Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Risk Register

    Also known as: Risk log, Register of risks, Enterprise risk register

    Definition

    A record of identified risks that holds, for each, its rating, controls, owner and review date, and is kept up to date as the risks and the controls change.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/risk-register

    Scope: A risk register is not a risk assessment, a one-off list or proof that controls work. The sources read for this page do not name it, so what a law, contract or standard asks for in your country has to be checked, and ISO text is not reproduced.

    Example for your evaluation: Follow one entry from its first rating and actions, through a near miss that raises its score, to the review that resets its date.

    Sources checked: . Examples are editorial illustrations.

    What HSE, CCOHS, ILO and NIST say about recording and reviewing risks

    On this page a risk register means a record, kept over time, of identified risks, each with its rating, controls, owner and a date for review. NIST's glossary defines it as a central record of current risks and related information for a given scope or organisation. NIST IR 8286 Rev. 1 adds that the register shows a single point in time and that its fields vary. That report concerns cybersecurity and enterprise risk, so read its fields as an illustration for other kinds of risk. This is general information, not legal or certification advice.

    None of the HSE, legislation.gov.uk, CCOHS or ILO texts read for this page uses the words risk register, so the register is one way of keeping what they do ask for. HSE gives five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. It asks who might be harmed, what is done already, what further action is needed, who carries it out and by when. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires an employer with five or more employees to record the significant findings. HSE adds that controlling risks in practice matters more than paperwork.

    Review is part of the duty. Regulation 3(3) requires a review if there is reason to suspect that an assessment is no longer valid or there has been a significant change. HSE lists changes to staff, a process, substances or equipment, problems spotted by workers, accidents and near misses as reasons to review. CCOHS says to review regularly, and ILO-OSH 2001 asks for an assessment before work methods, materials, processes or machinery change.

    Ratings and ownership are left to the organisation. CCOHS says there is no single method for determining the level of risk and that scores need clearly defined parameters. NIST says a qualitative scale can be adjusted to suit the circumstances, records current and, after responses, residual risk, gives each risk an accountable owner and says risk guidance should name who maintains the register and how often it is updated. ILO asks that records be traceable, with retention times specified.

    Sources opened :

    What a risk register entry holds in software

    • A unique identifier, a category and the site, activity or process the risk belongs to.
    • A scenario in plain words: what could happen, under what conditions, and to whom or to what.
    • The rating before and after controls, with the scale and its version, who rated it and when.
    • Existing and planned controls, each with an owner and a due date.
    • A named risk owner and a status, such as open, controlled, accepted or closed, with who accepted any remaining risk.
    • Links to the assessment, incident and near-miss reports, audit findings and actions that relate to it.
    • Dates first recorded, last reviewed and next review, and a history of every change with the reason.

    Risk register, risk assessment, hazard log and action tracker

    Usage varies, so this page fixes its own. A risk assessment is the work of identifying hazards, judging likelihood and severity and deciding on controls, and the register is where the result is kept and followed up. NIST describes an assessment report as complementary to the register, a detailed record behind a register that stays a summary. A hazard log lists hazards found, often before any rating. An action tracker holds tasks with owners and due dates. A register entry should link to its actions, but a list of actions does not show which risk each one reduces.

    A hypothetical example: a forklift risk that is re-scored after a near miss

    Everything in this case is invented and describes no real company. A distribution firm with 40 staff keeps a register of 14 risks on its own scale: likelihood from 1 to 5, severity from 1 to 5, score equal to likelihood times severity, with 1 to 5 low, 6 to 12 medium and 15 to 25 high. Entry R-07 is contact between forklifts and pedestrians in the loading yard. On 4 March the warehouse manager, as owner, rates likelihood 4 and severity 4, a score of 16, which is high. Three linked actions, a marked walkway, barriers at two crossings and a one-way route, are due on 18 April. With them in place the residual rating is likelihood 2 and severity 4, a score of 8, which is medium, and the next review is set for 4 July.

    On 22 May a near miss is logged in which a pedestrian steps into a forklift's path. The report is linked to R-07, and the owner raises likelihood from 2 to 3, so the residual score moves from 8 to 12 (3 times 4), still medium but at the top of the band. The history keeps both scores, who changed them and why, and a stop line and a mirror are added as actions. At the register review on 4 July, 3 of the 14 entries are past their review date, or 21%, and R-07 is not one of them because its date was reset in May. The three overdue entries get new owners and dates.

    Common misunderstandings about a risk register

    • It is not a one-off list. Regulation 3 and HSE both require a review when circumstances change.
    • A score is not a fact. CCOHS says no single method applies and that matrices can be customised, so a score depends on the scale and on the judgement behind it.
    • A register is not the controls. HSE says the main priority is to control the risks in practice, and a complete register does not show that a control works.
    • The law read here does not name it. The sources ask for a record of significant findings, and whether a customer, regulator or management system asks for a register is for you to check.
    • More detail is not better. NIST keeps the register a summary and puts assumptions in a separate risk detail record, so an entry can link to the assessment instead of repeating it.
    • A low residual score does not close an entry. CCOHS asks for a process to monitor controls so that they remain effective.

    How a risk register relates to other glossary terms

    A register sits between the assessment and the work that follows from it. These terms sit around it.

    Records and evidence that usually exist for a risk register

    • The register itself, with the scale in use, its version and the reason for each change.
    • The assessments or detail records behind each entry, with the date and the people who took part.
    • Review records showing when each entry was last reviewed and what changed.
    • Action records with owner, due date, completion and a check that the control works in practice.
    • Links to the incident, near-miss and audit records that prompted a review or a new rating.
    • Retention periods by record type, with a note of any local requirement.

    What a software tool needs to capture for a risk register

    • A configurable rating method, with scales, bands and wording held by version, so an old score is read against the scale that applied.
    • Ratings before and after controls, so current and residual risk can both be seen.
    • A named owner and a review date on every entry, with a view of entries past their date.
    • Actions with owner, due date and status, linked to the risk they reduce.
    • Links to incident, near-miss, audit and change records, so a new event can prompt a review.
    • A history showing who changed a rating, a control or an owner, when and why, which cannot be silently edited.
    • Filtering and export in an open format, so the register can be handed to an auditor.

    Catalog profiles documenting risk assessment workflows

    Listed profiles meet the risk assessment rule. That rule does not show a register with owners, review dates and change history, so ask to see one risk taken from its first rating to a review and a new score in a demonstration.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is a risk register a legal requirement?

    The sources read do not use the term. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires an employer with five or more employees to record the significant findings of the risk assessment. Other countries, sectors, contracts and management systems differ. This is general information, not legal advice.

    How often should a risk register be reviewed?

    No single interval appears in the sources read. The 1999 Regulations require a review when there is reason to suspect an assessment is no longer valid or after a significant change, and HSE adds accidents and near misses. CCOHS says to review regularly, and NIST says risk guidance should state how often the register is updated. Set intervals and triggers in your own procedure.

    What is residual risk, and should the register show it?

    NIST uses residual risk for what remains after a risk response has been applied, and says it can be recorded in its own column beside the current assessment. Whether to hold both ratings is a choice for your own method, but showing them lets a reader see what the controls were judged to achieve.

    More safety terms