The Register That Proves You Managed the Risk

Key takeaway: When something goes wrong in a commercial building, the first thing an investigator asks is: did you know about the risk, and what did you do about it? A risk register is the single document that answers both questions. It is how you turn a drawer full of certificates and contractor reports into evidence that you actively identified, assessed and managed your risks — the difference between a defensible position and an indefensible one.

“We Got Someone In To Do It” Is Not Risk Management

Most commercial buildings in the UK are full of managed risk. Fire alarms get tested. Extinguishers get serviced. An electrician comes in every few years. A water treatment company visits. On paper, everything is being done.

And yet the prosecutions keep coming — not because businesses did nothing, but because nobody joined the outputs together into a single, coherent picture of the building’s risks. The fire risk assessment sat in one folder. The EICR sat in another. The asbestos survey sat in a filing cabinet nobody had opened in three years. Each individual task was done. The risk was never actually managed.

That gap — between “we got contractors in” and “we know exactly what our risks are, who owns them, and what we are doing about each one” — is where liability lives. And the document that closes it is the one most small and mid-sized businesses do not have: a proper risk register.

Statutory Compliance Is Risk Management

It is easy to think of compliance and risk as two separate things — compliance as a list of certificates to collect, risk as something more abstract that “proper” businesses worry about. In law, they are the same thing.

The foundation of health and safety law in Great Britain is the requirement to assess and control risk. Under the Management of Health and Safety at Work Regulations 1999, every employer must make a “suitable and sufficient” assessment of the risks to employees and to anyone else who might be affected by their work — contractors, visitors, tenants, the public. Fire safety, Legionella, asbestos, electrical safety and gas safety are not separate obligations bolted on top of that duty. They are specific, named risks that flow from it.

And crucially, the law does not just ask you to assess. It asks you to record. Under Regulation 3(6) of the same Regulations, any employer with five or more employees has a legal duty to record the significant findings of their risk assessment. Recording is not best practice or paperwork for its own sake — for most businesses it is a statutory requirement in its own right.

The First Question an Investigator Asks

When the HSE or a local authority investigates an incident, the enquiry almost always follows the same line: was the risk foreseeable, was it assessed, and were adequate control measures put in place and monitored? Enforcement outcomes turn on the answers.

In one 2025 prosecution, an HSE inspector summed up a fatal incident by pointing to “a complete failure to risk assess and implement control measures” — noting that had the company done so, the worker would still be alive. The company was fined £250,000. That phrase — failure to assess and control — appears again and again across the enforcement record. It is the thread running through fire, electrical, machinery and maintenance cases alike.

It is worth being clear about what “adequate control” means, because it is not a one-off event. In a separate 2025 case, a London developer was fined £63,000 after the regulator found not only an inadequate risk assessment but a total failure to monitor and supervise the work as it went on. Risk assessment is not something you do once and file. Where circumstances change — a new piece of plant, a change of use, a refurbishment — the assessment must be reviewed. A register is what makes that review systematic rather than accidental.

What a Risk Register Actually Does

A risk register is a live document that pulls every identified risk into one place and, for each one, records four things:

• What the risk is — the hazard, and who it could affect (staff, contractors, visitors, the public).
• How serious it is — an assessment of likelihood and consequence, so risks can be prioritised rather than treated as an undifferentiated list.
• What you are doing about it — the control measures in place, the certificates and assessments that evidence them, and any outstanding remedial actions.
• Who owns it and when it is next reviewed — a named responsible person and a review date, so nothing quietly lapses.

Done properly, the register becomes the spine of your whole compliance programme. Your fire risk assessment, Legionella assessment, asbestos register and EICR stop being isolated documents and become entries against named risks, each with an owner and a review date. When an inspector, an insurer or a prospective buyer asks “how do you manage risk in this building?”, you have a single, credible answer instead of a scramble through folders.

The Golden Thread: Where This Is Heading

The direction of travel in UK building safety is firmly towards documented, traceable risk information. The Building Safety Act 2022 introduced the concept of the “golden thread” — a requirement, for higher-risk buildings, to maintain accurate building and safety information throughout a building’s life, so that the right people have the right information at the right time.

Even where your building sits outside the Act’s higher-risk definition, the principle is spreading through insurance requirements, funding conditions and due diligence expectations. Insurers increasingly want evidence of systematic risk management before they underwrite, and gaps in that evidence are increasingly cited when claims are challenged. A maintained risk register is the most straightforward way to demonstrate exactly the kind of live, joined-up information the golden thread principle is built around.

Why Most Registers Fail — And What Good Looks Like

Plenty of businesses have a risk register. Very few have one that works. The common failure modes are familiar: a spreadsheet built once and never opened again; no named owners, so no accountability; no review dates, so entries silently go stale; and — most limiting of all — a register that only covers health and safety, when the real risks in a business span far wider.

A register that lives, that has an owner and a review cycle for every entry, and that is genuinely referred to when decisions are made, is worth more than a perfect one that sits untouched. The test is simple: if an incident happened tomorrow, would your register show that you had already identified the risk and were actively managing it? If yes, you have a defensible position. If no, you have a document that exists but does not protect you.

This blog is intended for general guidance only and does not constitute legal advice. Legislation is subject to change — always verify against current law and seek professional advice on your specific circumstances.