Risk register vs control register vs decision log: which one stops drift in a live operation?

A live operation does not drift because it has too few documents. It drifts when one document tries to carry three jobs, and the team stops noticing that exposure, barrier ownership, and decision memory are not the same thing. The risk register, the control register, and the decision log each answer a different question, which is why mixing them creates a slower, blurrier operation.

Across more than 25 years in multinational EHS and more than 250 cultural transformation projects, Andreza Araujo has seen the same failure repeat. Leaders ask one spreadsheet to do the work of governance, field control, and retrospective justification. The result looks tidy, but the work keeps changing faster than the record. In Safety Culture: From Theory to Practice, the point is that repeated decisions reveal culture. In The Illusion of Compliance, the warning is sharper still. Paper can look complete while the field stays exposed.

This article is for plant managers, EHS managers, and risk owners who need a clean choice. If you know which record should hold the risk, which one should hold the barrier, and which one should hold the decision, you can stop arguing about format and start improving control.

Evaluation criteria

Before comparing the three tools, use the same criteria for each one. The first criterion is purpose. The second is owner. The third is review cadence. The fourth is the type of evidence it must hold. The fifth is the failure mode when it is confused with something else. The sixth is the audience that actually needs it. If a document cannot pass those six tests, it is probably carrying someone else's job.

Risk register

The risk register belongs to the question, "What could hurt us, and how serious is it?" It is the memory of exposure. It belongs close to portfolio review, enterprise risk, and leadership discussion because it helps the organization rank what matters and decide where attention should go first. That is why the article Risk Register Explained is useful as a companion. It covers the structure of the record, while this comparison focuses on the decision boundary.

A strong risk register describes the risk, the cause, the consequence, the current controls, and the residual concern in plain language. It should help a senior leader understand whether the business is facing a severe exposure, a shifting exposure, or a local nuisance. It should not try to prove that a barrier works on every shift. That is a different job.

James Reason's work on latent conditions helps here. A risk register is strongest when it keeps the organization honest about the conditions that make failure more likely. It becomes weak when it is treated as a static list that nobody uses after the annual review. In that state, the register still exists, but it no longer influences the next decision.

Use the risk register when the question is strategic or cross-functional. Use it when you need to compare hazards across sites, rank investments, or decide which exposure deserves senior attention. Do not use it as the place to log every control check or every temporary exception. That overload hides the signal.

Control register

The control register answers a different question. It asks, "Which barriers must stay alive for this risk to remain under control?" It belongs closer to the line of work, because barrier failure is usually local, specific, and time bound. The article Critical Control Register goes deeper on that point, and Critical Control Handover shows why control continuity breaks when ownership is vague.

A control register should identify the control, the owner, the check that proves it still works, and the consequence if it fails. A control that is not verified is just a hope with a label on it. That is why this record matters most where the risk is serious, the energy source is high, or the consequence of one missed step is severe.

Across more than 250 cultural transformation projects supported by Andreza Araujo, the recurring problem is not that teams lack words for control. It is that the site cannot say who checks the control, when the check happens, and what the team does when the evidence is missing. In Safety Culture: From Theory to Practice, culture becomes visible in repeated decisions. A control register makes those decisions concrete.

Use the control register when the question is operational and immediate. If a barrier is missing, degraded, bypassed, or unverified, this is the record that should show it. If a supervisor can read the register and know what must be checked before work continues, the document is doing its job.

Decision log

The decision log answers the question, "What did we decide, why did we decide it, who owns the next move, and when does the decision expire?" It is the memory of governance. It matters when the team accepts temporary risk, changes scope, approves a deviation, or chooses one option over another under time pressure. The article Safety Decision Log is the natural companion here.

This record becomes valuable when the business is forced to make tradeoffs. A shutdown may be delayed because a critical part has not arrived. A permit may be revalidated because the condition changed. A temporary workaround may be accepted with a short expiry and a named owner. If those decisions live only in memory, the operation loses accountability as soon as the shift changes.

Andreza Araujo has seen in many multinational settings that unclear decisions create hidden drift. People think the choice was made, but the reason was never recorded, the expiry was never stated, and the next owner was never told. The result is predictable. The same issue returns on the next shift with a new face and the same exposure.

Use the decision log when the organization must defend why it accepted a condition, postponed a fix, or changed the plan. It is not a substitute for the risk register, because it does not rank all exposure. It is not a substitute for the control register, because it does not prove the barrier. It is the place where the organization records the judgment call.

Decision matrix

The three tools become easier to use when you put them beside one another. The risk register handles exposure. The control register handles barriers. The decision log handles tradeoffs. That division looks simple on paper, yet it changes the whole rhythm of a meeting because each artifact now has one job instead of three.

Which one fits which role

A board needs the risk register most, because the board should understand exposure, trend, and priority. A plant manager needs the risk register and the decision log, because strategy becomes real only when tradeoffs are visible. An EHS manager needs all three, because the role sits between enterprise memory, barrier verification, and exception control. A supervisor needs the control register first, because the task lives or dies on what is actually in place before work starts.

The trap is to assume that one document can serve every role equally well. That assumption creates two bad outcomes. First, the board sees detail without direction. Second, the field sees direction without enough detail to act. The best system keeps one core record per decision type and connects them with a shared ID, a clear owner, and a short review rhythm.

If you want to see how those connections behave in practice, pair this comparison with Risk Owner Critical Control. That article shows why ownership becomes real only when the register leads to a live check, and the check leads to a decision.

What to do next

Start by mapping your current files into the three buckets. If a line in the sheet says "hazard," "likelihood," "consequence," or "priority," it belongs in the risk register. If it says "critical control," "verification," "owner," or "test," it belongs in the control register. If it says "approved," "accepted," "deferred," or "temporary," it belongs in the decision log. Many operations already have all three. The problem is that they are mixed together, which makes each one weaker.

Then give each record one owner and one cadence. The risk register can move monthly or quarterly. The control register should move with the work, because barriers drift faster than strategy. The decision log should move whenever a tradeoff is made, because governance loses value the moment the reason disappears. James Reason would call that a latent weakness. Andreza Araujo would call it a culture signal.

If you want the method behind that split, return to Safety Culture: From Theory to Practice and The Illusion of Compliance. They are useful precisely because they show why paperwork only matters when it changes the next decision. For a more direct next step, explore the books and tools at Andreza Araujo's store, then apply the same logic to one live register this week.