EHS Incident Management Software Problems: The 7 That Hide Repeat Causes

Why does the scope become a reporting form instead of a learning system?

Because reporting is what the group asks for. The board wants a rate, the group director needs a monthly number that is not assembled by email, and the brief describes capture, workflow and a dashboard. All three are legitimate and none of them answers the only question that matters, which is what is going to hurt somebody next.

This scope failure is specific to environment, health and safety work because the metric and the purpose diverge. A better reporting pipeline produces a more accurate rate faster, and a more accurate rate prevents nothing. The learning capability lives in coded data, cross site queries and investigation routing, and none of those show well in a demonstration.

Correct it by putting the cause taxonomy and the routing rules into release one alongside capture. Code the task being performed, the equipment class and model, the energy source involved, the failed control and the contributing organisational factors. Route investigations on potential severity and likelihood of recurrence rather than on what actually happened, assessed with a short structured prompt at the moment of reporting. Those two decisions are what let you ask which task and equipment combinations are producing high potential events across multiple sites. A dashboard built on free text will never answer it, however good the dashboard is.

What goes wrong migrating legacy incident history and site trackers?

Every site arrives with its own history: a spreadsheet, a departed coordinator's tracker, paper investigation packs, and in Europe often a works council agreed local record. The instinct is to load it all so the group finally has one history. What that produces is a coded system full of uncoded records, and the first cross site analysis returns a picture dominated by whichever site kept the best spreadsheet.

Two specific hazards. Legacy records frequently contain medical detail inside a general narrative field, which means a bulk load can put diagnosis information in front of line managers on day one, and in Europe that is special category personal data under the General Data Protection Regulation being processed without a basis anyone has considered. And retrospective coding by a central team produces codes that reflect what the report said rather than what happened, which quietly poisons the trend analysis the system exists to provide.

Migrate deliberately. Load closed incidents as reference records, flagged as legacy and excluded from coded analytics. Code retrospectively only where the original investigator is available to confirm, and only for high potential events, which is a manageable set. Screen every free text field for medical content before load, with a redaction pass rather than an assumption. And publish the cut off date in the analytics so nobody presents a five year trend that is really eighteen months of coded data with a long uncoded tail.

Why do HR, learning and insurer integrations break after launch?

An incident record spawns obligations in four directions at once and each integration fails in its own way. The human resources feed breaks on leavers and organisational change, because an action owner who moves department or leaves the company becomes an orphaned obligation and escalation silently stops. The learning management system (LMS) breaks on course code changes, so a training action that should close on completion sits open because the course was renumbered.

Insurer first report of injury feeds break on format, and they break expensively, because late reporting costs money and the failure is often discovered by the carrier rather than by you. Occupational health integrations break on consent, since a provider changes what it will return and the operational record loses the fitness information it was relying on.

Build for all four the same way. Owners are people in your identity system with a manager above them, so a leaver triggers reassignment rather than an orphan, and unowned actions raise an exception to the site lead. Every outbound feed reports delivery and acknowledgement, not just dispatch, with a named person alerted on failure. Course and category mappings live as maintained data with effective dates rather than hard coded values. And keep the insurer feed reconcilable, so you can show what was sent, when, and what came back, for any claim that is later disputed.

What happens when health separation and effectiveness checks are missing?

Two omissions cause most of the trouble. The first is separation of medical information. If diagnosis, treatment detail and fitness restrictions sit in the same record as the operational narrative, the only control available is hiding a tab by role, and that will not satisfy a works council or a data protection officer, nor should it. In Europe health data is special category personal data and the separation has to be demonstrable at field level with an access log.

The second is effectiveness. Corrective actions closed on the strength of somebody typing done are not evidence of anything. The guard fitted in April and quietly removed in May by a fitter who could not do the job with it on is the single most common story in this field, and a closed action in a tracker reports it as prevented.

Cover both structurally. One incident carries several views, with occupational health holding medical detail under its own access control and a record of who read what. Closure requires evidence appropriate to the action type: a photograph of the installed guard, a signed off procedure revision, a training completion record from the learning system. Then schedule a separate effectiveness check weeks later, owned by someone other than the person who closed the action. That check is the mechanism that turns a corrective action into a control, and it is the item most often cut from scope to save money.

Should you build custom or configure what you already own?

Configure if you operate in one country under one regulator across a handful of sites with a common language and a common safety culture, and your integration needs stop at exporting a spreadsheet. VelocityEHS is the most approachable for organisations moving off paper. Intelex and Enablon are broad suites with mature modules. Cority has genuine strength where occupational health is your centre of gravity. Benchmark Gensuite has a wide functional footprint. Buying is right in that situation and building would be an indulgence, particularly if your safety team is two people, because a custom system needs an internal owner you do not have to spare.

The friction appears in predictable places. Recordability logic tends to be centred on United States requirements, with other jurisdictions handled as configuration that local teams work around. Cause taxonomies ship as vendor defaults, so an organisation with a group taxonomy the board already reports against chooses between changing its language and fighting the tool. Deep integration with human resources, learning, occupational health and insurer systems is a services engagement in every case and usually the largest implementation line. And per user licensing collides directly with wanting every employee and contractor to report a hazard from a phone.

Build when two or more apply: three or more recordability regimes, an established group taxonomy, demonstrable occupational health separation as a legal requirement, escalation through your real reporting line, or integrations that already carry most of the value.

How do hidden costs get into the quote?

Jurisdictions drive cost more than sites do, and quotes usually count sites. Each recordability regime is a discrete piece of encoded logic that must be reviewed by someone qualified in that country, so eleven plants in one country is a smaller job than four plants in four. Ask for jurisdiction logic to be priced per country with the legal review named as a separate activity, since your developer cannot sign off on it.

Languages are the second. Frontline reporting only works in the language spoken on the floor, which means translation of interface, guidance, notifications and reference data, plus a process for keeping translations current as the taxonomy evolves. Third is works council consultation in Europe, which is a genuine timeline item and not a formality, and which can change requirements late.

Fourth is contractor access, the part most often designed badly and exactly the population whose near misses you are missing. Reporting has to work without a company account and without a login they do not have, which affects authentication design across the whole system. Fifth is the pilot. Most groups need two sites running for six to eight weeks before wider deployment, and that pilot is where the cause taxonomy earns its final shape, so budget the rework it will produce rather than treating the taxonomy as settled at design.

What separates a build that works from one that fails here?

The builds that work make coding almost invisible to the investigator. The interface proposes the equipment, task and failed control codes from the narrative and from equipment records, and the investigator confirms or corrects rather than classifying from scratch. This is a narrow and legitimate use of a language model: it is not deciding anything, it is removing the reason people leave the fields blank. Coding compliance is what determines whether cross site analysis works at all, and it collapses the moment coding feels like extra work.

They also encode the routing rule that most organisations only write in a procedure. A load that swung off a crane and missed a man by a metre triggers a full team investigation and group escalation. A recordable graze may not. Putting that in software rather than in a document is the single highest return change in this category, and it survives staff turnover in a way a procedure does not.

The failures share a signature: a system that produces a beautiful group rate and no coded data underneath it, usually because the taxonomy was deferred to phase two and the pilot never happened. Guard against it by running the pilot before rollout and by requiring the first cross site query to be demonstrated on real pilot data. Then settle ownership in writing at kickoff, the repository, the infrastructure accounts and the right to hire anyone else, because a system holding injury records and regulatory evidence is the last place for a single supplier dependency.