Free HSE tool · Risk Assessments
Risk Register
A risk register is the living version of the risk assessment — not the one-time document, but the running list of the significant risks in the organisation, each with an owner, a control plan, a date, and a status that gets challenged in the monthly management review.
Free HSE Risk Register
One line per significant risk — the score and the colour are automatic. Export to CSV or print.
| Risk (who is harmed by what) | Category | L | C | Score | Owner | Current controls | Mitigation / action | Target | Status |
|---|
The register below scores every line automatically on the standard 5×5 grid, colour-bands it, and exports to CSV so it moves into your spreadsheet without re-typing. The worked example and the review routine below are what separate a register that gets used from one that gathers dust.
How to use the tool
- Add one line per significant risk — the risk as a phrase: fall from the mezzanine platform, not safety
- Give each line a category (physical, chemical, biological, ergonomic, psychosocial, vehicle) so you can filter and read the mix
- Score likelihood and consequence — the register does the maths and the colour for you
- Name the owner and the target date on every high or very high line — an unowned risk is not a managed risk
- Export to CSV or print; review at the management meeting and move the status when the control lands
Worked example
A 40-person warehouse register typically carries 15–25 significant lines: the racking (collapse, 3×5=15, high — load review due this month), the fleet (pedestrian strike, 3×4=12 — segregation and speed limit, in place), the cold store (hypothermia, 2×3=6 — rota limits), the dock (vehicle reversal, 2×5=10 — spotter and camera, in place). The monthly review does one specific thing: it asks the owner of every red line what has happened since last month. The register only works if that question actually gets asked — the tool makes the lines visible, the meeting makes them real.
Standard & legal context
ISO 45001:2018 clause 6.1.2 requires hazard identification and clause 6.1.3 the determination of controls — the register is the typical vehicle for both, and ISO 45003 extends the method to psychosocial risk. UK law does not name a register, but MHSWR regulation 6 (recording) and the HSE expectation of a managed, reviewed risk system produce the same document in practice. OSHA record-keeping complements it from the incident side. The register real standard is its own: a line without an owner, a date or a status is a wish, and the review meeting should say so out loud.
Common mistakes
- Writing risks as nouns — fire, slips, chemicals — instead of who is harmed by what, and the severity if it happens
- One register for the whole organisation instead of per site and per activity — the owner of a site risk is a site person
- Letting the status sit at in progress for six months with no owner pressure — status is a claim; the review meeting is the audit
- Deleting closed lines — the history is the trend, and the trend is what the directors actually read
Need the sign-off, not just the tool?
The tool is the preparation; the sign-off is the professional. For the statutory assessments, the audits, the ISO 45001 implementation and the training that comes with them, ask Muhammad Umer — 8+ years across Iraq, KSA and Pakistan, and the programme runs through umer-hse.pro. One message gets the written scope.
Common questions
Risk Register — answered
What is an HSE risk register?
A risk register is the organisation running list of its significant risks — each with a score, an owner, a control plan, a target date and a status — maintained and reviewed at a set interval rather than written once.
What is the difference between a risk register and a risk assessment?
The risk assessment is the method and the document for a workplace or an activity; the register is the portfolio of significant risks across the organisation, drawn from those assessments and from the incident and near-miss record.
How often should a risk register be reviewed?
At least monthly in active environments (construction, process), quarterly in stable offices, and always after an incident, a near miss that revealed a gap, or any change to the work. The interval is yours to set; the triggers are not.
What goes in a risk register?
One line per significant risk: description, category, pre-control and residual scores, controls, owner, target date, status, and the last review date. Keep it to significant risks — the register is not the place for the 2×2s.
Can I export this register?
Yes — the Export CSV button builds a file with every column, ready for Excel or your HSE software. Print gives a PDF via the browser print dialog.
Is a risk register a legal requirement?
Indirectly: the UK recording duty (MHSWR reg 6), ISO 45001 clause 6.1, and client and lender requirements all converge on the same document. The law requires managed risk; the register is how the management is evidenced.
Keep building
Related tools
Risk Matrix Calculator
Free HSE risk matrix calculator: enter likelihood and consequence, get the 5×5 score, the colour band and the
Risk AssessmentsGeneral Risk Assessment
Free 5-step general risk assessment tool: identify hazards, who is harmed, score the risk, select controls and
Reports & DataIncident Report
Free HSE incident report form: the facts, the first aid, the witnesses, the 5-Why root cause, the corrective a
THE HEALTH AND SAFETY is an education and knowledge network. The tools are free and open; the professional assessments and audits run through umer-hse.pro.
Safety disclaimer
These tools are practical guidance, built to the UK baseline with the US equivalents named on each page. They do not replace a competent person assessment for high-risk work, a statutory assessment, or the advice of your insurer. Where a document has legal force — the fire risk assessment, the COSHH register, the permit to work — the responsible person owns it. Use the tool as the preparation, and the competent person as the sign-off.