What good looks like in a people risk register
Write risks as a condition and consequence with accountable controls. Broad labels such as wellbeing obscure the action required.
The performance question
A register entry should let management see what might fail and why. For example, insufficient trained cover could interrupt a critical approval process during absence. Describe the process and the condition without making an unsupported judgement about a named person’s health.
What the evidence supports
FRC Principle O and Provisions 28 and 29 address principal and emerging risks, monitoring and internal controls for companies within scope. HSE’s stress guidance provides work design categories for investigating pressure. Neither mandates one people risk scoring matrix.[1][2]
A practical approach
Include cause, event, consequence, owner, existing controls, evidence of effectiveness and next action. State the basis of likelihood and impact estimates rather than hiding assumptions behind a colour. Connect the entry to a specific business objective and identify what would trigger escalation.
How to review progress
Review overdue controls and changes in exposure, not just movement in the colour rating. Retire entries only when the risk is genuinely controlled or no longer relevant. Keep confidential employee cases separate from the enterprise register.
Sources and references
- UK Corporate Governance Code 2024 Opens in a new tab
Financial Reporting Council
Application; Principles A, E, F, I, J and O; Provisions 2, 5, 6, 17, 28 and 29
- Work related stress and how to manage it Opens in a new tab
Health and Safety Executive
Overview: employer duties and six areas of work design