Skip to main content
    QHSEtech
    All templatesRisk Assessment · 3 pages · Updated 19 October 2026

    Risk Register Template

    Three-page risk register to print landscape on A4: a header block (organisation, site or activity, register owner, version and date, the risk assessments it summarises), a box where you write your own rating scale, a register with an ID, a scenario written as cause, event and consequence, existing controls, a rating before further action, further actions with owner and due date, a rating after, a review date and a status, then a review log and sign-off. It summarises the significant results of your risk assessments; it is not the assessment and it is not an action tracker. The form supplies no rating scale, and a completed form does not show that you meet a legal requirement.

    What's inside

    Print the form landscape on A4.

    Page 1: details, your rating scale and how to write a row

    1. Register details: organisation, site, area or activity covered, register owner, version and date, the risk assessments the register summarises, who took part, and what is excluded
    2. Your rating scale: an empty box in which you write your own scale, each rating with its meaning in your method and what it calls for. The form supplies no scale, and a line records where your scale is written down and who agreed it
    3. How to write a row: what goes in each column, with the status codes O open, A actions under way, C complete and checked, R retired (our own example codes)

    Pages 2 and 3: the register

    1. Register of significant risks: fourteen rows and one example row. Each row has an ID, a scenario written as cause, event and consequence, the existing controls, the rating before further action, the further actions with a tracker reference, an owner, a due date, the rating after, a review date and a status

    Page 3: review and sign-off

    1. Review log: date, reviewer, trigger (scheduled, change, incident or near miss, audit, other), risks added, changed and retired, and the version issued
    2. Sign-off and distribution: prepared, reviewed and approved with signatures, who it was issued to, the next review date, and where the version is kept and for how long

    The columns, the status codes and the example row are ours, to change.

    What requires or shapes this record

    None of the sources opened for this page uses the term risk register, and none says that a document with that name must exist. What they ask for is a record of the significant results of a risk assessment, kept up to date. In Great Britain, regulation 3(6) of the Management of Health and Safety at Work Regulations 1999 says an employer with five or more employees must record the significant findings of the assessment and any group of employees it identifies as especially at risk, and HSE says what that record should show. CCOHS, for Canada, says to keep records of the assessment and of the control actions taken, and that the level of documentation depends on the risk, the law and any management system. The ILO guidelines are international and voluntary: they say the documentation may cover the significant hazards and risks and the arrangements to control them, and that records should be identifiable and traceable with retention times specified. Which of these applies depends on your country, sector and contract. A register is one way to keep such a summary; it is not the assessment, it does not replace your action tracker and it does not show that you meet any rule. This page is general information, not legal advice.

    • Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), regulation 3 (Great Britain, legislation.gov.uk)

      Regulation 3(1) requires an employer to make a suitable and sufficient assessment of the risks to its employees and to others affected by its work, for the purpose of identifying the measures it needs to take to comply with the relevant statutory provisions. Regulation 3(3) says the assessment must be reviewed if there is reason to suspect it is no longer valid or there has been a significant change in the matters it relates to, and changed where the review requires it. Regulation 3(6) says an employer with five or more employees must record the significant findings of the assessment and any group of its employees identified as especially at risk. The regulation does not mention a register. It is the reason for the review log and for the field that points back to the assessments behind the register. These regulations apply in Great Britain; other countries differ.

    • HSE, Managing risks and risk assessment at work, 2. Steps needed to manage risk (Great Britain; the page shows "Updated 2026-10-16")

      HSE's page lists five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. When assessing, it asks you to decide who might be harmed and how, what you are already doing to control the risks, what further action you need to take, who needs to carry out the action and when it is needed by. It says an employer of five or more people must record its significant findings: the hazards, who might be harmed and how, and what is being done to control the risks. It says to review the controls to check they are working, and also if they may no longer be effective, if staff, a process, substances or equipment change, if workers have spotted problems or if there have been accidents or near misses, and to update the record with any changes. It adds that paperwork should not be the main priority. The columns for existing controls, further actions, owner and due date, and the triggers in the review log, follow this page in our own wording.

    • CCOHS, Hazard and Risk: Risk Assessment (OSH Answers, Canada; fact sheet last revised 2025-03-12)

      The Canadian Centre for Occupational Health and Safety describes risk assessment as the process of identifying hazards, assessing their risk and prioritising them, considering the likelihood and the severity of harm, and says risk can in general be expressed as probability times severity. It says that risk assessments with clearly defined parameters for probability and severity make it easier to decide which hazards to address first, that there is no single method and the organisation has to determine which works for each situation, and that checklists or a risk matrix can help. Its goal questions include whether an adequate level of risk reduction has been achieved or further action is required. It says to establish a review process so controls stay effective, to review the assessment regularly, and to keep records of the assessment and the control actions taken: the level of documentation depends on the risk, legislated requirements and any management system, and records may have to be kept for a set number of years under local rules. That is why this form leaves the rating scale for you to write and has a rating after the further actions. CCOHS names no register form and no scale to use.

    • ILO, Guidelines on occupational safety and health management systems, ILO-OSH 2001, sections 3.5 and 3.10 (international, voluntary guidelines, International Labour Office, Geneva)

      The guidelines are voluntary and are not a national regulation. Section 3.5.1(c) says management system documentation may cover the significant hazards and risks arising from the organisation's activities and the arrangements for their prevention and control. Section 3.5.2 says documentation should be periodically reviewed, revised as necessary, communicated and readily accessible to those affected. Section 3.5.3 says records should be established and maintained according to the needs of the organisation, be identifiable and traceable, and have their retention times specified. Section 3.10.1.1 says hazards and risks should be identified and assessed on an ongoing basis, and that preventive and protective measures follow an order of priority starting with eliminating the hazard or risk. The form's version, date, distribution and retention fields follow this idea in our own wording. The guidelines do not name a register.

    Each source checked on 19 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    The register is one list of the significant risks of one site or activity, written so that a manager can read it in one sitting and a worker can see their own risk in it. It points back to the risk assessments for the detail and out to your action tracker for the progress of actions. The form supplies no rating scale: write the one your organisation uses in section 2, and keep the same scale between versions so that ratings can be compared. The columns, the status codes and the example row are ours to change.

    Site, area or activity this register covers
    Why: A register holds the risks of one place or one activity. Naming the organisation, the site or activity and what is excluded keeps the list from turning into a list of everything, and shows where an excluded risk is covered instead.
    Common mistake: One register for "the company", so rows from different sites cannot be owned or reviewed by the same people.
    Register owner (name, role)
    Why: One named person keeps the register current and issues each version. The version and date, printed beside it, tell a reader whether they hold the latest one; ILO-OSH 2001 asks for documentation that is reviewed and revised and records that are identifiable and traceable.
    Common mistake: Several people editing copies, so two versions with different ratings are both in use.
    Risk assessments this register summarises
    Why: The register is the summary and the assessments are the detail. HSE's and CCOHS's pages describe the assessment as the work of identifying hazards and judging risk; listing the assessments behind the register lets anyone trace a row back to its reasoning.
    Common mistake: Treating the register as the assessment and writing no assessment behind it.
    Your rating scale
    Why: CCOHS says risk assessments with clearly defined parameters make it easier to decide what to address first, and that no single method suits every case. The scale is yours: write it, say where it is documented and who agreed it, so that one person's rating means the same as another's.
    Common mistake: Copying a scale from a template or another site without checking that it fits your own risks and the people who must act on it.
    ID
    Why: A short number that never changes lets actions, incidents and reviews refer to one risk even after the wording of its row is edited or the row is retired.
    Common mistake: Renumbering rows when one is removed, so earlier references point to the wrong risk.
    Scenario: cause, event, consequence
    Why: Writing what causes it, what could happen and what harm follows makes the risk specific enough to control and to rate. HSE asks who might be harmed and how; CCOHS asks what can happen, under what circumstances, and with what consequences.
    Common mistake: A topic instead of a scenario, such as "manual handling" or "slips and trips", which no one can rate or control as one risk.
    Existing controls (in place today)
    Why: HSE asks what you are already doing to control the risks. Only controls that are in place and working belong here, so the rating before reflects the real position today.
    Common mistake: Listing planned measures as existing, which understates the risk and hides the work still to do.
    Rating before further action
    Why: The rating from your own scale with the existing controls in place. It tells a reader which risks need attention first, which CCOHS describes as ranking hazards to decide which to control first.
    Common mistake: Rating what would happen with no controls on one row and with today's controls on the next, so ratings cannot be compared.
    Further actions (and tracker reference)
    Why: HSE asks what further action is needed, who will carry it out and when. The register names the action and gives its reference in your tracker; the tracker keeps the progress, evidence and closure, so the register does not turn into a second action list.
    Common mistake: Writing "improve training" with no specific action, or tracking progress in the register as well as in the tracker so the two disagree.
    Owner
    Why: One named person who can make the action happen, as HSE asks who needs to carry it out.
    Common mistake: A department or a job family, so no one person answers when the date passes.
    Due date
    Why: A date by which the action will be done, as HSE asks when it is needed by. It lets the register show which actions are late.
    Common mistake: "Ongoing" or "as soon as possible" instead of a date.
    Rating after
    Why: The rating from your scale that you expect once the further actions are done and shown to work. CCOHS asks whether an adequate level of risk reduction has been achieved or further action is required; this column records the expected answer and, once checked, the actual one.
    Common mistake: Filling in a lower rating after with no action named beside it, or lowering it when the action is promised and not when it is checked.
    Review date
    Why: A date by which the row is looked at again. Regulation 3(3) and HSE also call for a review when something changes, so the date is a minimum and not the only trigger.
    Common mistake: A single annual date for every row, ignoring a change or incident that should reopen one.
    Status
    Why: A short code (our examples: O open, A actions under way, C actions complete and checked, R retired) shows at a glance which rows are still moving. A retired row stays visible, with its ID, so earlier references still make sense.
    Common mistake: Marking a row complete when the action is done but not yet checked, or deleting a retired row.
    Review log
    Why: Records when the register was reviewed, why (scheduled, change, incident or near miss, audit or other) and what changed. HSE lists changes to staff, process, substances or equipment, problems spotted by workers, and accidents and near misses as reasons to review.
    Common mistake: Reviewing only on the calendar, so a change or incident does not reopen the register until the next date.
    Sign-off and distribution
    Why: Shows who prepared, reviewed and approved this version, who received it and how they were told, and where it is kept and for how long. ILO-OSH 2001 asks that documentation be communicated and accessible and that retention times be specified.
    Common mistake: Approving the register but not telling the people whose work and risks it describes.

    Worked example

    IllustrativeFive register rows for an invented distribution warehouse, Northfield Distribution, Unit 4 yard and warehouse, version 3 of 12 October 2026 (invented organisation, people and references)

    IDScenario (cause, event, consequence)Existing controlsRating beforeFurther actions (owner, due)Rating afterReview date and status
    R-01Cause: trucks and people share the yard. Event: a person is struck by a reversing truck. Consequence: serious injury.Painted walkway, reversing alarms, a banksman for visiting drivers.HighFit a fixed barrier between the walkway and the bays (A-114, yard manager, 30 November 2026).Medium, expected once the barrier is fitted and checked31 December 2026. Status A, actions under way.
    R-02Cause: forklift trucks strike the racking. Event: an upright is damaged and a load falls. Consequence: serious injury and damaged stock.Guards at aisle ends, a weekly rack check by the warehouse supervisor.MediumInspection of all racking by a competent person, and repair of any damaged upright (A-118, warehouse supervisor, 20 November 2026).Low, expected once the inspection findings are closed20 December 2026. Status A.
    R-03Cause: 20 kg boxes are lifted from floor level at the packing bench. Event: a back strain. Consequence: lost time and a long-term back problem.A two-person lift rule and a trolley.MediumFit a height-adjustable bench (A-109, packing lead, done 30 September 2026 and checked on 6 October 2026).Low, confirmed on 6 October 202612 April 2027. Status C, complete and checked.
    R-04Cause: seasonal agency staff start before the induction is complete. Event: a new starter walks through the truck area without knowing the rules. Consequence: injury.First-day induction and a named buddy for the first week.MediumNo further action on the site now. Review the agency contract at the next quarterly meeting (A-121, HR lead, 30 November 2026).Medium, unchanged30 November 2026. Status O, open.
    R-05Cause: a temporary mezzanine was used for storage. Event: a person falls from the open edge. Consequence: serious injury.Edge rails.MediumRemove the mezzanine (A-101, facilities manager, done 30 August 2026).Not applicable: the risk ended with the mezzanineNo review date. Status R, retired.

    The rating words are this invented site's own three-step scale, written here as High, Medium and Low. They are not a recommended scale and carry no meaning for yours: write your own scale in section 2 of the form. Row R-04 shows a row where the rating does not change after the review, with the reason; row R-05 stays in the register with its ID after it is retired. The references and dates are invented.

    When a spreadsheet stops being enough

    A spreadsheet or a printed register works for one site, a few dozen rows and one person who owns it. It stops working when several sites keep their own copies of the register, when ratings are made on different scales, when a row must be traced to the assessment behind it and to the actions in a tracker, and when someone has to chase every review date by hand.

    A software record holds one entry per risk with its history, links each entry to its assessment and to the actions that were promised, shows the rating before and after, rolls the entries up by site or activity, and reminds owners when a review or an action falls due. Ask whether the scale is configurable and what happens to old ratings when you change it, and whether an incident or change can reopen the row it touches. The list below applies the risk assessment capability rule used by the risk assessment software guide. Nothing in it shows that a product holds your scale, so test it with a few dozen of your own rows.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.