• OH&S risks absolutely belong on the risk register, especially significant workplace health and safety hazards that could lead to injury, breach of legislation, or reputational damage.

• On a practical level, OH&S risks are often categorised under the “Operational” risk category on the register, because they arise from day-to-day operations and impact operational continuity.

• However, serious or systemic OH&S risks (e.g., culture of non-compliance, repeated near misses, regulatory investigations) may also feature in higher-level strategic or compliance risk categories depending on your risk taxonomy.

• Routine OH&S incidents (e.g., minor injuries, first aid treatments) are generally reported through incident registers, WHS committees, and line management as part of standard operational monitoring.

• The risk register should record the key OH&S risks (e.g., ‘Risk of workplace injury due to inadequate hazard controls’), not every minor incident. Controls, treatment actions and residual risk ratings are tracked here.

Good practice:
The risk register should reflect the systemic WHS risks and link to:

• routine WHS hazard registers and incident reports,

• compliance monitoring with Work Health and Safety laws,

• Board or executive reporting if the risk level is high.

• Risk appetite = the amount and type of risk the organisation is willing to pursue or accept in pursuit of its objectives.

• Risk tolerance = the acceptable deviation from that appetite — the specific thresholds or limits before action must be taken.

Process to establish them (common approach):

a) Board/Executive direction:
Risk appetite is owned by the Board and senior executives. They consider:

• The organisation’s mission, stakeholders, and regulatory context.

• What levels of risk are acceptable in various categories (e.g., zero appetite for safety breaches vs moderate appetite for innovation risk).

b) Develop a draft statement:
Risk management staff or advisors draft a risk appetite statement, often describing appetite by risk category (e.g., strategic, financial, operational, compliance, reputational, safety).

c) Workshop with leadership:
Facilitated discussions test the draft appetite against realistic scenarios. For example:

• “Are we really prepared to tolerate a minor injury rate of X per year?”

• “What does zero appetite for fatalities mean in terms of control systems and investments?”

d) Translate into operational tolerances:
This is where appetite becomes measurable tolerances, e.g.,

• Maximum incident frequency rates,

• Specific compliance breach limits,

• Budget variance thresholds.

e) Formal approval and integration:
The Board approves the appetite and tolerance framework. It’s embedded in:

• Risk registers (with risk ratings aligned to appetite),

• Reporting dashboards (flagging breaches of tolerance),

• Decision-making processes (new projects, control investments).

f) Ongoing review:
Appetite is reviewed regularly — annually, or if a major incident or change in strategy occurs.