Hazard Register: What to Record & When the Law Requires One

Every facilities manager has been handed a hazard register that turned out to be a list of categories: slips, trips, electrical, manual handling. None of those is something a person can walk up to and fix. This guide is about the other kind, the register that names the loose rung on the roof hatch ladder and the dock door that will not stay closed, and about what the law does and does not ask you to keep.

The examples come from a multi-tenant office building in property and facilities management and a distribution centre in transport and logistics. They are illustrations, not customers. The register and a review checklist fit on 2 pages: download the PDF, or the CSV to open in a spreadsheet.

What Is a Hazard Register?

It is the running list of hazards at a workplace: each one written down where it was found, with how serious it is, what is controlling it, who owns it, and when it is next checked. It includes the hazards you already have under control, because a control that is not on the list is a control nobody will notice failing.

Safe Work Australia's code of practice on managing risks never uses the term, but it describes the thing exactly. It suggests that a business inspecting its workplace make a list of the hazards it finds, including the ones it knows are already being dealt with, so that nothing is missed, and says the list can be kept and updated at the next inspection.¹ That is a hazard register, described by the national body that writes the model laws.

The register is the front end of risk management. It is where a hazard enters the system. The rating, the choice of control, and the review all happen to rows that are already on it, so a hazard that never makes the list never gets managed at all.

Hazard, Risk, or Incident Register: Which Is Which?

Three lists get confused, and most businesses need all of them.

• A hazard register records what could hurt someone, found before it does: on a walk, in a report, or in a near miss.
• A risk register rates those hazards and tracks the controls, owners, and reviews. Our guide to what goes in a risk register covers its columns and who keeps it current.
• An incident register records what already happened. Its entries feed the hazard register, because an injury proves a hazard was there.

In a small business the first two are often one spreadsheet, and that is fine if every hazard row carries a rating and an owner. The mistake is to keep only the third, and learn about each hazard from the person it hurt.

Is a Hazard Register a Legal Requirement in Australia?

Not under that name in the model laws. The phrase does not appear once in the model WHS Act, the model WHS Regulations, or the November 2024 risk code; the code itself uses "risk register" and says you may prepare one.¹²³

What is required is the work the register records. Under regulation 34 of the model WHS Regulations, a duty holder managing risks to health and safety must identify reasonably foreseeable hazards that could give rise to those risks.³ Under section 17 of the model WHS Act, a duty to ensure health and safety requires eliminating risks so far as is reasonably practicable and, where that is not reasonably practicable, minimising them so far as is reasonably practicable.² Neither provision says how to record it, and nothing in regulations 34 to 38, which set out how risks are managed, asks for a written record.³

So why keep one? Because the code says records of the risk management process demonstrate what you have done to comply with the WHS Act and Regulations, and codes of practice are admissible in court proceedings, where a court may rely on them to decide what was reasonably practicable.¹ When an inspector asks how you know about the hazards on your site, a dated list is the answer. A memory is not.

The model laws have been implemented in every state and territory except Victoria, which has its own Occupational Health and Safety Act and Regulations, and some jurisdictions have made variations, so check your own state's version before quoting a regulation number.⁴

The Two Registers the Law Does Name.

Read through every regulation in the model WHS Regulations with "register" in its heading and two are registers a workplace must keep.³ The others deal with registering plant and designs, with the asbestos register's own review, access, and transfer, or with lists kept by an authority rather than by the workplace.

The hazardous chemicals register. Under regulation 346, a business must ensure that a register of the hazardous chemicals used, handled, or stored at the workplace is prepared, kept at the workplace, and kept up to date, and that it includes the current safety data sheet for each chemical listed.³ The register must also be readily accessible to the workers involved and to anyone else likely to be affected, and Safe Work Australia's guidance adds that consumer products needing no safety data sheet can be left off.³⁵ In an office building that can mean the cleaners' store; in a distribution centre, the gas cylinder cage for the forklifts as well.

The asbestos register. Under regulation 425, the person with management or control of a workplace must ensure that an asbestos register is prepared and kept at the workplace. It does not apply to a building constructed after 31 December 2003 where no asbestos has been identified and none is likely to be present from time to time.³ Victoria has its own rule: its Regulations require the person who manages or controls a workplace to record the results of an asbestos identification in an asbestos register.⁶ Under the model rule, the person with management or control must also ensure that a business that carries out, or intends to carry out, work there involving a risk of exposure to airborne asbestos is given a copy of the register.³

Some hazard-specific regulations also demand writing where the general rules do not. A risk assessment for a confined space, for example, must be conducted by a competent person and recorded in writing under regulation 66.³ The code's own summary is the safe one: there are specific record-keeping requirements for some hazards, such as hazardous chemicals, plant, and equipment, and where those hazards are present you must keep the records for the time specified.¹ Keep those registers separate, and put a row on the hazard register that points to each.

What to Record in Each Row.

Safe Work Australia's template at Appendix D of the code is a good spine: the hazard, the harm it could cause, the likelihood, the level of risk, how effective the current controls are, what further controls are needed, who acts, the dates due and completed, and maintenance and review.¹ On a real site, each row needs the six things below.

Column	Why it earns its place
Exact location	"Roof, east plant deck, hatch ladder" can be found by a contractor who has never been there. "Roof" cannot.
Reported by and date	Shows the list is fed by people, and tells you who to ask when the description is unclear.
Hazard, as observed	What was seen, not a category. One hazard per row.
Control now, and its level	The make-safe in place today, and whether it is elimination, an engineering control, or a sign on a door.
One owner	A named person with the authority to fix it, not a team.
Evidence and next review	A photograph or work order that shows the control exists, and the date someone looks again.

Write the hazard as an observation. "Visiting drivers walk the dock apron at doors 5 to 9 while forklifts load" tells the owner what to change. "Forklifts" tells them nothing, and could be copied onto any register in any warehouse.

Where the Hazards on the List Come From.

A register built from one annual walk-around is a list of what was visible on one day. The code names four sources, and on a shared site a fifth matters as much.

• Inspections. Walk the workplace and watch how work is actually done, with a checklist that suits the site.¹ Our site risk assessment checklist runs in the order you walk.
• Your workers. Ask them about problems they have met doing the job, and about near misses and incidents nobody reported.¹
• Your records. The code says to analyse records of incidents, near misses, workers' compensation, worker complaints, sick leave, turnover, and past inspections, because if someone was harmed doing a task, a hazard exists that could hurt someone else.¹
• Your supply chain. Talk with suppliers and with those who commission your services to identify hazards together.¹
• Contractors on site. The lift technician, the fire services crew, and the visiting drivers see corners of the site your staff rarely do.

The fourth and fifth are the ones most registers miss. In a shared building or a leased warehouse, other businesses hold duties on the same hazards. Section 46 of the model WHS Act requires each person with a duty in relation to the same matter to consult, co-operate, and co-ordinate with the others, so far as is reasonably practicable.² A shared hazard list is the simplest way to show you did.

A Worked Example: One Office Building, One Distribution Centre.

The office building. A cleaner reports on a Thursday evening that the top rung of the roof hatch ladder moves when she steps on it. The facilities coordinator logs it the next morning: "Roof hatch ladder, level 14 east stair, top rung loose at the left fixing, reported by the cleaning contractor." The code says that where there is immediate or significant danger, people are moved away first and the hazard attended to urgently.¹ So the make-safe goes in the same day, with the hatch locked and a note at the stair door, and the row gets an owner, the building's facilities manager, and a fix-by date for the ladder contractor. The row stays on the list after the repair, with its next check set for the quarterly roof inspection.

The distribution centre. A forklift driver mentions at a toolbox talk that a visiting truck driver walked between his forklift and a trailer at door 7. Nobody was hurt, so nothing was written up. The warehouse manager adds it anyway, because the code treats near misses as a source of hazards.¹ The row reads "Visiting drivers on the dock apron, doors 5 to 9, during loading", and the controls chosen are a driver waiting room off the apron, which keeps drivers away from the forklifts altogether, with a painted exclusion zone as back-up. The carrier is told, because it has drivers on that apron too.

In both cases the person who saw the hazard was not an employee of the business that owns the row. That is normal in property and in logistics, and it is why the register has to accept reports from anyone on site.

How Often Should a Hazard Register Be Reviewed?

On a cycle, and on triggers. The cycle is yours to set: tie it to your inspection schedule, and look at high-risk rows more often. The triggers come from the law.

Where the model Regulations require a risk to be managed, regulation 38 requires a control to be reviewed, and revised as necessary, when it does not control the risk it was put in for so far as is reasonably practicable, before a change at the workplace likely to create a new or different risk it may not control, when a new relevant hazard or risk is identified, when consultation indicates a review is necessary, and when a health and safety representative requests one in the circumstances the regulation sets out.³ Its examples of a failing control are monitoring results that show it is not working, and a notifiable incident caused by the risk.³

In practice that means four moments to open the register outside the cycle: after an incident or near miss, before a fit-out or a new tenant moves in, before a new piece of plant or a new racking layout, and when someone raises a concern. A fit-out on level 9 can change the egress from level 10, and it will not be on anyone's monthly list.

Hazards found on inspection that need a fix go onto a list of actions with owners and dates. Our guide to the corrective action register covers that half: the make-safe, the permanent fix, and checking it worked.

When a Spreadsheet Stops Being Enough.

A spreadsheet holds a hazard register well for one site with a handful of people reporting into it. It stops working when the reports come from contractors and tenants, when one hazard sits at several sites, and when nobody can tell which version of the file is current.

In ComplyFlow's risk register, hazards are recorded against each site with an initial score from your risk matrix, controls, and a residual score, and a consolidated view shows each risk across every site where it is present, with the highest residual risk shown.⁸ For the WHS risk area, the help article on risk areas says a category can be read as a hazard, such as working from heights or loading dock accidents.⁷ On a site that uses Live Access for sign-in, an active hazard can be set against an area, with a hazard notification shown when it is submitted.⁹ Hazardous chemicals can be recorded per contractor and project, with the safety data sheet's issue and expiry dates.¹⁰

Start With a Walk and Last Year's Reports.

Take the last 12 months of incident reports, near misses, and inspection findings, and put every hazard they reveal on one list before you walk anywhere. Then walk the site with the list in hand, adding what you see and the hazards you already control. Give each row a location, an owner, and a review date, and add a row that points to your chemicals register and, unless your building is exempt, your asbestos register.

Expect the honest version to be longer than the one you had, and expect the new rows to be ones your contractors and drivers already knew about. The 2-page template has a column for each part of the row and a review checklist on the second page. To see a register shared across sites and contractors, book a demo and bring the hazard that keeps coming back.