Arbowet RI&E: Risk Inventory and Evaluation Explained

What the Arbowet actually asks for

Every employer in the Netherlands with staff has to have a risico inventarisatie en evaluatie, an RI&E. It is written down in the Arbowet as a duty, not as a recommendation, and it consists of three parts that belong together:

1. An inventory: which hazards exist in this organisation, for whom, and where.
2. An evaluation: how serious each one is, how likely, and which risks therefore come first.
3. A plan van aanpak: which measures you will take, who owns them, and by when.

The third part is the one the Nederlandse Arbeidsinspectie tends to ask about, because it is the part that shows whether the first two led to anything. An RI&E without a plan van aanpak is not half compliant. It is an unfinished document.

Two more obligations sit around it. The RI&E has to be available to your employees, and the works council or personeelsvertegenwoordiging has a formal say in it. And it has to stay current: the moment the work changes, the document no longer describes the work.

If you want the wider frame of what the Arbowet puts on the employer, we set that out separately in employer obligations under the Arbowet.

Inventory is the easy half

Most organisations can produce a list of hazards. Walk the site, talk to the people doing the work, read the incident history, and the list writes itself: machinery, hazardous substances, physical load, noise, working at height, traffic on site, screen work, workload and undesirable behaviour.

The problem is usually not the inventory, but the evaluation.

Evaluation means ranking. It means saying out loud that one of these risks deserves budget this quarter and another one does not, and being able to explain why. That is uncomfortable, so in practice it often gets skipped: every risk gets a medium score, every measure gets a deadline somewhere next year, and the document ends up describing an organisation that treats everything as equally urgent. Which is the same as treating nothing as urgent.

A usable evaluation is specific. Not "risk of exposure to hazardous substances, medium", but which substance, in which task, how often, how long, who is exposed, and which control you are relying on right now.

What belongs in the plan van aanpak

Keep it boring and checkable. For every measure:

• The risk it addresses, referenced back to the RI&E.
• The measure itself, described concretely enough that someone else could execute it.
• One named owner. Not a department.
• A deadline.
• What you will accept as evidence that it is done.
• The date it was actually closed, and by whom.

That last pair is where most action lists quietly fail. A measure marked green because someone remembers discussing it is not the same as a measure with a signed off result behind it. If the next colleague has to assume anything, the record is not finished.

Apply the arbeidshygiënische strategie when you choose measures: eliminate the hazard at source first, then technical controls, then organisational controls, and only then personal protective equipment. Inspectors read a plan van aanpak that jumps straight to PPE as a signal about how the rest of the system works.

Specific risks that need their own treatment

The general RI&E is the base. On top of it, certain subjects carry their own requirements and are easy to overlook until someone asks for them:

• Hazardous substances, including a register of substances and exposure assessment.
• Physical load and manual handling.
• Noise.
• Biological agents.
• Psychosocial workload: work pressure, aggression, bullying, harassment.
• Young workers and pregnant or breastfeeding employees.
• Display screen work, including the arrangements you make for eye tests and, where needed, screen glasses. We covered that specific question in computer glasses and reimbursement under the Arbowet.
• Explosion risk, where an explosieveiligheidsdocument applies.

If you run a Seveso-III or ARIE site, the RI&E is not the outer boundary of your obligations but one component inside a much heavier safety management system, with a veiligheidsrapport, a PBZO document, veiligheidsstudies and management of change all needing to stay consistent with each other. That is a different problem with a different failure mode, and it is why generic safety management software falls short for Seveso-III companies.

Does yours need an external review

An RI&E normally has to be reviewed by a certified expert, an arbodienst or a certified safety professional. There are exceptions for smaller employers: up to 25 employees, using a recognised branch RI&E instrument, the external review can drop away, and for very small amounts of work a lighter checklist may be enough. The thresholds and the list of recognised instruments do change, so check the current rules for your situation rather than relying on what was true at your last cycle.

Worth saying plainly: the review is about the quality of the RI&E, not about whether your site is safe. A reviewed RI&E and a controlled work floor are two different achievements.

When to update it

There is no fixed statutory interval. The rule is that the RI&E must reflect the actual situation, which means the triggers are events, not dates:

• New or modified installations, machinery, or processes.
• A new work method, a new product, a new substance.
• Reorganisation, or a significant change in staffing or shift patterns.
• An incident or near miss that shows a risk you had not scored.
• New legislation or a revised PGS or standard that touches your operation.
• Findings from an inspection, internal or external.

An annual check on whether the plan van aanpak is progressing, plus an update whenever one of the triggers above fires, is a defensible rhythm. What is not defensible is a document dated five years ago describing equipment you no longer own.

Keeping it alive without building a second administration

The recurring pattern we see is this: the RI&E lives in a document, the actions live in a spreadsheet, the inspection rounds live on printed checklists, and the incidents live in a separate system. Each part is fine. The connections between them are what rot. Nothing is openly non-compliant, and yet the document slowly stops describing reality.

Two practical habits help more than any tool:

• Make the RI&E feed the work. The risks you scored highest should be visible in the checklists people actually use on their rounds, so the inventory gets tested in practice instead of only on paper.
• Make the work feed the RI&E. Observations, near misses and inspection findings should have a route back into the risk assessment, otherwise you keep relearning the same thing.

Software can carry the administrative weight here: one place for the forms and rounds, one action register where every corrective action has an owner, a deadline and an evidence trail, and a searchable link back to the risk that caused it. Our own platform does that part, with Clara, our AI assistant, available to find what a document actually says instead of you hunting through folders. It does not make you compliant and it does not take over the judgement. Ranking risks and accepting them remains the employer's call.

If you are in the middle of an RI&E cycle and the part that worries you is the plan van aanpak rather than the document, that is the conversation we are usually most useful in. Send us the actual situation, including the messy parts, and we will tell you honestly whether we are a fit.