Skip to content
SentinelHSE
Corrective actions

Every finding becomes an action with a name and a date on it.

One tracker for every module, an owner on every line, chasing that happens whether or not anybody remembers — and an effectiveness review that asks whether closing it actually worked.

See it on your own dataBook a 20-minute walkthrough

The second incident is almost always the first one's action.

Investigations are not usually where sites fail. The findings are typically right, and the people writing them know their plant. What fails is the fortnight afterwards: the action goes into a spreadsheet with a name that means three people, a date nobody agreed to, and no way to tell today which of them are late.

Ask an HSE Manager how many actions are open across their sites right now. If the answer takes more than a few seconds, that is the whole problem — and it is why the same finding comes back.

Nobody is careless. They are remembering forty dates on top of an actual job.
The mechanism

Owner. Date. Chase. Check.

Four things, and only the fourth is unusual. Most trackers stop at the first two, and a tracker that stops at the first two is a list.

Owner

A person, not a department. “Maintenance” is three people on a good week and nobody on a bad one, and it is the single most common reason an action sits untouched for a month.

Date

Agreed at the point the action is raised, not backfilled when somebody asks. An action raised against an incident arrives with an estimate already on it, inherited from that incident’s SLA.

Chase

The assignee is notified when it lands on them or moves; managers are notified when one is created and on every status change. Overdue is on the screen, not in somebody’s memory.

Check

Closing is a claim. The effectiveness review is where the claim gets tested, and the sign-off is what happens after somebody has been and looked.

A live action and the form that raises one, every control on both. Hover a card to light that control on the screen, or hover the screenshots themselves to magnify them and click to open one full size.

A corrective action on a phone: the action text, an Open status with a dropdown, the assigned person, the due date, an effectiveness percentage, and camera and gallery buttons for attaching evidence

A live action

The new action form on a phone: a description field, an owner chip, a date chip, a due-in-thirty-days strip, an Open, In progress or Closed status control, an effectiveness slider labelled how well this action prevents recurrence, a module picker with a reference ID, and a create button

Raising one

Screenshots from a working build. Illustrative records — not a customer.

The board

49 actions, seven sources, one list

A live board from a working month, filterable by status, source, owner and overdue — with counters that follow the filter rather than the whole site.

Corrective actions

One working month, every line with a name and a date on it

Illustrative data — not a customer
Shown
21
Open
9
In progress
6
Finished
6
Status
  • 24
    Open8d overdue

    Repair or replace the caustic transfer pump and raise a standing work order whenever it fails

    Source
    Incident#12
    Owner
    James Okonkwo
    Due
    Effectiveness
    —
  • 53
    Open6d overdue

    Re-mark the pedestrian walkway through the yard

    Source
    Near missNM-26
    Owner
    Robert Pierce
    Due
    Effectiveness
    —
  • 47
    Open5d overdue

    Post the key-exchange rule at every dock in English and Spanish

    Source
    Incident#18
    Owner
    Robert Pierce
    Due
    Effectiveness
    —
  • 20
    Open2d overdue

    Restore and function-test the guard interlock on the deburring wheel

    Source
    Incident#10
    Owner
    James Okonkwo
    Due
    Effectiveness
    —
  • 58
    In progress

    Verify contractor certification before any permit is issued to a third party

    Source
    Inspection#9
    Owner
    Karen Liu
    Due
    Effectiveness
    —
  • 61
    In progress

    Fit a tamper-resistant interlock to the bandsaw and raise management-of-change on all guard modifications

    Source
    Hazard#38
    Owner
    Anthony Russo
    Due
    Effectiveness
    —
  • 22
    In progress

    Isolate and re-cover the junction box beside weld bay 2, then re-inspect the bay

    Source
    Inspection#4
    Owner
    James Okonkwo
    Due
    Effectiveness
    —
  • 60
    Open

    Service FE-GAR-002 — Paint Booth clean agent unitRaised automatically

    Source
    Fire extinguisherFE-GAR-002
    Owner
    Victor Ramos
    Due
    Effectiveness
    —
  • 46
    In progress

    Induct the evening carrier’s drivers to the key-exchange procedure

    Source
    Incident#18
    Owner
    Robert Pierce
    Due
    Effectiveness
    —
  • 17
    Open

    Recharge or replace FE-HOU-003 — Maintenance Shop CO₂ unitRaised automatically

    Source
    Fire extinguisherFE-HOU-003
    Owner
    James Okonkwo
    Due
    Effectiveness
    —
  • 19
    In progress

    Re-run the JHA for the relocated deburring cell with the operators who work it

    Source
    Incident#10
    Owner
    Tanya Brooks
    Due
    Effectiveness
    —
  • 18
    Open

    Restock burn gel and nitrile gloves — Paint BoothRaised automatically

    Source
    First aidFA-GAR-02
    Owner
    Victor Ramos
    Due
    Effectiveness
    —
  • 28
    In progress

    Re-brief the work-at-height procedure to the maintenance crew and log attendance

    Source
    Incident#13
    Owner
    Derek Coleman
    Due
    Effectiveness
    —
  • 21
    Open

    Assign a named owner to the deburring cell’s daily pre-use check

    Source
    Incident#10
    Owner
    Marcus Delgado
    Due
    Effectiveness
    —
  • 45
    Open

    Fit wheel restraints with a dock-door interlock to dock 3

    Source
    Incident#18
    Owner
    Marcus Delgado
    Due
    Effectiveness
    —
  • 42
    Approved

    Restore the two-hand control on press 4 and audit the other three presses

    Source
    Incident#19
    Owner
    James Okonkwo
    Due
    Effectiveness
    100%
  • 41
    Approved

    Require the fire watch to remain 30 minutes after hot work ends

    Source
    Incident#20
    Owner
    Derek Coleman
    Due
    Effectiveness
    90%
  • 36
    Approved

    Add a quarterly spill-kit and drain-cover verification to the yard round

    Source
    Incident#15
    Owner
    Emily Carver
    Due
    Effectiveness
    90%
  • 48
    Approved

    Require continuous ventilation for entries into sludge-bearing spaces

    Source
    Incident#17
    Owner
    Angela Reyes
    Due
    Effectiveness
    95%
  • 62
    Closed

    Install goalposts and ground markings under the overhead line, and add overhead services to the contractor induction

    Source
    Hazard#41
    Owner
    Anthony Russo
    Due
    Effectiveness
    90%
  • 30
    Closed

    Add “tower must not be moved while occupied” to the scaffold pre-use tag

    Source
    Incident#13
    Owner
    Victor Ramos
    Due
    Effectiveness
    75%

21 of 49 actions in the month — 19 open, 8 in progress, 18 closed and four signed off. Five are overdue as at 09 Aug 2026, four of them in the rows above. Action 58 is due today and is not among them — under the site's own timezone it is not late until midnight.

CSV exports the filtered set

The same board, in the supervisor's hand

Grouped by state, searchable, and closable from where the work is. If the list is not short, clear and theirs, nothing moves — so the phone shows the actions assigned to the person holding it, not the site's whole backlog.

The phone groups 19 open, 8 in progress and 18 closed — 45 of the 49 in the counter above them. The other four are signed off, and sign-off is not a stage a handset has.

The action list on a phone: a counter strip showing nineteen open, eighteen closed and forty-nine total, a search field, and the records grouped into open, in progress and closed
One queue

Seven sources, one tracker

An incident, a near miss, a failed inspection, a hazard, a risk assessment, an expired extinguisher — each produces corrective actions, and each action keeps a link back to the record that produced it.

  • Incident3367%
  • Near miss510%
  • Fire extinguisher36%
  • First aid36%
  • Inspection24%
  • Hazard24%
  • Risk assessment12%

43 somebody raised — from an incident, an investigation, a near miss, an inspection, a hazard or a risk assessment, each keeping a link back to the record it came from.

six nobody typed — one for every extinguisher and first-aid box currently failing its check, raised against the named custodian with a due date. The equipment chases itself.

Illustrative month. The extinguisher and first-aid counts are read from those registers — one action for every unit currently failing its check.

The module picker on a phone, listing incident, inspection, near miss, hazard, risk assessment and other, with incident selected

6 choices when a person raises one by hand — and a reference field for the record number, so the action points back at something.

Six of these nobody typed. An extinguisher that fails its monthly check, or a first-aid box that passes its date, raises its own action against the named custodian with a due date and notifies managers. Nobody has to notice first — which matters, because the whole failure mode of equipment checks is that nobody does. See it happen on fire extinguishers and first aid readiness.

Closed is not the same as fixed

Closing is a claim. The review is where it gets tested.

This is the single most credible thing on the page, and the one most trackers do not have: a stage after Closed, at which somebody has been and looked.

Action 42

Press 4, two-hand control

Incident #19 · investigation 9 · due Jun 26

The investigation into a pinch injury found the two-hand control had been re-wired to a single palm button during a 2025 repair, outside management of change.

  1. Closed

    Closing it in June was one person’s word, recorded as one, with their name against it.

  2. Approved

    The effectiveness review verified the control on the machine, scored it 100%, and it was signed off by the HSE Manager and then the VP HSE. Only then did it reach Approved.

100%

Action 42 — the control verified on the machine and the other three presses audited.

75%

Action 30 — add “tower must not be moved while occupied” to the scaffold pre-use tag. Closed, and scored honestly.

The action beside it — a warning added to the scaffold pre-use tag — closed too, and scored 75%. That number is the useful one: the control is in place but weak, and it stays visible. Across the whole board, 21 of the 22 finished actions carry a score, averaging 92%. Two are below 80. Those two are where the next incident lives.

Capacity

Work with a date is still work with no time

A due date says when something should be finished. It says nothing about whether the person who owns it has an hour that week — and that gap is where actions go late.

People lanes, grouped by department

One row per person rather than one row per action. A supervisor with eleven open actions looks like a supervisor with eleven open actions.

Scheduled hours against planned hours

Bars across the window show what is booked. The gap between what a week is estimated at and what is actually in it is the number worth arguing about.

A “to plan” backlog

Everything with a date but no slot, with the hours still to place. Work with a due date and no time against it is the work that goes late.

Estimates that arrive with the action

An action raised against an incident inherits half that incident’s SLA for its category and severity, so the backlog has real hours in it from the first minute rather than after a planning meeting.

Auto-planned on create

It lands on the owner’s lane without a planner touching it. Somebody can move it; nobody has to.

Finished work leaves

Closed and approved actions drop out of the backlog, so the queue is what is left rather than everything that ever existed.

The planboard is the answer to the question a Plant Director actually asks, which is not “how many are open” but “is there anybody with time to do them”.

Chasing

Overdue means overdue here, not overdue in UTC

A small thing that tells you whether anyone building the product has run a site across three timezones.

Overdue means overdue here

Computed in the site’s configured timezone. An action due today is due today until midnight local — not from 19:00 the evening before because a server is on UTC.

Only unfinished work is chased

A signed-off action is never late. Approved is a finished stage, not an old one, and a tracker that chases finished work is a tracker people stop reading.

One number, three places

The count on the banner, the rows tinted red and the overdue filter are the same number. You can click it and count the rows.

On the board above, as at 09 Aug 2026

Action 58In progressdue Aug 09

Verify contractor certification before any permit is issued to a third party — due today, and not tinted red, because it is not late yet. It becomes overdue at midnight at that site, not at 19:00 the evening before because a server is on UTC. Chase somebody a day early enough times and they stop reading the chase.

The chain

From a finding to a signature

Ten steps, of which a person does five. The other five happen whether anybody remembers them or not — which is the entire argument for a tracker over a spreadsheet.

  1. 1

    Raised

    From a finding on any module — or by the platform itself, when a unit fails its check and nobody has to notice.

  2. 2

    Owned

    A named person, and they are notified that it has landed on them. Reassign it and the new owner is notified too.

  3. 3

    Dated and estimated

    A due date agreed at the point it is raised, and a planned duration inherited from the parent record’s SLA.

  4. 4

    Planned

    Onto that person’s lane on the resource planboard, automatically, at the moment it is created.

  5. 5

    Worked

    Status moves to In progress from the row or from a phone — one tap, no modal. Managers see the change.

  6. 6

    Evidenced

    Photographs attach to the action itself and are viewable from the row. A photograph of the fitted guard is a record; “done” is not.

  7. 7

    Closed

    A claim, recorded as one, with who made it and when. Nothing about closing it makes it true.

  8. 8

    Reviewed

    Effectiveness scored 0–100% — the product’s own wording is “how well this action prevents recurrence”, which is the right question.

  9. 9

    Signed off

    Two named signers on the approval workflow. Only then does it reach Approved, and the API refuses an attempt to set that on the record.

  10. 10

    Retained

    Exportable as CSV with its filters applied, auditable field by field, every change attributed.

Oversight

Open actions are unclosed risk, and they are countable

Three numbers a VP HSE can read off this board in a morning, none of which a folder of spreadsheets will produce before the meeting.

5

Overdue, as at 09 Aug 2026

Per site, per owner, filter-aware, and clickable — the banner, the red rows and the overdue filter are the same number, so you can check it by counting.

Red appears nowhere else on this board. That is deliberate: a colour that means four things means nothing.

92%

Average effectiveness

Across 21 scored actions. A closure rate tells you how busy the team was; this tells you whether the controls they put in are holding.

Actions closed on time — The percentage that did not run late — comes off the same board, and it is a leading indicator rather than a body count.

OpenIn progressClosedApproved

Four stages, live

The board updates when a colleague closes something — with a toast, rather than a silent redraw that moves the row you were reading. Pagination is server-side, because a real board reaches thousands of rows.

Every field change is attributed in the audit trail, and view, create, update and delete are separate permissions from who may sign an approval.

Evidence

What an auditor actually asks for

10.2 is the clause this module exists for, and the only one on the list that asks for an effectiveness evaluation by name.

  • ISO 45001:201810.2

    Incident, nonconformity & corrective action

    Where the evidence comes from

    The whole life of an action, including the effectiveness evaluation the clause explicitly requires

  • ISO 45001:20188.1.2

    Hierarchy of controls

    Where the evidence comes from

    What the action actually changed, recorded against the hierarchy of controls

  • ISO 45001:20188.1.3

    Management of change

    Where the evidence comes from

    Two-signature sign-off before a control change is accepted as effective

  • ISO 45001:20187.4

    Communication

    Where the evidence comes from

    The assignee notified on assignment and reassignment; managers on creation and every status change

  • ISO 45001:20189.1

    Monitoring, measurement & analysis

    Where the evidence comes from

    Overdue count, closure rate and effectiveness scores over time, per site — leading indicators, not a year-end tally

  • ISO 45001:20187.5

    Documented information

    Where the evidence comes from

    Every action retained with its evidence, its audit trail and its signatures

  • OSHA 29 CFR1904

    Recording and reporting occupational injuries

    Where the evidence comes from

    Abatement and follow-up evidenced against the recorded case that required it, on the same record

  • OSHA 29 CFR1910

    General industry standards

    Where the evidence comes from

    The corrective action that closed a finding, with the photograph taken when the control went in

SentinelHSE supports evidencing these requirements. Certification is an audit of your organisation, not of software — any vendor who tells you their product makes you compliant is selling you a problem.

See all twelve ISO clauses in the full map
Objections

The eight things you are already thinking

Answered the way we would answer them in the room, including the one where the honest answer is “nothing stops it”.

Then answer this without opening it: how many are overdue right now, and who owns the oldest one? A spreadsheet holds the list perfectly well. What it cannot do is chase, and chasing is the part that is not being done — not because anyone is careless, but because it is somebody remembering forty dates on top of their actual job.

They update one line from a phone: a status pill, or a photograph of the guard they just fitted. That is the whole ask. The notifications, the overdue count and the escalation happen whether or not anybody logs in — which is exactly the part that usually is not done at all.

No. People close actions. The platform makes sure every one has a named owner and a date, tells that person it exists, tells their manager when it moves, and refuses to let it quietly disappear off a list. That is a smaller claim than the one most vendors make, and it is the one that survives contact with a real site.

Nothing stops it — and any vendor who says otherwise is describing a product they have not shipped. What the platform does is record closing as a claim, with a name and a timestamp against it. What stops a false claim mattering is the effectiveness review and the two-signature sign-off behind it. Closed and Approved are different states for exactly this reason.

No. Without it you still get owners, dates, chasing and an audit trail. With it you get to see which of your controls are weak before they fail — in the month on this page, 21 scored actions average 92% and two sit below 80. Those two are where the next incident lives.

Any module raises them, and each keeps a link back to the record it came from — the incident, the near miss, the inspection, the hazard, the risk assessment, the extinguisher. six of the 49 on this board were raised by the platform itself when equipment failed a check, against the named custodian, without anybody noticing first.

Whoever the approval template names, and only them. An administrator cannot sign on somebody’s behalf, and the API refuses an attempt to set Approved directly on the record — the status is produced by the workflow or it does not exist. Signing is row-locked, so a double-tapped Approve on a slow connection produces one signature.

Yes — our cloud, your cloud, or your own servers. Permissions are granular: view, create, update and delete are separate from who may sign an approval, and every field change is attributed in the audit trail.

The platform does not close actions. People close actions. What it does is make sure all 21 of the rows in the extract above have a named person and a date against them, tell those people, tell their managers when something moves, and refuse to let any of it disappear off a list.

See it on your own data

Send us your open action list — a spreadsheet is fine. We'll load it, show you what is overdue today and who owns it, and put the oldest five on a planboard.

Book a walkthroughIncident investigation

45 minutes. 21 rows is enough to see the shape of it; 49 is enough to see the problem.