A Form Somebody Else Owns
Almost every report this product makes is one you designed. You pick the dataset, the columns, the filters; you save it, certify it, schedule it. Part 5 of Victoria's Occupational Health and Safety Act asks for the other kind: a written record of an incident, given to the Authority within forty-eight hours, <em>in the form approved in writing by the Authority</em>. The schema belongs to somebody else, it can change without asking you, and you have to keep your copy for five years and show it to people who do not work for you.
The short version, first
This obligation has three parts and three different shapes. Notification is immediate, on awareness, by whatever means the Authority accepts. The written record follows within forty-eight hours on a form the Authority owns. And the copy has to survive five years and be produced, on request, for an inspector, for the person who was hurt, and for a representative of somebody who died — none of whom is a user of your workspace. We hold the third part well: a vault with a checksum, a classification, a link to whatever record the incident concerns, and an access log with an IP address against every read. What we have no shape for is a form defined outside the product, or an entitlement to inspect held by somebody who has no login.
Which incidents, and two different forty-eight hours
Section 37 sets the scope, and it is a list rather than a standard. The Part applies to an incident resulting in a death; in a person requiring medical treatment within forty-eight hours of exposure to a substance; in a person requiring immediate treatment as a hospital in-patient; or in a person requiring immediate medical treatment for one of eight named things — an amputation of any part of the body, a serious head injury, a serious eye injury, the separation of skin from underlying tissue such as de-gloving or scalping, electric shock, a spinal injury, the loss of a bodily function, or serious lacerations. Plus anything else the regulations prescribe. Section 37(2) extends the Part to incidents exposing a person to serious risk from immediate or imminent exposure to an uncontrolled escape, spillage or leakage of a substance, including dangerous goods — and the subsection carries on past that paragraph.
Two forty-eight-hour periods, measuring different things
This is the easiest mistake to make in the whole Part, so it is worth isolating. The forty-eight hours in section 37(1)(b) is part of the definition of a notifiable incident: a person requiring medical treatment within forty-eight hours of exposure to a substance. It looks backwards, at whether the incident qualifies. The forty-eight hours in section 38(3) is a deadline: the written record must reach the Authority within forty-eight hours of your being required to notify. It looks forwards, at what you owe. Same number, different clocks, and a system that stored one field called "48h" would be storing two things.
Immediately, then a form, then five years
Section 38(1) is framed as an offence rather than as a duty: an employer or self-employed person must not, without reasonable excuse, fail to notify the Authority immediately after becoming aware that an incident has occurred at a workplace under their management and control. There is a carve-out in section 38(2) for the case where the employer or self-employed person is the only person injured, harmed or exposed. Awareness as the anchor for a statutory clock is a shape we have looked at from another jurisdiction in <a href="/blog/two-days-from-when-you-knew">Two Days From When You Knew</a>, and the same observation applies: the day somebody knew is a fact a person has to enter, because no timestamp in any system means it.
Then section 38(3) adds the document, and section 38(4) adds the life of the document: keep a copy for at least five years, and make a copy available for inspection by an inspector, by a person injured in the incident or whose health or safety it affected, by a representative of a person whose death it caused, and by others the section names.
-
Immediately, on awareness
Notification to the Authority. Not on a form, not on a schedule — the moment the organization knows, subject to a reasonable excuse.
-
Within forty-eight hours
A written record of the incident, in the form the Authority has approved in writing. Yours to complete, theirs to define.
-
For at least five years
A copy kept, and kept findable, because the entitlement to inspect it does not expire before the record does.
-
On request, to named people
An inspector, the person who was hurt, a representative of somebody who died, and others the section names. Three of those four are outside your organization.
A report you designed answers a question you asked. A statutory form answers a question somebody else asked, in a shape they can change, and your copy has to still be readable in five years.
What the vault already does well
The retention half of this is the half we are strongest on, and the details are worth naming because they are exactly the ones a five-year statutory record needs. A file in the document vault carries a title and a description, its original filename, its MIME type and extension, its size, and a SHA-256 checksum — so the question "is this the same document we filed" has an arithmetic answer rather than a trusting one. It carries a classification and a status. It carries a JSON tag array. And it carries a polymorphic relation to any record in the product, so an incident record can be attached to the asset, the employee or the ticket the incident concerned rather than sitting in a folder called Incidents.
Every read is logged, with the user and the IP address it came from. Nothing in the retention policies prunes a vault file — the defaults cover logs and job tables, not business documents — so the five years happens by default rather than by configuration. The access log itself is kept for seven hundred and thirty days, which is a shorter window than the record it describes, and that is a deliberate decision worth revisiting if you are exposed to this Part.
The three parts of the obligation, against what exists
| What is required | Held today | On a form we control | Available to an outsider |
|---|---|---|---|
| A dated record of the incident | Yes | Yes | No |
| The record attached to the thing it concerns | Yes | Yes | No |
| Proof the copy has not changed | Yes | Yes | No |
| A log of who read it, and from where | Yes | Yes | No |
| A record kept for five years | Yes | No | No |
| The Authority's own approved form | No | No | No |
| The day the organization became aware | No | No | No |
| An entitlement to inspect, held by a named person | No | No | No |
Built and maintained Configurable by you, not maintained by us Not built
The middle column is the point of the whole post. Everything we do well, we do on a form of our own design — and this obligation is satisfied only on a form of somebody else's. The last column is the other half: three of the four people entitled to inspect the record have no account in your workspace, and vault access is by authenticated user.
One small detail in the vault schema points at the shape of the gap. A file carries an <code>expires_at</code> — the field the document-expiry reminder reads to warn you thirty days before a certificate lapses. That is a <em>valid until</em> date. A statutory record needs the opposite: a <em>keep until</em> date, which is a floor rather than a ceiling, and which should make a file harder to delete rather than easier to notice. The same column cannot mean both, and today only one of the two meanings exists.
Four things, and only one of them is a form
The order matters: the last one is the largest and the first three are worth having whatever your jurisdiction asks for.
A keep-until date on a document
A retention floor beside the existing validity date, so a record under a statutory obligation resists deletion rather than announcing its own expiry.
An awareness date on an incident record
Entered by a person, with a note on how it was learned, and audited on change — because both clocks in this Part run from it and no timestamp means it.
A time-limited, logged link for one document
So a person entitled to inspect a record can be given exactly that record, for a bounded period, with the access written to the same log that already records every internal read.
A form definition you do not own
A field list, validation and layout defined externally, versioned, so a change by an authority is an update to a definition rather than a change to the product.
The first is a column and a rule. The second is a column and an audit entry, and it is the one this Part actually turns on. The third is the interesting one, because it extends a governance model designed for a workspace to somebody with no account — and it should reuse the access log rather than bypass it. The fourth is a proper project and worth scoping only if you file several statutory forms.
Tell us what your operation needsFour questions for a system that will hold a statutory record
Can this document be deleted?
What you will probably hear
Only by an administrator.
How to read it
Ask whether the system knows the document must be kept, as opposed to knowing who is allowed to remove it. A retention floor and a permission are different controls: the first survives a reorganisation of roles, the second does not.
Can you prove this is the copy you filed?
What you will probably hear
It is the same file.
How to read it
Ask for a checksum. Ours stores a SHA-256 against every vault file, which turns that question into a comparison. Without one, the answer rests on nobody having replaced the file, which is exactly what you would be asked to show.
How would an injured worker see their own incident record?
What you will probably hear
We would email them a copy.
How to read it
Workable and unlogged. Ask whether the disclosure can be recorded — who saw what, when, from where — because an entitlement to inspect is a right you will one day need to show you honoured, and an email in a sent folder is a weak record of that.
What happens when the regulator changes the form?
What you will probably hear
We would update the template.
How to read it
Ask whether the old submissions still render on the old version. A form definition that is edited in place rewrites history; one that is versioned lets a five-year-old record be read as it was filed, which is the whole reason you kept it.
What AWRA OpsHub does today
- A document vault with a SHA-256 checksum on every file, so whether a copy is the one that was filed is a comparison rather than an assurance.
- A classification and a status on every document, indexed together, so a governed record is distinguishable from an ordinary attachment.
- A polymorphic link from a document to any record, so an incident record attaches to the asset, employee or request it concerns.
- An access log on every read, carrying the user, the action and the IP address it came from.
- Business documents that nothing prunes, so a five-year retention duty is met by a policy set that covers logs and job tables and leaves documents alone.
- A validity date and a thirty-day reminder, for documents that lapse rather than documents that must be kept.
- A report builder, a certification workflow and scheduled runs, for the reports you design yourself.
More we can add to your workspace
- A keep-until date on a document, as a retention floor beside the validity date, so a record under a statutory duty resists removal.
- A form definition owned outside the product, with its own field list, validation, layout and version history, so an authority's change is a definition update.
- A record of a submission as filed, held against the form version it was filed on, so a five-year-old record reads the way it read then.
- A date the organization became aware, separate from the day a record was created, with a note on how it was learned.
- A time-limited link to one document for one person, logged in the same access trail as internal reads.
- A register of who is entitled to inspect a record, and of every occasion on which that entitlement was honoured.
- An obligation with its own deadline and recipient, so "written record to the Authority within forty-eight hours" is a tracked item rather than a diary note.
Where we point you to a specialist
- We will not tell you whether an incident is notifiable. Section 37 turns on medical judgements — immediate treatment, a serious head injury, the loss of a bodily function — and on a regulation-making power that can add to the list. That is a decision for a safety professional with the clinical facts in front of them, made under time pressure, and no system should present it as a checkbox.
- We will not reproduce a regulator's form from memory or from a summary. Section 38(3) requires the record to be in the form approved in writing by the Authority, which means the current form, obtained from the Authority. If we build form support for you, the field list comes from the published form and carries the date we took it, so a stale version is visible rather than assumed.
- We hold a position on disclosing a record to somebody outside your workspace, and it is that the disclosure should go through the same access log as an internal read. Emailing a copy satisfies the entitlement and leaves you unable to show you honoured it. A quotation from us for this work puts the outsider inside the trail rather than around it.
The fourth item is the one this Part turns on and it is a column, a note field and an audit entry. The first is a column and a rule and it protects everything else on the list. The fifth and sixth belong together and are the genuinely interesting piece of work here, because they extend a governance model built for a workspace to a person entitled to see one record and nothing else. The second and third are a project rather than a field, and they are worth it only if you file more than one statutory form; the seventh is small and would sit alongside whichever of these goes first.
Tell us which of your reports you did not design
A reporting module is usually judged on how well it lets you build what you want. The harder test is what happens when the shape is fixed by somebody else, changes without notice, and has to be reproducible five years later. The companion piece to this one is <a href="/blog/the-year-that-puts-you-in-scope">a return denominated in a unit nobody recorded</a> — the same problem seen from the data side rather than the document side.
Talk to us about your workspace