Quick answer: A hazard register is a simple list of identified workplace hazards and their controls. A risk register goes further — it adds a formal risk assessment, including likelihood, consequence and risk ratings for each hazard. Many small businesses use a combined document that covers both.
Last reviewed: June 2026 by the BlueSafe Technical Team. Reflects current Model WHS framework.
If you have ever been handed a contract or tender document that asks for a "risk register" and wondered whether your existing hazard register is the same thing — you are not alone. These two terms are often used interchangeably in Australian workplaces, but they do refer to different things.
This guide explains the distinction in plain language, shows you what each document contains, and helps you decide which approach is right for your business.
At a glance
| Feature | Hazard Register | Risk Register |
|---|---|---|
| Purpose | List identified hazards and basic controls | Formally assess and rate each risk |
| What it records | Hazard type, location, date identified, responsible person, controls in place | Hazard, risk description, likelihood, consequence, risk rating, control measures, residual risk, review date |
| When it's updated | When new hazards are found or controls change | When risks change, after incidents, or on a set review cycle |
| Who uses it | Supervisors, HSRs, safety officers, workers | Safety managers, PCBU, auditors, senior management |
| Format | Simple table or spreadsheet | Detailed table or software-based register |
What is a hazard register?
A hazard register is a central record of all identified hazards in a workplace. Think of it as a live list — it is updated whenever a new hazard is found and reviewed regularly to make sure controls remain in place.
The hazard register's job is straightforward: capture every known hazard so nothing gets forgotten. It does not need to include a full risk assessment, but it should make clear what is being done to control each hazard.
What a hazard register typically contains
A basic hazard register will include:
- Hazard type — what the hazard is (e.g., chemical, physical, ergonomic, psychosocial)
- Location — where on the worksite or in the workplace the hazard exists
- Date identified — when the hazard was first recorded
- Responsible person — who is accountable for managing the hazard
- Controls in place — what has been done to eliminate or minimise the hazard
- Status — whether the hazard has been controlled, is in progress, or requires further action
Hazard registers are particularly common in smaller businesses, field-based trades, and organisations that are building their WHS system from the ground up. They are practical, easy to maintain, and accessible to workers who need to know what hazards are present.
What is a risk register?
A risk register is a more structured document. In addition to listing hazards, it includes a formal risk assessment for each one — applying a risk matrix to rate the likelihood and consequence of harm before and after controls are applied.
The risk register supports risk-based decision-making: it helps you prioritise which hazards need attention most urgently and provides documented evidence that your organisation has assessed and managed its risks in a systematic way.
Risk registers are standard in organisations that operate under ISO 45001 (the international standard for occupational health and safety management systems) or AS/NZS risk management frameworks, and are commonly required in tender responses and third-party WHS audits.
What a risk register typically contains
A risk register will generally include everything in a hazard register, plus:
- Risk description — a clear statement of what could go wrong and who could be harmed
- Inherent likelihood — how likely is the harm to occur without any controls (using a 1–5 or similar scale)
- Inherent consequence — how severe would the harm be (using a 1–5 or similar scale)
- Inherent risk rating — the combined risk score before controls (e.g., Extreme, High, Medium, Low)
- Control measures — the specific controls in place, aligned to the hierarchy of controls
- Residual likelihood — likelihood after controls are applied
- Residual consequence — consequence after controls are applied
- Residual risk rating — the remaining risk level after controls (the "treated" risk)
- Risk owner — who is responsible for managing the risk
- Review date — when the risk assessment will next be reviewed
Key differences
The core difference is depth of analysis.
A hazard register tells you: "We know this hazard exists and here is what we are doing about it."
A risk register tells you: "We know this hazard exists, we have assessed how serious it is before and after controls, we have assigned responsibility, and we will review it on this date."
| Aspect | Hazard Register | Risk Register |
|---|---|---|
| Risk rating included? | No (or basic) | Yes — likelihood, consequence, overall rating |
| Residual risk assessed? | Rarely | Yes |
| Review cycle documented? | Sometimes | Always |
| Suitable for ISO 45001 audits? | Unlikely on its own | Yes, when properly maintained |
| Suitable for tender responses? | Depends on what is asked | Usually yes |
| Complexity | Low | Medium to high |
Do you need both?
Not necessarily. Many small to medium businesses operate with a combined hazard and risk register — a single document that captures the hazard details alongside the risk assessment columns. As long as the document records what the hazard is, how the risk has been rated, what controls are in place, and when it will be reviewed, it can satisfy the intent of both.
Where a separate, detailed risk register becomes important:
- Your business is working towards ISO 45001 certification
- You are responding to a tender or contract that specifically asks for a risk register
- You are subject to a WHS audit by a regulator, insurer, or principal contractor
- Your workplace is high-risk or complex — for example, construction, mining, healthcare or chemical processing
- You have multiple sites or significant changes in work activities
Which one should your business use?
Sole traders and very small businesses (1–5 workers): A simple hazard register is a practical starting point. Focus on identifying your hazards and making sure controls are documented. A one-page register that gets used consistently is far more valuable than an elaborate system that sits in a drawer.
Small to medium businesses (5–50 workers): A combined hazard and risk register is usually the right fit. Add risk rating columns to your hazard register so you can prioritise your highest risks. Review it at least annually or whenever work processes change.
Larger businesses, construction principals, or ISO-certified organisations: A dedicated risk register — maintained as part of a broader WHS management system — is appropriate. This will be expected in audits and tenders, and aligns with ISO 45001 and AS/NZS 4801 requirements.
Businesses tendering for government or large commercial work: Expect to be asked for a risk register in pre-qualification and tender submissions. A hazard register alone may not satisfy what is being requested. Check the tender documents carefully and, if needed, upgrade your register before submitting.
Example entries
The following example shows how the same hazard — working at heights — would appear in each type of document.
Hazard register row: working at heights
| Hazard | Location | Date Identified | Responsible Person | Controls in Place | Status |
|---|---|---|---|---|---|
| Working at heights — roof access (3 m) | Building A roof, Level 2 | 10 June 2026 | Site Supervisor | Edge protection installed, harness required, SWMS in place | Controlled |
Risk register row: working at heights
| Hazard | Risk Description | Inherent Likelihood | Inherent Consequence | Inherent Rating | Controls | Residual Likelihood | Residual Consequence | Residual Rating | Risk Owner | Review Date |
|---|---|---|---|---|---|---|---|---|---|---|
| Working at heights — roof access (3 m) | Worker falls from roof, causing serious injury or death | 3 (Possible) | 5 (Catastrophic) | High | Edge protection, fall arrest harness, SWMS, pre-start check, workers trained | 2 (Unlikely) | 5 (Catastrophic) | Medium | Site Supervisor | December 2026 |
The hazard register row confirms the hazard exists and is controlled. The risk register row shows the level of thinking that went into managing it — and gives an auditor or principal contractor confidence that the risk has been formally assessed.
How these registers connect to your WHS system
Both the hazard register and the risk register are outputs of your hazard identification and risk assessment process — a core element of any WHS management system.
The general process looks like this:
- Identify hazards — inspections, worker consultation, incident reports, job observations
- Record hazards — in your hazard or risk register
- Assess the risk — apply a risk matrix to rate likelihood and consequence
- Apply controls — follow the hierarchy of controls (elimination through to PPE)
- Review and update — after incidents, when work changes, or on a scheduled cycle
Your register does not sit in isolation. It should feed into your incident investigation process, your safe work procedures, your training records, and your management review meetings. When a new hazard is identified through an incident investigation, it goes into the register. When a control measure fails, the register is updated.
This is why regulators and auditors look at your register — it tells them whether you have a living system or just paperwork.
Example scenario: a small construction business setting up its registers
A carpentry subcontractor with eight workers decides to set up their WHS documents before tendering for a commercial fit-out project.
They start with a hazard register — walking each of their typical work environments and listing every hazard they find: power tools, manual handling, working at heights, chemicals (adhesives, stains), noise, and electrical hazards. They assign a responsible person and record the controls currently in place.
When the tender comes through, the principal contractor's pre-qualification questionnaire asks for a "current risk register with risk ratings." The carpentry business reviews their hazard register and adds likelihood, consequence, and residual risk columns. They now have a combined hazard and risk register that satisfies the tender request.
After completing the fit-out, they keep the register updated — adding a psychosocial hazard after a worker raises a concern about bullying on site, and closing out a manual handling hazard after they invest in a panel lift.
Six months later, when they go through a SafeWork NSW audit, the inspector is able to see exactly what hazards were identified, how they were rated, and what controls are in place. The register becomes a key piece of evidence that the PCBU has met their duty to manage risks so far as is reasonably practicable.
Frequently asked questions
What is the difference between a hazard register and a risk register?
A hazard register is a simple list of identified workplace hazards, recording what the hazard is, where it was found, and what controls are in place. A risk register goes further — it includes a formal risk assessment for each hazard, with likelihood and consequence ratings, an overall risk score, and a review date. Both aim to keep your workplace safe, but a risk register provides more detail and is typically required for larger businesses, complex workplaces, or ISO 45001 certification.
Does a small business need a risk register?
There is no single WHS law that requires every small business to have a document called a "risk register." However, all PCBUs must manage workplace risks. For many small businesses, a combined hazard and risk register is enough. If you are responding to a tender, seeking WHS certification, or operating in a higher-risk industry, a more detailed risk register is likely expected.
How often should a hazard register be reviewed?
Your hazard register should be reviewed whenever a new hazard is identified, after an incident or near miss, when work processes change, and at least annually as part of your routine WHS review. Some industries or contracts may specify more frequent reviews.
Can I use one document for both hazard and risk recording?
Yes. Many businesses — especially small to medium enterprises — use a combined hazard and risk register that captures hazard details alongside the risk assessment information. As long as it records both what the hazard is and what the assessed risk level is, a single document can serve both purposes.
Ready to build your registers?
BlueSafe Online gives you access to ready-to-use WHS document templates including hazard registers, risk registers, and combined formats — designed for Australian small business and built to satisfy audit and tender requirements.
This guide provides general information only. Register requirements will depend on the nature of your business, applicable legislation and any contractual obligations.