The Definition of Risk Register

Definition of Risk Register

A risk register is a central record of the risks an organization, project or site has identified. For each risk, it typically lists a description, a rating, the controls in place, the person responsible, any further actions and the date of the last review. It is sometimes called a risk log.

In health and safety, a risk register pulls together the findings of individual risk assessments so that managers can see the most significant risks across the operation in one place. It turns risk assessment from a one-time exercise into an ongoing management tool.

No OSHA standard requires a risk register by name. However, ISO 31000:2018 includes recording and reporting as part of the risk management process, and ISO 45001:2018 requires organizations to keep documented information on their risks and the actions to address them. A risk register is a common way to meet those expectations.

What a Risk Register Includes

Typical fields

• Risk ID: a unique reference number.
• Hazard and risk description: what could happen, to whom and how. A clear format is "cause, event, consequence."
• Location or activity: where or during which task the risk occurs.
• Existing controls: the measures already in place.
• Risk rating: likelihood and severity scores, usually from a risk matrix. Many registers show inherent, current and target ratings.
• Further actions: additional controls needed, with due dates.
• Risk owner: the person accountable for managing the risk.
• Status and review date: whether actions are open or closed and when the risk will next be reviewed.

Optional fields

• Links to the related job hazard analysis, permit or procedure.
• Applicable regulations or standards.
• Key risk indicators that warn when a risk is increasing.
• Incident or near miss history linked to the risk.
• The residual risk accepted and who approved it.

Types of Risk Registers

• Site or operational register: covers the main health and safety risks at a facility.
• Project register: covers risks for a specific construction project, shutdown or contract.
• Enterprise register: covers risks across the whole organization, including safety, financial, legal and reputational risks.
• Topic registers: focus on one area, such as chemicals, contractors or critical controls.

How to Build and Maintain a Risk Register

Building it

• Agree on a standard format and rating method across the organization.
• Populate it from existing risk assessments, job hazard analyses, inspections and incident data.
• Involve supervisors and workers to capture risks that may not appear in formal documents.
• Assign a named owner for each risk, not a department.
• Prioritize the highest risks for action and management attention.

Keeping it current

• Review it on a set schedule, such as monthly for high risks and annually for low risks.
• Update it after incidents, near misses, audits and inspections.
• Add new risks when work, equipment or sites change through management of change.
• Close actions only when they are verified as complete and effective.
• Report the top risks and overdue actions to senior management.

Risk Register vs. Related Tools

• Risk assessment: the detailed analysis of a task, area or process. The register summarizes the significant results.
• Corrective action log: tracks actions from incidents, audits and inspections. Many organizations link these actions to the related risk in the register.
• Hazard log: a list of hazards identified in a system or project, often used in engineering and system safety. A risk register adds ratings, owners and actions.

Common Problems

• Too long to use: a register with hundreds of trivial entries hides the risks that matter. Focus on significant risks.
• Out of date: a register that is only updated before an audit gives a false picture.
• Vague controls: entries such as "training" or "be careful" do not show what actually controls the risk.
• No follow-through: listing actions without owners and dates means they rarely get done.

Example of Risk Register

A regional utility kept separate risk assessments for each of its 30 field crews, but managers had no overall view. The safety team built a single risk register in a shared spreadsheet, drawing the most significant risks from each assessment.

Once the risks were in one place, the team saw that three of the five highest-rated risks involved employees working alone in remote areas, including vehicle breakdowns, animal encounters and medical emergencies with no one nearby. Each was assigned an owner and actions, including a check-in procedure and satellite devices for areas without cell coverage. The register was reviewed monthly at the operations meeting, and the ratings for these risks were updated once the controls were verified in the field.

Frequently Asked Questions: Risk Register

Is a risk register the same as a risk assessment?

No. A risk assessment evaluates the hazards of a specific task, area or process. A risk register is a summary record that collects and tracks the significant risks from many assessments over time.

Is a risk register a legal requirement?

Not by that name in OSHA regulations. However, standards such as ISO 45001 require documented information about risks and the actions taken, and a risk register is a common way to provide it.

Who owns the risk register?

Usually the safety or risk manager maintains it, but each risk should have its own owner who is accountable for its controls and actions.

How often should a risk register be reviewed?

Review high risks frequently, such as monthly, and the full register at least annually. Update it whenever there is an incident, a significant change or new information about a risk.