Most providers have a risk register. Far fewer have one that's been opened since registration day. Here's what the standards actually expect, what a good register looks like, and a simple rhythm for keeping it alive.
The Accorda Team · 20 October 2026
Most care providers have a risk register. It was usually built in a hurry, for registration or a first audit, in a spreadsheet with tidy columns and a colour-coded rating. Then the audit passed, the spreadsheet was saved somewhere sensible, and nobody opened it again.
That's not a failing of character. It's what happens to any document that doesn't have a job to do between audits. But it does leave a quiet gap, because the standards don't ask whether you have a risk register. They ask whether you're actually managing risk, and whether you can show it.
The good news is that a register people genuinely use is less work than it sounds. Here's what the standards expect, what belongs in a good register, and a rhythm a small team can keep.
Risk management shows up in every framework our readers work under. The wording differs, but the expectation is the same: identify risks, do something about them, and keep reviewing.
Risk management is its own outcome in the Core Module, under provider governance and operational management. The outcome is simple: risks to participants, workers and the provider are identified and managed.
The quality indicators get more specific. Risks across the organisation, including risks to participants, financial and work health and safety risks, and risks tied to how supports are delivered, should be identified, analysed, prioritised and treated. The provider needs a documented risk management system that is proportionate to its size and the complexity of its supports. And that system is expected to cover:
incident management
complaints management and resolution
financial management
governance and operational management
human resource management
information management
work health and safety
emergency and disaster management
Two indicators are easy to overlook. Supports should be delivered in a way that's consistent with the risk management system, and appropriate insurance should be in place. In other words, the register isn't a separate exercise. It should describe how you really operate.
For aged care, Outcome 2.4 requires providers to use a risk management system to identify, manage and continuously review risks to older people, aged care workers and the provider's operations. The actions behind it set out four expectations:
a system to identify, assess, document, manage and regularly review risks
strategies and actions to prevent, control, minimise or eliminate those risks
collecting and analysing data, and talking with older people and workers, to inform risk assessment, with the results feeding into the quality system
regularly reviewing and improving how well the risk management system itself is working
Under the new model, these outcome statements are legal obligations for registered providers, depending on the services they deliver.
Early learning services meet risk management most directly through specific risk assessments. Under regulations 100 and 101 of the Education and Care Services National Regulations, a risk assessment must be carried out before an excursion, identifying risks to children's safety, health and wellbeing and how each will be managed. For regular outings, one assessment can cover outings for up to 12 months, as long as the circumstances stay the same. There are similar requirements for transporting children.
Whatever your sector, WHS law already asks every employer to identify hazards and eliminate or minimise risks so far as is reasonably practicable. If you run a dental practice, an allied health clinic or a trades business, this is where your risk register starts.
It helps to be clear on the difference.
An incident is something that happened.
A complaint is someone telling you something isn't right.
A risk is something that could happen, and what you're doing to make it less likely or less harmful.
They're three views of the same picture. An incident is often a risk that came true. A complaint is often an early warning of a risk you hadn't written down. A well-run provider lets each one inform the others, which is exactly what the aged care standards mean when they ask for data to feed risk assessment.
You don't need a complicated template. Most good registers have the same handful of fields:
The risk, described plainly: what could happen, and why.
Who or what it affects: participants or residents, workers, the business.
How likely and how serious it is, giving you an overall rating so you know what to deal with first.
What's already in place: the controls you rely on today.
What else you'll do, if the current controls aren't enough.
An owner: one named person, not "management".
A review date, and a record of each review.
Status: open, being treated, or closed.
Here's what a few real entries might look like.
Risk: A support worker attends a client's home alone and is exposed to aggression with no way to call for help. Affects: Workers. Current controls: Lone-worker procedure; check-in call at the start and end of each shift. Further action: Add a mobile duress app for workers on solo evening shifts; refresh lone-worker training. Owner: Operations Manager. Review: Quarterly, and after any related incident.
Risk: A staff member's screening clearance or registration lapses without anyone noticing, and they continue to work. Affects: Clients, the business. Current controls: Credentials register with expiry warnings. Further action: Monthly check of upcoming expiries at the team meeting. Owner: Practice Manager. Review: Six-monthly.
Risk: Personal information is sent to the wrong recipient by email. Affects: Clients, the business. Current controls: Privacy policy signed off by all staff; email auto-complete turned off for client records. Further action: Add a "check recipient" step to the client correspondence procedure. Owner: Director. Review: Annually, and after any near miss.
Notice that none of these are dramatic. The risks that hurt providers are usually ordinary ones that were known about and never quite dealt with.
A risk register isn't judged by how many risks it lists. It's judged by whether anyone has looked at it since the day it was written.
Written once, never reviewed. The register reflects the business as it was on registration day. New services, new sites and new staff never made it in.
Too generic to be useful. "Client injury" or "staff shortage" with a rating of medium tells nobody what to do. Specific risks lead to specific actions.
Nobody owns anything. Without a named owner and a date, further actions sit in the register indefinitely, looking reassuring.
Disconnected from what's happening. Three falls in the bathroom last quarter, yet the register still rates falls as low. When incidents and complaints live in one place and risks in another, the connection is rarely made.
Treating every risk as something to eliminate. This one surprises people. The aged care standards explicitly expect providers to support positive risk-taking that promotes a person's autonomy and quality of life, and choice and control sit at the heart of the NDIS. Good risk management isn't wrapping people in cotton wool. It's understanding the risk, agreeing how it's managed, and recording that conversation.
You don't need a risk committee. You need a few triggers that bring the register back into view.
After an incident or complaint: ask, was this on the register? If not, should it be? If it was, did the controls work?
When something changes: a new service, a new site, a new contract, or a change to the rules you operate under.
On a schedule: a short review of the whole register, quarterly or twice a year depending on your size. The standards don't set a fixed frequency, so pick one you'll actually keep and write it down.
Before your internal audit: the register is one of the first places an auditor will look to see whether your system is alive.
Each review should leave a trace: what was looked at, what changed and who did it. That trace is what turns "we manage risk" into something you can show.
To be clear about the boundary: Accorda doesn't assess your risks for you, and it won't decide what level of risk is acceptable for your clients or your business. That judgement belongs with you and your team.
What it does is keep the register from going stale.
A risk register you actually keep. Each risk is raised, given an owner, reviewed and closed, with the full history on file. It sits beside your incident and complaints registers, so the link between a risk and the events that realised it is visible rather than reconstructed.
Records you can trust. Entries are timestamped and protected by Accorda's records integrity, so a review dated in March was genuinely done in March.
Controls that live in your policies. Many controls are really policies: lone working, privacy, infection control. Those sit in your policy library with version history and staff sign-offs, so you can show the control exists and your team knows it.
A nudge when the rules move. Regulatory Radar flags regulation changes and which of your policies they may affect, which is often the first sign a risk needs another look.
Evidence when you need it. Your registers are part of the records Accorda holds, and can be included when you assemble an audit evidence pack.
You manage the risk. Accorda helps you keep the register honest and show your working.
Open your risk register and ask three questions:
When was it last reviewed, and could you prove it?
Does every open action have a named owner and a date?
Think of your last three incidents or complaints. Can you see each one reflected in the register?
If the answers come easily, you're in good shape. If they don't, that's not a failure. It's simply the place to start.
Want to see what a living risk register looks like? Book a short demo or start a free 14-day trial at accorda.com.au.
NDIS Quality and Safeguards Commission — Core module: Provider governance and operational management
Aged Care Quality and Safety Commission — Strengthened Quality Standards guidance
This article is general information only, current as at October 2026, and is not legal or compliance advice. Regulatory requirements can change.
Start today
Try Accorda free for 14 days. Every feature, no credit card, no auto-charge.
