New Zealand edition. This guide is written for volunteer-run clubs in New Zealand. Where rules differ — grants, tax, incorporation, safeguarding — follow the New Zealand-specific pointers below or check with your national body.
Risk management has a branding problem in community sport. Say the words at a committee meeting and people picture corporate paperwork — binders, matrices, meetings about meetings. So most clubs skip it, and their actual risk management becomes "hope, plus whatever the insurer requires".
Here's the reframe: risk management is just deciding in advance what could hurt your people, your money or your club's existence — and doing the cheap, obvious things that make those outcomes less likely. Done at club scale it's one working session a year, a one-page register, and a habit of writing down incidents when they happen. This guide gives you exactly that: the method, a matrix, a template with worked examples, and the loop that keeps it alive.
General information only. This guide is general information for community clubs, not legal or financial advice. Requirements differ by state and change over time — always confirm with the official sources linked below.
For the authoritative backdrop: your sport's national body almost certainly publishes mandatory safety policies — heat, lightning, concussion, blood rules — and those belong in your register as controls, not as a separate document nobody reads. Underneath them sits your jurisdiction's safety law, which reaches volunteer organisations further than most committees assume.
The health and safety at work legislation reaches volunteer organisations in defined circumstances, and the distinction between a volunteer association and a business with volunteers decides which duties apply — worth establishing which side your club falls on, because the answer changes your obligations materially. The workplace safety regulator publishes guidance specifically for volunteer organisations.
The five categories of club risk
Brainstorming "what could go wrong" works better with prompts. Almost every club risk fits one of five buckets:
- People / safety — player injury, spectator injury, heat illness, concussion handled badly, child safety failures, a medical emergency with no first aider present.
- Money — cash theft or "leakage", fraud, losing a major sponsor, a fundraiser that loses money, unpaid fees, uninsured losses.
- Property and equipment — clubroom fire or break-in, storm damage, mower/equipment failure, ground condition hazards.
- Governance / compliance — no quorum at the AGM, key-person dependency ("only Sue knows the banking"), lapsed incorporation or insurance, permits not obtained, checks not tracked.
- Reputation — a social media pile-on, a discrimination complaint handled badly, a food safety incident at the canteen.
Run your annual session against these five headings and you'll surface 20–30 risks in under an hour. That's the raw material; the matrix turns it into priorities.
The risk matrix: two questions per risk
For each risk, ask two questions: how likely is it (over, say, the next couple of seasons) and how bad would it be if it happened. Score each 1–4 and read the priority off the grid:
| Insignificant (1) | Moderate (2) | Major (3) | Severe (4) | |
|---|---|---|---|---|
| Almost certain (4) | Medium | High | Extreme | Extreme |
| Likely (3) | Medium | High | High | Extreme |
| Possible (2) | Low | Medium | High | Extreme |
| Rare (1) | Low | Low | Medium | High |
Calibrate the words for a club: Severe means someone dies or is permanently injured, the club faces an existential financial or legal blow, or juniors are harmed. Major means hospitalisation, five-figure loss, or serious reputational damage. Moderate means first-aid injuries or four-figure losses. Insignificant is bruises and inconvenience.
The scores aren't science — they're a forcing device for the conversation, and their real output is rank order: Extreme and High risks get controls and an owner this month; Medium risks get controls when practical; Low risks get accepted, consciously, in writing. Accepting a risk on purpose is legitimate risk management. Never getting around to thinking about it is not.
The risk register template (steal this)
One row per risk. A club register that gets used is one page long, not forty.
| Risk | Category | Likelihood | Consequence | Rating | Controls (what we do about it) | Owner | Review |
|---|---|---|---|---|---|---|---|
| Serious player injury with no first aid response | People | 2 | 4 | Extreme | Qualified first aider rostered every match day; stocked kits checked monthly; defib on site and signed; emergency plan laminated in canteen | First aid officer | Pre-season |
| Heat illness at summer training | People | 3 | 3 | High | Adopt sport's heat policy; modify/cancel thresholds published to coaches; water breaks mandated | Head coach | Nov |
| Cash stolen or lost on match day | Money | 3 | 2 | High | Two-person cash counting; float log; bank within 48h; shift to online/card payments wherever possible | Treasurer | Mid-season |
| Key-person dependency in club admin | Governance | 3 | 3 | High | All records in club systems (not personal accounts); two admins on every account; documented handover at AGM | Secretary | AGM |
| Clubroom break-in | Property | 2 | 2 | Medium | Locks changed when keys unreturned; asset register with photos; nothing valuable visible | Facilities | Annual |
| Lightning during play | People | 2 | 4 | Extreme | Adopt 30/30 rule per sport's policy; suspension call sits with ground marshal, not captains | Ground marshal | Pre-season |
| Fundraiser makes a loss | Money | 2 | 2 | Medium | Budget approved by committee before commitment; deposit caps; review vs budget after event | Treasurer | Per event |
Notes on making it work: every risk has exactly one named owner (a role, not a person's name, so it survives handover); "controls" are specific actions someone can verify happened, not aspirations ("promote safety culture" is not a control — "first aider rostered every match day" is); and the register lives with your other club documents where the whole committee can see it, not in a personal drive.
Incidents: where your register learns
A risk register written once and never touched is a guess. What makes it true is incident data — every injury, near-miss, equipment failure and complaint, written down while memories are fresh. Incidents tell you which risks are real at your club, which controls are failing, and what belongs on the register that nobody brainstormed.
That only works if reporting is easy. A paper form in a drawer in the canteen produces zero reports; a form every coach and manager can fill in from their phone within minutes of the incident produces a usable record. ClubHelix's incident reporting feature gives clubs exactly that — structured reports submitted from any device, access-controlled so sensitive details stay with the right officers, and a searchable history the committee can review. (For what the form itself should capture, field by field, see our incident report form template.)
Then close the loop, quarterly, in ten minutes at committee: how many incidents this quarter, any patterns (same ground, same age group, same drill?), did any control fail, does the register need a new row or a changed rating? Minute the answers. That little ritual — incidents in, register updated, minuted — is the whole discipline of risk management at club scale, and it's also precisely the trail that insurers, associations and grant assessors increasingly want to see.
The special cases worth their own attention
Some areas of club life carry their own frameworks that plug into your register rather than being reinvented within it. Child safety has the national principles and your sport's safeguarding policies — your register should reference that framework (see our child safe standards guide) with its own controls and owner. Concussion and medical policies come from your sport's national body; adopting and enforcing them is the control. Food handling at the canteen sits under state food regulation — our canteen food safety guide covers it. Insurance is the financial backstop for the risks you can't eliminate; it transfers cost, not responsibility, and most policies expect you to have taken reasonable precautions — which is your register, doing its quiet work.
Frequently asked questions
How often should a club review its risk register?
Do the full working session annually — pre-season is ideal, because controls like first-aid rosters and ground checks need setting up before round one — plus a ten-minute standing review each committee quarter driven by the quarter's incident reports. Re-rate a risk any time an incident shows your likelihood or consequence guess was wrong.
Who should own risk management on the committee?
Give the register a coordinator — commonly the secretary or a dedicated safety officer — but never let one person own all the risks. Each row's owner should be the role closest to the control: the treasurer owns cash risks, the head coach owns training-related risks, the canteen coordinator owns food handling. Risk management fails when it's one person's hobby instead of everyone's checklist.
Does having insurance mean we don't need a risk register?
No — they're complements, not substitutes. Insurance transfers the financial cost of some bad outcomes; it doesn't prevent injuries, doesn't cover everything, and policies generally assume the club takes reasonable care. A working register with sensible controls both reduces the chance you ever claim and demonstrates the diligence insurers and associations expect. See our guide on what insurance clubs actually need.
Do we need risk assessments for individual events too?
For anything materially outside normal club operations — a major tournament, a public fair, a bus trip, anything involving water, heights or big crowds — yes, do a quick event-specific pass using the same matrix: what's different about this event, what could go wrong, what are we doing about it, who owns each control on the day. It's usually a half-page addendum to the main register, not a new document, and venues, councils and insurers frequently ask for exactly this before approving an event. The bonus is reusability: the risk assessment for this year's presentation night is 90% of next year's, so each event you run properly makes the next one cheaper.
What's the difference between a risk assessment and a risk register?
A risk assessment is the activity — identifying risks and scoring their likelihood and consequence, like the matrix session in this guide. The risk register is the living document that activity produces: one row per risk with its rating, controls, owner and review date. You assess once a year (and after significant incidents); the register persists and evolves between assessments.
Make incident reporting so easy it actually happens. ClubHelix's incident reporting captures structured reports from any phone and keeps your committee's review loop honest — explore all features or see pricing.
