Event Risk Management Plan: Australian Organiser Guide

Every Australian event carries risk that somebody has to own — and as the organiser, you are the person the council, the insurer and the regulator will look at first. A 40-stall farmers market and a 5,000-person festival differ in scale, not in principle: both need a written event risk management plan that proves the hazards were identified before the gates opened.

It is also the single most requested piece of paperwork in Australian event approvals. Councils ask for it, insurers price on it, and stallholders quietly judge you by it. This guide covers what goes in one, how to score a risk register without a safety degree, the controls that cost nothing, and how to actually run the plan at 2pm when a storm cell arrives and 3,000 people need somewhere to go.

What an Event Risk Management Plan Actually Is

An event risk management plan is a written record of the risks your event creates, how likely each one is, how severe the outcome would be, and what you are doing to reduce it. In practice it is not one document — most Australian councils expect a package of five:

• Risk register — the working list of every hazard, its rating and its controls. This is the heart of the plan.
• Event safety plan — how safety runs operationally: roles, communications, signage, first aid, security and site services.
• Emergency management plan — what happens in a serious incident: who calls 000, where the assembly point is, and how you evacuate or shelter in place.
• Site plan — an accurate map showing stalls, exits, fire equipment, first aid, toilets, generator placement and emergency vehicle access.
• Insurance certificates — your certificate of currency for public liability, plus any extra cover the event needs.

The good news for repeat organisers: these documents are roughly 80% reusable. The register and the site plan get reviewed and adjusted before each event — they should never be rebuilt from scratch, because the hazards at a market do not change nearly as often as the layout does.

The Legal Side, in Plain English

Australia operates under harmonised work health and safety legislation. The core obligation is a duty of care: a person conducting a business or undertaking — the PCBU, which for an event is you — must eliminate risks to health and safety so far as is reasonably practicable, and minimise those that cannot be eliminated.

For an event organiser that translates into three practical obligations:

• Duty of care to everyone on site — not just employees. Stallholders, contractors, volunteers, performers, children and the general public are all in scope. Marquee installers, food trucks, amusement operators and security firms are your contractors, and you must satisfy yourself that they are competent and insured.
• Council event approvals — most local governments require a risk management plan, a site plan and a certificate of currency before they will issue a permit or a temporary use consent. Venue hire agreements, road closures, and temporary food premises permits sit on top of that.
• Insurance conditions — public liability policies carry conditions around risk assessment, contractor vetting and incident reporting. A claim can be reduced or refused where an obvious, known hazard had no documented control.

The rule event safety officers in Australia repeat: if you cannot point to a written control for a hazard you knew about, you did not manage that risk — you got lucky.

The Five-Step Risk Management Process

Risk management is not paperwork for its own sake; it is a loop you run before, during and after the event. The standard Australian approach has five steps.

1. Identify the hazards

Walk the site with fresh eyes, ideally with someone who is not attached to the event. Consider each phase separately — bump-in, event day, bump-out — because the risks are different. Ask your vendors what has gone wrong at their last three events; they will tell you things no template contains. Then review your own incident records, photos, weather history for the same weekend and any near misses, including the ones that were resolved quietly.

2. Assess likelihood and consequence

For each hazard, judge how likely it is to occur and how bad the outcome would be if it did. A power lead across a walkway is likely and, more often than not, minor. A gas cylinder stored beside a deep fryer under a marquee on a 38°C day is unlikely but potentially catastrophic. Both belong on the register, ranked differently.

3. Choose the controls, strongest first

Work down the hierarchy of controls rather than jumping to instructions:

• Eliminate — remove the hazard completely. Cancel the fireworks display on a total fire ban day; do not put a generator in a walkway.
• Substitute — swap the hazard for something safer. Silent generators or battery packs instead of petrol units under canvas.
• Engineering — barriers, bollards, weighted marquee bases, hardstand for vehicles, separate pedestrian and vehicle movement.
• Administrative — briefings, inductions, sign-off checklists, radios, no-glass rules, rosters that prevent fatigue.
• Personal protective equipment — high-visibility vests, gloves, hearing protection, hats and sunscreen for your crew.

PPE is last for a reason. A reflective vest does nothing about a forklift moving through a crowd; separating people from vehicles does.

4. Document and communicate it

A plan nobody has read is a liability with a cover page. Brief stallholders at or before bump-in, induct volunteers on the day, and make sure every contractor knows their own obligations. Keep one printed master copy at the information or first aid point and one digital copy where your team can reach it from a phone.

5. Monitor and review

Conditions change: a gust front approaches, the crowd builds earlier than expected, a stallholder leaves a gas bottle out. Monitor throughout the event, log decisions with times, and hold a short debrief afterwards. That debrief is what makes next year’s register genuinely useful rather than a copy of a template you downloaded in 2023.

How to Score a Risk Register Without a Safety Degree

You do not need software or a certification to rate risk well. Use plain-language scales and apply them consistently:

• Likelihood — Rare, Unlikely, Possible, Likely, Almost certain.
• Consequence — Minor (first aid, no disruption), Moderate (medical treatment, brief closure), Major (serious injury, extended closure), Severe (permanent injury or single fatality), Catastrophic (multiple fatalities).

Multiply the two ratings into a score, then group the result into Low, Medium, High and Extreme. The only decision that matters is the one you make next: anything rated High or Extreme needs a named owner and a control that is already in place before the event opens — not a note to look into it later.

Two worked examples from typical Australian market events:

• Severe heat — likelihood Likely in December, consequence Major (heat stress in the crowd and in food trucks) = High. Controls: shaded rest areas, free water stations, vendor cold-storage checks, a heat trigger plan that shortens trading hours.
• Vehicle movement during bump-in — likelihood Possible, consequence Severe = High. Controls: a signed 6am–9am access window, marshals at entry, hardstand-only parking, no reversing without a spotter.

The Risks That Actually Bite at Australian Events

Severe heat and heat stress

Outside the coastal capitals, summer event days routinely exceed 35°C, and an asphalt car park or a tin-roofed shed runs hotter again. Heat affects three groups differently: crowds (fainting, dehydration), vendors (fryer heat, fatigue, food temperature control) and volunteers (the least acclimatised people on site). Plan for shade, water, rotation, and a threshold at which you shorten or suspend trading.

Storms, lightning and flash flooding

Australian storm cells escalate in minutes. Build in a weather decision chain: who monitors the radar, at what warning level you announce a hold, when you shelter attendees in vehicles or buildings, and when you cancel. Have a documented lightning rule — the widely used 30/30 approach suspends activity when lightning is within 10 kilometres and keeps people sheltered for 30 minutes after the last thunder. Weighted marquee bases and a wet-weather call made the night before prevent the worst of it. Our guide to weather contingency planning for outdoor events covers the operational detail.

Crowd management and crush points

Crush risk is a function of density and flow, not total attendance. The pinch points are predictable: entry gates, the narrow aisle beside the most popular stall, the stage front and the walkway in front of the toilets. Widen entries, remove obstacles from aisles, marshal the two or three known bottlenecks, and set a site capacity you can actually count — then count it, using gate tallies or wristbands.

Food safety and vendor compliance

Food-borne illness is the risk most likely to generate headlines and legal claims. Your exposure is regulatory as much as medical: temporary food premises permits, evidence of compliance, temperature logs and cleanliness at bump-in. Check vendor documentation before the day and inspect on arrival. See food safety compliance for market vendors for the documentation you should be collecting.

Electrical, gas and structural risks

Untested leads, overloaded boards, generators running in enclosed spaces, gas cylinders chained beside open flame and marquees anchored with pegs into dry ground. Require test-and-tag evidence, one certified electrician on call, cylinders secured upright away from ignition sources, and documented marquee ballast weights.

Security, theft and cash handling

Cash-heavy markets are attractive targets — for external theft, and for internal loss. Schedule cash pickups or encourage tap-and-go terminals, keep float amounts low, log any incident, and brief security on egress points and after-dark parking areas.

Lost children, vulnerable attendees and accessibility

Your plan should state how a lost child is reported, who stays with them, and how a public address announcement is made. Include accessibility in the same breath: an accessible toilet, a hard-surface path, a quiet space and reserved parking are basic inclusions that also reduce falls and congestion for everyone.

Bushfire smoke and air quality

Beyond the fire danger rating itself, smoke events can push air quality into hazardous ranges hundreds of kilometres away. Decide in advance at what air-quality reading you cancel outdoor activity, move performances indoors, or hand out masks, and reference your state health authority’s guidance in the plan.

Controls That Cost Nothing

Most of the highest-value risk controls at an Australian community event are free. They are habits, not purchases:

• A radio channel and a shout-out protocol so marshals can reach the coordinator instantly.
• A visual head count at each gate, updated hourly, so you always know roughly how many people are on site.
• Marshals posted at your two or three known bottlenecks during peak hours only.
• Shade sails, water stations and a chair-facing fan in the volunteer rest area.
• A no-glass and no-propane rule for stallholders, briefed in advance.
• A cash drop schedule and a second pair of eyes on every cash count.
• Someone other than the organiser watching the weather radar, so a decision is not made alone.
• A bump-in sign-off sheet where vendors confirm they have read the safety rules — hours saved later when something goes wrong.

Running the Plan on the Day: Incident Management

The plan earns its keep when something goes wrong, and that is where most organisers are weakest. Define these before the event opens:

• Roles — an event controller, a safety officer, a first aid lead and a communications lead with named replacements for each.
• An escalation ladder — what a marshal handles, what gets the controller on the radio immediately, and what triggers a 000 call.
• A single incident log — time, location, who was involved, what was done, who was notified. Written during the event, not reconstructed the next day.
• A record of decisions — the temperature reading that closed a ride, the radar screenshot that triggered a shelter announcement, with the time you acted.
• A 30-minute debrief — before the site is stripped, while the details are still accurate.

Evntle includes incident management built for exactly this: logged incidents with custom form templates, severity, assigned owners and a timestamped record you can hand to a council, an insurer or your committee. Because it sits alongside your vendor applications, stallholder bookings and run sheets, the incident log is already linked to the site, the vendor and the event it happened at — not in a notebook in somebody’s ute.

See incident management in Evntle for the forms and workflow, and bump-in and bump-out for the checklists that bookend the day.

Event Day Compliance Checklist

• Risk register reviewed and signed off, with controls marked as in place.
• Site plan printed and displayed; emergency vehicle access route kept clear.
• Certificates of currency on file for the event and all contractors.
• First aid qualified people, stocked kits, and a clearly signed first aid point.
• Fire extinguishers and fire blankets in every food stall, serviced and accessible.
• Signed access, egress and evacuation signage visible from the main approaches.
• Vendor documents collected — food permits, licences, test-and-tag evidence.
• Weather monitoring assigned, with radar checked hourly and decisions logged.
• Incident log open and accessible, with a nominated owner.
• Accessibility provisions in place: accessible toilets, paths and a quiet space.
• Waste, recycling and litter management scheduled, including mid-event collections.

Common Mistakes Australian Organisers Make

• Reusing a template from a different event. A school fete register does not cover a licensed festival with amusement devices and generators.
• No named owner. A control without a person attached to it does not exist at 6am on event day.
• Skipping the bump-in review. Conditions on the morning of the event are the ones that matter most.
• Treating contractors as someone else’s problem. You still need evidence of their competence and insurance.
• Waiting for the council to ask. Building the plan during the approval process costs far more time than building it first.
• Believing insurance is the plan. Insurance compensates after an incident; risk management stops it happening.
• No post-event review. Without a debrief, every event starts from zero and repeats last year’s near misses.

Where Evntle Fits In

Risk management is a documentation problem as much as a safety one, and that is the part software solves best. Evntle keeps the compliance side of your event in one place: vendor and stallholder applications that capture insurance details and permits at the point of booking, stallholder bookings and site allocations that match your site plan, run sheets your team can read on a phone, incident management with timestamped records, and bump-in and bump-out tracking so nothing is missed at either end of a long day.

You can try the full platform in the live Evntle demo — vendor applications, POS, kitchen display and order board, no signup required — or look at pricing if you are running a regular market or festival calendar.

Frequently Asked Questions

Does every event in Australia need a written risk management plan?

Small private gatherings may not, but any event requiring a council permit, a temporary use consent, a road closure or venue hire agreement will almost certainly need one, and work health and safety duties apply regardless. If you are charging stallholders or selling tickets, assume a written plan is expected.

How long should a risk register be?

Long enough to cover the hazards that could realistically occur at your event, and short enough that your team reads it. For a community market, 15 to 30 hazards across bump-in, event day and bump-out is typical. Padding a register to 200 lines does not reduce risk.

What is the difference between a risk management plan and an emergency management plan?

The risk management plan covers everything: identifying hazards, rating them and putting controls in place. The emergency management plan is the subset that deals with serious incidents — evacuation, shelter-in-place, assembly points, emergency services access and medical response. Most councils want both.

How often should an event risk management plan be reviewed?

Review the register and site plan before every event, update the controls as conditions change during the event, and complete a formal review after each one. If nothing changes for a year, at least confirm that your insurance, contractor list and site layout are still current.

Who is responsible if something goes wrong at my event?

As the organiser you hold the primary duty of care, but obligations extend to stallholders, contractors and service providers for the parts of the site they control. The practical defence in every case is the same: a documented hazard assessment, documented controls, and a record of the decisions you made on the day.

Start before the permit, not after it. Build the register, name the owners, brief the crew, and keep the log — then the plan becomes the reason your event runs smoothly instead of the paperwork you scramble for when it does not.