Risk register

A risk register is the core artefact of a risk-based management system — the living list of identified risks that ties each hazard to its owner, its controls, and its review date. A row carries the risk description, the category, the likelihood and consequence (often on a 5×5 matrix), the inherent risk score, the controls in place, the residual score after controls, the owner, and the next review date. ISO 31000 and ISO 45001 both expect it, and an auditor treats a register that has not been reviewed in the last quarter as a finding rather than a backlog.

The register is only as good as its review cycle. A list built once and never refreshed is a compliance artefact, not a risk tool, because the risks that matter change — a new process, a new chemical, a new contractor, or a near-miss that moved a hazard up the matrix. The discipline that keeps it live is the same corrective-action discipline that closes a finding: every risk has an owner, every control has a verification, and the review is scheduled not triggered by an audit. A QEHS platform holds the register, the bow-tie or HAZOP that produced the top risks, and the corrective actions that close them, on one record. See risk, hazard, and bowtie.