Institute of Work Health and Safety / Risk

The risk register that nobody reads

A document maintained for an auditor stops describing the operation.

Risk registers decay in a predictable way. They are created carefully, reviewed thoroughly for the first year, and then reviewed by having somebody open the previous version and change the date. Entries accumulate and are never closed, because closing one requires a decision and leaving it costs nothing. After several years the register lists everything that has ever been a concern, with no way of telling what is currently live.

The symptom is length. A register with three hundred entries is not a more thorough register, it is one that has stopped being used for decisions, because nobody can hold three hundred things in mind and prioritise among them. The people doing the work are not consulting it. The managers are not steering by it. It exists to be produced when requested.

The useful version is short and painful to maintain, because maintaining it requires saying that something is no longer a priority. That is uncomfortable and it is the entire value. A register of fifteen things that the leadership team can actually name is worth more than one of three hundred that nobody can.

The other half is that entries need owners who are individuals rather than departments, and review dates that produce a decision rather than a signature. A review that can be satisfied by confirming the entry still exists is not a review.

The other decay pattern is subtler and worth naming. A register that is reviewed regularly can still stop describing the operation, because reviews tend to consider the entries that exist rather than asking what is missing. Nothing in the process prompts anybody to add a hazard that has emerged since the register was built, so a changed process, a new material or a new piece of equipment can operate for years without appearing. Asking what has changed since the last review, before opening the document, catches most of it.