How to Perform a Biosafety Risk Assessment for Your Laboratory

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

By the end of this guide, you will be able to complete a documented biosafety risk assessment for one procedure in your microbiology laboratory, score it with a defensible method, select controls that lower the score, and record approvals and a review date. The method follows the risk-based approach of the WHO Laboratory Biosafety Manual, fourth edition (LBM4), which requires assessments tailored to specific pathogens, specific activities, and the operational setting rather than one rule applied to every lab [1].

You need a spreadsheet application such as Excel, Google Sheets, or LibreOffice Calc. Python 3 is optional if you prefer scripted scoring. Gather the following before you start:

The standard operating procedures (SOPs) for the procedure being assessed
A list of agents and sample types the laboratory handles, with the identification method used for each
An equipment inventory, including centrifuge rotors and safety cups, biosafety cabinets (BSCs, the ventilated HEPA-filtered enclosures used for open-tube work), and the autoclave
Staff training records
The incident and near-miss log, if one exists
The blank biosafety risk assessment template in this article, pasted into your document or spreadsheet

One assessment takes one to two hours for a single procedure once the background material is gathered. The output is a record of one to three pages that an inspector, an accreditor, or a new employee can read and act on.

What a Biosafety Risk Assessment Covers

A biosafety risk assessment is a documented evaluation of what could harm people when a specific agent is handled in a specific way, how likely that harm is, and which controls reduce it to an acceptable level. It answers four questions in order: what is the hazard, how can people be exposed, how severe would one exposure be, and how likely is exposure. A fifth question closes the loop: which controls bring the risk down, and who accepts what remains.

That remainder has a name. Residual risk is the risk left after controls are applied. An assessment is finished when a named person accepts every residual risk, not when the form is full.

Biosafety and biosecurity are different questions. Biosafety protects laboratory workers and the surrounding community from the agent. Biosecurity protects the agent from theft, loss, or misuse. Synthetic biology has moved some biosecurity questions from theory into planning, because the de novo synthesis of eradicated pathogens such as variola virus is now technically feasible [2]. This guide covers biosafety and marks the points where a biosecurity review should be added.

Three frameworks anchor the paperwork:

ISO 35001 is a dedicated biorisk management standard covering risk assessment, staff training, incident reporting, and processes for ongoing improvement. Its adoption is still limited, and certification is not mandatory for laboratory licensing everywhere, so internal discipline still carries the load [3].
Laboratories accredited to ISO/IEC 17025:2017 must address risks and opportunities under Clause 8.5. A structured, laboratory-specific framework aligned with ISO 31000:2018 and ICH Q9 converts that clause into practical steps for biological quality control testing, where operational, analytical, and biosafety risks run high [4].
LBM4 supplies the logic for containment decisions. Practices and facilities follow from the assessed risk of the agent-activity combination, not from the agent name alone [1].

When You Need a New Assessment

Write a new assessment, or formally review an existing one, when any of the following happens:

A new agent, strain, or isolate enters the laboratory
A new procedure, instrument, or kit replaces an old one
The laboratory moves, or renovation changes airflow or layout
Staffing changes the skill mix, such as a wave of new hires
An incident or a near miss occurs, even one with no injury
An SOP is revised
Twelve months pass since the last review

The list targets known causes. Reviews of high-containment laboratory failures identify human error, inadequate training, and differences between standard operating procedures as the primary causes of biosafety incidents [3]. Each trigger attacks at least one of those causes. A near miss is any event that could have caused harm but did not, and it deserves the same review as an injury.

The Biosafety Risk Assessment Template

The template below is the deliverable. Copy it into a word processor or spreadsheet. The format uses seven numbered blocks, and one completed record covers one procedure for one agent group. Keep the format identical across assessments so records can be compared and audited. Name files with the assessment ID and version, for example BRA-2026-014_v1.0.docx, and archive superseded versions rather than overwriting them.

BIOSAFETY RISK ASSESSMENT RECORD
Copy this block into a document or spreadsheet. One record per procedure per agent group.

1. HEADER
   Assessment ID:        BRA-YYYY-NNN
   Version and date:     v1.0, YYYY-MM-DD
   Assessor (name, role):
   Independent reviewer (name, role):
   Approver (name, role):

2. SCOPE
   Laboratory and room:
   Procedure (cite the SOP number and title):
   Agent (genus, species, strain or isolate ID):
   Sample types and known status (inactivated, titer, clinical material):
   Exclusions (what this assessment does NOT cover):

3. AGENT CHARACTERIZATION
   Risk group (1 to 4) and basis for the assignment:
   Routes of infection and dose information:
   Available treatment or prophylaxis:
   Identification method and confidence level:
   Data gaps and default stance if data are missing:

4. TASK TABLE (one row per task)
   Task | Exposure route | L (1-5) | S (1-5) | Score | Band

5. CONTROLS (list per task or globally)
   Elimination or substitution:
   Engineering controls:
   Administrative controls (SOP, training, medical surveillance):
   Personal protective equipment:
   Waste handling and decontamination:

6. RESIDUAL RISK (one row per task)
   Task | New L | New S | New score | New band | Accepted (Y/N)

7. APPROVAL AND REVIEW
   Approval conditions (if any):
   Training linked (course, date, records location):
   Emergency and spill response references:
   Review date:
   Review triggers (new agent, new equipment, incident, renovation):

Two format rules matter more than the rest. First, every task gets its own row in the task table, because risk lives at the task level, not the agent level. Second, every control must be written as something a person does or something a device does, with a name, a setting, or a frequency. "Handle carefully" is not a control.

How to Complete the Template, Step by Step

Step 1. Define the Scope and the Team

Write the scope as one sentence: room, procedure, agent, sample types. For example: "Room 214, primary culture and identification from clinical blood cultures, all organisms including unknowns."

Keep the team to three roles: the bench scientist who performs the work, the direct supervisor, and the biosafety officer. The bench scientist must be in the room when the assessment is written, because task knowledge beats assumptions. The bench scientist proposes scores, the reviewer challenges them, and disagreements are settled by evidence rather than seniority.

State the exclusions. A scope that says what the assessment does not cover prevents two common failures: assuming a record covers more than it does, and duplicating work already assessed. For example: "Does not cover mycobacterial processing, covered by BRA-2025-009."

Step 2. Characterize the Agent

Start with the risk group. Risk groups (RG) classify agents by intrinsic hazard:

RG1, agents not associated with disease in healthy adults
RG2, agents associated with human disease that is rarely serious and often has available preventive or therapeutic options
RG3, agents associated with serious or lethal disease where spread is possible but not usually efficient
RG4, agents associated with serious or lethal disease that is readily transmissible and for which effective interventions are usually unavailable

Henipaviruses such as Nipah virus and Hendra virus are classified as Risk Group 4 agents and are recognized as priority pathogens by the WHO [5].

Risk group describes the agent. A biosafety level (BSL) describes the facility, equipment, and practices applied to the work. The two are linked through the assessment, not automatically.

Then go deeper than the species name, for two reasons.

First, species identity alone is an inadequate basis for safety decisions in some groups. Bacillus cereus is the clearest illustration. Individual strains may cause emetic intoxication, diarrheal toxicoinfection, or spoilage, while selected strains are investigated for beneficial use in food biotechnology. A published three-gate framework converts strain-level data into use-specific decisions. Gate 1 screens for definitive genomic hazards and transferable antimicrobial resistance (AMR) determinants. Gate 2 tiers toxin output using matrix-specific assays. Gate 3 weighs exposure through dose, route, persistence, and vulnerable consumers. The sequence produces auditable outcomes: exclude, restrict, conditionally authorize, or permit controlled cell-free use [6]. The lesson for the template is that a hazard verdict may need strain-level evidence, and field 3 holds exactly that.

Second, identification itself can be wrong, and a wrong name produces a wrong risk group. Weissella confusa shows the failure mode. It is an emerging opportunistic pathogen implicated mainly in invasive infection of immunocompromised patients, and the first systematic synthesis covers 39 published invasive cases. It shows intrinsic vancomycin resistance and shares phenotypic characteristics with other lactic acid bacteria, so misidentification is frequent, and definitive identification requires matrix-assisted laser desorption/ionization time-of-flight mass spectrometry (MALDI-TOF MS), 16S rRNA sequencing, or whole-genome sequencing [7]. In the template, record the identification method and your confidence in it. An ambiguous identification is a data gap.

Record data gaps explicitly, with a default stance. For recently discovered viruses, the absence of live isolates and animal model data precludes definitive risk assessment [5]. When the data are missing, the default is higher containment until evidence arrives, and the template states that default in field 3.

If the work involves genetically modified microorganisms, add a problem formulation step before scoring. Define plausible pathways to harm, such as invasiveness, gene transfer, and toxicity, and write the question that would confirm or refute each step in the pathway [8].

Step 3. Break the Procedure into Tasks and Exposure Routes

List every manipulation from sample receipt to final waste disposal. For each task, name the exposure routes:

Inhalation of aerosols, which are suspended droplets or particles small enough to reach the lungs. Aerosol-generating tasks include vortexing open tubes, syringe ejection, sonication, spill cleanup, and centrifugation without sealed cups.
Percutaneous inoculation through needles, lancets, broken glass, or animal bites
Mucous membrane exposure from splashes during aliquoting, pouring, or plate opening
Ingestion from hand-to-mouth transfer

Keep the task list honest. Laboratory-acquired infections (LAIs) and accidental pathogen escape from laboratory settings (APELS) remain a real concern, and the true number is probably underestimated because there are no mandatory reporting systems or standard surveillance frameworks [3]. Occupational exposure is documented even for high-consequence agents handled by professional teams, which is why biosafety evidence for agents such as henipaviruses draws on outbreak investigations and occupational exposure reports alongside experimental studies [1]. Laboratories performing biological quality control testing face both testing-related and occupational health risks, and proactive identification of both is the point of a structured framework [4].

Mark the aerosol-generating tasks in the table. They usually dominate the risk, and they are the tasks where engineering controls earn their cost.

Step 4. Score Initial Risk

Worked example multiplying likelihood 4 by severity 5 to get 20, then using the band rule to return High.

Score each task on two anchored 5-point scales. The bench scientist proposes, the reviewer challenges, and the pair records the agreed number.

Table 1. Likelihood and severity anchors used by this template

Score	Likelihood, per task per year	Severity, health effect of one exposure
1	Rare, no plausible route	Negligible, no illness
2	Unlikely, requires multiple simultaneous failures	Minor, self-limiting, first aid only
3	Possible during routine lapses	Moderate, medical treatment and days lost
4	Likely without specific controls, or has happened in this laboratory	Severe, hospitalization or lasting effects
5	Almost certain without controls	Catastrophic, life-threatening with limited treatment options

Multiply the two numbers. Risk score = likelihood x severity. Band the product with the rules in Table 2.

Table 2. Risk bands and required actions

Score	Band	Required action	Example
1 to 6	Low	Proceed with standard precautions	L2 x S3 = 6
8 to 12	Medium	Named controls in place before work starts	L2 x S5 = 10
15 to 25	High	Stop, redesign the task or escalate	L4 x S4 = 16
Any task with S5	Medium floor	Never accept at Low band, regardless of score	L1 x S5 = 5

The severity 5 floor is a convention worth keeping. A catastrophic consequence should never ride on a lucky year.

Spreadsheet version, where column B holds likelihood, column C holds severity, and row 2 is the first task:

Score (D2):  =B2*C2
Band  (E2):  =IF(D2>=15,"High",IF(OR(D2>=8,C2=5),"Medium","Low"))

With 4 in B2 and 5 in C2, D2 shows 20 and E2 shows High. Add data validation on columns B and C, whole number between 1 and 5, so a typed word cannot enter a score cell.

Scripted version in Python, using the tasks from the worked example later in this guide:

# score_tasks.py: compute initial and residual risk from the template task table

def band(score, severity):
    # 5x5 matrix, severity 5 is floored at Medium
    if score >= 15:
        return "High"
    if score >= 8 or severity == 5:
        return "Medium"
    return "Low"

def decision(b):
    return "Stop, redesign or escalate" if b == "High" else "Proceed with listed controls"

tasks = [
    ("Unpack and inspect inactivated aliquots",  2, 5, 1, 5),
    ("Extract RNA, inactivation validated",      4, 5, 2, 5),
    ("Extract RNA, inactivation NOT validated",  5, 5, 5, 5),
    ("Set up RT-PCR reactions",                  1, 5, 1, 5),
    ("Decontaminate bench and process waste",    2, 3, 1, 2),
]

for task, l0, s0, l1, s1 in tasks:
    print(task)
    print(f"  initial : L{l0} x S{s0} = {l0 * s0} ({band(l0 * s0, s0)})")
    print(f"  residual: L{l1} x S{s1} = {l1 * s1} ({band(l1 * s1, s1)})")
    print(f"  decision: {decision(band(l1 * s1, s1))}")

Expected output:

Unpack and inspect inactivated aliquots
  initial : L2 x S5 = 10 (Medium)
  residual: L1 x S5 = 5 (Medium)
  decision: Proceed with listed controls
Extract RNA, inactivation validated
  initial : L4 x S5 = 20 (High)
  residual: L2 x S5 = 10 (Medium)
  decision: Proceed with listed controls
Extract RNA, inactivation NOT validated
  initial : L5 x S5 = 25 (High)
  residual: L5 x S5 = 25 (High)
  decision: Stop, redesign or escalate
Set up RT-PCR reactions
  initial : L1 x S5 = 5 (Medium)
  residual: L1 x S5 = 5 (Medium)
  decision: Proceed with listed controls
Decontaminate bench and process waste
  initial : L2 x S3 = 6 (Low)
  residual: L1 x S2 = 2 (Low)
  decision: Proceed with listed controls

Three errors appear constantly in this step, with exact messages:

Excel returns #VALUE! when a score cell contains text such as likely instead of a number. Fix: enter digits only, keep the word anchors in Table 1, and enable data validation.
Python returns TypeError: unsupported operand type(s) for *: 'str' and 'int' when a score is read from a file as a string. Fix: cast with int() before multiplying.
A score of 0 or a blank cell means a missing entry, never a real result, because the minimum product of the scales is 1. Fix: treat blank as an incomplete record and return the form.

Step 5. Select Controls and Score Residual Risk

Decision path from a High band task through redesign or escalation, with the severity 5 floor and referral route shown.

Work down the hierarchy of controls, which orders controls from most to least reliable:

Elimination or substitution. Remove the hazard or replace it with something less hazardous. Prefer molecular detection over culture where the clinical question allows it, inactivated material over live culture, and plastic over glass.
Engineering controls. Class II biosafety cabinets for open-tube work, sealed rotors or safety cups for centrifugation, sharps containers at the point of use, splash guards.
Administrative controls. SOPs, competency-based microbiology biosafety training, medical surveillance where indicated, exposure response plans, spill drills.
Personal protective equipment (PPE). Gloves, fluid-resistant gowns, fitted eye protection, and respiratory protection where the assessment justifies it.

Substitution deserves a caution. Inactivated material is only safer if the inactivation is real. For high-consequence agents such as henipaviruses, validated inactivation and decontamination practices are a core part of the biosafety evidence base, and the adequacy of that evidence is exactly what risk-based containment decisions depend on [1]. Ask for the validation file: method, parameters, verification method, and the signature of the person who approved it.

Training is the control most often assumed rather than verified. Competency means demonstrated ability to perform the task to standard, confirmed by direct observation, not a signature on an attendance sheet. Simulation-based biosafety education improves understanding of PPE use and risk perception and helps learners connect theory to practice [9]. Tie the assessment to the training matrix by course name and date.

Then rescore. Controls usually lower likelihood more than severity, because the agent fixes severity while exposure likelihood is what engineering and behavior change. Enter the new numbers in field 6 and recompute. If any task still bands High, either redesign the task or escalate the assessment to the institutional biosafety committee.

Step 6. Approve, Train, and Schedule Review

The approver is the laboratory director or supervisor, countersigned by the biosafety officer. Attach conditions where a control is not yet in place, and write the condition as a gate: work begins only after a named file is reviewed and signed.

Set the review date at 12 months and list the triggers from earlier in the same field. Present the completed record at a laboratory meeting, ten minutes, walking the task table rather than reading the form. Post the one-page summary at the bench.

Close the loop with incident reporting. Record every incident and near miss against the assessment ID so trends surface at the annual review, which is how the risk assessment, training, and incident reporting elements of a biorisk management system reinforce each other [3]. For accredited testing laboratories, file the assessment where it feeds management review under ISO/IEC 17025 Clause 8.5, and record resolved risks as documented improvements [4].

Worked Example: Nipah Virus RT-PCR on Inactivated Material

This biosafety risk assessment template example shows the record filled in for a realistic molecular diagnostics request. A hospital laboratory is asked to test EDTA blood from a returning traveler for Nipah virus RNA by reverse transcription PCR (RT-PCR), which amplifies viral RNA. The laboratory will not culture live virus. The sending laboratory heat-inactivates aliquots under a documented protocol before transport.

BIOSAFETY RISK ASSESSMENT RECORD (completed example)

1. HEADER
   Assessment ID:   BRA-2026-014
   Version/date:    v1.0, 2026-03-02
   Assessor:        A. Rivera, senior technologist, molecular suite
   Reviewer:        J. Okafor, shift supervisor
   Approver:        M. Chen, biosafety officer

2. SCOPE
   Laboratory/room: Room 118, molecular diagnostics suite
   Procedure:       SOP MOL-07 rev 3, RNA extraction and RT-PCR for
                    Nipah virus RNA
   Agent:           Nipah virus (NiV), genus Henipavirus
   Samples:         EDTA blood and serum, heat-inactivated upstream by
                    the sending laboratory under protocol INACT-02
   Exclusions:      No culture, no sonication, no live-virus work, no
                    unfixed tissue. Covered elsewhere or referred out.

3. AGENT CHARACTERIZATION
   Risk group:      4. Basis: highest-consequence zoonotic virus,
                    WHO priority pathogen classification [5]
   Routes:          Inhalation, percutaneous, mucous membrane
   Treatment:       Prophylactic and therapeutic options limited,
                    which sets severity at 5 [5]
   Identification:  Agent identity presumed from the clinical request,
                    samples tracked by accession number, confirmatory
                    testing by the reference laboratory if positive
   Data gaps:       None for this activity. The controlling evidence
                    item is the upstream inactivation validation [1]

4. TASK TABLE (initial)
   Task                             Route            L S Score Band
   Unpack and inspect aliquots      percut, mucous   2 5  10   Medium
   Extract RNA (validated inact.)   aerosol, splash  4 5  20   High
   Extract RNA (unvalidated)        aerosol          5 5  25   High
   Set up RT-PCR reactions          aerosol          1 5   5   Medium
   Decontaminate bench and waste    contact          2 3   6   Low

5. CONTROLS
   Substitution: accept only aliquots with an inactivation certificate
     stating method, time, temperature, and lot verification
   Engineering: class II BSC for all open-tube steps, sealed-rotor or
     safety-cup centrifugation only
   Administrative: competency sign-off before first run, buddy system
     for first three runs, spill drill twice yearly
   PPE: fluid-resistant gown, double gloves, fitted eye protection
   Waste: validated disinfectant with documented contact time,
     autoclave cycle logged

6. RESIDUAL RISK
   Task                             L S Score Band    Accepted
   Unpack and inspect aliquots      1 5   5  Medium   Y
   Extract RNA (validated)          2 5  10  Medium   Y
   Extract RNA (unvalidated)        5 5  25  High     N, refer out
   Set up RT-PCR reactions          1 5   5  Medium   Y
   Decontaminate bench and waste    1 2   2  Low      Y

7. APPROVAL AND REVIEW
   Condition: work begins only after the INACT-02 validation file is
     reviewed and countersigned by the biosafety officer
   Training: molecular suite competency, 2026-02-20, records in the
     laboratory information system
   Emergency refs: spill plan SP-04, exposure response ER-11
   Review date: 2027-03-02, or on any trigger

Three features of this example are worth copying.

The assessment turns on one verifiable fact, the inactivation validation. With validation, extraction scores L4 x S5 = 20 initially and drops to Medium after controls. Without validation, the same task scores L5 x S5 = 25 and the decision is stop and refer. One document, the validation file, decides the outcome, which is why the approval condition names it.

The severity 5 floor keeps unpacking and PCR setup at Medium even though their products are numerically Low. The band records the floor, not just the product.

The referral path is written down. When capability or containment is missing, the assessment ends with a referral rather than an improvised workaround. Reference laboratory networks exist for exactly this purpose. During the 2026 Andes virus outbreak linked to a cruise ship, European public health reference laboratories provided rapid support where national diagnostic capability gaps remained [10].

If the request changes to live-virus culture, this record is void. Live Nipah virus work requires containment and approvals that hospital laboratories do not hold, and the correct output of the reassessment is a referral to a laboratory that does.

How to Check the Result

Run these checks before you file the record:

Recalculate independently. A second person re-scores at least three tasks from the raw task descriptions without seeing your scores. Differences larger than one scale point mean the anchors need sharper wording.
Audit for blanks. Any blank mandatory field invalidates the record. Blank score cells are the most common defect.
Check band-action consistency. Every High task shows a redesign or an escalation record. Every Medium task names its controls before work. Every Low task maps to standard precautions.
Check the severity 5 floor. No S5 task sits at Low band.
Verify that controls exist in the room, not just on paper. The BSC is certified on schedule, the safety cups are on the shelf, the disinfectant is in date, the spill kit is stocked.
Verify that training records match the named controls.
Confirm the ordering. Every residual score is lower than or equal to its initial score. A residual score that is higher means a listed control does not work as written.

Sensible next steps after filing: link the record to the training matrix, schedule the spill drill, set calendar reminders for the review date, and archive superseded versions with their version numbers so the history stays auditable.

Common Mistakes and Limitations

Copying the risk group straight to the biosafety level. Risk group describes the agent, the BSL describes the facility and practices, and LBM4 links them through the assessed risk of the specific activity, so the same agent can sit at different containment for different tasks [1].
Using the species name as the whole hazard evaluation. Bacillus cereus and Weissella confusa both show why strain-level and identification-level checks change the answer [6][7].
Trusting an inactivation claim without a validation file. The claim is not the evidence, the file is.
Writing a control as an attitude. Be careful and handle carefully are not controls. Name the device, the setting, or the frequency.
Scoring once and filing forever. The trigger list exists because risk drifts as agents, equipment, and staff change.
Treating training as a checkbox. Inadequate training is a primary cause of laboratory incidents [3], and scenario-based methods such as simulation build PPE and risk perception skills better than a signature sheet [9].
Ignoring near misses. LAIs are probably undercounted in the absence of mandatory reporting [3], so your own near-miss log is the best early warning you will get.
Letting one negative result stand for a whole safety verdict. A single negative broth result is not proof of safety for a strain-level question, which is why gated frameworks require the missing test to be named [6].

Limitations: a template structures judgment, it does not replace it. Work with live Risk Group 3 or 4 material, genetically modified organisms with release potential, and agents subject to national biosecurity rules needs review by an institutional biosafety committee or equivalent body and, where applicable, national authorization. Individual cases need a qualified biosafety professional, and local regulations set the minimum standard this template is designed to exceed.

Frequently Asked Questions

What is a biosafety risk assessment template?

A biosafety risk assessment template is a pre-formatted record with fields for the agent, the tasks, the exposure routes, the likelihood and severity scores, the controls, the residual risk, and the approvals. It turns expert judgment into a document that others can read, check, and audit.

Is there a free biosafety risk assessment template I can copy?

Yes. The blank template in this article is free to copy into any document or spreadsheet, and the worked example shows the same format filled in.

What is the difference between a risk group and a biosafety level?

A risk group describes how hazardous an agent is. A biosafety level describes the facility, equipment, and practices used to handle it. The risk assessment links the two for a specific activity, and the link is not automatic.

How often should a biosafety risk assessment be reviewed?

Review at least every 12 months, and immediately after a new agent, new equipment, a renovation, an SOP revision, a staffing change, or any incident or near miss.

Who should approve a completed assessment?

The laboratory director or supervisor approves, with the biosafety officer countersigning. Work with live Risk Group 3 or 4 material also needs institutional committee review.

How do I score likelihood and severity?

Use anchored 1 to 5 scales for each, multiply the two numbers, and apply the bands: 1 to 6 is Low, 8 to 12 is Medium, 15 to 25 is High, and any severity 5 task is held at Medium or above.

What is the difference between biosafety and biosecurity?

Biosafety protects people and the community from the agent. Biosecurity protects the agent from theft, loss, or misuse. This template covers the biosafety side and flags where a biosecurity review should be added.

Do I need a separate assessment for routine BSL-2 work?

Yes, one record per distinct procedure. A program-level assessment can cover a set of routine tasks on the annual review cycle, with its own task rows for anything that generates aerosols.