Five of 11 ‘open risks’ on HSE risk register rated ‘high’ 

The HSE corporate risk register (CRR) for the third quarter of 2025 contained 11 ‘open risks’ and five ‘watched risks’. An internal meeting in November noted that five of the 11 open risks were rated ‘high’.

According to the CRR, open risks rated as having a potential high impact included a HSE-wide cyberattack; a major cost overrun or a “failure to deliver critical infrastructure” projects; and a “sudden and exceptional level of demand for emergency care services”.

The HSE defines open risks as suited to “short-, and medium-term, action”. They are assessed on a quarterly basis with the option for more frequent review if more “dynamic in nature”.

Watched risks are significant risks that may be considered long-term or low frequency occurrences, where the source is often external and over which the HSE may have limited or no control.

Watched risks in the CRR include the emergence of a new pandemic or large-scale outbreak of high-consequence infectious disease from a new or existing pathogen, as well as “acceleration in the rate of climate change”.

The CRR was discussed at the HSE audit and risk committee last November. According to meeting minutes, Mr Joe Ryan, HSE Chief Risk Officer (CRO), presented the document to the committee. The committee noted the 11 open risks and five watched risks. Five of the open risks were rated as high and six as medium.

Members were told that the CRR reflected updates arising from quarterly risk assessments and engagements with relevant senior managers.

A HSE spokesperson said it recognises the “importance of adopting a proactive approach to managing risk” to support the achievement of its objectives and compliance with governance requirements.

“The HSE is committed to ensuring that risk management is seen as everybody’s responsibility and is both embedded in normal day-to-day business and informs the strategic and operational planning and performance cycle.”