A risk register is one document listing your hazards, how serious each risk is, the controls in place, what more is needed, who will do it and when it will be reviewed. The Queensland Work Health and Safety Regulation 2011 does not require one by name, but it is a practical way to show you are managing risk.
Many small businesses do risk assessments for individual jobs, but the results can end up scattered across job sheets, SWMS and people’s heads. A risk register pulls them into one list you can sort, assign and review. This guide explains what goes in it, gives a layout you can copy and shows a made-up example. For the hazard checklist side, see our free hazard register guide.
What the law says about managing risk and keeping records
The risk management process sits in Part 3.1 of the Work Health and Safety Regulation 2011 (Qld). Under section 32 it applies to a person conducting a business or undertaking (PCBU) who has a duty under the Regulation to manage risks. Reading sections 32 to 38:
- Section 34 says you must identify reasonably foreseeable hazards that could give rise to risks to health and safety.
- Section 35 says you must eliminate risks so far as is reasonably practicable, and if you cannot, minimise them so far as is reasonably practicable.
- Section 36 sets out the hierarchy of control measures: substitute, isolate or use engineering controls first, then administrative controls, then personal protective equipment (PPE).
- Section 37 says a control measure must be, and be maintained so that it remains, effective: fit for purpose, suitable for the nature and duration of the work, and installed, set up and used correctly.
- Section 38 says you must review and, as necessary, revise control measures. It lists when you must do so: the control does not control the risk it was meant to (for example monitoring shows it is not working, or a notifiable incident occurs because of the risk), before a change at the workplace likely to create a new or different risk, when a new relevant hazard or risk is identified, when consultation indicates a review is necessary, and when a health and safety representative requests one.
None of sections 32 to 38 mentions a risk register or says the results must be written down. The Queensland approved code of practice How to manage work health and safety risks says keeping records of the risk management process helps you demonstrate how decisions were made, target training at key hazards, prepare safe work procedures and review risks after changes. It says the detail depends on the size of your workplace and the potential for major work health and safety issues, and it notes that the Regulation has specific record-keeping requirements for some hazards. The same code says you may prepare a risk register, and it includes an example in its Appendix D.
An approved code of practice is guidance rather than law in itself. However, section 26A of the Work Health and Safety Act 2011 (Qld) requires a PCBU to comply with an approved code or manage the hazards and risks in a way that is different but provides an equivalent or higher standard of health and safety, and under section 275 a court can rely on the code when deciding what is reasonably practicable. So following the code’s approach to recording is a sensible default, and a register is an easy way to do it.
Some written records are specific requirements. Two we checked: a safe work method statement must be prepared before high risk construction work starts (section 299 of the Regulation, with high risk construction work defined in section 291), and a person with management or control of plant that must be registered under Part 5.3 must keep a record of tests, inspections, maintenance and alterations (section 237). A risk register does not replace those.
Risk register vs hazard register vs incident register vs SWMS
These are workplace tools. The Act and Regulation we checked do not use the names hazard register, risk register or incident register (the Regulation does deal with safe work method statements, for high risk construction work), so people use them loosely. A simple way to separate them:
- Hazard register: a list of hazards found on inspections, usually with the action taken.
- Risk register: the hazards plus how serious each risk is, the controls, the further actions, owners, dates and reviews. It is the overview across the business or a site.
- Incident register: a log of injuries, near misses and incidents. Incidents often reveal hazards that belong in your risk register. See the free incident register guide.
- SWMS: a task-level document for high risk construction work. See what is a safe work method statement. Its hazards and controls should line up with your register, not contradict it.
Not sure about hazard versus risk? Read hazard vs risk.
What columns should a risk register have?
The code’s Appendix D example has columns for the hazard, the harm it could cause, the likelihood, the level of risk, how effective the current controls are, further controls required, who will action them, the date due, the date complete, and maintenance and review. The layout below follows that idea and adds a few columns many small businesses find useful. It is common practice, not a prescribed form.
| Column | What to put in it |
|---|---|
| ID | A short number so you can refer to the line (R1, R2). |
| Task or area | Where or when the hazard occurs, such as a task, machine or work area. |
| Hazard | The thing that could cause harm, in plain words. |
| Who could be harmed | Workers, subcontractors, visitors, the public. |
| Existing controls | What you already do, and whether it works. |
| Likelihood | The code suggests ratings such as certain to occur, very likely, possible, unlikely and rare. |
| Consequence | How severe the harm could be, from first aid only to death or permanent injury. |
| Risk rating | The result from your matrix. See how to use a 5×5 risk matrix. |
| Extra controls | What more you will do, starting from the top of the hierarchy of controls. |
| Owner | One named person responsible, not “everyone”. |
| Due date | When the action will be done. |
| Review date | When you will check the control is still working. |
| Status | Open, in progress or done. |
Section 36 of the Regulation is why the “extra controls” column matters. Write the best option you can reasonably do first (see the hierarchy of controls), rather than defaulting to “toolbox talk” or “wear PPE”.
Worked example (made up)
This example is invented to show the layout. It is not a real business and not a complete register. Example Landscaping Pty Ltd is a three-person crew doing residential gardens in Queensland.
| ID | Task and hazard | Existing controls | Rating | Extra controls | Owner | Due and review |
|---|---|---|---|---|---|---|
| R1 | Hedge trimming: blade contact and noise (workers) | Gloves and ear muffs (PPE only) | Possible x serious: high | Where the job allows, use battery trimmers with blade guards in place (substitution and engineering); add a pre-start check of guards | Sam (lead hand) | End of next month; review after the first month of use |
| R2 | Loading pavers and bags into the ute: manual handling (workers) | Told to lift with a straight back | Very likely x moderate: high | Order materials on pallets delivered to the work area; use a trolley and ramp; two-person lift for heavy items | Priya (owner) | Two weeks; review after the next big job |
| R3 | Reversing the ute and trailer in customer driveways (workers, children, neighbours) | Driver checks mirrors | Possible x severe: high | Second person acts as spotter and the driver stops if the spotter is out of sight; set up the unloading area so reversing is not needed where possible | Sam (lead hand) | Spotter rule straight away; review monthly |
Notice that each line has one owner, a due date and a review point, and that the extra controls aim above “tell people to be careful”.
How to keep the register alive
- Start with how work is actually done. Walk the site and talk to the crew. The code says to consider how work is actually done, rather than relying on written manuals and procedures. Our guide on how to identify hazards helps.
- Consult your workers. They know where the near misses are, and under section 38 the results of consultation can trigger a review.
- Review when section 38 says to. That means when a control is not working (including after a notifiable incident caused by the risk), before a change that could create a new or different risk (a changed workplace, system of work, process or procedure), when a new hazard or risk is identified, when consultation points to a need, or when a health and safety representative asks.
- Review after incidents and near misses. Check whether the hazard is already on the register and whether the control worked.
- Set a regular review date as a habit. The code says controls should be reviewed regularly and that controls for high risks should be reviewed more frequently. How often is your call; the sections of the Regulation we read do not set a calendar interval.
- Close the loop. Mark actions done, record the date, and check later that the control is still being used (section 37 requires controls to stay effective and be used correctly).
Common mistakes
- Copying someone else’s register. Your tasks, equipment and people differ. Borrow the layout, not the content.
- No owner. A line with no named person tends not to get done.
- No dates. Without a due date and a review date the register becomes a one-off exercise.
- Everything rated the same. If every line looks alike, you cannot see what to fix first.
- Relying on PPE and warnings. If the extra controls column is all administrative controls and PPE, check whether something higher in the hierarchy is reasonably practicable.
- Never opening it again. Put the review in the calendar.
Templates to get started
If you want a head start, the free hazard register Excel template and the free risk assessment template are starting points to adapt to your own site. If you also want a written policy and procedure for your risk management process, there is the Risk Management Policy & Procedure template, and the Plant Risk Assessment Form is there for machinery and equipment. Edit any template so it describes how your business actually works.
This guide is general information, not legal advice. Check the current law or talk to Workplace Health and Safety Queensland for your situation.
Templates for this job
Ready-to-edit Word and Excel templates for Queensland workplaces.
