The Risk Register Is Not Risk Management
In HSE, useful ideas often become rituals. A risk register records decisions about risk; it does not by itself manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. The difference between a mature organization and a merely compliant one appears after the document, meeting, or assessment is complete. Mature organizations ask whether the intended protection survives actual operating conditions: competing priorities, imperfect information, contractor interfaces, equipment degradation, fatigue, change and time pressure. They are less interested in proving that the system exists than in understanding whether it works.
That distinction is central to the risk register is not risk management. This is not an argument against structure or discipline. High-risk work depends on both. It argues for keeping systems connected to purpose. HSE should help an organization make better risk decisions, design stronger controls, recognize deterioration earlier, and respond before weak signals become serious events. When a system consumes attention without improving those outcomes, organizations should challenge it rather than defend it simply because it is established practice.
Why The Conventional Approach Falls Short
One reason this issue persists is that organizations naturally manage what is easiest to see and count. In this context, a risk register records decisions about risk; it does not, by itself, manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. Completing a form or activity can show that a process occurred, but it cannot, by itself, show that the intended protection is present. This matters because HSE performance is shaped by thousands of operational choices about equipment, people, sequencing, interfaces, priorities, and responses to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test why the conventional approach falls short is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today?
What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain? These questions turn the risk register from a broad principle into a management discipline. They also improve learning because gaps can be traced to design, information, competence, supervision, resources, or governance, rather than reduced to the assumption that adaptation is relying on adaptation, or to the vague conclusion that somebody failed to follow the system.
Where The Real Risk Sits
The operational difficulty is that real work rarely presents itself in a neat, isolated form. In relation to where the real risk sits, a risk register records decisions about risk; it does not by itself manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. Small differences between what was expected and what actually exists can materially alter exposure, especially where high energy, simultaneous operations, complex interfaces or time pressure are involved. This matters because HSE performance is created through thousands of operational choices about equipment, people, sequencing, interfaces, priorities and response to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test where the real risk sits is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today? What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain? These questions turn the risk register from a broad principle into a management discipline. They also improve learning because gaps can be traced to design, information, competence, supervision, resources, or governance instead of being reduced to the vague conclusion that somebody failed to follow the system.
What Strong Organizations Do Differently
The practical question for leaders is not whether the concept sounds sensible, but whether it changes decisions. In relation to what strong organizations do differently, a risk register records risk decisions; it does not, by itself, manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. When people compensate for weak information, impractical procedures, or degraded equipment, the organization relies on adaptation, whether it recognizes it or not. This matters because HSE performance is shaped by thousands of operational choices about equipment, people, sequencing, interfaces, priorities, and responses to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test what strong organizations do differently is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today?
What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain? These questions turn the risk register from a broad principle into a management discipline. They also create better learning because gaps can be traced to design, information, competence, supervision, resources or governance instead of being reduced to a vague conclusion that somebody failed to follow the system.
The Role of Leaders and Supervisors
On the frontline, the difference becomes visible in how work is planned, adapted, supervised, and stopped. In relation to the role of leaders and supervisors, a risk register records decisions about risk; it does not by itself manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. This is why mature HSE systems focus on the quality of controls and decisions rather than the volume of administrative evidence generated around them. This matters because HSE performance is shaped by thousands of operational choices about equipment, people, sequencing, interfaces, priorities, and responses to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test the role of leaders and supervisors is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today?
What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain? These questions turn the risk register from a broad principle into a management discipline. They also create better learning because gaps can be traced to design, information, competence, supervision, resources,HSE or governance instead of being reduced to a vague conclusion that somebody failed to follow the system.
How HSE Professionals Can Add Value
A stronger approach begins by separating evidence from assumption and intent from actual performance. In relation to how HSE professionals can add value, a risk register records decisions about risk; it does not by itself manage risk. The real test is whether it changes controls, resources, ownership, and how work is executed. The absence of an incident is useful information, but it is weak evidence of control unless verification supports the conditions intended to prevent serious harm. This matters because HSE performance is shaped by thousands of operational choices about equipment, people, sequencing, interfaces, priorities, and responses to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test how HSE professionals can add value is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today?
What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain HSE,? These questions turn the risk register from a broad principle into a management discipline. They also improve learning because gaps can be traced to design, information, competence, supervision, resources, or governance, rather than reduced to the vague conclusion that somebody failed to follow the system.
Turning the Concept into Daily Practice
The management-system implication is important because ownership, assurance and escalation all depend on clarity. To turn the concept into daily practice, a risk register records risk decisions; it does not, by itself, manage risk. The real test is whether it changes controls, resources, ownership, and ho work is executed. The more critical the risk, the less comfortable leaders should be with assumptions, generic statements or controls that exist only because a document says they do. This matters because HSE performance is created through thousands of operational choices about equipment, people, sequencing, interfaces, priorities and response to change. A system that does not help those choices become safer and more reliable may still look compliant while gradually losing contact with its purpose.
A useful way to test turning the concept into daily practice is to ask a small set of hard questions. What event or exposure are we actually trying to prevent? Which control must work for that prevention to be credible? What evidence shows the control is healthy today? What assumption would invalidate the plan? Who has the authority to stop, escalate, or redesign the work if the answer is uncertain? These questions turn the risk register from a broad principle into a management discipline. They also improve learning because gaps can be traced to design, information, competence, supervision, resources, or governance instead of being reduced to the vague conclusion that somebody failed to follow the system.
What This Means for HSE Leaders
The practical implication is that the risk register is not risk management should be treated as a management issue rather than an HSE slogan. Leaders need to be clear about the risk outcome they are trying to achieve, the evidence that demonstrates control, and when uncertainty or degradation requires escalation. HSE professionals can support this by simplifying risk language, challenging weak assumptions, and building assurance around the controls that matter most. Operational teams need the space and confidence to explain how work is actually being done and where the formal system creates friction, ambiguity or unintended behaviour.
None of this requires abandoning established HSE systems. It requires using them more intelligently. Strong organizations do not confuse documentation with performance, activity with value, or a period without incidents with proof that risk is controlled. They stay curious about the gap between intention and reality and adjust when evidence changes. That is the standard worth aiming for: not a system that looks complete, but one that helps people make better decisions and keeps serious risk under control when operations are most demanding.
References
ISO 31000:2018, Risk management - Guidelines.
ISO 45001:2018, Occupational health and safety management systems - Requirements with guidance for use.
IOGP, Operating Management System Framework (Report 510).
James Reason, Managing the Risks of Organizational Accidents, Ashgate, 1997.
