Risk Management

Near-misses go unreported because there's no easy way to document them. Hazards are mentioned verbally but never formally recorded. By the time something becomes an incident, the opportunity to prevent it has passed. There's no systematic process to identify risks before they happen.

Anyone can report a hazard from mobile or web with photos and location data. Each hazard flows through a structured workflow: reported → assessed → controls identified → actions assigned → verified → closed. Nothing falls through the cracks. High-risk hazards trigger automated notifications to safety category owners. Management sees patterns across all reported hazards.

Drivers report hazards on the spot with photos, location tagging, and categorisation. Takes less than 2 minutes. Submissions sync instantly to the web portal for triage and response.

Encourages reporting of potential risks, not just actual incidents. Demonstrates to auditors that your organisation actively seeks out risks rather than waiting for incidents to occur.

Hazard identification is a core requirement of SMS Standard 2 (Risk Management). Auditors will look for evidence of proactive risk identification, not just reactive incident response.

Different teams use different risk scoring methods. Incidents are assessed one way, hazards another. There's no consistent language for describing risk levels. Management can't compare risks across different safety events. Risk scores change arbitrarily, making it impossible to measure improvement over time.

Every risk assessment uses a standard 5×5 matrix with fixed scoring methodology. Likelihood (1-5) × Severity (1-5) = Risk Score (1-25). Risk scores map to consistent categories: Very Low (1-3), Low (4-6), Medium (7-12), High (13-19), Very High (20-25). Category labels are fully customisable to match your terminology, but the scoring method stays consistent across all assessments and over time.

Fixed scoring methodology means you can track meaningful trends. Compare average risk scores month-over-month. Measure whether controls are reducing risk scores. Demonstrate to auditors that risks are trending down as your SMS matures. Evidence-based proof that your safety program is working.

Risk category determines response requirements. Very High and High risks trigger immediate notifications to safety category owners and escalation contacts. Medium risks require supervisor acknowledgement. All risk assessments feed into the unified risk register for oversight and trending.

Rename risk categories to match your organisation's terminology while maintaining the consistent 1-25 scoring underneath. Whether you call them Critical/High/Medium/Low or Extreme/Significant/Moderate/Minor, the numerical scores remain standardized for comparison and trending.

Incidents cannot move to "Under Review" without a completed risk assessment. Ensures every safety event receives proper risk evaluation before closure.

Risk assessments are buried in different places: incident reports, hazard logs, NCR files, maintenance records. Management has no way to see all high-risk items across the organisation. Trend analysis requires manual compilation from multiple sources. Auditors ask "show me all your high risks" and you're scrambling through different systems.

Every event-based risk assessment — whether it came from a hazard, incident, NCR, or vehicle fault — appears in the risk register. Real-time visibility of all Critical and High risks. Filter to see Medium and Low risks. Sort by date, category, or status. Click any entry to view the full parent item with complete details and history.

Quick view of current risk profile: how many Critical, High, Medium, Low risks are open right now. Trend analysis shows risk distribution over time. Identify recurring risk patterns. Evidence that high risks are being addressed promptly.

Export the entire register or filtered views to CSV. Demonstrate to auditors that you have a complete, systematic view of organisational risks. Show how quickly high risks are closed. Prove risk-based decision making.

Controls are scattered across procedure documents, safety plans, and people's heads. You don't know which controls are actually implemented versus just documented. When incidents occur, you can't easily see if relevant controls existed or if they failed. No systematic way to measure control effectiveness.

Create controls organized by the hierarchy of control types (Elimination, Substitution, Engineering, Administrative, PPE). Tag with safety categories (Fatigue, Maintenance, Mass & Dimension, Safety). Link controls to the policies that mandate them and procedures that implement them. Set the implementation status for each control. Rate effectiveness based on real-world outcomes.

See which controls apply to specific hazards and incidents. When a hazard is identified, search the controls library and link relevant controls. If an incident occurs despite controls being in place, create an action for effectiveness review. Track patterns: if a control appears in multiple incidents, it's not effective.

Controls link to policies (which mandate them) and procedures (which implement them). Creates full evidence chain: Policy → Control → Procedure → Implementation → Effectiveness. Demonstrates to auditors how policy requirements are translated into operational controls. See how our Policies & Procedures Management module supports this.

Set review frequencies (Quarterly, Semi-annually, Annually) for each control. High-risk controls reviewed more frequently. Review process confirms control is still appropriate and effective. Complete history of reviews and updates.

Incidents are reported on paper forms that get lost. Investigations are incomplete or inconsistent. Root causes are never identified. Corrective actions are assigned verbally and forgotten. No way to track if actions are completed. Same incidents keep happening because lessons aren't learned.

Incidents flow through defined stages: Reported → Under Investigation → Under Review → Closed. Each stage has specific requirements and actions. Investigation captures what happened, why it happened, and what controls failed or were missing. Risk assessment determines response priority. Corrective actions are assigned with owners, deadlines, and completion tracking.

Document sequence of events, contributing factors, root causes, and immediate actions taken. Attach photos, witness statements, and supporting evidence. Link to existing hazards that identified this risk previously. Identify which controls were in place and why they failed.

Assign specific, time-bound actions to prevent recurrence. Actions can involve implementing new controls, improving existing controls, or updating procedures. Track completion status with evidence of closure. History shows what actions were taken and when. Corrective actions also support your Chain of Responsibility obligations.

Recurring incident types flag for deeper investigation. Identify systemic issues rather than isolated events. Link multiple incidents to the same control to identify whether that control is effective or needs improvement. Evidence of continuous improvement through incident learning.

Compliance breaches are noticed but not formally documented. Fatigue violations, maintenance non-conformances, and safety breaches go unrecorded. No systematic process to prevent recurrence. Auditors find gaps because violations aren't tracked.

When the EWD system detects a fatigue breach, create an NCR with a single click. Manual NCRs capture other compliance issues (maintenance, mass & dimension, safety procedures). Each NCR documents what was breached, who was responsible, and what caused the non-conformance. Corrective actions prevent recurrence.

One-click creation when drivers breach work/rest hour rules. Captures work hour details, breach type, and regulatory classification. Links to the specific EWD records as evidence. Tracks corrective actions and prevents repeat violations. Learn more about our Non-Conformance Reporting workflows.

Safety-critical NCRs can include risk assessment using the same framework as incidents. Helps prioritize response to high-risk non-conformances. Feeds into the unified risk register alongside hazards and incidents.

Vehicle defects are managed separately from safety systems. Safety-critical faults (brake failures, steering issues) aren't assessed for risk. No connection between maintenance defects and safety management. Auditors see maintenance and safety as disconnected.

Pre-start inspection failures automatically create faults through our Maintenance Management module. Add optional risk assessment to safety-critical defects. High-risk faults trigger immediate notifications and management oversight. Link faults to maintenance controls (preventive maintenance schedules, inspection programs). Measure control effectiveness: if the same fault type keeps recurring, your preventive maintenance control isn't working.

Not all faults require the same urgency. Risk assessment helps prioritize which defects must be addressed immediately versus scheduled for next service. Demonstrates systematic, risk-based approach to vehicle safety.

Every driver completes a daily self-assessment before starting a shift. Configurable questions cover fatigue, health, medication, and fitness factors. The system calculates a fitness score and automatically approves shifts, escalates to supervisors, or blocks unsafe operations based on your configured risk thresholds.

Add optional risk scoring to any custom form — trip acceptance assessments, customer request reviews, site risk profiles, or operational decision logs. Each form calculates a risk score using the same 100-point deduction method, with configurable questions, thresholds, and automated actions tailored to the specific decision.

Auditors won't just ask what you did after an incident. They'll ask what processes you have to identify and manage risks before they materialise. Proactive risk assessment demonstrates that your SMS is genuinely operating and effective — not just reactive.