New Zealand edition. This guide is written for volunteer-run clubs in New Zealand. Where rules differ — grants, tax, incorporation, safeguarding — follow the New Zealand-specific pointers below or check with your national body.
The room booking form asks for it. So does the grant application. So does the external venue, and so — buried in the affiliation pack nobody read — does the insurance cover you assumed you already had. Somewhere between "let's do a quiz night" and a hundred and twenty people in a function room, a member of your committee has to produce a risk assessment. Usually at 11pm. Usually the night before the deadline. Usually by opening last year's, changing the date and hoping.
That copy-paste version is worse than useless, because it looks like diligence while containing none. A risk assessment is not really a document. It is twenty minutes of your committee sitting down and asking honestly what could go wrong at this event, in this room, with these people — and then writing down the cheap, obvious things that make each of those less likely. The document is the receipt for that conversation, not the conversation itself.
This guide gives you the five-column form your student association will accept, the hazards that genuinely turn up at society events (they are rarely the ones the template lists first), controls that cost nothing, a fully worked example for a 120-person quiz night, and a twenty-minute version you can run every week without anyone resenting it. It is general information rather than legal or safety advice — your student association's own form, policies and safety staff are the authority for your campus.
What a risk assessment is actually for
It does three jobs, and only one of them is paperwork.
It forces the thinking while you can still change something. Two weeks out you can move the start time, cap the numbers, swap home-cooked food for catering or move the speaker so its cable does not cross the doorway. On the night you can do none of that. Almost every genuinely bad society event story ends with "we noticed at the time, but it was too late to do anything".
It tells the people on the door what they are supposed to do. This is the part committees skip. An assessment written by one person, submitted, approved and never read again has protected nobody. The controls only exist if the four people running the event know they are theirs.
It is the key that unlocks everything else. In most systems your affiliation, your venue booking and your cover all hang off having an approved assessment on file. It is not a hoop you jump through after the event is confirmed — it is frequently the thing that confirms it.
What it is not: a shield. Writing "committee will monitor" next to a serious hazard is not a control, it is a sentence. And it is not permanent. An assessment written for a 40-person social in a seminar room does not cover the same social when 140 people RSVP and you move to the big hall. If the numbers, the venue, the timing or the activity changes, the assessment changes with it.
The single best habit: write the risk assessment and the event run sheet in the same sitting. Every "further action" in column five should end up as a line on the run sheet with a name and a time against it. If it cannot, it was never going to happen. Our end-to-end event guide covers the run sheet side in detail.
The five columns every form has
Association forms look different and ask the same five things. Learn the columns rather than the template and you can fill in any version of it.
| Column | What actually goes in it | The mistake committees make |
|---|---|---|
| 1. Hazard | A specific thing that can cause harm: "PA cable running across the main doorway" | Writing "the event" or "alcohol" with no detail |
| 2. Who might be harmed, and how | Members, committee, venue staff, contractors, passers-by — and the injury | Listing only "attendees" and forgetting your own volunteers |
| 3. Controls already in place | Things that are true today, not things you intend | Writing aspirations as if they were arrangements |
| 4. Risk rating with those controls | Likelihood × severity, honestly | Rating everything low so it sails through approval |
| 5. Further action, owner, date | One extra thing, one named person, one deadline | Leaving the owner column blank, which means nobody |
Rate it with a three-by-three grid
Five-by-five matrices are for organisations with a safety officer. A committee of six needs three levels each way, and it needs them defined in words a first-year can apply at speed.
Likelihood — Unlikely (has not happened at an event like this and would need something unusual) · Possible (has happened somewhere on campus in the last couple of years) · Likely (happens at most events of this type).
Severity — Minor (dealt with on the night: a graze, a spill, someone sent home in a taxi) · Serious (hospital, the event stops, a real amount of money lost) · Severe (life-changing injury, or the kind of incident that ends a society).
Multiply and you get three bands. Green: run it as planned. Amber: run it, with the named controls actually in place and a named person accountable for each. Red: do not run this event in this form — change the activity, the venue, the numbers or the time until it is not red.
Use two rating columns: risk before controls and risk after. That second column is the whole point. If a hazard is red before your controls and still red after, you have written a wish rather than a control, and the reviewer will notice before you do.
Your assessment goes to your students' association's clubs coordinator, normally attached to an event or activity approval form rather than submitted on its own. The point most committees miss is that the association's cover applies to approved club activity. The assessment is not paperwork about the event — it is the thing that makes the event covered, and it is frequently a condition of the club grant you were counting on.
Typical lead times run two to three weeks for a standard on-campus social, and longer for anything the association classes as higher risk: tramping and the outdoors, water, heights, vehicles, off-campus venues, or an event where the club itself supplies alcohol rather than using a licensed venue. Many associations publish a short form for routine activity and a longer one that goes to a staff member for review, so build in a week of slack for the round trip of questions that comes back.
Underneath the association sits health and safety at work legislation, which reaches volunteer organisations in defined circumstances — and whether your club counts as a volunteer association or something carrying wider duties changes what applies to you. The workplace safety regulator publishes guidance written specifically for volunteer groups. This is general information; your association's club handbook is the authority for your campus.
The hazards that actually happen at society events
Generic templates open with fire, electricity and manual handling. Real incident logs open with alcohol, getting home, and rooms with more people in them than the fire notice allows. Write for what actually happens.
| Hazard | What it actually looks like | Controls that genuinely work |
|---|---|---|
| Alcohol | Someone arrives already heavily affected after drinking beforehand — the highest-risk person is rarely the one you served | Two named sober committee members; free water on every table; food; a stated rule for turning people away; no unlimited free bar |
| Getting home | 11pm, dark, one person walking alone, no transport running | Finish before transport stops or arrange a shared taxi fund; a buddy rule; the welfare contact's number on the poster |
| Overcrowding | A room rated at 100 with 140 RSVPs, and everybody arrives in the same twenty minutes | Ticket to a hard cap below capacity; count people at the door; a nominated person who owns the number |
| Trips, cables, clutter | The PA lead across the main doorway; boxes stacked in front of the fire exit | Tape every cable; walk the room once before doors open; keep exits clear and photograph them |
| Food | Home-cooked curry sitting warm for four hours; an allergen nobody labelled | Buy catered or shelf-stable food; label everything; collect allergen information at sign-up, not on the night |
| Medical | Fainting, an asthma attack, a seizure, low blood sugar — and nobody knows who has what | A named first aid contact; a kit that has been checked; emergency contacts collected in advance; a quiet room |
| Set-up and pack-down | A 25kg speaker carried down stairs by one person at midnight; someone standing on a chair | Two-person lifts written into the run sheet; a step ladder, never a chair; pack down while people are still sober |
| Behaviour and exclusion | Harassment, a gatecrasher, someone who has to be asked to leave, pressure to drink | A code of conduct on the ticket page; a named welfare contact; a written script for asking someone to leave; venue staff briefed |
| Cash | $600 in a tin on a table by the door at 10pm | Sell tickets online in advance; two people count; nobody walks home holding it |
| Physical taster sessions | Thirty people who have never done the activity trying it in one hour | A qualified instructor; ratios; a briefing; kit checked; a genuine opt-out that is not embarrassing |
| Off-campus venues | Someone else's building, someone else's rules, and no idea where the assembly point is | Visit first; ask for their evacuation plan and capacity in writing; get the duty manager's mobile number |
| Fire and evacuation | Nobody on the committee can name the assembly point | Two committee members walk the exits before doors open; the assembly point goes on the run sheet and in the briefing |
Two patterns are worth naming because they cause a disproportionate share of real incidents. The first is the gap between RSVPs and capacity: free RSVPs convert at roughly 55–70%, so a free list of 140 for a 100-capacity room is fine right up until the week your society is popular and it is not. If capacity genuinely matters, sell a ticket — even at $2 — because paid tickets convert above 90% and give you a hard number.
The second is the last hour. Most of what goes wrong at a society event happens between the last drink and everybody actually being home: the pack-down, the walk to the station, the person who has quietly disappeared. Write controls for that hour specifically, because the templates never do.
Alcohol: the hazard your form is judged on
If your event involves alcohol, the reviewer will read that section first and skim the rest. It is worth writing properly.
The thing to understand is that your controls at the event are only half the picture. A large share of alcohol harm at student events originates before anyone arrives — people drink cheaply at home and turn up already at their limit. That means "we will serve responsibly" is an incomplete control on its own. The controls that actually move the needle are about arrival, atmosphere and exit.
Five rules that hold up anywhere. Never run an unlimited free bar — it converts a social into a drinking competition and no amount of monitoring rescues it. Always provide free water and genuinely appealing non-alcoholic options, positioned as an equal choice rather than an apology; a jug of tap water in the corner is not that. Always provide food, and put it out at the start rather than at the end. Never make drinking the price of belonging — no initiations, no forfeits, no "you have to" games; this is the single fastest way for a society to lose recognition. And name two sober committee members on the form, with their names on the run sheet and their phone numbers on the poster, whose only job is to notice people.
The exit deserves its own line. Decide in advance what happens if someone is too affected to get home safely: who stays with them, who calls whom, where the taxi money comes from, and who tells the association afterwards.
Where the venue holds the licence, host responsibility obligations under the Sale and Supply of Alcohol Act do most of the heavy lifting: a certified duty manager on site, refusal of service to intoxicated patrons, no supply to under-18s, and legally required provision of substantial food, free drinking water and low-alcohol and non-alcoholic options. Your job is to brief the duty manager on what the night is, agree a signal for cutting someone off, and make sure your committee does not undermine them.
Where the society supplies alcohol itself — selling drinks at your own event, or charging admission that includes alcohol — you are almost certainly in special licence territory. Applications go to the local district licensing committee, need to be lodged well ahead (twenty working days is a common minimum), and usually require a certified manager. Many associations simply prohibit clubs from doing this and require you to use a licensed venue instead, which is generally the right answer for a student committee.
Associations almost universally ban initiations and drinking games at club events, with breaches treated as a disciplinary matter for the whole club. This is general information — your association's alcohol policy and the licensing rules are the authorities.
Controls that are worth writing down
A control is only real if it changes something. Work down this order and stop as soon as the hazard is genuinely handled — the cheapest controls are almost always the ones at the top.
- Remove the hazard. Start the event at 6pm so people go home in daylight. Do not put the speaker where its cable crosses the doorway. Do not serve home-cooked food.
- Change the activity. Buy catered food instead of asking members to cook. Hire the equipment with an operator rather than running it yourselves. Book a venue with its own staff.
- Change the physical set-up. Tape the cable, move the tables to widen the exit route, prop the heavy door, bring a step ladder so nobody stands on a chair.
- Rules, roles and briefings. Named people, stated ratios, a fifteen-minute briefing before doors open, a written script for asking someone to leave.
- Equipment. First aid kit, torch, hi-vis for the door team, a charged phone that is not the president's dying one.
The four roles worth naming on every form, no matter how small the event: an event lead who makes the call when something is ambiguous; a welfare contact who is sober, named and whose number is on the poster; a door who owns the number in the room; and a first aid contact who knows where the kit is. On a small event two people can hold four roles, but the roles still get written down, because "someone will deal with it" is how nobody deals with it.
A workable staffing rule for socials is one committee member per 25 attendees, with a floor of three regardless of how small the event is — two is one bad moment away from nobody being in charge. The welfare and inclusion guide covers what the welfare contact's remit actually is, and just as importantly what it is not.
Then brief the team. Fifteen minutes before doors: who holds which role, where the exits and the assembly point are, where the first aid kit is, what the cut-off signal is, what to do if someone is unwell, and who to call. It is the highest-value quarter hour of the whole night.
Waivers, medical information and what a signature does not do
Committees reach for a waiver as if it were a control. It is not. A waiver does not stop anything happening, and it does not remove your duty to take reasonable care — which is exactly why an association reviewer will glance at your waiver and then go straight back to column five.
What a waiver genuinely does is worth having. It tells participants, in writing and before they commit, what the activity involves and what it demands of them. It records that they were told. It is the natural place to collect an emergency contact and any condition your first aid contact would need to know about. And when it is versioned and timestamped, it tells you exactly which wording a given person agreed to — which matters far more than the wording itself.
Collect the minimum and hold it briefly: emergency contact name and number, anything medically relevant to this activity, allergens and dietary needs, and access requirements. Do not collect a full medical history you have no plan for, and do not keep the list after the event — print or download it for the event lead, then delete it. The trips and tours guide goes deeper on this, because a weekend away raises the stakes considerably.
Paper waivers fail in the ways you would expect: unreadable, unsigned, left in a bag, impossible to check at the door, and impossible to find six months later when someone asks. Collecting them digitally as part of the sign-up — versioned, searchable, attached to the member record — takes the whole problem away, and a digital waiver flow means the event lead can see at a glance who has completed one and who has not.
Health details attract extra care under the Privacy Act 2020 and the Health Information Privacy Code: collect only what you need for a stated purpose, tell people at sign-up who will see it, and delete it when the event is over. Your association's and university's own policies sit alongside. In practice: collect the condition, not the history; hand it to the first aid contact for the night; destroy it afterwards.
On the waiver itself, temper your expectations considerably. The accident compensation scheme covers treatment for personal injury on a no-fault basis, which means a waiver aimed at heading off an injury claim is doing much less than committees imagine — your real exposure is regulatory, disciplinary and reputational, and none of those is signed away. Consumer guarantees legislation also limits how far exclusions bite where a service is supplied.
Most associations publish approved participation-agreement wording for affiliated clubs. Use theirs rather than drafting your own: it is already aligned with the cover you are relying on. This is general information rather than legal advice; your association's clubs coordinator can point you to the current version.
A worked example: the 120-person quiz night
A society with 180 members runs a quiz night. Ticketed at $5, capped at 120, in a campus function room with a stated capacity of 140, from 7pm to 11pm. The venue's own bar is open. Prizes are donated. Two committee members are rostered sober, four in total on the roster.
| Hazard | Who / how | Existing controls | Before | Further action (owner, when) | After |
|---|---|---|---|---|---|
| Intoxication; someone unwell | Members — injury, choking, needing hospital | Venue bar staff trained; food included in ticket; free water on tables | Amber | Two named sober committee members on the roster; welfare number on the ticket page and on the door poster (Welfare officer, 5 days before) | Green |
| Getting home after 11pm | Members — assault, road injury | Event finishes while transport still runs | Amber | $60 taxi contingency in the budget; buddy rule announced at last question (Events officer, on the night) | Green |
| Overcrowding at the door | Members, venue staff — crush, blocked exit | Hard ticket cap at 120 against 140 capacity | Green | Door team counts arrivals; late entry closes at 8.30pm (Door lead, on the night) | Green |
| PA cable across the main doorway | Everyone — trip, fracture | None yet | Amber | Reroute behind the stage and tape; walk the room at 6.30pm (Tech, on the night) | Green |
| Allergen in the catered food | Members — anaphylaxis | Caterer supplies an allergen list | Amber | Allergen question added to the ticket form; labels on every platter (Events officer, at set-up) | Green |
| No first aid response | Anyone — delayed treatment | Venue has a first aider on shift until 11pm | Amber | Society kit checked and brought; first aid contact named; venue duty manager's mobile on the run sheet (Secretary, 2 days before) | Green |
| Harassment or unwanted behaviour | Members — harm, exclusion | Code of conduct on the ticket page | Amber | Welfare contact named and visible; script for asking someone to leave briefed to the roster (President, at the 6.45pm briefing) | Green |
| Cash on the door | Committee — theft, loss | Tickets sold online in advance | Green | No cash sales at all; walk-ups directed to the online link (Treasurer, from booking) | Green |
| Pack-down after 11pm | Committee — manual handling injury | Four people rostered to stay | Amber | Two-person lift rule for the PA; nothing carried down stairs alone (Events officer, on the night) | Green |
| Evacuation | Everyone — injury in a real emergency | Venue has a plan | Amber | Two committee members walk the exits at 6.30pm; assembly point stated in the briefing and on the run sheet (Event lead, on the night) | Green |
Ten rows, twenty minutes, nothing invented and nothing exaggerated. Notice how many of the "further actions" cost nothing at all — the expensive one on that sheet is a $60 taxi contingency, and it is the line most likely to matter. If your flagship event is bigger than this, the ticketing guide covers capping numbers against a venue minimum without gambling the society's money.
The twenty-minute version for routine events
You do not write a fresh assessment for every Tuesday meeting. Write one standing assessment for your regular activity — same room, same shape, same numbers — get it approved once, and then run a five-question delta before each specific event:
- Is the venue different? (New room, off campus, outdoors, someone else's building.)
- Are the numbers materially different, or is it near capacity?
- Is alcohol involved, or is it involved differently?
- Is the activity different — anything physical, anything with equipment, anything new?
- Are the people different — under-18s, members of the public, guests from outside the society, anyone with an access or medical need you have been told about?
Five no's means the standing assessment covers it; note the date and move on. Any yes means you write the rows that change, not the whole document again. Most associations will accept exactly this, and many prefer it — a live one-page delta beats a fourteen-page document written once in September. Ask when you submit your standing assessment whether they will run it that way. The room bookings guide covers holding a recurring slot, which is the other half of making regular activity easy.
Sign-off, the night itself, and the debrief
Three practical points close the loop.
Sign-off should be at least two people. The event lead writes the assessment because they know the detail; the president or a nominated safety lead signs it because a second brain catches the thing the first one normalised; your student association approves it because that is what makes it count. Put a version number and a date on it, and if something material changes after approval — the venue moves, the numbers double — resubmit rather than hoping.
On the night, the assessment has to be present. A printed copy in the box with the first aid kit, a digital copy on two phones, and the four named roles briefed. If nobody on the night can tell you what the assessment says, you did the paperwork and skipped the safety.
Afterwards, write down what actually happened — including the near misses, which are free lessons nobody had to get hurt for. The wobbly table, the fire door propped open by a caterer, the person who nearly got left behind. A ten-minute debrief in the next committee meeting, with the notes attached to the event record, is what stops next year's committee rediscovering the same hazard the hard way. Recording incidents and near misses in the society's own system rather than a group chat means they survive the handover and can be quoted back in your next funding application, where "we run 30 events a year and log every incident" reads considerably better than silence. For the club-level version of this loop — an annual register rather than a per-event form — see our risk management guide.
Report anything that caused or nearly caused injury to your association's clubs coordinator within its stated window, commonly 24 to 48 hours, and often a condition of the cover you are relying on. Late notification is one of the more common ways a club discovers a claim will not be paid.
Above that sits a separate legal obligation. Health and safety at work law defines "notifiable events" — a death, a notifiable injury or illness, or a notifiable incident — which must be reported to the regulator as soon as possible, with the site left undisturbed until told otherwise. That duty does not wait for your next committee meeting. Treatment for personal injury is separately covered by the accident compensation scheme, so make sure the injured person actually lodges a claim.
Put the practical numbers on the run sheet before you need them: 111 for emergencies, your campus security number, and the venue duty manager's mobile. Then write the incident up the same night, while people still remember the sequence — memory degrades fast and the details are exactly what will be asked for later. This is general information; your association's incident procedure and the regulator are the authorities.
Frequently asked questions
Do we really need a risk assessment for a pizza night in a seminar room?
You need one on file, but you almost certainly do not need a new one each time. Write a single standing assessment covering your regular activity — the room, the usual numbers, food, the walk home afterwards — get it approved once, and then run the five-question delta before each session to check nothing has changed. A pizza night that suddenly attracts 90 people instead of 25, or moves to someone's flat, has changed enough to need its own rows. The real answer to "is this too small to bother" is that the assessment for a genuinely small event takes about ten minutes, so the question rarely earns the time spent debating it.
How long should a risk assessment actually take?
Twenty minutes for a normal on-campus event, once you have done two or three of them. The reason committees experience it as a weekend of work is that they start with a downloaded template and try to answer every prompt, most of which are written for a construction site. Start with the room and the hour instead: walk through the evening from set-up to pack-down, note the six to ten things that could realistically go wrong, and write one control against each. A big off-campus event, a trip away or anything involving an outside provider is a different job and deserves a couple of hours plus a site visit.
What do we do when a hazard is still high risk after every control we can think of?
You change the event, and that is a legitimate outcome rather than a failure. Move the finish time so nobody walks home at midnight, cap the numbers below the room's capacity, drop the activity that needs an instructor you cannot get, or move to a venue with staff and a licence. If you genuinely cannot get a hazard out of the red band, do not run it in that form and say so plainly on the form — reviewers trust a committee that shows its working far more than one whose every row is conveniently green. Escalate early to your association's staff; they have usually seen the same problem solved on another campus.
Who signs the risk assessment — the president or the whole committee?
At least two people, with the association as the third. The person running the event writes it because they know the detail, the president or a nominated safety lead signs it because a second reader catches what the first one had stopped seeing, and your student association approves it because that approval is usually what activates your cover and confirms your booking. Record all of that against the event rather than in someone's inbox, so next year's committee inherits both the assessment and the evidence it was approved. Our committee roles guide covers who should hold the safety brief on a small committee.
Does our student association's insurance actually cover us?
Usually yes for approved activities, and the word doing the work in that sentence is "approved" — cover typically attaches to activities your association has signed off, which is why the risk assessment is upstream of the event rather than filed after it. Every policy also carries an exclusions list, and student committees discover it at the worst possible moment. Read it once at the start of your term, and ask specifically about anything off campus, anything on or in water, anything at height, anything with a vehicle and anything involving a paid outside provider. This is general information rather than insurance advice — your association's staff can confirm what your society is actually covered for.
Your association almost certainly holds a public liability policy extending to affiliated clubs running approved activities. Understand the shape of it before you assume either that you are exposed or that you are fine: because the accident compensation scheme covers treatment for personal injury on a no-fault basis, liability cover matters most for property damage and non-injury claims rather than for the injured-member scenario committees usually picture.
Ask specifically about the standard exclusion families: aviation, motorsport and vehicles the club is operating itself, water activities, tramping and anything at height, contact sport, and events where the club supplies the alcohol rather than a licensed venue. Most policies also exclude anything the association classifies as high risk unless you have prior written approval — which is exactly what an approved risk assessment provides, and exactly why submitting it late matters more than it feels like it does.
Two habits are worth building. First, any external provider — an instructor, a bus company, a caterer — should give you a certificate of currency before you book, kept with the event record; a provider who cannot produce one within a day is telling you something useful. Second, note the claim notification window, because a late report is among the most common ways a club discovers it was not covered.
This is general information rather than insurance advice — your association's clubs coordinator can confirm the specifics.
Where ClubHelix fits
A risk assessment is only as good as the system around it: the sign-up form that collected the allergen and the emergency contact, the waiver that is versioned and searchable, the attendance number that tells you whether you were near capacity, and the incident log that survives the handover. When those live in four different tools owned by four different graduates, the assessment is an isolated document rather than part of how the society runs.
ClubHelix puts the society's sign-up and event forms, digital waivers and incident and near-miss reporting in the same place as the member register and the event itself — so the event lead can see who has completed a waiver, the welfare contact can pull the emergency contacts, and next year's committee inherits both the paperwork and the lessons. See how it fits together for university clubs and societies, and the pricing page covers the free tier for building the site and trying it out, with taking payments online and being found in search on the paid plans.
Keep the whole event trail in one place: forms and sign-ups, digital waivers and incident reporting that outlives your committee. Start free before your next event deadline.
