Integrated Risk Management: Turning Incidents And Hazards Into Preventive Controls

Most Australian organisations record incidents properly. They investigate, they find a root cause, they assign a corrective action.

Then the file closes, and the risk register that should have changed as a result stays exactly as it was.

That gap is the whole subject of this guide. Integrated risk management is not another framework to adopt.

It is the connection between the operational data you already collect and the risk decisions your executives already make, and it is missing in most organisations for a structural reason: the incident system and the risk register are owned by different people and were never designed to talk.

This guide covers integrated risk management under the model work health and safety laws and ISO 31000. Duties vary between states and territories and by industry.

What Integrated Risk Management Actually Means

Integrated risk management is an approach that connects incident management, hazard identification, risk assessment, preventive controls, monitoring and leadership oversight into a single flow of information, rather than running each as a separate process owned by a separate team.

The word doing the work is integrated. It does not mean using one piece of software.

It means an event captured at the front line reaches the risk register, changes something, and the change is visible to the people accountable for it.

This matters beyond tidiness. Under regulation 38 of the model work health and safety regulations, a risk control must be reviewed when a notifiable incident occurs, when a new hazard is identified, or when a control is found not to be effective.

Each of those is an operational event. If operational events do not reach the register, the review obligation cannot be met, because nobody knows it has been triggered.

Integrated Risk Management Compared With ERM And GRC

These three terms are used interchangeably in vendor material, which is why they confuse people. They describe different things and an organisation needs all three.

	What it describes	The question it answers	Where it lives
Enterprise risk management	The governance structure. Risk appetite, categories, owners, board reporting lines	How is risk governed across the organisation?	Board and executive
Governance, risk and compliance	The operating disciplines and how they align. Policy, obligation tracking, assurance, audit	Are we meeting our obligations, and can we show it?	Compliance, legal, internal audit
Integrated risk management	The connective tissue. How operational data moves into risk decisions and back out as controls	Does what happens on the floor change what the board sees?	Between the two, which is why it is usually nobody’s job

The overlap is real and the distinction still matters.

An organisation can have a mature enterprise risk management framework on paper and no integrated risk management in practice, because the framework describes categories and owners without describing how information travels.

That organisation will have an accurate-looking register that has not moved in a year.

The 6 Core Components Of Integrated Risk Management

Six components make up the system. Most organisations already run four or five of them. The failure is almost never a missing component.

It is a missing connection between two of them, which is why buying another system rarely helps.

Component	What good looks like	Where it usually breaks
1. Incident management	Incidents captured consistently, with enough detail to analyse later, using the same categories across departments	Free-text descriptions and department-specific categories, so nothing can be aggregated
2. Hazard identification	Reporting of potential risks before harm occurs, including near misses, with no penalty for reporting	Reporting is technically possible but socially discouraged, so only actual harm gets recorded
3. Risk assessment	Likelihood and consequence evaluated consistently, using a shared scale such as a 5×5 risk matrix	Each department uses its own definition of high, so ratings cannot be compared
4. Preventive controls	Controls designed from root cause and placed as high in the hierarchy of control as is reasonably practicable	Controls default to training and procedure, which sit at the bottom of the hierarchy
5. Continuous monitoring	Corrective actions tracked to completion, then reviewed for whether they actually worked	Completion is tracked. Effectiveness is not, so a control that failed still reads as closed
6. Leadership oversight	Boards and executives receive integrated reporting that connects operational trends to risk ratings	Leaders receive incident counts, which show volume but not whether exposure is rising or falling

Read the third column again. Every one of those failures is a connection problem rather than a capability problem, and none of them require new software to see.

Why Reactive Risk Management Fails

Reactive risk management responds to events one at a time. It is not negligent and it is not lazy.

It is what happens by default when incident data has nowhere to go. Four failure modes account for most of it.

1. The cost of isolated incident reporting

When reporting stays inside individual departments, the pattern is invisible even though every piece of it is recorded. Human resources logs several complaints about management behaviour in one division. Payroll sees overtime climbing in the same division. The people team records turnover rising there. Safety records two manual handling injuries.

Separately, none of those crosses a threshold. Together they describe a division under sustained pressure with a supervisor who needs support, which is a psychosocial hazard with a well-understood control. A connected approach is what makes the fifth data point visible instead of leaving four departments each holding a quarter of the picture.

2. Root cause analysis without systemic change

Many organisations investigate thoroughly. Root cause analysis is completed, recommendations documented, corrective actions assigned.

Then the corrective action tracking loosens. Deadlines slip. Ownership blurs when someone changes role.

Preventive controls are implemented and never reviewed for effectiveness, so the corrective action closes without anyone confirming the root cause was addressed.

The deeper problem is that corrective actions tend to fix the instance rather than the condition. If workload pressure contributed to an error, retraining the individual does not reduce workload.

The investigation was correct and the response was still ineffective, which is the hardest failure to see from the inside because all the paperwork looks complete.

3. Data silos across departments

Human resources systems track grievances. Safety systems track injuries. Quality tracks non-conformances. Information technology tracks security events.

Each system is fit for its purpose and none can answer a question that spans two of them, which is why hazard trends stay invisible even when every incident is recorded.

You do not need one system to fix this, and organisations that wait for a single platform usually wait for years.

You need a shared classification, a common risk scale, a policy on who reviews what, and one place where the aggregate trend is reviewed. That can start as a quarterly meeting with four exports.

4. The near-miss blind spot

Near misses are the cheapest risk intelligence available, because they carry the same root cause information as an incident without the harm.

They are also the first thing to go unreported, since nothing happened and reporting feels like paperwork for its own sake.

An organisation whose near-miss reports fall to zero has usually not become safer.

It has stopped hearing about the events that precede harm, which means the next real incident will look like it came from nowhere.

Turning Incidents Into Preventive Controls

This is the core mechanism, and it runs in four moves.

1. From investigation to action

A useful incident investigation answers more than what happened.

It answers why it happened, what conditions allowed it to happen, whether those conditions exist elsewhere in the organisation, and what would have to change for it to be prevented rather than repeated.

The third question is the one most often skipped and the one that turns a single incident into a systemic fix.

If a contractor was inducted incorrectly at one site, the question is not how to correct that induction. It is how many other sites use the same process.

2. Identify patterns and trends

Single incidents rarely justify a control change. Patterns do. Look for trends and patterns: clustering by location, by team, by shift, by task, by time since a change was made, and by the risk the incident relates to.

A single incident is an event. A pattern of incidents is a control failure, and the trend is what justifies redesigning the control.

That last one requires incidents to be tagged against register entries at the point of capture.

It is a small change to a reporting form and the single highest-value adjustment in this guide, because without it every trend has to be found manually and most patterns are never found at all.

3. Design preventive controls

Controls designed from root cause should be placed as high in the hierarchy of control as is reasonably practicable.

Regulation 36 requires elimination first, then substitution, isolation and engineering controls, with administrative controls and personal protective equipment last.

Most corrective actions default to the bottom two, because retraining and a procedure update are quick to write and easy to evidence.

Training and policy updates are legitimate preventive controls. They are simply the weakest available, and a regulator will ask what was considered above them.

4. Close the loop

Closing the loop means four things happened: the control was implemented, the risk register entry was updated to reflect the new residual rating, an owner was named, and a date was set to test whether the control worked.

Most organisations complete the first. Some do the second, updating the risk register after the investigation closes.

Very few do the fourth, which is why controls accumulate in registers without anyone knowing which of them are still doing anything.

Connecting Hazard Reporting To Enterprise Risk

Encourage hazard and near-miss reporting

Hazard reporting volume is a function of how easy the system makes reporting, and of what happens afterwards.

Make hazard and near-miss reporting possible in under a minute, from a phone, without naming anyone.

A reporting system nobody can use at the moment they notice something will only ever capture incidents after the fact.

Then close the loop publicly, because the fastest way to stop reports is for people to conclude that nothing happens when they make one.

Tell people what changed as a result. A short note that a hazard report led to a specific preventive control does more for reporting rates than any campaign about reporting culture.

Risk scoring and prioritisation

Hazards need to be scored and prioritised on the same risk assessment scale as everything else in the register, or they cannot be compared with the risks already there.

A shared scoring scale is what allows a supervisor’s hazard report and a strategic risk to sit in the same conversation, and it is what lets you prioritise across them.

Prioritise on the combination of rating and how many places the hazard condition exists.

A moderate hazard present at twelve sites is a bigger systemic exposure than a high hazard present at one, and the second gets attention first in most organisations because the number next to it is larger.

Linking hazard data to strategic oversight

Boards and leadership teams do not need raw incident counts. Counts tell them about volume and reporting behaviour, not about exposure.

What changes a decision is the movement: which risk ratings moved this quarter, which controls were tested and failed, and which operational trends are pushing a rating up.

The IIA Three Lines Model is useful here. Management owns and manages risk, the risk and compliance functions provide expertise and challenge, and internal audit provides independent assurance.

Integrated risk management is largely a first-line activity owned by operational management, which is why it stalls when leadership treats it as something the compliance team should build alone.

Oversight belongs to the board. The reporting and hazard workflow belongs to the business.

What Happens To A Hazard Report In A Connected System

The clearest way to see the difference is to follow one hazard report through both kinds of system.

The report is the same. What the organisation learns from it is not.

Stage	In a disconnected system	In a connected system
Capture	Free-text description in the safety system. No link to any risk	Same description, tagged to a risk register entry and classified with shared categories
Triage	Assessed by the safety team against its own severity scale	Scored on the same risk assessment scale used across every department, so it can be prioritised against existing register entries
Pattern check	None. The report is treated as a standalone hazard	Automatically visible alongside every other event tagged to that risk, which surfaces the trend immediately
Control design	A corrective action, usually a toolbox talk or a procedure update	Root cause reviewed against the hierarchy of control, with the question of whether the condition exists elsewhere asked explicitly
Register update	None. The risk rating is unchanged until the next scheduled review	Residual rating reassessed. If it moved, the movement is recorded with the hazard report as the reason
Effectiveness	The corrective action is marked complete and the file closes	A separate effectiveness review date is set. The preventive control is tested and either confirmed or redesigned
Oversight	Appears in a quarterly count of hazard reports logged	Appears in leadership reporting as a rating that moved, with the operational trend behind it

The disconnected column is not a failure of diligence. Every step in it is performed properly. The hazard was reported, assessed, actioned and closed.

What is missing is any mechanism for that hazard to change the organisation’s understanding of its own risk, which is the difference the whole approach exists to make.

The 5-Step Framework For Integrated Risk Management

A realistic sequence for building this, with what each step produces and what it typically costs in elapsed time.

Step	What you do	What it produces	Realistic time
1. Assess current workflows	Map how an incident and a hazard travel today, from capture to close, naming every system and every handover	A picture of where information stops moving, which is usually one or two specific handovers	2 to 4 weeks
2. Centralise reporting and classification	Agree one set of categories and one risk scale across departments. Keep existing systems if you must	Data that can be aggregated, which is the prerequisite for everything after this	4 to 8 weeks
3. Align incident data with the risk register	Add a field that tags each incident and hazard to a register entry, and make it required	The ability to see which risks are actually generating events	2 to 4 weeks
4. Implement corrective action governance	Named owners, due dates, and an effectiveness review date separate from the completion date	Controls that get tested rather than assumed	4 to 6 weeks
5. Review trends and improve	A standing quarterly review of movement, not volume, reported to the executive	Register ratings that move for reasons anyone can explain	Ongoing

A Worked Example Of Integrated Risk Management

A 180-person Australian facilities services business, across nine client sites. Nothing here is unusual and that is the point.

When	What was recorded	What each system saw	What integrated risk management would have shown
February	Two near misses involving a powered pallet jack at Site C	Safety logged both, closed both, retraining delivered	Both tagged to the manual handling and plant risk. Two events on one asset in one month
March	A grievance about a supervisor at Site C	Human resources opened a file, resolved it informally	Same site, same shift as both near misses. A supervision signal, not an isolated complaint
April	Overtime at Site C up 22% on the prior quarter	Payroll saw a cost variance and queried the budget	Sustained workload, which is a psychosocial hazard with an obligation attached
May	Two resignations from the Site C day shift	Recruitment started, exit interviews filed	Fourth signal on the same site in four months. Rating should have moved in March
June	A recordable injury involving the same pallet jack	Investigated as a first event, root cause recorded as operator error	The fifth signal. Not a first event, and operator error is a symptom of the other four

Every one of those was recorded correctly by someone. Four different systems each held a fragment and none held the pattern.

The June investigation concluded operator error because, from inside the safety system alone, that is what the root cause looked like. A pattern was there. No system was looking for it.

The cost of the gap is not the injury alone. It is that four opportunities to act were logged, processed and closed before it happened.

5 Mistakes That Break Integrated Risk Management

1. Buying a platform before agreeing a classification: Software will happily store inconsistent categories. Agreeing what a category means across every system is the work, and it is free.
2. Measuring incident volume as a performance indicator: It rewards under-reporting. Measure the ratio of near misses to incidents, the proportion of corrective actions tested for effectiveness, and whether hazard trends are falling.
3. Treating it as a compliance project: Integrated risk management is a first-line activity. If operational managers do not own it, the system produces a report nobody uses and oversight becomes a formality.
4. Assigning corrective actions without an effectiveness date: Completion is not effectiveness. A control marked done and never tested is an assumption in the register.
5. Escalating everything: If every incident reaches the executive, none of them registers. Agree in advance what movement warrants escalation to leadership oversight, and let the rest aggregate into the trend.

Reporting Integrated Risk Management To Leadership

Most risk reporting to boards and executives describes activity. Incident counts, hazard reports logged, corrective actions closed.

Those numbers describe how busy the system was, not whether exposure moved, and a board reading them has no basis for a decision.

A connected system changes what oversight reporting can contain. Once incidents and hazards are tagged to register entries, you can report movement instead of volume.

Instead of reporting	Report this	Why it changes the conversation
Incidents this quarter: 34	4 risk ratings moved, 3 up and 1 down, with the operational trend behind each	Volume reflects reporting behaviour. Movement reflects exposure, which is what leadership governs
Corrective actions closed: 28	22 corrective actions were tested for effectiveness, 4 failed the test and were redesigned	Closure is administrative. Effectiveness testing is the only evidence a control works
Hazard reports logged: 61	Near-miss to incident ratio moved from 3:1 to 6:1	A rising ratio means people are reporting before harm. Falling means reporting has stopped
Training completed: 94%	3 of 5 controls added this quarter sit at the administrative level of the hierarchy	Shows whether the organisation is designing out risk or documenting around it
Top 5 risks by rating	Which risks generated events this quarter, and whether their controls held	Connects the register to reality. A top risk generating no events may be mis-rated either way

None of this requires new data collection. It requires the tagging step and a quarterly review that asks about trend rather than total.

That is the whole reporting change, and it is what turns leadership oversight from a compliance ritual into governance.

What Integrated Risk Management Looks Like When It Is Working

Four observable signs, none of which require an audit to check.

Risk ratings move between reviews

In most organisations a risk register is updated on a cycle and looks identical in between.

Where integrated risk management is working, ratings move when operational conditions move, and each movement has an event behind it that someone can name.

A register that has not changed in twelve months is not stable. It is disconnected.

Investigations reference other incidents

A good investigation report cites the pattern it belongs to.

When investigations routinely open by noting that this is the third similar event at two sites, the incident data and the risk assessment process are genuinely connected.

When every investigation reads as a first event, they are not.

Corrective actions get tested, not just closed

The distinguishing feature is a second date. A corrective action has a completion date and an effectiveness review date, and the second one is honoured.

Organisations that do this discover that a meaningful share of controls do not work as intended, which is uncomfortable and far cheaper than finding out through a repeat incident.

Departments cite each other’s data

The clearest cultural sign is human resources referencing safety data in a workforce discussion, or operations referencing grievance trends when planning a roster change.

That only happens once classification is shared. Until then each function reasons from its own system and reaches defensible conclusions from partial information.

Bringing It Together

Integrated risk management is not a larger version of risk management.

It is the same components most Australian organisations already run, connected so that information travels in both directions.

Incidents and hazards inform the register. The register informs where controls are designed and tested. Leadership sees movement rather than volume.

The barrier is rarely capability or budget. It is that the connection between the operational systems and the risk register sits between two owners, so it belongs to neither.

Naming an owner for that connection is the decision that makes the rest possible.

If this is new ground, do not begin with a platform selection.

Begin by tagging incidents and hazards to risk register entries, agree one risk scale across departments, and add an effectiveness review date to every corrective action.

Those three changes cost almost nothing, and together they convert an incident archive into the evidence base for preventive controls.

Integrated risk management assumes the underlying discipline is already in place.

If any part of that is still being built, our complete Australian risk management guide covers the framework, the six risk types and the five-step process this sits on top of.

Frequently Asked Questions

1. What is integrated risk management?

Integrated risk management is an approach that connects incident management, hazard identification, risk assessment, preventive controls, monitoring and leadership oversight into one flow of information. Rather than each process running separately, an event captured at the front line reaches the enterprise risk register, changes a control or a rating, and that change is visible to the people accountable for it.

2. How does integrated risk management differ from traditional risk management?

Traditional risk management tends to assess risk on a cycle, often annually, and handle incidents as separate operational matters. Integrated risk management treats every incident, hazard and near miss as an input to the register. The practical difference is direction of travel: traditional risk management pushes assessments down to operations, while integrated risk management also pulls operational reality back up into the assessment.

3. How is integrated risk management different from enterprise risk management and GRC?

Enterprise risk management describes the governance structure, including risk appetite, categories, owners and board reporting. Governance, risk and compliance describes the operating disciplines that keep obligations met and evidenced. Integrated risk management is the connective tissue between them, covering how operational data moves into risk decisions and back out as controls. Organisations need all three, and integrated risk management is the one most often missing because it is nobody’s specific job.

4. Why is incident tracking critical for prevention?

Because incidents are the only unfiltered evidence of how controls perform in practice. A control can look adequate in a register and fail consistently in the field, and the incident record is where that shows up first. Tracking incidents against register entries turns that record from a compliance archive into the evidence base for control design.

5. How do near misses support preventive controls?

A near miss carries the same information as an incident without the harm, which makes it the cheapest risk intelligence available. It identifies a control gap, and the root cause behind it, before a cost is attached. A falling number of near-miss reports usually means people have stopped reporting rather than that conditions have improved, so the ratio of near misses to incidents is a more useful measure than either count alone.

6. How do you connect operational incidents to enterprise risk?

The mechanical step is to add a required field at the point of capture that tags each incident and hazard to a risk register entry. That single change makes it possible to see which risks are generating events, which controls are failing, and where a condition exists in more than one place. Without it, every pattern has to be found manually, which means most are never found.

7. Does integrated risk management require software?

No, though it becomes difficult to sustain manually beyond a certain size. What it requires is a shared classification, one risk scale used across departments, a tagging link between incidents and register entries, and a standing review of movement. Organisations often begin with existing systems and a quarterly review before consolidating. Waiting for a single platform before starting is the more common failure.

8. What does integrated risk management have to do with work health and safety obligations?

Under regulation 38 of the model work health and safety regulations, control measures must be reviewed when a notifiable incident occurs, when a new hazard is identified, when a control is found not to be effective, before a change at the workplace, or when a health and safety representative requests it. Every one of those triggers is an operational event. If operational events do not reach the risk register, the review obligation cannot reliably be met because nobody knows it has been triggered.

Sources

• Work Health and Safety Regulations 2011 (Cth), regulation 36, Hierarchy of control
• Work Health and Safety Regulations 2011 (Cth), regulation 38, Review of control measures
• Safe Work Australia, Incident notification
• Safe Work Australia, Psychosocial hazards
• Safe Work Australia, Key Work Health and Safety Statistics Australia 2025
• Institute of Internal Auditors, The IIA’s Three Lines Model, 2020
• ISO 31000 Risk management, International Organization for Standardization

Read more

• Risk management: the complete guide for Australian businesses
• Enterprise risk management framework
• Continuous risk monitoring
• Why manual risk registers fail
• Key risk indicators
• The 5×5 risk matrix
• Audit-ready risk management
• Risk management maturity
• Cultural risk management
• Implementing risk management software

Disclaimer: This article is general information, not legal advice. Work health and safety duties vary between states and territories and by industry. Confirm your obligations with the relevant regulator or a qualified adviser before acting.