Biological Risk Assessment for Laboratory Protocols

A biological risk assessment is the analytical step that decides what containment level, practices, and personal protective equipment a specific laboratory protocol actually needs — it comes before biosafety level (BSL) assignment, not after. It is a different exercise from a generic severity-times-likelihood hazard matrix: a matrix scores an already-identified hazard on two dimensions so competing risks can be prioritised, while a biological risk assessment identifies the hazard in the first place, by working through the biological agent’s own characteristics, the people doing the work, and the exact procedures involved. This guide walks through the framework CDC/NIH’s Biosafety in Microbiological and Biomedical Laboratories (BMBL) uses, then applies it to a full worked example, ending in a containment and PPE determination.

The three inputs BMBL’s risk assessment weighs

BMBL’s Section IV frames biological risk assessment as a synthesis of three categories of information, not a single checklist:

• Agent hazards — the biological agent’s own capability to infect and cause disease in a susceptible host: its infectivity, virulence, severity of disease, and whether effective preventive measures (vaccines) or treatments exist. An agent with a low infectious dose and no available treatment carries more weight here than one that is common, mild, and treatable.
• Host factors — the susceptibility of the people who will actually be exposed: age, immunological status (including pregnancy or immunosuppression), pre-existing conditions, and any occupational or geographic factors that change their baseline risk. The same agent can justify different precautions for different personnel working the same bench.
• Laboratory procedure hazards — what is actually being done to the agent or specimen. Centrifugation, sonication, vortexing, and needle use each create a different exposure profile than, say, reading a closed culture plate, even when the agent is identical.

These three inputs are combined, not scored independently and summed — a low-hazard agent handled by an immunocompromised worker in an aerosol-generating procedure can land at a higher precaution level than the agent’s intrinsic hazard alone would suggest, and BMBL explicitly allows a protocol-specific assessment to diverge from an agent’s default Risk Group-to-BSL mapping in either direction.

The five routes a laboratory-acquired infection actually travels

Procedure-hazard analysis exists to answer one question for each step of a protocol: which of the five recognised laboratory exposure routes does this step create, and how likely is it?

1. Parenteral inoculation — needlesticks or other contaminated sharps injuries.
2. Mucous membrane or non-intact skin contact — spills and splashes reaching the eyes, mouth, nose, or broken skin.
3. Ingestion — historically mouth pipetting, now more often hand-to-mouth contact after inadequate decontamination.
4. Animal bites and scratches — relevant to any protocol involving live animal work with the agent.
5. Inhalation of infectious aerosols — the route procedures like centrifugation, sonication, vortexing, and pipetting most readily create, and the reason biosafety cabinets exist.

A protocol step that creates none of these five exposure routes for a given agent generally doesn’t drive the containment decision; a step that creates one or more does, and the control selected (engineering control, PPE, or both) should map to the specific route it closes off, not be applied generically.

Running the assessment: a five-part process

1. Characterise the agent. Confirm Risk Group classification (RG1–RG4), infectious dose, transmissibility, and whether a vaccine or treatment exists. For a novel or poorly-characterised agent, assess conservatively against the closest well-characterised relative rather than defaulting to the lowest containment level.
2. Assess the host population. Identify who will actually perform each step and whether any of them carry elevated susceptibility (immunosuppression, pregnancy, lack of vaccination where one exists for the agent).
3. Map the procedure against the five exposure routes. Go step by step through the protocol — not the project as a whole — and flag which of the five routes each step creates.
4. Select engineering controls, practices, and PPE that close the routes identified. This is where the BSL assignment, biosafety cabinet class, and PPE list get decided — driven by the specific exposure routes found in step 3, not by the agent’s Risk Group alone.
5. Document the assessment and route it through the Institutional Biosafety Committee. A completed risk assessment is what an Institutional Biosafety Committee (IBC) reviews before approving covered work; it is also the record that justifies the BSL and PPE choices if either is ever questioned by an inspector or an incident investigation.

Worked example: centrifuging human serum of unknown infectious status

Consider a diagnostic proteomics protocol that centrifuges human serum samples of unknown infectious status to separate plasma proteins before mass-spectrometry analysis. Running the five-part process:

1. Agent characterisation. The specimen is not a defined single agent — it is human-source material of unknown infectious status, which BMBL and institutional biosafety programs treat as presumptively capable of harboring bloodborne pathogens (HBV, HCV, HIV) absent evidence otherwise. This is the standard basis for defaulting clinical/diagnostic work with human blood, body fluids, tissue, and primary cell lines of unknown status to BSL-2.
2. Host assessment. The technicians performing the centrifugation have no known immunocompromising conditions; hepatitis B vaccination has been offered per the lab’s occupational health program (a standard BSL-2 measure), and at least one has declined — that individual’s risk profile for this specific step is therefore assessed separately.
3. Procedure mapping. Centrifugation is a recognised aerosol-generating step even when tubes are capped, because aerosols can form on opening a tube that was under mechanical stress. That places this step squarely on route 5 (inhalation of infectious aerosols) and, given the specimen is human blood-derived, also route 2 (mucous membrane/skin contact) if a tube leaks or a splash occurs during loading or unloading.
4. Control selection. The assessment lands on BSL-2 as the base containment level, with the following procedure-specific controls: use of sealed centrifuge safety cups or a sealed rotor, opened only inside a Class II biosafety cabinet after a rest period to let aerosols settle; gloves and a buttoned lab coat for all handling; eye/face protection during loading and unloading outside the BSC; and the general BSL-2 facility features (self-closing lockable doors, accessible eyewash, autoclave access for waste). Because the material is human blood, the lab’s exposure control obligations under the OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030) apply in addition to — not instead of — these BMBL-derived controls: a written exposure control plan, free hepatitis B vaccination for at-risk staff, and a defined post-exposure follow-up procedure.
5. Documentation and IBC routing. The completed assessment, including the specific aerosol-mitigation step (sealed rotor plus BSC-only unloading) and the unvaccinated technician’s individual risk note, is submitted with the protocol registration for IBC review before work begins, and is retained as the record justifying BSL-2 plus the enhanced aerosol controls if the protocol is ever audited.

Notice what the worked example does not do: it does not simply look up “human blood samples” on a chart and assign BSL-2 by rule. It reaches BSL-2 through the same three-input synthesis described above, and it adds a procedure-specific control (sealed-rotor, BSC-only unloading) that a generic BSL-2 checklist would not surface on its own, because that control responds to this specific step’s aerosol-generation risk, not to the specimen type in isolation.

When the assessment needs to be re-run

A biological risk assessment is not a one-time form. NIH Guidelines require IBC re-review on any hazard-increasing change to a covered protocol, and the same trigger logic applies more broadly to any biological risk assessment:

• A change in agent — a new strain, a higher-titer stock, or a switch from an inactivated to a live preparation.
• A change in procedure — adding a step that introduces a new exposure route (for example, adding an animal-inoculation arm to a previously in-vitro-only protocol).
• A change in personnel host factors — a new team member whose vaccination or health status differs materially from the assumptions the original assessment made.
• A near-miss or actual exposure incident — which should trigger a re-assessment of whether the controls in place were adequate, independent of any disciplinary or medical follow-up.

Institutions that treat the risk assessment as a document filed once at protocol approval, rather than a living record revisited at each of these triggers, tend to accumulate the gap that incident investigations find afterward: controls that matched the original protocol but not the one actually being run.

How this fits with the rest of a lab’s biosafety program

The risk assessment described here is the input to several other documents a covered lab maintains, rather than a replacement for any of them: it justifies the BSL and control selections recorded in the IBC-approved protocol registration, it feeds the facility- and program-level biosecurity plan where select agents or dual-use research of concern are involved, and — for agents meeting Federal Select Agent Program thresholds — it sits alongside the separate registration and responsible-official obligations that program imposes. A protocol-level biological risk assessment and a program-level hazard matrix answer different questions and are meant to coexist, not substitute for one another.

Frequently asked questions

Is a biological risk assessment the same thing as choosing a biosafety level?

No. BSL assignment is the output of the assessment, not a separate decision made independently of it. The assessment is what justifies why a given protocol lands at a particular BSL rather than the agent’s default Risk Group classification alone.

Who is responsible for conducting the assessment?

Typically the principal investigator, in consultation with the institution’s biosafety officer, drafts the assessment as part of protocol registration; the Institutional Biosafety Committee reviews and approves it before covered work begins.

Does BMBL itself require a biological risk assessment?

BMBL is an advisory best-practice reference, not itself a standalone federal regulation, but it is incorporated by reference into the NIH Guidelines and Federal Select Agent Program frameworks, which are binding on covered institutions and do require risk assessment as part of protocol approval.

Can a low-Risk-Group agent still require BSL-2 or higher controls?

Yes. The three-input synthesis means host factors or procedure-specific exposure routes can push the required controls above what the agent’s Risk Group alone would suggest — the worked example above (human serum of unknown status) illustrates exactly this.