risk-register

---
name: risk-register
description: Builds a risk register written for an insurance underwriter rather than for the generic health and safety file, naming each risk, the control measure in place, who owns it and when it was last reviewed, built alongside the Management of Health and Safety at Work Regulations 1999 risk assessment but organised to support the Insurance Act 2015 duty of fair presentation rather than to repeat this pack's own under-insurance and cover-audit skills. Use when a broker asks what risk management you have, or you have a safety risk assessment but no document that tells an insurer anything.
---

# The risk list written for the person pricing the risk, not just managing it

You give this your existing health and safety risk assessment if one exists, a walk of how the business trades, and your policy's declaration conditions. You get back a risk register with each risk, its control measure, a named owner and a review date, written in a form an underwriter can use, plus a note on how it differs from the risk assessment it sits alongside. It will not carry out the risk assessment itself, and it hands any cover gap it exposes to this pack's own under-insurance and cover-audit skills.

## What it does

1. **Start from the legal risk assessment duty, then build something different from it.** Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make "a suitable and sufficient assessment of" the risks to employees and others affected by the business, with significant findings recorded where there are 5 or more employees. Confirm this duty is met before building the register, since the register does not substitute for it.

2. **Name each risk as a business fact, not a hazard category, in the same style as this pack's cover-audit skill, which already builds this list.** Fire in the kitchen, flood from the cellar, theft of stock, failure of the walk-in, a key supplier with no second name. Write each as a sentence describing what would happen.

3. **Name a control measure and an owner against each risk, specifically, not generically.** Not "fire safety" but the named measure in place, such as a duct cleaning interval or a keyholding arrangement, and the role of the person responsible for it. A control with no named owner depends on everyone, which means nobody.

4. **Set a review date for each risk, tied to a trigger, not just a diary date.** A new menu item, new equipment, an incident, or a fixed interval, whichever comes first. Flag any risk with no review date set as unreviewed, not as low risk.

5. **Link the register to the fair presentation duty, without repeating it.** The Insurance Act 2015 requires disclosure of every material circumstance the insured knows or ought to know; a register naming what could go wrong and what is done about it is itself evidence of what was considered. Mark which risks correspond to a declaration already made, and flag any never mentioned to the insurer.

6. **Hand the mechanical work to Codex and keep the judgement here.** Run, from the folder holding the risk assessment and the business walk notes:

   ```
   codex exec --sandbox danger-full-access --skip-git-repo-check -C "<working folder>" - < CODEX.md
   ```

   Claude hands over the named risks, control measures, owners, review dates, and the cross-reference to what has and has not been declared. Codex returns the register, the ownership and review schedule, and the undeclared-risk list. Codex names and decides nothing itself.

## Then it checks

1. The regulation 3 risk assessment duty is confirmed met, or the gap is stated plainly.
2. Every risk is written as a business fact, not a bare hazard category.
3. Every risk carries a named control measure, or is marked as having none.
4. Every control measure carries a named owner by role.
5. Every risk carries a last review date and a next review trigger, or is marked unreviewed.
6. Every risk is marked declared, not yet declared, or not applicable, with none left unmarked.

Any check fails: name it, redo that step once. Failed twice: say what is wrong and stop.

## Rules
- Public information only.
- Never invent a fact, a number or a quote.
- Anything sent in someone's name says whose name it is.
- Never treat this register as satisfying the regulation 3 risk assessment duty on its own.
- Never price, value or rank a risk by cost. Rank only by whether the business survives it.
- Never mark a risk controlled from a heading or a policy title alone.
- Never decide on the owner's behalf whether an undeclared risk is material; record it and hand it to the broker.
- This output is a working document for the owner's own FCA authorised broker to check, and for a competent person to confirm the underlying risk assessment. It is not a health and safety risk assessment, and not a statement that any risk is adequately covered.

## Built from
- Management of Health and Safety at Work Regulations 1999, SI 1999/3242, regulation 3, https://www.legislation.gov.uk/uksi/1999/3242/regulation/3, read 14 October 2026: the risk assessment duty and recording requirement, step 1.
- Health and Safety Executive, "Managing risks and risk assessment at work", https://www.hse.gov.uk/simple-health-safety/risk/index.htm, updated 24 March 2025, read 14 October 2026: the three-step identify, assess, act summary, step 1.
- Insurance Act 2015, section 3, https://www.legislation.gov.uk/ukpga/2015/4/section/3, read 14 October 2026: the duty of fair presentation, step 5.

# risk-register

## You are given
Confirmation of whether a regulation 3 risk assessment exists, when it was last done, and whether it is recorded (required at 5 or more employees). Every risk as a plain sentence describing what would happen. For each, the control measure as described, or a statement none exists, and the role of the person who owns it. The last review date and next review trigger, or a statement none has been set. Each risk marked declared to the insurer, not yet declared, or not applicable. All judgement calls are already made and supplied to you.

## Produce
Write into a `./risk-register-output/` folder:

1. `risk-assessment-status.md` recording, on separate lines: whether a regulation 3 risk assessment exists (`yes`, `no` or `not stated`), the date it was last done, and whether the significant findings have been recorded in writing (`yes`, `no`, `not applicable` where fewer than 5 employees, or `not stated`).
2. `risk-register.csv` with columns in this order: `risk_ref`, `risk_description_verbatim`, `control_measure`, `control_owner_role`, `last_review_date`, `next_review_trigger`, `declared_to_insurer`. `risk_ref` is R001 upward in the order supplied. `control_measure` is the owner's supplied text, or `none` where the owner states there is no control. `declared_to_insurer` is exactly one of `declared`, `not yet declared`, `not applicable`.
3. `undeclared-risks.md` a numbered list of every risk where `declared_to_insurer` is `not yet declared`, naming the risk reference and the risk description verbatim.
4. `uncontrolled-risks.md` a numbered list of every risk where `control_measure` is `none`, naming the risk reference and the risk description verbatim.
5. `review-schedule.csv` with columns: `risk_ref`, `last_review_date`, `next_review_trigger`, `status`. `status` is `reviewed` where both dates are supplied, or `unreviewed` where either is missing.
6. `gaps.md` a numbered list of: every risk with no control measure; every control measure with no named owner; every risk with no review date or trigger set; and every risk with no `declared_to_insurer` marking supplied.

## Rules
- Codex transcribes, classifies against supplied markings, and sorts. It never decides materiality, never invents a control measure, never decides whether an undeclared risk should be declared.
- Never record a control measure as present where supplied as `none` or blank; record `none` and list it in `uncontrolled-risks.md`.
- Never mark `declared_to_insurer` from inference; where none supplied, leave empty and record the gap.
- Never treat the register as evidence the regulation 3 duty is met; the two are recorded separately and never merged.
- British English, DD Month YYYY dates, no em dashes.
- Every file ends: this is a working document for the owner's own FCA authorised broker, and for a competent person to confirm the risk assessment. It is not a health and safety risk assessment and not a statement any risk is adequately covered.

## Return
The absolute path of every file written, the row count of `risk-register.csv`, the risk assessment status recorded, the count of risks by `declared_to_insurer` category, the count of uncontrolled risks and their references, the count of unreviewed risks, and the `gaps.md` item count.