Managing a Risk Register for Health and Safety in New Zealand
Managing a risk register is a core requirement of effective health and safety management in New Zealand – not a paperwork exercise, and not a one-off task.
A risk register records how hazards are identified, assessed, controlled, owned, and reviewed over time. When done properly, it demonstrates that risks are being managed so far as is reasonably practicable, as required by the Health and Safety at Work Act 2015 (HSWA).
When done poorly, it becomes one of the first documents regulators scrutinise after an incident.
What Is a Risk Register?
A risk register is a structured record of workplace health and safety risks and the controls used to manage them.
In a health and safety context, a risk register documents:
identified hazards and sources of harm
risk assessments (likelihood and consequence)
control measures applied using the hierarchy of controls
ownership and accountability for controls
review dates and effectiveness checks
Short answer:
A risk register shows how a business identifies hazards, controls risk, and verifies that controls remain effective over time.
Why Managing a Risk Register Matters Under HSWA
Under HSWA, PCBUs must eliminate risks to health and safety so far as is reasonably practicable, or minimise them where elimination is not possible.
A risk register matters because it:
demonstrates systematic risk management
links hazards to controls and accountability
shows how decisions were made and reviewed
provides evidence of due diligence by officers
After serious incidents, WorkSafe often asks one question early:
“Show us how this risk was identified, controlled, and reviewed.”
The risk register is usually where that answer lives – or doesn’t.
Risk Register vs Risk Assessment – What’s the Difference?
This is a common point of confusion.
A risk assessment evaluates a specific hazard or task at a point in time
A risk register tracks risks over time, across the business
Risk assessments feed into the risk register.
The register then tracks whether controls remain effective as conditions change.
If your risk register doesn’t change, your risk management probably isn’t working.
What Should Be Included in a Health and Safety Risk Register?
A practical NZ health and safety risk register typically includes:
Risk Identification
hazard description
activity or location
people exposed
Risk Assessment
likelihood of harm
potential severity
initial risk rating
Risk Controls
controls applied using the Hierarchy of Control
residual risk rating
supporting procedures or documents
Ownership and Review
control owner
review date
verification method
More fields do not equal better risk management. Clear ownership and review do.
How to Create a Risk Register That Actually Works
Step 1: Identify Real Hazards
Use inspections, worker input, incident data, and task analysis. Avoid copying hazards from templates without context.
Step 2: Assess Risk Honestly
Risk ratings should reflect reality – not optimism. Over-downscoring risk is a common failure point in prosecutions.
Step 3: Apply the Hierarchy of Control
Engineering and elimination controls should be prioritised over administrative controls and PPE.
Step 4: Assign Clear Ownership
Every control must have a named owner. Shared responsibility usually means no responsibility.
Step 5: Review When Conditions Change
Changes in equipment, layout, people, contractors, or work methods should trigger review.
This links directly to management of change, not annual compliance cycles.
Common Risk Register Mistakes We See in NZ Workplaces
treating the register as a static document
listing hazards without linking to controls
relying on administrative controls by default
failing to review after change or incidents
disconnect between register and actual work
Many high-profile NZ prosecutions involve risks that were “known” but not effectively managed.
Risk Registers, Contractors, and Shared Workplaces
In multi-PCBU environments, risk registers must align across organisations.
This means:
identifying overlapping risks
clarifying who controls what
integrating contractor risk into the principal’s system
Contractor risk management failures frequently feature in enforcement action, especially where registers exist but are not shared or verified.
Real NZ Lessons: Why Risk Registers Matter
KiwiRail and port sector prosecutions have repeatedly reinforced the same message:
change invalidates controls
assumptions are not risk management
documentation must reflect reality
In many cases, risk registers existed – but were outdated, generic, or disconnected from work as actually performed.
How Risk Registers Support Better Safety Outcomes
When managed properly, risk registers:
improve decision-making
focus attention on high-risk work
support leadership oversight
reduce reliance on worker behaviour alone
They are not about compliance theatre – they are about preventing harm before it occurs.
Frequently Asked Questions About Risk Registers
Do I legally need a risk register?
HSWA does not mandate a specific document, but it requires effective risk management. A risk register is the most common way to demonstrate this.
How often should a risk register be reviewed?
Whenever conditions change, after incidents, and at planned intervals. Annual review alone is usually insufficient.
What is the difference between a risk register and a hazard register?
They are often used interchangeably, but a risk register should link hazards to risk level, controls, ownership, and review – not just list hazards.
Who should be involved in maintaining the risk register?
Workers, supervisors, and leaders. Risk registers built in isolation rarely reflect reality.
Final Thoughts
Managing a risk register is not about filling in rows of a spreadsheet.
It is about ensuring that risks are understood, controlled, owned, and reviewed as work evolves.
Well-managed risk registers rarely attract attention – because incidents don’t happen.
Poorly managed ones are often read aloud in court.
About the Author
Matt Jones is a HASANZ-registered health and safety consultant and founder of Advanced Safety. He works with construction, infrastructure, manufacturing, and service organisations across New Zealand to design practical, HSWA-aligned safety systems that work in real operations – not just in documents.
