. A risk is never rated down only because it has not yet happened. Anything Critical or High needs senior attention and a dated plan, Medium needs routine controls with a named owner, and Low is accepted and watched. Engineers and technicians should challenge the ratings, and the register is reviewed whenever a warning indicator reaches its threshold or the plant changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Refrigerant top up volumes recorded against each circuit over a rolling quarter.Escalate to the facilities manager when any circuit is topped up twice in a quarter, and to the owner if a leak is confirmed.
Panel doors opened without a permit to work or isolation record.Escalate to the electrical services supervisor at once and suspend the work until isolation is proven.
Carbon monoxide or gas sensor readings above the alarm setpoint.Escalate to the mechanical services engineer at once, evacuate the area and make the boiler safe before restart.
Missed water treatment doses or sampling dates for towers and humidifiers.Escalate to the facilities manager on the day, and to the owner if a sample result is outside agreed limits.
Overdue planned maintenance tasks on critical plant and supplier lead times longer than the outage allowance.Escalate to the maintenance manager when any critical task is overdue by more than 14 days, and to the owner if a lead time exceeds the outage allowance.

Contingency arrangements

If a serious event occurs, such as a refrigerant release, a carbon monoxide alarm, an electrical injury or a confirmed legionella result, the facilities manager makes the plant safe, isolates the affected circuit and clears the area. Emergency services are called where people are at risk. The maintenance manager arranges temporary cooling or heating and hire plant. Regulators and the owner are informed through the appropriate channel, and the engineer records the cause before any restart.

Prioritized action plan

  1. Enforce isolation, lockout and proving dead procedures for all panel work, owner electrical services supervisor, within 30 days.
  2. Install and test carbon monoxide and gas sensors linked to alarms in all boiler rooms, owner mechanical services engineer, within 30 days.
  3. Run a documented water treatment routine with independent sampling for towers and humidifiers, owner facilities manager, within 30 days.
  4. Require witnessed control sequence tests and a setpoint change log, owner controls engineer, within 45 days.
  5. Rank overdue maintenance by risk and qualify a second source for key compressors, owner maintenance manager and procurement lead, within 90 days.

Conclusion

Safe and reliable thermal systems depend on a few steady habits: controlled isolation, verified gas and carbon monoxide safety, a documented water treatment routine, witnessed commissioning and a maintenance plan ranked by risk. The highest scores sit with refrigerant, electrical, combustion and water hazards, and each has controls that bring residual scores down. Treat the register as a living record, review it on the stated cycle, and seek licensed engineering advice for any real design, gas, electrical, refrigerant or water question.

Assumptions and limitations

Assumptions

  • The building operates under local construction and mechanical services rules, which are not named here and must be checked by a licensed engineer.
  • Plant is installed by competent contractors and commissioned before handover, but records of the handover may be incomplete.
  • Refrigerants, fuels and controls are typical of commercial plant, and the building management system is networked.

Limitations

  • The scores are examples for learning and do not describe any real plant, building or incident.
  • Codes, refrigerant handling rules and fuel safety requirements differ by place and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific risk assessment or licensed engineering advice.

Related frameworks to study

  • Hierarchy of controls
  • Lockout and tagout for energy isolation
  • Commissioning and functional performance testing
  • Planned preventive maintenance planning
  • Building management system alarm management

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Thermal Systems and HVAC Engineering course Read the best practices for this course

More Technical risk assessments

Hourly Active: 35,186 Learners