Risk Assessment and Hazard Identification – if the organisation doesn’t know what the hazards are, or fails to identify them, control measures maybe missed.