What is a site risk register?

A live list of the hazards present on a site, each with its risk rating, the controls in place, who owns them, the residual rating once the controls work, and the date the control was last verified. It is the bridge between a risk assessment written before work starts and what is actually in place today.

How is a risk register different from a risk assessment?

A risk assessment covers one activity or method statement and is approved before that work begins. The risk register covers the whole site, stays open for the life of the project, and changes as activities, subcontractors, weather and site layout change.

What is the hierarchy of control?

Eliminate the hazard, then substitute, then engineer it out, then use administrative controls such as permits, sequencing and training, and only then rely on PPE. A register full of PPE-only controls is a warning sign, not a completed assessment.

How often should a risk register be reviewed?

On any change of activity, method, subcontractor or site layout, after any incident or significant near miss, and on a fixed cycle — commonly monthly — so entries that nobody has touched become visible.

How does a risk register support leading indicators?

Every verified critical control is a measurable event. The share of critical controls verified in a period, the age of unverified entries, and the number of open high-risk hazards are leading indicators that move before an injury rate does.

Risk register

Building a site risk register that stays true

A risk register earns its place when someone can open it mid-project and see what can hurt people today, what is stopping it, who owns that control and when it was last checked. This page covers the columns worth keeping, how to rate risk before and after controls, and how a live register feeds a site's leading indicators.

What each entry should carry

Columns in a construction site risk register
Field	What good looks like
Hazard and activity	What can cause harm, and the work that exposes people to it.
Who is at risk	Crews, visitors, the public, neighbouring plots — named, not implied.
Initial risk rating	Likelihood x severity before the controls are counted.
Controls	Set out in hierarchy-of-control order, with PPE last.
Site plan reference	The zone, access point or exclusion area the control depends on.
Owner and due date	One named owner — a subcontractor's company name is not an owner.
Residual rating	Likelihood x severity assuming the controls are in place and working.
Verification	Who last checked the control on the ground, and when.
Status	Open, controlled, verified or closed — with the reason recorded.

Four principles that keep it honest

Rate twice, honestly

An initial rating that ignores the controls, and a residual rating that assumes only the controls that genuinely exist. If the residual rating never changes, the controls are not doing anything.

Verify, do not assume

A control is not in place because it is written down. Record who checked it, when, and what they saw — that record is what an inspector and a client will both ask for.

Escalate high residual risk

Any hazard still rated high after controls belongs in the daily briefing and in the monthly pack, with a decision recorded about whether the work proceeds.

Keep it living

Update on change and review on a cycle. A register last edited at mobilisation describes a site that no longer exists.

From register to indicator

On this platform the site risk register holds each hazard with its ratings, controls, PPE and a reference to the zone or access point on the site plan. Verifying a control is recorded as an event, so the critical-control verification rate and the count of open high-risk hazards update on the leading-indicator charts without anyone compiling a separate spreadsheet.

Open the risk register Method statements and risk assessments

Frequently asked

What is a site risk register?: A live list of the hazards present on a site, each with its risk rating, the controls in place, who owns them, the residual rating once the controls work, and the date the control was last verified. It is the bridge between a risk assessment written before work starts and what is actually in place today.
How is a risk register different from a risk assessment?: A risk assessment covers one activity or method statement and is approved before that work begins. The risk register covers the whole site, stays open for the life of the project, and changes as activities, subcontractors, weather and site layout change.
What is the hierarchy of control?: Eliminate the hazard, then substitute, then engineer it out, then use administrative controls such as permits, sequencing and training, and only then rely on PPE. A register full of PPE-only controls is a warning sign, not a completed assessment.
How often should a risk register be reviewed?: On any change of activity, method, subcontractor or site layout, after any incident or significant near miss, and on a fixed cycle — commonly monthly — so entries that nobody has touched become visible.
How does a risk register support leading indicators?: Every verified critical control is a measurable event. The share of critical controls verified in a period, the age of unverified entries, and the number of open high-risk hazards are leading indicators that move before an injury rate does.

Reference material, not legal advice. Rating scales and review frequencies should follow your client's and the authority's requirements for the project.