What Is Included in a Risk Register: A Complete Guide

At its core, a robust risk register includes several key pieces of information: a unique risk ID, a clear description of the hazard, its potential consequences, ratings for likelihood and consequence, a calculated risk score, the control measures in place, an assigned action owner, and target dates for completion. It’s your central logbook for identifying, analysing, and managing workplace health and safety risks in line with ISO 45001. Understanding the components of this critical document is the first step toward building a safer, more compliant workplace.

What Key Information Is Included in a Risk Register?

Think of your ISO 45001 risk register as the architectural plan for your entire safety management system. It's not some dusty document you file away just to tick a compliance box. Instead, it’s a living, breathing tool that gives you a clear, organised map of every potential hazard in your workplace.

For any Australian business chasing ISO 45001 certification or tendering for major projects, getting a handle on what is included in a risk register is the first, non-negotiable step. It’s what moves your organisation from a reactive, "fix-it-when-it-breaks" mentality to a proactive one where problems are spotted and sorted before anyone can get hurt.

This document is also your proof. It shows auditors, clients, and your own people that you have a methodical system for managing your Occupational Health and Safety (OHS) obligations.

The Core Function: Identify, Analyse, Control

Fundamentally, a risk register is there to answer three critical questions for effective safety management:

• What could go wrong? This is where you identify the hazards. It could be anything from a frayed power cord in the workshop to a lack of training on new equipment.
• How bad could it be? Here, you analyse the risk. You figure out the likelihood of something actually happening and how severe the consequences would be if it did.
• What are we doing about it? This is the control part. You document the practical steps you’re taking to either eliminate the risk or reduce it to an acceptable level.

This simple three-step process is the engine room of ISO 45001, forming a continuous cycle of improvement.

As you can see, the flow is logical: you spot a hazard, you understand the risk it poses, and then you put controls in place to manage it.

Core Components of an ISO 45001 Risk Register

While the specifics can vary between businesses, every compliant risk register is built on a foundation of essential fields. These columns ensure you capture all the necessary information to satisfy an auditor and effectively manage safety.

Here’s a breakdown of the must-have components:

These fields provide a complete picture of each risk before you implement any new actions, which is a critical part of the assessment process.

Why It's More Than Just a Spreadsheet

Sure, most risk registers live in a spreadsheet, but their value goes far beyond the cells and formulas. A well-kept register becomes the central communication hub for all things safety in your business.

A risk register shouldn’t be static. It’s meant to evolve as your business grows and as threats, systems, and priorities for your business modernise and shift.

It effectively turns abstract safety policies into real, actionable tasks with clear owners and deadlines. This is exactly the kind of practical, on-the-ground detail that auditors want to see and that major clients now demand as proof of your commitment to a safe workplace.

If you’re ready to build this foundational document, our detailed guide on how to create a risk register is the perfect place to start.

Breaking Down the Key Parts of a Risk Register

To get your head around what goes into a risk register, you need to look past the column headings and understand the why behind each bit of information. It’s a bit like building a house – you need solid footings before the walls go up. These core components are your footings, giving you the essential data to properly identify and assess workplace hazards.

For an ISO 45001 audit, getting these initial fields right is non-negotiable. They show an auditor you have a systematic way of spotting potential harm before you even jump to solutions. Let's walk through these foundational elements, using some real-world examples you’d see in any Aussie workplace.

Hazard Identification and Description

First things first, you have to clearly state the hazard. This is no place for wishy-washy language. If you describe a hazard poorly, you've got no chance of assessing the risk correctly. The aim is to be so specific that a new starter or an external auditor can immediately picture the potential source of harm.

Vague descriptions like "dangerous machine" or "unsafe chemical" just don't cut it. You need to get into the nitty-gritty.

• Weak Example: Manual handling.

• Strong Example: Lifting 25kg cement bags from a pallet to a wheelbarrow, forcing workers to bend and twist repeatedly at the main storage shed.

• Weak Example: Trip hazard.

• Strong Example: Exposed electrical leads running across the main workshop floor between the welding bay and the cutting station.

That level of detail is gold because it sets the exact boundaries of the problem you're trying to fix.

Identifying the Risk Cause

Once you've nailed down the hazard, the next logical question is: why is it there? The risk cause gets you to dig a bit deeper and uncover the root of the problem. Just spotting a hazard without knowing its cause is like treating the sniffles without figuring out if it’s a cold or hay fever. Real prevention starts here.

Identifying the root cause is the difference between a band-aid fix and a long-term solution. That exposed electrical lead (the hazard) might be there because of a lack of available power outlets (the cause). Taping the lead down doesn't solve the real issue.

Take another example: if the hazard is "working at height on an incomplete scaffold," the cause might be "poor handover procedures from the scaffolding subcontractor." If you fix the handover process, you stop the problem from happening again on the next job. This is exactly the kind of detail auditors love to see, as it proves your system is all about being proactive.

Detailing Potential Consequences

After you’ve defined the hazard and its cause, you need to spell out what could go wrong if no one does anything. Documenting the potential consequences forces everyone to think about the worst-case, but still realistic, outcomes. This step is crucial for creating a bit of urgency and justifying the time and money needed to put controls in place.

When you're listing consequences, be specific about the harm to people.

• Hazard: Exposed electrical leads on the workshop floor.

• Potential Consequence: Electrocution resulting in a fatality, or a trip leading to musculoskeletal injuries like a broken wrist or sprained ankle.

• Hazard: Using a wood chipper without its safety guard.

• Potential Consequence: Amputation of fingers or a hand, severe cuts, or permanent disability.

By clearly stating the potential human cost, you build a powerful case for taking action. This information flows directly into the next part of the process, where you'll formally rate just how severe these outcomes could be. These first few pieces – hazard, cause, and consequence – tell the story of the risk, setting a clear and detailed stage for everything that follows.

How to Quantify Risk Using Likelihood and Consequence

So, you’ve identified a hazard and what could go wrong. Now what? You can’t tackle everything at once, and a simple list of risks doesn't tell you where to start. This is where you need a way to prioritise, and that’s a crucial part of what is included in a risk register.

To do this, we need to quantify the risk by looking at its likelihood and consequence. This isn't just about ticking boxes; it’s about moving from guesswork to a logical, evidence-based approach.

Think of it like triage in an emergency room. The doctors don't just see patients in the order they arrive. They quickly assess how severe each case is to figure out who needs help right now. A risk rating does the same job for your workplace hazards.

Having this systematic process is also non-negotiable when you’re dealing with ISO 45001 auditors or trying to win work with major clients. They need to see a clear, logical reason for why you’re focusing on certain safety issues over others.

Understanding Likelihood and Consequence Scales

To rate a risk properly, you need two distinct scales: one for likelihood (what are the chances of this happening?) and one for consequence (if it does happen, how bad will it be?). The real trick here is to clearly define what each level on your scale means so everyone on your team is on the same page.

Most businesses use a simple numerical scale, often from 1 to 5.

Example Likelihood Scale:

• 1 – Rare: You’d be genuinely surprised if this ever happened; requires a perfect storm of events.
• 2 – Unlikely: It could happen, but probably won't.
• 3 – Possible: There's a fair chance this might happen at some point.
• 4 – Likely: You'd expect this to happen in most circumstances if nothing is done.
• 5 – Almost Certain: It’s pretty much guaranteed to happen, and probably often.

Example Consequence Scale:

• 1 – Insignificant: No real injuries, maybe some minor scuffs to equipment.
• 2 – Minor: Someone needs a plaster from the first aid kit.
• 3 – Moderate: Requires a doctor's visit and maybe some time off work.
• 4 – Major: Serious injuries, hospitalisation, or significant damage to property.
• 5 – Catastrophic: A fatality, permanent disability, or an event that could shut the business down.

By defining these terms, you get rid of the guesswork. A "Likely" risk means the same thing to your site supervisor as it does to the managing director. That consistency is a hallmark of a mature safety system.

Using a Risk Matrix to Calculate the Risk Rating

Once you've got your scales sorted, you can bring them together in a risk matrix to calculate an overall risk rating. It's usually a simple multiplication: Likelihood x Consequence = Risk Rating.

That final number then falls into a specific risk level, which is often colour-coded so you can see the priorities at a glance.

The risk matrix is the engine of your risk assessment. It translates two separate judgments—likelihood and consequence—into a single, actionable priority level that tells you where to focus your resources.

For instance, say you have a hazard with a Likelihood of 4 (Likely) and a Consequence of 4 (Major). The risk rating is 16 (4×4). On most matrices, a score of 16 would land squarely in the 'High' or 'Extreme' risk category, signalling that you need to do something about it, and fast.

In Australia, this structured approach isn't just a nice-to-have; it's what's expected. Any credible risk register for an ISO 45001 system will use likelihood and consequence ratings because regulators and auditors want to see an evidence-based approach to WHS. In fact, reviews like those from the Australian National Audit Office have shown a direct link between weak risk processes and poor company governance. You can explore their insights on effective risk management for more on this.

Prioritising Actions Based on the Risk Rating

The final piece of the puzzle is using that rating to decide what to do next. Your risk matrix should clearly spell out the required action for each risk level.

• Extreme Risk: Stop the job. This needs immediate senior management attention, and work can't restart until proper controls are in place.
• High Risk: This is unacceptable. Action is needed urgently to control the hazard.
• Medium Risk: The risk is tolerable for now, but you need a plan to implement controls within a set timeframe.
• Low Risk: This is acceptable. Keep an eye on it and manage it through your standard day-to-day procedures.

This clear prioritisation framework ensures your biggest safety headaches get the attention they deserve. It not only makes your workplace safer but also gives you a solid, defensible position if an auditor comes knocking.

Putting Controls in Place and Calculating Residual Risk

So, you’ve identified your hazards and given them a risk rating. Now for the most important part: turning your risk register from a list of problems into a blueprint for action. This is where you document the practical steps you’re taking to make your workplace safer.

This phase is all about control measures. Think of these as the specific actions, procedures, or equipment you put in place to either get rid of a hazard entirely or bring the risk down to a level you can live with. It’s the core of proactive safety management and exactly what an ISO 45001 auditor wants to see.

Existing vs. Proposed Controls: Telling the Whole Story

To paint a complete picture for an auditor, your risk register needs to show two kinds of controls:

• Existing Controls: These are the safety measures you already have. It could be anything from the safety glasses everyone has to wear, to the guard on a machine, or the safe work procedure for a specific task.
• Proposed New Controls: These are the extra things you plan to do to knock the risk down even further. This section is essentially your improvement plan.

Listing both is crucial. It proves you’ve recognised what’s already working but also shows you've spotted the gaps and have a solid plan to close them.

Following the Hierarchy of Controls

Not all safety fixes are created equal. To show you’re following best practice, your proposed controls should align with the well-known Hierarchy of Controls. This is a simple framework that prioritises the most effective and reliable safety solutions.

The hierarchy, from most effective down to the least, goes like this:

1. Elimination: Get rid of the hazard completely. If a chemical is dangerous, stop using it. Simple.
2. Substitution: Swap the hazard for something safer. Think about switching from a solvent-based paint to a water-based one.
3. Engineering Controls: Physically change the workplace to isolate people from the hazard. This is where you’d install things like guard rails, better ventilation, or sound-proof enclosures.
4. Administrative Controls: Change how people work. This includes writing safe work procedures, conducting training, and putting up warning signs.
5. Personal Protective Equipment (PPE): This is your last line of defence. It’s about giving workers gear like gloves, hard hats, or safety harnesses to protect them.

An auditor will always check to see if you’ve tried to implement controls from the top of the list before settling for something less effective, like just handing out PPE.

What is Residual Risk?

Once you’ve decided on your new control measures, you can't just tick the box and walk away. You need to figure out the residual risk—that’s the level of risk left over after your new controls are up and running.

Residual risk is the 'after' photo in your safety story. It provides real proof that your control measures are actually working and shows you're committed to the continuous improvement that sits at the very heart of ISO 45001.

Calculating it is straightforward but incredibly powerful. You just re-evaluate the likelihood and consequence of the hazard, but this time with the new controls in place. In nearly every case, the new rating will be much lower than what you started with.

Calculating the New Risk Rating

Let's revisit our example of "exposed electrical leads running across the main workshop floor."

• Initial Risk Rating: We said it was Likelihood 4 (Likely) x Consequence 4 (Major) = 16 (High Risk).
• Proposed Control (Engineering): We decide to install a permanent, ceiling-mounted power reel so the leads are no longer on the floor.
• Re-evaluation: With the trip hazard gone, the likelihood of an incident plummets.
• Residual Risk Rating: We re-assess it as Likelihood 1 (Rare) x Consequence 4 (Major) = 4 (Low Risk).

Notice the consequence rating stays 'Major'—if something went terribly wrong with the new reel, someone could still get badly hurt. But the likelihood of that happening is now so low that the overall risk is down to an acceptable, manageable level.

To get a clearer picture, let's look at how this transformation appears in a risk register.

Example Risk Register Entry Before and After Controls

This simple before-and-after calculation is exactly what auditors look for. It demonstrates a clear, logical process for reducing risk in the workplace.

For businesses here in Australia, documenting this process is non-negotiable. Our national WHS data shows just how effective systematic risk management can be. Safe Work Australia reported that between 2012 and 2022, the worker fatality rate dropped by a massive 35%, a change directly linked to better risk management systems. To prove you have a "safer system," Australian auditors will almost always require you to detail your existing controls and show how your new ones make a real difference. You can explore the detailed findings from Safe Work Australia to learn more about our national safety trends.

Driving Action: Turning Your Risk Register into a Plan

A risk register gathering dust on a server is just a box-ticking exercise. All the work you've done identifying hazards and rating risks means very little until you actually do something about it. This is where the administrative fields come in—they're the engine room of the whole document.

These next few columns are what transform your register from a static list of worries into a dynamic action plan. They’re all about creating clear ownership, setting deadlines, and making sure safety improvements don't just become ‘things we’ll get to eventually’. This is what an auditor wants to see: proof that your safety management system is alive and kicking.

Why You Need an "Action Owner"

One of the quickest ways to guarantee a safety task never gets done is to assign it to a group. "The Maintenance Team" or "The Safety Committee" sounds official, but in reality, it creates a classic case of bystander apathy. When everyone is responsible, no one is.

That's why the Action Owner field is non-negotiable. Every single action must be assigned to a specific person by name. This individual is now accountable for seeing that control through to completion. They might not do the physical work themselves, but they’re the one who has to chase people up, report on progress, and make sure it gets done.

Assigning an action to a named individual creates a powerful sense of personal responsibility. It removes ambiguity and prevents critical safety tasks from falling through the cracks—a key signal to auditors that you have effective governance in place.

So, instead of assigning "Fix guard on Lathe #2" to the workshop, you assign it to John Smith, Workshop Supervisor. Suddenly, there's no confusion. John knows it's his job to organise the repair, check the work, and close it out in the register.

Setting Realistic "Target Dates"

Along with an owner, every action needs a Target Date. This is the non-negotiable deadline. Without it, there’s no sense of urgency, and even high-priority safety fixes can drift for months.

Setting these dates is a balancing act. You have to weigh the severity of the risk against the practicalities of your business—things like budget, getting parts, or scheduling downtime.

• For Extreme or High Risks: The deadline should be immediate. The action might be to stop that activity right now until a temporary fix is in place, with a firm date for the permanent solution just days away.
• For Medium Risks: You might set a target of a few weeks or a month. This allows enough time for proper planning, purchasing equipment, or organising training sessions.
• For Low Risks: The action might be scheduled for the next planned maintenance period or a quarterly safety review.

This simple column demonstrates to an auditor that you have a logical, prioritised plan for tackling risk, not just a random to-do list.

Closing the Loop with a "Review Date"

Managing safety isn't a one-and-done job; it's a continuous cycle. The Review Date is the field that forces you to circle back and check if your fix actually worked. It closes the loop on the risk management process.

This scheduled follow-up prompts the Action Owner to go back and ask:

• Is the new control actually in place and working as we intended?
• Is our new, lower residual risk rating accurate?
• Did our solution accidentally create any new problems we didn't foresee?

By scheduling these reviews, you build the principle of continuous improvement right into your system. It ensures your risk register is a living document that accurately reflects the reality of your workplace, which is a core requirement of the ISO 45001 standard.

Keeping Your Risk Register Effective and Compliant

Getting your risk register built is a huge milestone, but it's really just the starting line. For that document to become a powerful safety tool and keep you on the right side of ISO 45001, it has to be treated as a living, breathing part of your business. Its true value isn’t in its creation, but in its ongoing use.

Think of it this way: a static, outdated register isn't just a compliance headache, it's a wasted opportunity to stop someone from getting hurt. Regular reviews and timely updates are what keep it relevant, transforming it from a simple spreadsheet into the engine room of your safety culture. This is what proactive management is all about.

When to Update Your Risk Register

While ISO 45001 requires at least an annual review, best practice means you’ll be looking at it far more often. In fact, certain events should be an automatic trigger to pull it out and check if your controls are still up to the job.

Key triggers for an immediate update include:

• After an Incident or Near-Miss: An investigation will always unearth new details about a hazard’s real-world likelihood or expose weaknesses in your controls.
• Introducing New Equipment or Plant: A new piece of machinery brings a whole new set of risks. These need to be properly assessed and documented before anyone switches it on.
• Changing a Work Process: The moment you change how a job is done, you can inadvertently create new hazards or alter existing ones.
• Hiring New Staff or Contractors: Different people bring different levels of experience and awareness, which can absolutely change a task's risk profile.
• Legislative or Code of Practice Changes: Your register must always be in step with current Australian WHS laws and standards. No exceptions.

Weaving the Register into Daily Operations

The best risk registers don't just gather dust on a server waiting for an auditor to ask for them. They're actively used in the day-to-day running of the business, making safety a part of the everyday conversation.

A risk register shouldn’t just be a compliance document; it should drive decision-making. By embedding it in regular meetings, you ensure that safety is considered alongside productivity and quality, not as an afterthought.

A simple way to do this is to make risk a standing agenda item in your team and management meetings. Spend five minutes discussing the top 5 highest-rated risks or checking the progress on outstanding actions. This keeps safety front-of-mind for everyone and clearly shows an auditor that risk management is a genuine, active part of how you run your business.

Common Mistakes to Avoid

So many businesses, especially smaller ones, stumble over the same few hurdles. These mistakes can seriously weaken your register’s effectiveness and cause major headaches during an ISO 45001 audit.

• Using Generic Templates Without Customisation: A template is a great starting point, but it's not the finished product. Your register has to reflect the specific, unique hazards found in your workshop, site, or office.
• Failing to Consult Your Team: The people on the tools are the real experts on the risks they face. Leaving them out of the process is like trying to fix a car without looking under the bonnet – you’re missing the most important information.
• Poorly Described Risks or Controls: Vague entries like "Staff might get hurt" or "Provide training" are useless. They make it impossible to properly manage the risk or check if the control is even working.
• No Clear Ownership: As we've mentioned, assigning an action to "the team" is the same as assigning it to no one. It's a recipe for things falling through the cracks.

To make sure your risk register truly helps your organisation meet its legal and ethical duties, you might find it useful to check out a practical guide to compliance risk management. By sidestepping these common pitfalls and maintaining your register as the dynamic tool it's meant to be, you build a much more resilient safety system that protects your people and strengthens your business.

Your Top Questions About Risk Registers Answered

Let's tackle some of the most common questions we hear from businesses getting to grips with their risk registers for ISO 45001.

How Detailed Does the Hazard Description Need to Be?

Think of it this way: your hazard description needs to be crystal clear to someone who has never set foot in your workplace before. Vague entries like ‘unsafe equipment’ just won’t cut it.

Get specific. Instead of ‘unsafe equipment’, write something like ‘Exposed gears on Conveyor Belt #3 in the main workshop’. This tells everyone exactly what the problem is and where to find it. The goal is to leave no room for guesswork, because that clarity is what your entire risk assessment is built on.

What Is the Difference Between a Risk Register and a Risk Assessment?

This is a classic point of confusion, but the distinction is quite simple. A risk assessment is the process you go through—the act of walking around, identifying hazards, and figuring out how serious they are.

The risk register is the document that comes out of that process. It's the official record, the central logbook of all those findings.

Think of the assessment as the 'verb' (the work you do) and the register as the 'noun' (the thing you create). For ISO 45001, your register becomes the master document that pulls together all your assessments, giving you a single source of truth for managing safety risks. You can dive deeper into its role by understanding what is the purpose of a risk register.

How Often Should We Review Our Business Risk Register?

ISO 45001 requires a formal review at least annually. But that’s the bare minimum. The real answer is that you need to update it whenever something significant changes.

A risk register is a living document, not a static file. Its value lies in its relevance to your current operations, which means regular updates are non-negotiable for effective safety management.

Treat it as a dynamic tool that reflects what’s actually happening in your business right now. Updates should be triggered by events like:

• Bringing in new machinery or chemicals.
• Altering a work process or procedure.
• An incident or a near-miss happening on site.
• Changes in WHS legislation or new codes of practice.

A great habit for many Australian businesses is to make a quick review of high-priority risks a standing item in monthly safety meetings. This keeps safety front of mind and ensures nothing slips through the cracks.