Risk Register Template for Primary Schools

Standard Operating Procedure: Primary School Risk Register Implementation & Management

Document ID: SOP-TR-EDU-042
Effective Date: October 24, 2023
Version: 3.1.0
Review Cadence: Annual / Post-Critical Incident
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the operational lifecycle for implementing, maintaining, and auditing the Primary School Risk Register template. Primary educational environments present unique operational, safeguarding, and liability vectors. This document ensures that institutional leadership, administrative staff, and facilities personnel systematically identify, quantify, mitigate, and review operational risks to guarantee student safety, regulatory compliance, and business continuity.

---

2. Scope & Prerequisites

2.1 Scope

This SOP applies to all physical facilities, digital infrastructures, curricular excursions, and personnel operating under the primary school's governance framework (Ages 4–11).

2.2 Prerequisites & Tooling

• Template Artifact: Template Registry Primary School Risk Register (Excel/Google Sheets schema v3.x or integrated GRC platform).
• Access Control: Role-Based Access Control (RBAC) configured to restrict write access to designated risk owners.
• Reference Frameworks: Local Department of Education guidelines, Health and Safety Executive (HSE) standards, and applicable child protection legislation (e.g., Working Together to Safeguard Children).
• Hardware/Software: Endpoints running encrypted OS, spreadsheet software supporting data validation and conditional formatting. No specialized PPE required for administrative compilation; site assessment teams must utilize standard facility inspection PPE (high-visibility vests, non-slip footwear).

---

3. Roles & Responsibilities (RACI Matrix)

• R = Responsible (The role that performs the activity)
• A = Accountable (The role with final approval and ownership)
• C = Consulted (The role providing advisory input)
• I = Informed (The role kept updated on progress/status)

---

4. Step-by-Step Procedure

Phase 1: Initialization & Context Setting

• 1.1 Deploy a fresh instance of the Template Registry Primary School Risk Register template to the secure administrative repository.
• 1.2 Populate the metadata header (Term, Academic Year, Lead Reviewer, Date of Issue).
• 1.3 Establish the risk appetite thresholds within the configuration tab (e.g., Likelihood scale 1–5, Impact scale 1–5, where any Residual Risk Score $\ge 15$ triggers mandatory executive escalation).

Phase 2: Hazard Identification & Data Capture

• 2.1 Conduct localized brainstorming sessions and site walkthroughs across four mandatory domains:
  • Safeguarding & Student Welfare (e.g., unauthorized site access, bullying vectors, medical non-compliance).
  • Health, Safety & Facilities (e.g., playground equipment degradation, fire suppression faults, chemical storage).
  • Curricular & Excursions (e.g., off-site trip ratios, swimming pool safety, dietary cross-contamination).
  • Digital & Information Security (e.g., student PII exposure, unauthorized Wi-Fi access).
• 2.2 Log raw observations into the Risk_ID queue using the standardized nomenclature format: [Domain]-[Sequential Number] (e.g., SAF-001).

Phase 3: Risk Quantification & Prioritization

• 3.1 Assess the Inherent Likelihood (1 = Rare, 5 = Almost Certain) based on historical incident data and baseline environmental exposure.
• 3.2 Assess the Inherent Impact (1 = Negligible, 5 = Catastrophic / Fatality or Severe Regulatory Breach), prioritizing child welfare above all fiscal metrics.
• 3.3 Calculate the Inherent Risk Score via the automated formula: $\text{Likelihood} \times \text{Impact}$.
• 3.4 Sort the register descending by Inherent Risk Score to establish the immediate mitigation queue.

Phase 4: Mitigation & Control Implementation

• 4.1 Assign an explicit Risk Owner (Named individual, not a department) to every identified hazard.
• 4.2 Formulate hierarchical control measures using the Hierarchy of Control (Elimination, Engineering, Administrative, PPE).
• 4.3 Input Target Resolution Dates for all mitigation strategies.
• 4.4 Recalculate Residual Likelihood and Residual Impact factoring in the implemented controls to derive the Residual Risk Score.

Phase 5: Monitoring, Review, & Archival

• 5.1 Schedule automated calendar alerts for risk owners 7 days prior to target resolution dates.
• 5.2 Perform monthly reviews of all high-residual risks ($\ge 10$) during operational leadership meetings.
• 5.3 Archive completed academic year registers to immutable read-only storage for a minimum statutory retention period (typically 7 years, or until students reach majority age depending on jurisdiction).

---

5. Quality Assurance & Pro-Tips

Best Practices

• Granular Ownership: Never assign a risk owner as "The Teachers" or "Maintenance Team." Assign specific named roles (e.g., Head of Facilities or Lead School Nurse).
• Dynamic Updating: Treat the risk register as a living document. A static register checked only annually violates baseline duty of care principles.
• Evidence Linking: Hyperlink external documentation (e.g., Fire Safety Certificates, DBS check logs, excursion risk assessments) directly into the register row for rapid audit retrieval.

Common Pitfalls

• The "Zero Risk" Fallacy: Attempting to eliminate all risk, leading to paralysis of educational and extracurricular programming. Focus on as low as reasonably practicable (ALARP).
• Vague Hazard Descriptions: Entering "Bad behavior" instead of specific vectors like "Unmonitored perimeter access points during transition periods between lessons."

Metric Thresholds

• Green Zone (Score 1–4): Acceptable; monitor via routine operations.
• Amber Zone (Score 5–12): Tolerable; requires active mitigation plans with set review dates.
• Red Zone (Score 15–25): Unacceptable; requires immediate executive intervention, operational cessation if necessary, and weekly oversight.

---

6. Frequently Asked Questions

Q: What is the protocol if a newly discovered, high-severity risk (Score $\ge 15$) is identified mid-term?
A: The identifier must bypass standard queue entry and immediately notify the Headteacher and Designated Safeguarding Lead within 2 hours. Implement temporary administrative controls (e.g., closing a play area) on the same business day, log the entry as an emergency addition, and table it for the next governance board meeting.

Q: How do we handle risks associated with third-party contractors on school grounds during school hours?
A: Third-party operational vectors must be captured under the Facilities domain. Contractors are required to submit their own method statements and risk assessments, which must be cross-referenced and appended to the school's master register before site access is granted.

Q: Can teaching assistants be assigned as Risk Owners?
A: No. Risk owners must possess the authority to allocate budget, alter operational procedures, or halt activities. Teaching assistants may act as Consulted parties, but accountability must rest with administrative, operational, or executive leads.