Risk Assessments

Every excursion is a decision.
We help you make it a defensible one.

Orca's risk assessment framework is built around one principle: that keeping students safe and protecting your school under law are not two separate goals. They are the same goal, documented properly.

The Framework

Built for Australian schools. Built around duty of care.

When a student is hurt on an excursion, insurers and regulators will ask what happened. But the critical question that follows is always: what did you do beforehand to prevent it?

Australian schools operate under a non-delegable duty of care. That duty does not transfer to a venue, a bus company, or a parent volunteer. It stays with the principal. It stays with the school.

Orca's risk assessment is structured to answer that question clearly and completely, before the bus leaves the car park.

Standards alignment

The framework aligns with AS/NZS ISO 31000 (Risk Management) and the ALARP principle (As Low As Reasonably Practicable) used in Australian WHS regulation and enforcement.

It is not enough to identify a hazard. You must be able to demonstrate that risks were assessed, controls were applied, and residual risk was considered acceptable before an activity was authorised. Orca creates that paper trail automatically, every time.

Orca risk assessment list showing status, dates, and templates for an excursion

Risk assessments listed alongside event details, with status tracking and version history.

Orca risk assessment generation showing questions and auto-generated hazards

Template-driven generation: answer context questions and Orca produces a structured risk register.

Templates

Consistency without rigidity

Every school has seen it: a risk assessment for a swimming excursion that still contains rows about parent-teacher interviews, because someone copied the wrong file. Or a brand-new event approved with last year's risk document, unchanged and unreviewed.

Orca's template system eliminates these problems. Schools build their own library of risk templates, drawing from a centralised database of risks that reflect your context, your policies, and your duty-of-care obligations. When a planner creates a new risk assessment, Orca presents the right template based on conditions the school has configured, such as campus, activity type, or year level.

The result is that every risk assessment starts from a consistent, school-approved foundation, while still allowing staff to tailor the document to the specific event in front of them.

Standard and non-standard risks

Schools can mark certain risk rows as standard, meaning they appear on every risk assessment generated from that template. Non-standard rows can be adjusted by staff to suit their specific event. Completely custom rows can also be added for risks unique to a particular excursion.

Conditional sections

Templates support conditional sections driven by pre-defined questions. For example, "Does this activity involve water-based activities?" If the planner answers yes, Orca includes the relevant risk rows automatically. If not, they are omitted. The planner sees only what is relevant to their event.

Guardrails against poor practice

Orca generates each risk assessment fresh from the template. There is no copying and pasting of old documents, no risk of outdated content carrying forward unreviewed. At the same time, the system is not so rigid that it prevents deep tailoring. Risk rows can be duplicated and modified, giving staff the flexibility to address the specific circumstances of their event.

Two-Snapshot Principle

Initial risk and residual risk. Why both matter.

Orca follows best-practice risk assessment standards, capturing likelihood and consequence as separate ratings, both before and after controls are applied. The overall risk rating is then calculated automatically from these, giving you results that are more defensible and consistent.

Initial Risk (before controls)

This is the raw risk: the exposure that would exist if nothing were done to manage it. Scoring it forces honest thinking. A bus trip with no licensed driver, no seatbelts, and no briefing is not a Low risk. Treating it as one produces a document that is unlikely to survive scrutiny.

Residual Risk (after controls)

This is the risk that remains once your controls are applied. It is the rating the approving officer signs off against, the rating an insurer or regulator will scrutinise, and the rating that ultimately determines whether the excursion should proceed.

If the residual risk remains High or Extreme after every reasonable control has been applied, Orca will display a prominent alert, prompting planners to redesign the activity rather than rubber-stamp it.

This two-snapshot structure creates an auditable record of your reasoning. An assessor or regulator can see not just what you decided, but how you got there.

Column by Column

What each column is asking, and why it matters

Risk assessments fail for two reasons: they are too vague to be useful, or they are so complex that teachers skip fields. Orca's column structure is designed to be neither.

Activity / Location

Separating activities (bus travel, pedestrian movement, outdoor lunch, guided tour) forces the assessor to think about each phase separately. A student is far more likely to be hurt crossing a car park than sitting in a museum. The column makes that visible.

Hazard / Description

"Accident" is not a hazard. "Vehicle collision during transit due to sudden braking" is. The more precisely a hazard is named, the more precisely it can be controlled. Vague hazards produce vague controls, which provide neither genuine safety nor legal protection.

Source / Root Cause

What creates the conditions for the hazard? Environmental factors, student behaviour, reliance on a third party, the time of year? Understanding the source connects a hazard to a meaningful control. Drawn from best-practice risk register methodology aligned with ISO 31000.

Who is at Risk

Not all students carry the same exposure. A student with an anaphylaxis action plan faces a categorically different risk at a food venue. This column requires the assessor to identify subgroups, ensuring individual health care plans and emergency protocols are calibrated to the students actually going.

Likelihood & Consequence (Initial)

Both scored 1–5. Multiplied to produce a score from 1 to 25, mapped to risk bands: Low (1–4), Medium (5–9), High (10–16), Extreme (17–25). Scoring separately produces more consistent and defensible ratings than a single holistic judgement.

Existing Controls

Safeguards already in place: school policy requirements, supervision ratios, venue certifications, first aid equipment, and individual health care plans. Listing them gives an honest picture of what protection exists and creates a record that standard obligations were met.

Additional Controls Required

What else needs to happen: specific briefings, modified routes, additional staff positioning, pre-notifications to venues, and communication plans. Every entry becomes an operational instruction for the staff member in charge. Not a wishlist, but a checklist that travels with the excursion.

Person Responsible

A control that belongs to everyone belongs to no one. This column assigns a named role (Excursion Leader, First Aid Officer, All Supervising Staff) to each set of controls. Demonstrates that supervision responsibilities were allocated and documented, not assumed.

Residual Likelihood, Consequence & Risk Rating

Once controls are applied, you re-score. The product of residual likelihood and consequence is the residual risk rating, the most legally significant part of the document. It is the number your principal or delegate signs against when they approve the excursion.

If the residual rating remains High or Extreme, Orca will display a prominent alert — a clear signal to planners that the activity should be redesigned before going ahead. An insurer investigating a claim will look at this column. A court assessing negligence will ask whether the rating was honest. Orca calculates it automatically. The approver's job is to verify it.

Governance

Approval is not a formality. It is acceptance of residual risk.

Orca does not enforce a fixed approval structure. Every school is different, and your governance process should reflect the way your school actually operates. Orca gives you the tools to design workflows that match your structure, whether that involves a single approver or multiple tiers of review running in sequence or in parallel.

Workflows can include any number of steps, with multiple people at each step. They can also change dynamically based on event details such as campus, activity type, or location.

What matters is the outcome. When an approver signs off on a risk assessment, they are making a professional judgement that the residual risk is acceptable and that the proposed controls are adequate. That approval creates the documented governance trail that regulators, insurers, and courts expect to see.

Flexible approval workflows

School-configured steps

Define as many or as few approval steps as your governance structure requires

Sequential or parallel

Multiple approvers per step, running one after another or at the same time

Conditional workflows

Different approval paths depending on campus, activity type, or other event fields

Documented governance

Every approval is timestamped and recorded, creating the audit trail regulators expect

In Practice

From planning to approval to the day itself

The excursion leader completes the risk assessment in Orca. Once submitted, it moves through whatever approval workflow the school has configured. Each approver reviews the document, accepts the residual risk, and signs off before permission forms are sent home.

On the day, the approved risk assessment travels with the excursion. The additional controls column functions as a supervision checklist, and the emergency section provides the nearest hospital address and the school emergency contact. Supporting documents such as health care plans or venue confirmations can be uploaded to the activity record separately.

After the excursion, all activity data is retained. If the same venue is used the following year, the previous activity can be duplicated as a starting point, giving staff a record of what was considered last time and a foundation to build on rather than starting from scratch.

FAQ

Common questions from compliance managers and principals

Does completing this risk assessment guarantee we won't face legal action if something goes wrong?

No document eliminates that possibility. What a thorough, honestly completed risk assessment does is demonstrate that your school exercised its duty of care: that risks were identified, assessed, controlled, and reviewed by the appropriate people before the excursion proceeded. Courts and insurers do not expect schools to prevent every possible harm. They expect schools to take reasonable precautions. This document is the evidence that you did.

Our teachers find risk assessments burdensome. Will this make it worse?

Risk assessments become burdensome when teachers have to build them from scratch or fill in fields that serve no purpose. Orca's template system does the heavy lifting. Your school configures templates with standard risks that ship automatically and conditional sections that appear only when relevant. Teachers answer a few context questions, and Orca generates a structured risk assessment drawn from your school's own risk database. Every column that remains has a specific function: either operational (it tells someone on the day what to do) or evidentiary (it demonstrates that a standard of care was met). For repeat excursions, previous activities can be duplicated as a starting point. Staff review and tailor rather than starting from zero.

We use a state education department template. Do we need to change?

Orca's framework is compatible with and extends the templates used by most state education departments. The addition of the Source / Root Cause column and the two-snapshot residual risk structure provide stronger evidentiary coverage than single-rating templates, particularly in the event of an insurance claim or a WorkSafe investigation, without requiring a wholesale change to how your staff approach excursion planning.

At what risk rating should a principal refuse to approve an excursion?

Orca's guidance is that a residual risk rating of High (10–16) or Extreme (17–25) should not proceed without redesigning the activity or controls. A residual Medium rating (5–9) warrants careful review but is not automatically prohibitive, as context matters. A residual Low rating (1–4) indicates that risks have been reduced to an acceptable level. These thresholds align with the ALARP standard and with the risk appetite frameworks published by most Australian state education departments.

Ready to see the framework in action?

Orca's risk assessment tools are built for the pace of a school term: fast to complete and rigorous enough to stand up. See how it works with your excursion types and year groups.

Get Started

Ready to bring order
to school life?

See how Orca transforms activity management at your school. Book a personalised demo and we'll walk you through exactly how Orca fits your workflows.

What you get with Orca

One centralised platform for every school activity
Configurable approval workflows aligned to your school's policies
Automated digital risk assessments, with PDFs generated from your templates
Complete audit trail and revision history for every event
Community calendar, parent permissions, and messaging built-in
API integration with your Student Information System
Personalised onboarding and ongoing support for your team
Personalised demos available now