Officers are asked to sign off on risks they cannot see
A 200-line hazard register is not a governance instrument. The critical-risk view in this register is deliberately short and reportable.
Risk Register Template (NZ)
The business-level register that sits above your hazard register — critical risks, named owners, treatment plans with dates, and a governance view an officer can actually use to discharge the section 44 duty.
⚖️Built for HSWA s44 due diligence
👷Reviewed by OH Professionals
✏️Editable .xlsx + .docx
NZD 99
Instant DownloadInstant download · Editable .docx + .xlsx
A hazard register tells you what could hurt someone on the tools today. It does not tell a director whether the business is carrying its critical risks well. Section 44 of HSWA places a personal duty on officers to exercise due diligence — including acquiring knowledge of the hazards and risks, and verifying that resources and processes are provided and used. That duty is discharged against a small number of critical risks with named owners and a reporting rhythm, which is what this register is built to hold.
Risks have no owner, so nobody moves them
Every entry carries a named owner, a treatment plan, a due date and a review cycle. Ownership is a field, not an assumption.
Nothing connects safety risk to business risk
Regulatory, commercial and reputational exposure sit alongside health and safety risk in the same register, because they are managed by the same people at the same table.
Who this is for
- Directors and officers
- The document you take into a board or leadership meeting to evidence the s44 duty.
- Owner-operators of growing businesses
- The point where informal knowledge of your risks stops being sufficient — usually somewhere past ten staff or the first big contract.
- H&S managers
- Escalation path from the operational hazard register to the governance conversation.
- Tender and prequalification teams
- Principals increasingly ask to see critical-risk management, not just a hazard list.
This is the governance-level register. Operational hazards and their controls belong in the hazard register.
What's inside the template
Excel — 4 sheets; Word — 10 pages (framework + reporting pack) · Formats: XLSX, DOCX
- Excel Sheet 1 — Risk registerRisk description, category, inherent rating, controls, control level, residual rating, owner, treatment plan, due date, status, last reviewed.
- Excel Sheet 2 — Critical risksThe short list. Filtered view of risks with potential for fatality or serious harm, with the critical controls named against each.hswa 44
- Excel Sheet 3 — Critical control verificationFor each critical control: who verifies, how, how often, last verified, finding.grwm 7
- Excel Sheet 4 — Movement logRating changes over time with reasons, so trend is visible rather than inferred.
- Word Section 1 — Risk frameworkCategories, appetite statements, rating scales and escalation thresholds.
- Word Section 2 — Roles and accountabilitiesWho owns risk at governance, management and operational level, and what each is accountable for.
- Word Section 3 — Officer due diligenceThe six due-diligence elements, with the evidence source for each mapped to a register field.hswa 44
- Word Section 4 — Reporting cycleWhat goes to the board or owner, in what format, how often.
- Word Appendix A — Board reporting packOne-page risk summary format ready to drop into a meeting pack.
Compliance checklist
HSWA 2015 ss.30, 36, 44 · GRWM Regulations 2016 regs 6–7
The register is structured around the officer due-diligence duty, because that is the duty a governance-level risk register exists to discharge.
- s44Officer due diligence — acquire and keep up to date knowledge of work health and safety matters; understand the operations and the hazards and risks; ensure appropriate resources and processes are available and used; ensure processes for receiving and considering information on incidents, hazards and risks; ensure processes for complying with duties; verify the provision and use of those resources and processes→ Sheet 2, Sheet 3 and Word Section 3 together evidence each element
- s36Primary duty of care so far as is reasonably practicable→ Sheet 1 — residual rating with recorded reasoning
- GRWM reg 7Ensure control measures remain effective→ Sheet 3 — Critical control verification
How this template compares
Reviewed by OH Professionals
Written and reviewed by the occupational health and safety team at OH Consultant. The critical-risk and critical-control structure follows the approach that has become standard in higher-hazard New Zealand industries, scaled down so that a business with twenty staff can run it without a dedicated risk function.
Legislation referenced
- Health and Safety at Work Act 2015 — Section 30 — Management of risks ↗
- Health and Safety at Work Act 2015 — Section 36 — Primary duty of care ↗
- Health and Safety at Work Act 2015 — Section 44 — Officer due diligence ↗
- Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 — Regulation 6 — Hierarchy of control measures ↗
- Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 — Regulation 7 — Duty to maintain control measures ↗
Frequently asked
What is the difference between a risk register and a hazard register?+
The hazard register is operational — it records hazards in the work and the controls on them. The risk register is a governance instrument: fewer entries, broader categories, named owners, treatment plans and a reporting cycle. The hazard register is worked daily; the risk register is reviewed periodically at leadership level.
Do small businesses need one?+
Not always. Below roughly ten staff, a well-maintained hazard register plus an owner who knows the work usually covers it. The register earns its place when there are more risks than one person can hold, when officers are not in the work daily, or when a principal or insurer starts asking how critical risks are governed.
What is a critical risk?+
A risk with the potential to cause a fatality or serious harm, regardless of how likely it is. The point of separating them out is that they justify a different level of attention — named critical controls, verified on a defined cycle, reported upward. Sheet 2 holds that short list.
Who is an officer under HSWA?+
Broadly, a person who occupies a position that allows them to exercise significant influence over the management of the business — directors, and partners or others in equivalent positions. The duty under s44 is personal and cannot be delegated, which is why the register is built to produce evidence an individual can rely on.
Can I include non-safety risks?+
Yes, and most businesses should. Regulatory, commercial, financial and reputational risks sit in the same register with a category field, because they are governed by the same people in the same forum. The H&S entries are the ones carrying the s44 duty.
How often should it be reviewed?+
The framework in Word Section 1 sets a quarterly governance review with critical-control verification on a shorter cycle defined per control. There is no statutory interval — what matters is that the cycle is defined, followed, and evidenced in Sheet 3.