Risk Register

Educational guidance on registers and logs — what each records, who maintains it, what it typically contains and how long it is generally kept. Informational only — template examples, not official documents or legal advice; a register documents activity, it does not by itself prove compliance, and employers remain responsible.

What a risk register is

A risk register is a management tool that records identified risks — to safety, operations, a project or the organisation — together with how serious each is judged to be, who owns it and what is being done about it.

This page is an educational overview with a simplified example. It is not an official template, not jurisdiction-specific and not legal advice — the employer or project decides what their register tracks and how it is governed.

Purpose

• Bring identified risks into one tracked list.
• Record a judgement of likelihood and impact for each.
• Assign an owner and a response for every open risk.
• Support review, escalation and decision-making.

Who maintains it

• A manager, project lead or risk owner keeps it current.
• Risk owners update the status of the risks assigned to them.
• Reviewed at management or project meetings.
• The employer or project decides governance and ownership.

When it is used

• When a new risk is identified from any source.
• When a risk’s likelihood, impact or response changes.
• At regular review or governance meetings.
• When deciding whether to escalate or accept a risk.

Typical fields

• Risk reference and description.
• Likelihood and impact judgement, and an overall rating.
• Owner, response or mitigation, and target date.
• Current status and review date.
• Links to related assessments or actions.
• Example columns only — adapt to your context and the applicable law.

Common mistakes

• Confusing a high-level risk register with a detailed safety risk assessment.
• Rating risks once and never revisiting them.
• Recording risks with no owner or no agreed response.
• Letting the register become a list nobody acts on.

Document workflow

A risk register sits above the detail: safety risk assessments and the hazard register feed risks into it, owners are assigned, and outstanding responses become safety or corrective action register entries. It is reviewed alongside incident and audit findings.

See the related documents below for what is commonly used with and completed after a risk register entry.

Retention (high level)

A risk register is generally kept for as long as the activity or project runs and for a period afterwards, in line with the organisation’s obligations. This page does not state a required period — confirm with the applicable law and the official authority.

Completing and sharing as a PDF

Risk registers are commonly held in a spreadsheet or tool and exported to PDF for governance meetings and records. Exporting to PDF supports the record; it does not make it official or prove compliance.

Employer checklist

• Capture risks consistently and rate them on a clear scale.
• Give every open risk an owner and an agreed response.
• Review and update the register on a regular cycle.
• Escalate the risks that need a decision above the team.

Worker notes

• Raise risks you see so they can be tracked and owned.
• If you own a risk response, keep its status up to date.
• Understand the safety risks that affect your own work.

Country considerations

Risk management terminology and any record-keeping requirements vary by country, sector and project type, and the official authority differs where one applies. This page is general and high-level — not a statement of any country’s law and not legal advice.

Confirm current requirements with the official authority for your country and a qualified professional.

Who is responsible

The employer or project is responsible for identifying, owning and responding to risks and for compliance with any applicable rules. This page is an educational overview with a template example; it does not make an organisation compliant and does not transfer responsibility.