Home / Insights / Construction Incident Reporting Systems: What IT Needs to Get Right

Construction Incident Reporting Systems: What IT Needs to Get Right

On many UK construction sites, incidents and near misses are captured on a phone or tablet before anyone gets back to the cabin. Photos, notes and timestamps land in an app or form while the detail is still fresh. That speed helps — but construction incident reporting systems only work when IT underpins whether those records are timely, attributable and usable when the responsible person must decide whether to report under RIDDOR.

This is an IT and process article, not legal advice. RIDDOR duties sit with the dutyholder. Digital tools support capture and evidence; they do not replace judgement or the official submission to the Health and Safety Executive (HSE).

RIDDOR is a duty, not an app feature

Under RIDDOR, only the "responsible person" reports. HSE guidance is clear that this means employers (for their workers), some self-employed people, and those in control of work premises when a reportable event occurs. Injured persons do not report unless they are self-employed with a RIDDOR duty; members of the public and others without RIDDOR duties do not report either.

Timing matters as much as who reports. For deaths, specified injuries to workers, non-fatal accidents to non-workers that require hospital treatment, and dangerous occurrences, HSE expects notification without delay and the report to be received within 10 days. Over-seven-day incapacitation of a worker must be reported within 15 days via the online form. Occupational disease should be reported as soon as the responsible person receives a diagnosis.

Online reporting is the easiest path. HSE's phone line (0345 300 9923) is for fatal accidents or specified injuries to workers. An app that stores a brilliant site record still leaves someone with a duty to make the official report on time. Build systems that get the right evidence to that person fast — and keep an audit trail of what was captured and when.

What good construction incident reporting systems need from IT

Buying software is the easy part. Making it trustworthy on a busy site is where IT earns its keep. Aim for:

• Named accounts, not shared cabin logins. If everyone signs in as "site tablet", you cannot show who raised a report or who edited it. That undermines accountability and investigations.
• Multi-factor authentication (MFA) for accounts that can create, edit or export incident records, especially anything holding personal data about injured people.
• Mobile capture with photos and timestamps, so supervisors can record what they see before memory fades — the same discipline you need for construction site device management.
• Offline-tolerant capture where cabin or tower signal is poor. Records should queue and sync when connectivity returns; pair this with sensible site connectivity planning so sync is reliable, not accidental.
• Role-based access so only the right people see sensitive personal data. A near-miss photo of a scaffold is not the same as medical detail about an injured worker.
• An audit trail of create, edit, assign and close actions, with retention that matches how long your organisation needs evidence for learning, insurance and statutory duties.

Those controls sound obvious until a package ends and a shared password still works, or a report sits in an offline phone for a week. Design for the site you actually run, not the office network you wish you had.

Near misses vs reportable events

Capture both. Internal near-miss reporting is valuable for learning and prevention. That does not mean every near miss is RIDDOR-reportable. Only specified dangerous occurrences (and the other reportable categories HSE defines) go to HSE. Confusing the two either floods the responsible person with noise or leaves reportable events buried in a general "H&S notes" folder.

Route RIDDOR-eligible items to the responsible person quickly, with enough context to decide. HSE's construction examples show how specific the rules are: a scaffold collapse is reportable only if the scaffold is more than 5 metres high from its base; all failures of falsework are reportable even with no injuries; and "construction work" itself is defined in CDM 2015. Your system should help people flag severity and category — not pretend an app checkbox equals a legal determination.

Subcontractors and leavers

Sites are full of people who do not work for the principal contractor. HSE's examples include a self-employed sub-contractor with an over-seven-day injury on site: the person in control of the site reports — often the principal contractor. So your process must be clear about who can raise an internal report, who reviews it, and who holds the RIDDOR duty for that event.

From an IT angle, that means:

• Named accounts for subcontractors who need to raise or view reports for their package — not a permanent shared login taped to a whiteboard
• Clear project and package scoping so access ends when the work ends
• The same joiners, movers and leavers discipline you use for email and drawings: remove access when someone leaves or a package finishes, and avoid orphaned shared accounts that outlive the project

Orphaned access is how old photos, personal data and incomplete drafts stay reachable by people who no longer have a reason to see them.

Incident records and document control

Incident and near-miss records sit alongside other site evidence: permits, inductions, method statements, photographs and correspondence. They need the same basics as wider document control — version sense, access control, retention and a place people can find them months later. That matters on every site where learning and accountability depend on records, not only on higher-risk buildings where the golden thread is a named duty.

If incident files live in three WhatsApp chats, a cabin spreadsheet and someone's Downloads folder, you will struggle when someone asks what was reported, when, and on whose authority.

Takeaway

A practical checklist for construction incident reporting systems:

1. Separate internal capture (including near misses) from RIDDOR submission — the app supports the dutyholder; it does not replace them
2. Use named accounts and MFA; ban shared cabin logins for incident systems
3. Support mobile capture with photos, timestamps and offline sync where sites need it
4. Restrict sensitive personal data with role-based access and keep an audit trail
5. Route likely reportable events to the responsible person within HSE's timing expectations
6. End subcontractor and leaver access when packages finish; no orphaned shared accounts
7. Store incident records with the same document-control discipline as other site evidence

If you want help designing the accounts, MFA, device and access patterns that sit behind your health and safety apps, KPCR's IT consultancy and managed IT services can help. Get in touch for a no-pressure chat.

External references: HSE, Who should report (https://www.hse.gov.uk/riddor/reporting/who-should-report.htm); HSE, When do I report (https://www.hse.gov.uk/riddor/when-do-i-report.htm); HSE, Examples of reportable incidents (https://www.hse.gov.uk/RIDDOR/examples-reportable-incidents.htm); HSE, Construction (Design and Management) Regulations 2015 (https://www.hse.gov.uk/construction/cdm/2015/index.htm).