Skip to content
SentinelHSE
Hazard reporting & risk register

Every incident was a hazard somebody could have written down.

Report it from the floor in under a minute, rate it severity × likelihood, and let the register put the four that matter above the 38 that do not.

See it on your own dataBook a 20-minute walkthrough

The only record that exists before somebody is hurt.

Everything else in an HSE system is an account of what already happened. An incident, an investigation, a clinic record — each one is the system reporting on its own failure to act on a hazard that was standing there first.

A hazard report is the one entry that can still change the outcome. It is also the easiest one not to file, because nothing has gone wrong yet and the form is back at the desk. So it does not get filed. And eleven months later the investigation finds that three people knew.

The register is not a list of problems. It is the list of things you still have a choice about.
Severity is not risk

Sorting by severity gives you the wrong list

Risk is severity × likelihood, captured as two separate judgements. Collapse them into one and the register hands the manager a list ordered by how bad it could be, rather than by what is going to happen.

Critical×Rare

Emergency generator not load-tested this year

Real, scheduled, and genuinely serious if it fails on the day it is needed. It is also not today’s problem, and treating it like one costs you the attention the row below deserves.

Low· 4
Medium×Almost certain

Offcuts accumulating at the saw station

Nobody would call this serious. Somebody will trip on it this week, and the week after that, until a person lands on a saw table instead of a floor.

High· 10

A register sorted by severity puts the generator first. A register sorted by risk puts the saw station first — and the saw station is the one that will actually hurt somebody.

Severity × likelihood

Scored 1–20, banded on the way in

Illustrative data — not a customer
Risk matrix. Severity down the side, likelihood across the top, each cell showing the risk score and its band.
SeverityRareUnlikelyPossibleLikelyAlmost certain
Critical
4A
8
12
16
20
High
3
6
9
12
15
Medium
2
4
6
8
10B
Low
1
2
3
4
5
  • Low1–5
  • Medium6–9
  • High10–14
  • Extreme15–20
BOffcuts accumulating at the saw station
Medium severity × almost certain = 10, High risk
AEmergency generator not load-tested this year
Critical severity × rare = 4, Low risk
A is Critical severity. B is Medium. B outranks A by more than two to one, because A happens rarely and B happens every week — and B is the one that will actually hurt somebody.

Five of the hazards in the extract below carry Critical severity and none of them reach the Extreme band, because likelihood is doing the work. That is not the matrix being lenient. It is the matrix being the only thing in the building that will say so out loud.

The register

42 hazards, four of them Extreme

A live register from a working month, ranked by risk so the Extremes are on page one without anybody sorting. Filter it by band, status, area, category and owner — or search the text of the controls, not just the titles.

Hazard register

One working month, ranked by risk rather than severity

Illustrative data — not a customer
Risk band
  • Extreme· 16CriticalOpen

    Guard interlock bypassed on the bandsaw

    Area
    Gary — Weld Bay 2
    Likelihood
    Likely
    Owner
    Anthony Russo
  • Extreme· 16CriticalIn review

    Exposed conductor at the weld bay junction box

    Area
    Gary — Weld Bay 2
    Likelihood
    Likely
    Owner
    Anthony Russo
  • Extreme· 15HighClosed

    Unlabelled decanted solvent, maintenance bench

    Area
    Houston — Maintenance Shop
    Likelihood
    Almost certain
    Owner
    James Okonkwo
  • Extreme· 15HighIn review

    Fire door wedged open, store to plant

    Area
    Ridgeline Houston Plant
    Likelihood
    Almost certain
    Owner
    Anthony Russo
  • High· 12CriticalOpen

    Missing edge protection, mezzanine loading gate

    Area
    Houston — Warehouse A
    Likelihood
    Possible
    Owner
    Anthony Russo
  • High· 12CriticalOpen

    Reversing area with no pedestrian separation

    Area
    Houston — Loading Dock 3
    Likelihood
    Possible
    Owner
    Marcus Delgado
  • High· 12HighIn review

    Reversing alarm inaudible at the yard gate

    Area
    Phoenix — Dock Apron
    Likelihood
    Likely
    Owner
    Marcus Delgado
  • High· 10MediumOpen

    Offcuts accumulating at the saw station

    Area
    Gary — Weld Bay 2
    Likelihood
    Almost certain
    Owner
    Tanya Brooks
  • High· 10MediumOpen

    Manual handling at the drum decanting bench

    Area
    Houston — Chemical Yard
    Likelihood
    Almost certain
    Owner
    Tanya Brooks
  • High· 10MediumIn review

    Noise at the press line above the action level

    Area
    Ridgeline Houston Plant
    Likelihood
    Almost certain
    Owner
    Priya Natarajan
  • Medium· 8CriticalClosed

    Sprinkler isolation valve found unlocked

    Area
    Ridgeline Houston Plant
    Likelihood
    Unlikely
    Owner
    Anthony Russo
  • Medium· 8CriticalClosed

    Untrained contractor working near the overhead line

    Area
    Ridgeline Houston Plant
    Likelihood
    Unlikely
    Owner
    Anthony Russo
  • Medium· 6MediumOpen

    Forklift horn intermittent on truck FL-04

    Area
    Houston — Warehouse A
    Likelihood
    Possible
    Owner
    James Okonkwo
  • Low· 5LowIn review

    Cardboard build-up at the recycling point

    Area
    Houston — Warehouse A
    Likelihood
    Almost certain
    Owner
    Robert Pierce
  • Low· 4CriticalIn review

    Emergency generator not load-tested this year

    Area
    Ridgeline Corporate Office
    Likelihood
    Rare
    Owner
    James Okonkwo
  • Low· 2LowClosed

    Chair with a seized gas lift, meeting room

    Area
    Ridgeline Corporate Office
    Likelihood
    Unlikely
    Owner
    Karen Liu

Showing 16 of 16 rows — sixteen of 42 hazards in the period. Read the last three rows: two carry Critical severity and both rank below a housekeeping issue graded Low, because likelihood is doing the work.

13

Open

14

In review

13

Closed

2

Approved

Four states, not three. Closing a hazard is a claim somebody makes; Approved is the signature on it, and only the sign-off workflow can set it — including for an administrator, who cannot sign on somebody else’s behalf.

If everything on it is serious, people have stopped reporting the rest.

A register of nothing but Highs and Extremes is not a well-run site. It is a site where only the undeniable gets written down — where somebody decided, correctly, that a torn mat is not worth the trouble of the form.

Torn matting, a cable across a corridor, cardboard past the line. Individually trivial; collectively the proof that reporting is normal behaviour rather than an escalation. Watch the Low count. When it goes to zero, the channel has closed — and the next thing you hear about will not be a hazard.

The three Low-band rows in this month

  • Low· 5Cardboard build-up at the recycling pointHouston — Warehouse A
  • Low· 4Emergency generator not load-tested this yearRidgeline Corporate Office
  • Low· 2Chair with a seized gas lift, meeting roomRidgeline Corporate Office

A seized gas lift on a meeting-room chair is on the register of an operator that also has an Extreme open on a bandsaw. Nobody confused the two. The point is that both got written down by somebody who expected it to be worth doing.

What actually closes it

Two different questions, two different fields

Most systems give you one box and get the first answer. The second is the one the auditor is asking about, and the third is the one that decides how hard anybody works on the second.

Hazard #41 · Electrical · Ridgeline Houston Plant · 11 Jul 2026

Description

A landscaping contractor was operating a tipper with the body raised within the exclusion zone of the 11 kV overhead line.

What is actually there, written where it is standing.

Potential consequences

Contact with an overhead line — fatality.

What this would have caused. The field that decides how hard anybody works on the last one.

Immediate action

Work stopped; contractor removed from site pending re-induction.

What was done on the spot. Necessary, and not the same as a control.

Corrective action

Goalposts and ground markings installed; overhead services added to the contractor induction.

What stops it recurring. This one becomes a dated, owned row on the CAPA board.

A hazard on the phone showing description, potential consequences, immediate action and corrective action as four separate fields, with photo attachment buttons underneath

The corrective action does not live on the hazard

It becomes a row on the same tracker that incidents, inspections, near misses and failed equipment checks feed — with an owner, a date and automatic chasing. Hazard #38, the open Extreme at the top of the register, reads like this:

Potential consequences
Contact with the blade — amputation.
Immediate action
Machine locked out and the cable tie removed.
Corrective action
Interlock replaced with a tamper-resistant type; management-of-change raised on all guard modifications.

Only the third one is a control, and it is a control because somebody fitted a different interlock — not because it was typed into a box. It is on the corrective-actions board with its hazard as its source, which is where it gets chased from.

The hierarchy of controls runs elimination, substitution, engineering, administrative, then PPE — and every one of those is something people do to a workplace. This platform records which one was chosen and evidences that it happened. It is not itself a control, and any vendor telling you otherwise is selling you a filing cabinet as a machine guard.

Your scale, not ours

Rename the levels and the matrix follows

Severity is configured in Settings — key, label, colour and order. Every surface reads that configuration rather than a constant compiled into the product.

The new hazard form on a phone: immediate action and corrective action fields, a severity picker with Low, Medium, High and Critical, and camera and gallery buttons

The demo runs 4 severity levels and 5 likelihood levels, which is where the 20-point scale comes from. A site that runs five severity levels, or calls the top one Catastrophic, or reports in Spanish, does not get a different product — it gets its own vocabulary.

  • The matrix redraws to the new dimensions, and the band edges move with it.
  • The register colours, the phone pickers and the filter options all follow.
  • The per-hazard PDF draws the configured matrix and marks that hazard’s cell.
  • Exports carry your labels, so a spreadsheet handed to an auditor reads in your language.

One thing does not move: the score is computed the same way on the phone, on the server and on the dashboard. Two people rating the same hazard cannot land in different cells.

The life of one hazard

Seen, to evidenced

Eight steps. The platform has no part in the first one, which is the only reason the other seven are worth anything.

  1. 01

    Seen

    On the floor, by somebody who was not looking for it. This is the only step the platform has no part in, and it is the one the whole register depends on.

  2. 02

    Reported

    From a phone, in front of the thing, in under a minute. A photo attaches at the point of reporting rather than being emailed in later.

  3. 03

    Rated

    Severity and likelihood picked as two separate judgements. The score and the band are computed — identically on the phone, the server and the dashboard.

  4. 04

    Assigned

    A named responsible person, notified that it has landed on them. Reassign it and the new owner is notified too.

  5. 05

    Made safe

    The immediate action is recorded as its own field. What was done on the spot is a different question from what stops it recurring.

  6. 06

    Controlled

    The corrective action becomes an owned, dated item in the same tracker every other module feeds, chased automatically when it runs late.

  7. 07

    Reviewed

    Open to In review to Closed, and Approved where a closure needs authorising. Closing is a claim; the sign-off is the check on it.

  8. 08

    Evidenced

    Every field change attributed on site time, a per-hazard PDF with the matrix drawn and its cell marked, and the filtered register exportable.

The hazard list on a phone showing 42 records with open and closed counts, a search field and a filter control
The register, grouped by what still needs doing
The new hazard form on a phone: a name field, an open status chip, category, location, department, date, observer, likelihood and responsible pickers, and description and consequence fields
Reporting it, in front of the thing
A hazard on the phone showing its title, closed status, critical severity, category, location, department, date, observer, likelihood and responsible person
Both judgements, on the record
The edit hazard sheet on a phone, with every field as a chip that can be changed and a save changes button
Reassign it and the new owner is told

Screenshots from a working build. Illustrative records — not a customer.

Compliance map

What an auditor asks, and what you hand them

Clause by clause, the record this module produces — not a claim that it makes you compliant.

  • 6.1.2

    Hazard identification & risk assessment

    What the register hands over

    The register itself, and a risk rating on every row of it

  • 8.1.2

    Hierarchy of controls

    What the register hands over

    Immediate and corrective actions recorded against the hazard, ranked against the hierarchy

  • 8.1.3

    Management of change

    What the register hands over

    A guard modification raises management-of-change rather than closing quietly

  • 5.4

    Consultation & participation of workers

    What the register hands over

    Anybody on site can file one from a phone, in front of the thing

  • 7.4

    Communication

    What the register hands over

    The responsible person notified on assignment, and again on reassignment

  • 7.5

    Documented information

    What the register hands over

    Every hazard retained, attributed field by field, and exportable

  • 9.1

    Monitoring, measurement & analysis

    What the register hands over

    Hazard reporting rate carried as a leading indicator, not a lagging one

  • 10.2

    Incident, nonconformity & corrective action

    What the register hands over

    Hazard to corrective action to closure, on one chain

  • OSH Act §5(a)(1)

    The general duty clause — recognised hazards

    What the register hands over

    Documented identification of a recognised hazard, the control chosen against it, and the date it was verified

Sentinel supports evidencing these requirements. Certification is an audit of your organisation, not of software — no product can be bought to pass one.

Objections

The seven things you are already thinking

Then answer this without leaving your desk: how many Extremes are open right now, and who owns each one? The book is a fine place to write a hazard down. It is a bad place to ask a question of, and it cannot chase anybody. In the illustrative month on this page 4 of 42 hazards are Extreme, and the register puts all 4 on the first screen without anybody sorting them.

They do not fill one in. They pick one word from a list of 4 and one from a list of 5, in front of the thing they are looking at. The multiplication, the score out of 20 and the band are computed — the same way on the phone, the server and the dashboard, so two people rating the same hazard cannot land in different cells.

The person standing in front of it, and their first judgement is revisable at review. That trade is deliberate: an estimate written at the point of reporting is worth more than a better estimate that never gets written because it needed a meeting. The point is that it is recorded and attributable, not that it is right first time.

Then configure the scale — key, label, colour and order, in Settings. Every surface reads that configuration: the matrix, the register colours, the phone pickers, the exports and the PDF. Sites that report in a second language or run a different number of levels do not get a different product, they get their own vocabulary.

That is the finding, and it is the earliest warning this platform gives you. A register with no Low-band rows is not a well-run site — it is a site where only the undeniable gets written down. In the month on this page 3 hazards are Low band, including a chair with a seized gas lift. When that number goes to zero, the channel has closed and the next thing you hear about will be an incident.

No. It ranks, it chases and it records; it does not control anything. The hierarchy of controls runs elimination, substitution, engineering, administrative, then PPE, and every one of those is something people do to a workplace. What the platform can do is make sure the control somebody chose has an owner, a date and evidence attached to it.

Yes, including on your own infrastructure. Permissions are granular — view, create, update and delete — and every field change is attributed in the audit trail on site time.

See it on your own data.

Send us last quarter’s hazard log — a spreadsheet, or photographs of the book in the guard hut. We will load it, rate it, and show you which of your hazards outrank the ones you have been working on.

Book a walkthroughWhat it costs you today

Forty-five minutes, your scenarios, no slides.