Risk Register: What Goes in One, and Who Keeps It Current

I have been shown a lot of risk registers. The good ones are dull documents somebody argued about last month. The bad ones are beautiful, colour-coded, and untouched since the audit they were built for. That gap is not a formatting problem.

What a Risk Register Actually Is.

A risk register is one list of every hazard your business has identified, and for each: what could go wrong, how bad and how likely, what you have in place to stop it, who is responsible, and when it is next looked at. One row per risk. One named person per row.

ISO 31000, the international risk management standard, is guidance and cannot be used for certification, though it does provide a basis for internal or external audit programs.⁴ Hold a register the same way: nobody certifies it, and everybody audits it.

Safe Work Australia’s code of practice lists the benefits of keeping records of the risk management process, and the last is the blunt one: it demonstrates to regulators, investors, shareholders, and customers that work health and safety risks are being managed.²

Australian Law Requires the Managing, Not the Document.

Start with the part most articles get wrong. No general provision in Australian WHS law requires a document called a risk register, and the phrase does not appear anywhere in the model WHS Regulations.

What the law requires is the managing. Section 17 of the model WHS Act says a duty to ensure health and safety requires the person to eliminate risks so far as is reasonably practicable and, if that is not reasonably practicable, to minimise them.¹ Section 18 defines reasonably practicable by weighing the likelihood of the hazard occurring, the degree of harm, what the person knows about the risk and ways of minimising it, the availability of those ways, and the cost.¹

Read that list again. It is a set of columns, and doing all of it while keeping no record is, to an inspector, indistinguishable from not doing it.

Safe Work Australia is explicit about the status. Its code says you may prepare a risk register identifying the hazards, the action needed, who is responsible, and by when, and publishes a blank one at Appendix D.² In that code, ‘may’ indicates an optional course of action and ‘must’ indicates a legal requirement.² The register is optional. The managing is not.

Some documents are not optional. A safe work method statement must be prepared before high risk construction work starts, specifying the hazards, the control measures, and how those controls will be implemented, monitored, and reviewed.³ A risk assessment is mandatory for certain high risk activities, including confined space entry, diving work, and live electrical work.² In construction, the SWMS is what an inspector asks for first. The register is what sits behind it.

The Columns That Earn Their Place.

Appendix D of the code has ten columns: the hazard, what harm it could cause, how likely that harm is, the level of risk, how effective the current controls are, what further controls are required, who it is actioned by, the date due, the date complete, and maintenance and review.² Most Australian registers are a version of it. Here is what earns its place, and how each fails.

The hazard and the harm, kept apart. A hazard is the thing: the unguarded conveyor, the 12-tonne excavator beside live traffic, the lone worker at 2 am. The harm is what it does to a person. A row collapsing both into ‘conveyor risk’ cannot be reviewed, because nobody can tell later what you were worried about.

Who it happens to. Name the exposed group, never ‘staff’. Fitters during a shutdown, the traffic controller, the subcontractor’s apprentice on day one. It decides whether the control is the right one, and it is the column most often left empty.

The rating before controls, and the rating after. Two numbers, not one. A single rating hides how much work the control is actually doing.

The named owner. A person, not a department. Operations does not answer an email.

The review date. A date in the future on the row, not a frequency buried in a policy.

The evidence. That one needs its own section.

The Evidence Column Separates a Live Register From a Dead One.

Appendix D asks how effective the current controls are.² Most registers answer with one word: effective. That word is a claim, and the register is alive only if the claim is attached to something.

Evidence is the record that the control did what the row says. The isolation has a signed permit from last Tuesday. The guard was checked on the monthly plant inspection. The induction the control depends on is complete for all 14 people on that crew, and you can see the 14 names.

The duty behind this sits with directors rather than safety managers. Section 27 of the model WHS Act defines an officer’s due diligence to include ensuring the business has and uses appropriate processes to minimise risk, then adds a separate limb: to verify the provision and use of them.¹ Verify is a different word from ensure, chosen deliberately. A rating is an assertion. Evidence is verification.

This is the practical reason risk work leaves the spreadsheet. In ComplyFlow’s risk register, each risk carries its controls and a residual score set by the owner or assessor rather than calculated for them, and a consolidated view shows each risk once with its highest residual score across every site.⁵ The worst site is the one on the row.

The Register That Went Green and Stayed Green.

Every safety manager recognises this one. Built in a fortnight before a client audit. Sixty rows, colour-coded, every residual rating amber at worst. It passed, and has not been opened since.

A regulator does not read that as an absence of risk. It reads as an absence of a risk management process. A register where nothing has changed in two years says either that the work has not changed, which is almost never true, or that nobody looked.

The tells are cheap to find and impossible to fake afterwards: a review date that passed eleven months ago, a control citing a withdrawn procedure, or an incident in the log that never changed the register row it belongs to. The last is the worst, because it shows the incident was investigated and the learning went nowhere.

Contractors Are the Rows Most Registers Miss.

This is where most registers on a subcontracted site are quietly incomplete. Under section 7 of the model WHS Act, a worker includes a contractor, a subcontractor, an employee of one, and a labour hire employee assigned to your business.¹ The primary duty of care in section 19 reaches workers whose activities in carrying out work are influenced or directed by you, not only the ones on your payroll.¹ And where more than one business has a duty about the same matter, section 46 requires each of them to consult, co-operate, and co-ordinate so far as is reasonably practicable.¹

A principal’s register therefore cannot stop at the direct employees. The people most exposed to the hazards you control usually do not work for you.

Accept that, and it becomes a data problem before it is a safety problem. The residual rating on ‘work at height, warehouse roof’ depends on whether the roofing crew’s high risk work licences are current, whether their SWMS matches what they will actually do, and whether their inductions are finished. None of that lives in the register. It lives in your workforce compliance records, so a register that cannot see them is guessing at every residual score it carries. Safety managers own the rating. Operations owns whether Monday’s crew is the crew the rating assumed.

What Actually Triggers a Review.

An annual cycle is a floor, and the least important trigger you have.

Regulation 38 of the model WHS Regulations requires a duty holder to review and, as necessary, revise a control in five circumstances: the control does not control the risk so far as is reasonably practicable; before a change at the workplace likely to create a new or different risk it may not control; a new relevant hazard or risk is identified; consultation indicates a review is necessary; or a health and safety representative requests one.³

Two details there do more work than the list. The first is the example the regulation gives of a control failing: a notifiable incident occurring because of the risk.³ An incident is not only something to report. It is a statutory instruction to go back to the register row. The second is the definition of a change at the workplace, which expressly includes a change to a system of work, a process, or a procedure.³ New plant, a new shift pattern, or a new subcontractor doing the same task differently are all changes, and none looks like one in a calendar.

Run a cycle too. The code says priority should follow the level of risk, and controls for high risks should be reviewed more often.² ComplyFlow schedules reviews as one-off or recurring tasks at one, three, six, or twelve months, scoped to chosen categories and sites, and raises an action for every risk owner in scope; the review closes only when all have finished.⁶ What matters is that the review arrives at the owner, rather than waiting for somebody to remember the register exists.

The Other Three Questions About Risk.

A risk register is one of four things people mean by risk management, and they are different jobs.

• The four types of risk management strategies answers the treatment decision: when to avoid a risk, reduce it, transfer it, or accept it, and how that sits against the hierarchy of controls the regulations require.
• A step-by-step guide to conducting a risk assessment answers the procedure: the four steps, who does them, and what gets written down at each one.
• Understanding the importance of conducting risk assessments answers the duty: why the law requires it, when it is mandatory rather than good practice, and what happens when one has not been done.

This post is the artefact the other three produce. Get the treatment wrong and the register records a bad choice neatly. Skip the assessment and it holds nothing true.

Start With the Ten Rows That Could Kill Someone.

If your register needs work, do not begin by rebuilding the spreadsheet.

Take the ten rows that could kill or permanently injure a person. Ask each named owner one question: what have you seen in the last 90 days that tells you this control is still working? The rows answered straight away are your live register. The rest are the real one, and they rarely carry the highest rating.

Then fix those ten. Ten rows somebody argued about this month are worth more to a regulator, an insurer, and the people on your site than sixty that all went green in 2023 and have stayed green.