Risk Register Software
Keep every risk your practice has identified in one register: what could happen, how likely it is and how bad it would be on a 5 by 5 matrix, who owns it, and when it is next reviewed. Raise a risk straight from an incident or complaint, and export the register when your assessor asks for it. For general practices, allied health practices and NDIS providers.
On the free trial and every paid plan. No credit card required.
Risk register
3 risks · 3 open · 2 extreme or high
- Identified
Shared drive gives every staff member access to clinical notes
GeneralIdentifiedRSK-2026-0004 · Information security · Rated 20 (Extreme) · Dana Whitfield · No actions yet
Review in
21 days
- Being treated
Fall on the stairs to the treatment rooms
NDISBeing treatedRSK-2026-0003 · Raised from INC-2026-0013 · Participant safety · Rated 12 (High) · Sam Okafor · 1 open action
Review in
88 days
- Monitoring
Only one physiotherapist knows the booking system
GeneralMonitoringRSK-2026-0001 · Operational · Rated 4 (Low) · Mei Lin · 2 actions done
Review in
177 days
Rating and review
RSK-2026-0004Rating
20 (Extreme)
Likelihood 4 · Likely
Consequence 5 · Severe
Review due
29 Nov 2026
in 21 days · every 3 months
Extreme. Act immediately. The practice owner should be involved, and the risk reviewed every three months until the rating falls. Review reminders go to the owner from 30 days before the due date, or to the managers while the risk has no owner.
What the standards ask of a risk register
RACGP 6th edition criterion F1.G asks a practice to use "a risk register (or equivalent) to document and prioritise identified risks", and to review and report those risks to practice leadership regularly. Practices are still accredited against the 5th edition, where indicator C3.1C asks for a business risk management system that identifies, monitors and mitigates risks. The NDIS Practice Standards Core Module asks that risks to participants, workers and the organisation are identified and managed. A spreadsheet holds the list, but nothing in it reminds anyone that a review is due or ties a risk to the incident that exposed it. That is where registers usually slip: risks with no owner, and review dates that pass without a review.
Source: RACGP Standards for general practices, 6th edition (criterion F1.G) and 5th edition (indicator C3.1C); NDIS Practice Standards, Core Module, Division 2. Verify against current guidance.
Is a risk register mandatory for RACGP accreditation?
Yes, in substance. RACGP 6th edition criterion F1.G requires the practice to use "a risk register (or equivalent) to document and prioritise identified risks". Practices are still accredited against the 5th edition, where indicator C3.1C requires a business risk management system that identifies, monitors and mitigates risks, and the guidance suggests a risk register as the way to show it. A surveyor who asks for your business risk management system is asking for this register under either edition.
Does an NDIS provider need a risk register?
Yes. The NDIS Practice Standards (the Core Module, Division 2, or the Verification Module for a provider assessed by verification) require that risks to participants, workers and the organisation are identified and managed, and a register is how a provider shows it. ClinicComply's categories include participant safety, work health and safety, workforce, and emergency and business continuity, and a risk can be raised straight from an NDIS incident or complaint.
How is a risk rated in ClinicComply?
On a 5 by 5 matrix. Likelihood runs from Rare to Almost certain and consequence from Insignificant to Severe, each scored 1 to 5, and the rating is the two multiplied. A rating up to 4 is Low, 5 to 9 is Medium, 10 to 16 is High and 17 to 25 is Extreme. Each band carries a line of guidance beside the rating; for Extreme it reads "Act immediately. The practice owner should be involved, and the risk reviewed every three months until the rating falls." The scale is fixed, so every risk in the register is rated the same way.
How is a risk register different from an incident register?
An incident register records what has already happened. A risk register records what could happen, before it does, with a rating and an owner. The two meet when an incident exposes a risk you had not recorded. In ClinicComply you raise the risk from the incident or complaint, the risk keeps its reference (for example "Raised from INC-2026-0013"), and the incident lists the risks raised from it.
How the register keeps risks current
Rated on a 5 by 5 matrix
Pick a likelihood from Rare to Almost certain and a consequence from Insignificant to Severe, and the rating is the two multiplied. It falls into Low, Medium, High or Extreme, with a line beside it saying what that band asks of the practice. Every risk is rated on the same fixed scale, and the record history keeps each rating.
Raised from an incident or complaint
When an incident or complaint shows a risk you had not recorded, raise it from that record. The new risk keeps the incident's or complaint's reference, and the original record lists every risk raised from it, so an assessor can follow the trail in either direction.
A review cycle with reminders
Each risk is reviewed every 3, 6 or 12 months. Recording a review re-rates the risk as it stands and sets the next date. Reminders go to the owner at 30, 14, 7 and 1 days before, on the day, then weekly while overdue, or to the managers while the risk has no owner.
Tagged to your standards
Tag a risk to items in your own compliance checklist. The picker lists first the items that ask for a risk register, including NDIS2.2, the NDIS Verification Module items, RACGP 6th edition F1.G and CG7.A, and NSQPCH 1.04. The code and name are kept as they were when tagged.
Raise an improvement from a risk
When treating a risk means changing how the practice works, raise an improvement from it. The improvement lands in the continuous improvement register carrying the risk's reference, and the risk lists every improvement raised from it.
Evidence, export and the readiness report
Upload evidence files to a risk. Managers and above export the register to CSV, for one practice or across all your practices, with the rating, owner, review dates and outcome on every row. The audit evidence pack and the readiness report list the risk register alongside incidents, complaints, conflicts of interest and improvements.
What every risk record holds
Each risk holds the columns a risk register is usually expected to have, on one record, and the CSV export carries the same columns.
- Reference, category and framework
- What could happen, its cause and its effect
- The controls already in place
- Likelihood, consequence and rating
- The treatment and the treatment actions
- The owner
- The incident or complaint it was raised from
- The standards it is tagged to
- The review interval, review dates and outcome
How it works, from identifying a risk to reviewing it
Identify
Log a risk as what could happen, why, and what it would lead to. Note the controls already in place and pick a category, such as participant safety or information security and privacy. Or raise it from an incident or complaint, and it keeps that record's reference.
Rate
Choose a likelihood and a consequence. ClinicComply works out the rating and its band and shows the band's guidance beside it. An Extreme risk asks you to act now, involve the practice owner, and review it every three months until the rating falls.
Treat
Give the risk an owner and write the treatment, or add treatment actions with a named person and a due date. A risk can only be marked Being treated once it has an owner and either a treatment or an open action. If the fix changes how the practice works, raise an improvement from it.
Review
When the review falls due, record it: re-rate the risk as it stands and confirm the interval, and the next review date is set from today. Each review and rating goes into the record history. Close the risk with an outcome when it no longer applies, and reopen it if it comes back.
Risk registers: common questions
Is a risk register mandatory for RACGP accreditation?
Yes, in substance. RACGP 6th edition criterion F1.G requires the practice to use "a risk register (or equivalent) to document and prioritise identified risks". Practices are still accredited against the 5th edition, where indicator C3.1C requires a business risk management system that identifies, monitors and mitigates risks, and the guidance suggests a risk register as the way to show it. A surveyor who asks for your business risk management system is asking for this register under either edition.
Does an NDIS provider need a risk register?
Yes. The NDIS Practice Standards (the Core Module, Division 2, or the Verification Module for a provider assessed by verification) require that risks to participants, workers and the organisation are identified and managed, and a register is how a provider shows it. ClinicComply's categories include participant safety, work health and safety, workforce, and emergency and business continuity, and a risk can be raised straight from an NDIS incident or complaint.
How is a risk rated in ClinicComply?
On a 5 by 5 matrix. Likelihood runs from Rare to Almost certain and consequence from Insignificant to Severe, each scored 1 to 5, and the rating is the two multiplied. A rating up to 4 is Low, 5 to 9 is Medium, 10 to 16 is High and 17 to 25 is Extreme. Each band carries a line of guidance beside the rating; for Extreme it reads "Act immediately. The practice owner should be involved, and the risk reviewed every three months until the rating falls." The scale is fixed, so every risk in the register is rated the same way.
How is a risk register different from an incident register?
An incident register records what has already happened. A risk register records what could happen, before it does, with a rating and an owner. The two meet when an incident exposes a risk you had not recorded. In ClinicComply you raise the risk from the incident or complaint, the risk keeps its reference (for example "Raised from INC-2026-0013"), and the incident lists the risks raised from it.
How often should risks be reviewed?
The RACGP does not fix a number. Criterion F1.G asks that risks are regularly reviewed and reported to practice leadership. In ClinicComply each risk is reviewed every 3, 6 or 12 months, 12 by default. Recording a review re-rates the risk as it stands today and sets the next review date from that day. Review reminders go to the owner from 30 days before the due date, or to the managers while the risk has no owner, and continue weekly while a review is overdue.
Who owns a risk, and who can see the register?
Each risk can have one owner, chosen from the team members with a login. Owners, admins and managers log risks and record reviews; staff see the risks they are involved in. RACGP 5th edition indicator C3.2D also asks for one team member with primary responsibility for leading risk management. That person is not always the right owner for every entry, which is why each risk carries its own.
How does the register feed our accreditation evidence?
Each risk can be tagged to items in your compliance checklist, and the picker offers first the items that ask for a risk register, such as NDIS2.2, RACGP 6th edition F1.G and NSQPCH 1.04. The audit evidence pack shows a risk register line with the number of extreme or high risks and whether reviews are up to date, and the readiness report lists the risks logged, open and closed over the last 12 months alongside incidents, complaints, conflicts of interest and improvements. Managers and above can export the full register to CSV at any time.
Is the risk register included in the free trial?
Yes. The risk register is on the free trial and every paid plan, including Solo. It is the fifth governance register in ClinicComply, beside the incident, complaints, conflicts of interest and continuous improvement registers, with the staff training and credential register alongside them. Practice data is stored in Sydney.
Related templates & reading
- Every risk on the same 5 by 5 matrix
- Australian data residency (Sydney)
- On the free trial
This page is general information, not legal advice. Verify risk management obligations against current RACGP and NDIS Commission guidance.
Be the practice the assessor compliments.
Choose your frameworks and work through the checklist. Walk into your next visit with your evidence linked and current, and nothing left to chase.