Risk Register Best Practice: Keeping a Site Register That Actually Controls Risk

Most site risk registers are written once at mobilisation and opened again when someone asks for it. A register used that way records intentions, not control. A register that works is short enough to read, specific to the work in progress, and revisited whenever the scope, sequence, season or crew changes.

What each entry needs

• The activity and the location, specific enough to picture — not "working at height"
• The hazard and the realistic worst outcome, not the average one
• Who is exposed, including people who are not doing the work
• Initial rating before controls, so the effect of the control is visible
• The controls, written in the order of the hierarchy
• A residual rating after controls, honestly assessed
• A named owner and a verification method and date

Score consistently or do not score

A likelihood-by-severity matrix is only useful if everyone on site reads the bands the same way. Define what each severity and likelihood band means for your project, write the definitions next to the matrix, and calibrate them with the team once rather than arguing about numbers entry by entry. Severity should reflect the credible worst outcome — a fall from a leading edge is not a first-aid case because the last one happened to be.

Controls, in order

1. Eliminate — change the design or sequence so the exposure does not exist
2. Substitute — a less hazardous method, material or plant
3. Engineer — edge protection, guarding, isolation, extraction, exclusion
4. Administer — permits, briefings, supervision, competence, timing
5. PPE — the last layer, never the first answer

An entry whose only controls are "trained operatives, PPE and supervision" has not been assessed. Read it back and ask what physically changes on site.

Critical controls deserve verification, not sampling

A small number of controls stand between the site and a fatality: fall protection at open edges, lift plans and exclusion zones, excavation support, isolation of energy, confined-space entry controls, plant-and-pedestrian separation. Name them as critical, verify them physically on a set frequency, and record the verification. Verification rate across critical controls is one of the clearest leading indicators a site can report.

Keep it live

Link it to what the site reports

A register earns its place when it feeds the rest of the reporting: open versus verified controls into the leading indicators, hazards into the inspection plan, controls into permit conditions, and unresolved high-residual entries into the monthly pack for the client. Kept that way, it stops being a document and starts being the site's risk picture.

1. Ratings, hierarchy of control and verification
2. Who maintains the register and what they report
3. Leading indicators the register feeds

Reference material, not legal advice. Requirements differ by emirate, authority and client.