Surveys & worker consultation

The answer you want is the one nobody will put their name to.

Anonymous surveys where anonymity is a mechanism rather than a promise — identity severed on submit, kept out of the audit trail, and results sealed until enough people have answered that no one can be picked out.

Run one on your own site Book a 20-minute walkthrough

AnonymousIncident Learning

After the tank farm release — what did we learn?

Participation

4 / 15

27% answered · due 15 Aug 2026

Who has and hasn’t answered stays visible, so the outstanding ones can be chased.

Results

Sealed

4 of the 5 responses needed. Below the threshold nothing is shown to anyone — not the aggregate, not the response list, not the export.

1 more answer and this opens.

Not for the administrator either. There is no view that shows four anonymous answers from a crew this size, because there is no honest way to show them.

Threshold is 5 by default and yours to set. Illustrative data — not a customer.

A low near-miss count is not safety. It is silence.

Every HSE manager knows the number that should worry them is the one that looks good. Two near misses reported last quarter across three hundred people does not describe a careful site. It describes a site where reporting costs something — time, awkwardness, naming a colleague, or the belief that nothing will come of it.

The instrument for hearing that is a survey, and it is the one instrument that breaks if the people answering don’t believe it.

Ask a crew whether they have ever decided not to report something, and you will get an honest answer exactly once: the first time, before anyone finds out whether it was traceable.

Which is why the rest of this page is about the mechanism and not the questionnaire. A survey tool is easy. A survey people answer honestly is a set of specific promises about what happens to the answer, and every one of them has to be checkable.

The mechanism

Three specific things, or the word is doing no work

Set as specification rather than marketing, because this is the section a safety committee will read twice.

01The link is severed, not hidden.
On submit, an anonymous response drops the respondent’s id and the link to their assignment. There is no column left to join on. The record of whether you answered is kept — that is how the people who haven’t are chased — but not what you said.

02It stays out of the audit trail.
This is the one most systems get wrong, including ours until we tested it. An audit trail that records every change faithfully records the anonymising step as user_id: 17 → None, stamped with the name of whoever was logged in — and each answer as it was written, under the same name. The feature designed to record who did what will de-anonymise the one feature whose entire value is that it cannot. Survey responses and answers are excluded from it outright, and so is a respondent’s own progress through their assignment, because the timestamp on that lines up one-for-one with a submitted response. Building the survey, publishing it and assigning it are all still audited.

03Results stay sealed until the crowd is big enough.
Three anonymous answers from a crew of five are not anonymous, whatever the database says — and the crew works that out before they answer, not after. Below the threshold (5 by default, and yours to set) the answers are not shown to anyone: not the aggregate, not the response list, not the export. Who has and hasn’t answered still is, so the outstanding ones can be chased.

We are not claiming your database administrator cannot read your database. We are claiming the product does not build a second path to the same answer and call it an audit trail.

Still audited

Building the survey
Publishing it
Assigning it
Closing it

Everything about the survey as an object. Who built it, who published it, who it went to and who closed it.

Excluded outright

Survey responses: The row that would carry user_id: 17 → None, stamped with whoever was logged in.
Individual answers: Each answer as it was written, under the same name, in the same trail.
A respondent’s progress through their assignment: The timestamp on it lines up one-for-one with a submitted response, which is the same fact by another route.

The survey register showing six surveys with their categories, whether each is anonymous, and how many people have answered. — The threshold is set here, in the product’s own words: “Anonymous surveys stay sealed until 5 people have answered — below that, an answer can be traced back to whoever wrote it.” Illustrative data — not a customer.

Ownership

Only the person it was sent to can answer it.

Not their supervisor, not their deputy, not an administrator. A survey is evidence that workers were consulted, and evidence that can be filled in on somebody’s behalf evidences nothing.

Refused — administrator

“This survey is assigned to somebody else. Only they can answer it — an administrator cannot answer on their behalf.”

This is one of the few places in the platform where administrator rights stop, and it is deliberate. An administrator can build the survey, publish it, assign it, chase it and close it. What they cannot do is answer it for somebody — because a consultation record that can be filled in on a worker’s behalf is not evidence of consultation, it is evidence of a form being completed.

Worked example

One question, one branch, and the answer a register never gives you

From the safety culture survey 2026 — 11 of 15 people answered.

Q4Yes / NoRequired

In the last 12 months, have you decided NOT to report something?

Yes · 5No · 6

visible if · Q4 is Yes

Q5Multiple choice

What stopped you?

Change Q4 back to No and what was typed on Q5 does not travel with it. The web and the app both hide the question; the server discards the answer, including anything hidden further down the branch. So the results never show reasons for not reporting, written by people whose final answer says they always did.

Q5 · Multiple choice

What stopped you?

Shown only to the 5 people who answered Yes on Q4.

It seemed too minor: 4
Nothing would come of it: 3
No time, mid-job: 2
Worried about the reaction: 1
Didn’t want to name a colleague: 0
Didn’t know how: 0

n = 510 selections across 6 options — it is a choose-all-that-apply question, so the tally exceeds the number of people.Illustrative data

Those are four different problems with four different fixes, and not one of them is visible in an incident register. “It seemed too minor” is a training and threshold problem. “Nothing would come of it” is a closure-rate problem. “No time, mid-job” is a form problem. “Worried about the reaction” is a supervisor problem, and it is the one you would never have been told to your face.

The measurement nobody counts

Response rate is a leading indicator, not admin

A crew that stops answering is telling you something before any of the questions do.

Before the date

A heads-up, while there is still time to do it in a break.

On the day

A note that it is due today.

Every 3 days

For a fortnight after — at most 4 more.

After 14 days

It stops. A reminder that fires forever is one people mute, and the row stays overdue in the register either way.

Safety Culture Survey 2026

15 assigned · 11 answered · 73% · due 20 Aug 2026

Illustrative data

Completed

In progress

Pending

Who the Safety Culture Survey 2026 was assigned to and whether they have answered. No answers are shown, because the survey is anonymous.
Assigned to	State	What they said
Priya Natarajan	Completed	Not recorded against a name
Tanya Brooks	Completed	Not recorded against a name
Emily Carver	Completed	Not recorded against a name
Marcus Delgado	Completed	Not recorded against a name
Nicole Hayes	Completed	Not recorded against a name
Robert Pierce	In progress	Not recorded against a name
Angela Reyes	Completed	Not recorded against a name
Derek Coleman	Completed	Not recorded against a name
James Okonkwo	Completed	Not recorded against a name
Sarah Whitfield	Completed	Not recorded against a name
Karen Liu	Completed	Not recorded against a name
Anthony Russo	Completed	Not recorded against a name
Victor Ramos	In progress	Not recorded against a name
Luis Ferreira	Pending	Not recorded against a name
Dana Whitlock	Pending	Not recorded against a name

Names here. No answers here. That is the entire distinction — whether you answered is kept so the outstanding ones can be chased; what you said is not kept against you at all. Nothing on this board is overdue, because 20 Aug 2026 has not arrived.

Recurring, and closing out the last cycle first

WeeklyMonthlyQuarterly

Each cycle closes out the last before opening the next, so the people who never answered last month are sent this month’s. A naive “skip anyone with an open assignment” rule quietly drops exactly the people whose silence you most need to notice.

And when a date does pass

PPE Fit & Condition Check — Q3 was due 06 Aug 2026. 2 of 5 are 3 days overdue and stay in the register as overdue whether or not the reminders have stopped. The row is the record; the reminder was only ever a nudge.

The assign tab of a survey, showing the audience picker, an optional due date, the recurring schedule control and the list of fifteen assignments. — Assign by person, role, department, group or everyone — and set the repeat on the same screen. Illustrative data — not a customer.

Analysis

Distributions, not just averages

Every chart states the number of responses it was drawn from. A percentage without its base is the thing this audience distrusts most.

Q1 · Linear scale

How confident are you that stopping the job would be supported by your supervisor?

1 — Not at all5 — Completely

n = 11Average 3.0 of 5 — and the average is the least interesting thing here. Four people sat at 1 or 2.Illustrative data

Q10 · NPS (0–10)

How likely are you to recommend this site as a safe place to work?

Detractors

0–6

Passives

7–8

Promoters

9–10

110

NPS -36 — 2 promoters minus 6 detractors, over 11 responses. The number is not the finding. The finding is the answer sitting at zero, and a chart that started at 1 would have hidden it.

n = 11Every point on the scale is plotted, including the empty ones.Illustrative data

Q9 · Paragraph

What is the one thing you would change?

Shown in full and without attribution, which on an anonymous survey is the only way it can be shown and the only way it is worth reading. On a safety survey the free text is the survey.

“The near-miss form is fine. It is the twenty minutes afterwards explaining it to someone that stops people bothering.”Anonymous
“We are told to stop the job if it is not safe. Nobody has ever seen anyone actually do it and still be on the same line the next week. Show us one and the message lands.”Anonymous
“Half the time the right guard is off because the last shift took it off and nobody logs it. It is not that people do not care, it is that putting it back is a fifteen-minute job at the end of a twelve-hour one.”Anonymous
“Toolbox talks are read out. Nothing wrong with them, but reading a sheet at somebody is not consultation and we all know it.”Anonymous

4 of 11 answers· CSV export carries all of them, still without names.Illustrative data — not a customer.

Once people have answered

An answered question can’t be deleted or re-typed

Both of those used to succeed silently, which is a worse outcome than either of them failing.

What can and cannot be changed on a survey that already has answers.
Change	After answers
Delete an answered questionDeleting it deletes the answers to it. This used to succeed silently.	Refused
Change an answered question’s typeShort text to a rating leaves the earlier answers filed under a question that no longer means the same thing.	Refused
Re-word an answered questionClarifying a confusing question is a real need, and the answers still mean what they meant.	Allowed
Add a new questionEarlier respondents simply have no answer to it, which is a fact rather than a corruption.	Allowed
Duplicate the whole surveyThe way to change the shape of a questionnaire. The copy’s conditional logic comes with it, pointed at its own questions.	Allowed

Refused — Q4

“This question already has answers, so it cannot be deleted or re-typed. Re-word it, or duplicate the survey to change its shape.”

So how do you change the shape of it?

Duplicate it. The copy comes with its conditional logic intact and re-pointed at its own questions, so the branch on Q5 still hangs off Q4 rather than off a question in the original. Then close the old one — closing a survey closes its assignments with it, so nobody is chased for a questionnaire that has been superseded.

Fourteen question types

Grouped by what the person answering actually does. Section headers and statements are on the list because structure is the difference between a questionnaire people finish and one they abandon halfway.

Text

Short text— One line. A job title, a bay number.
Paragraph— The one that carries the survey on a safety topic.
Email— Validated. Rarely wanted on an anonymous survey.

Number

Number— Years on site, hours on shift.

Choice

Single choice— One answer from a list.
Multiple choice— Choose all that apply — the tally can exceed the response count.
Dropdown— The same thing when the list is long.
Yes / No— The type most conditional branches hang off.

Scale

Star rating— One to five, for a quick read.
Linear scale— Your own range and your own end labels.
NPS (0–10)— Promoters, passives and detractors, computed.

Date

Date— When something happened, or last happened.

Structure

Section header— Breaks a long questionnaire into parts.
Statement— Says something without asking anything — context before a hard question.

Five to start from

Starters, not a straitjacket — every question is yours to re-word, and most sites do.

Safety culture: The long one. How safety actually works here, in their words, including whether they have ever decided not to report something.
Training feedback: Straight after a session, while they still remember what was missing from it.
PPE self-check: Two minutes on whether what they were issued still fits and still works.
Near-miss follow-up: Sent to the crew involved after a near miss, asking what nearly happened that the report did not capture.
Ergonomics: Where the aches are, before they are an over-exertion claim.

On the phone

Under four minutes, one hand, in a lay-by

The whole survey on the field app, with progress saved as you go — because that is where the crew is and a desk is not.

The My Surveys screen on the field app, listing one survey to do and one completed, each showing whether it is anonymous and when it is due.

A required yes or no question on the field app, showing progress through the survey and a save control.

It says it is anonymous before the first question

Somebody deciding how honestly to answer needs to know where they stand while they still have the choice — not on the confirmation screen. The card carries it, and the words that matter are these: “Your name is not saved with your answers and cannot be added later. Answer honestly.”

In the build these captures come from, that assurance sits in the survey’s own description rather than on a system-drawn notice screen — which means it is as good as whoever wrote the description. Ask to see it as a guarantee the product draws, not a sentence an author typed.

Saved as you go

Progress is saved as you go, so a lost signal in a lay-by does not cost the answers.

3 questions, 15 people, one date

The survey on these screens is the sealed one at the top of this page. 4 people have answered and it needs 5. Everybody can see that; nobody can see the answers, including whoever sent it.

Compliance map

What an auditor asks, and what you hand them

Clause by clause, the record this module produces — not a claim that it makes you compliant.

ISO 45001:2018 clauses this module produces evidence for.
Clause	What it asks for	What the survey hands over
5.4	Consultation & participation of workers	The clause this module exists for — and the brochure’s own evidence line for it names Surveys and Consultations
7.4	Communication	Surveys out, results back, and the response rate of both
6.1.2	Hazard identification & risk assessment	What people report they did not report — the hazards a register never receives
9.1	Monitoring, measurement & analysis	Response rate and score trend, treated as leading indicators rather than admin
10.2	Incident, nonconformity & corrective action	A survey finding becomes an owned, dated corrective action
9.3	Management review	Participation and results as a review input, with the base stated beside every figure

5.4
Consultation & participation of workers
What the survey hands over
The clause this module exists for — and the brochure’s own evidence line for it names Surveys and Consultations
7.4
Communication
What the survey hands over
Surveys out, results back, and the response rate of both
6.1.2
Hazard identification & risk assessment
What the survey hands over
What people report they did not report — the hazards a register never receives
9.1
Monitoring, measurement & analysis
What the survey hands over
Response rate and score trend, treated as leading indicators rather than admin
10.2
Incident, nonconformity & corrective action
What the survey hands over
A survey finding becomes an owned, dated corrective action
9.3
Management review
What the survey hands over
Participation and results as a review input, with the base stated beside every figure

Sentinel supports evidencing these requirements. Certification is an audit of your organisation, not of software. Assess the anonymity model described here against your own works-council agreements and privacy obligations rather than against a claim on this page.

Objections

The seven things you are already thinking

Not through the product. The link between the response and the person is severed on submit, and the responses and answers are excluded from the audit trail — including the respondent’s own progress through their assignment, because its timestamp is the same fact by another route. What we are not claiming is anything about direct database access, and you should be wary of a vendor who does. The honest boundary is that the product does not build a second path to the same answer and call it an audit trail.

Whether you answered is kept; what you said is not. Those are two different facts and only one of them is anonymous. The assignment register carries a name and a state and no answers at all — that is why it can be shown to a supervisor without breaking anything, and why the analysis carries answers and no names.

Then set the threshold to match, knowing exactly what you are trading. Below it the results are sealed for everyone including you — not the aggregate, not the response list, not the export. On a crew of eight a threshold of 5 still leaves three people who could be reasoned about, so decide it with the crew rather than for them, and be prepared for the honest answer that the crew is too small for an anonymous survey to be anonymous.

No, in either direction, and it is fixed from the first response onward. People answered on the strength of what it said at the time, and changing it afterwards would either expose answers given in confidence or discard names given openly. Duplicate it and run the questionnaire the other way.

Under four minutes on a phone, saved as they go, chased automatically, and honest about what happens to the answer. That is all we can offer — the software does not change anybody’s mind about whether it is worth answering. Run one crew as a pilot, ask one question that actually matters to them, and look at the response rate. If it is low, that is the finding.

Questions are free text, so write them in whatever language the crew reads. What the platform does not do is translate for you, and on a safety survey we would not want it to — a question that has been machine-translated into an ambiguity produces answers to a question nobody asked.

Yes, including on your own infrastructure if that is where you want it. This is usually the IT manager’s question and it is a fair one; it is also the easy half. The harder half is who inside your organisation can read what, and that is the anonymity model above rather than a hosting region.

6 surveys, 22 responses and 5 as the threshold — all illustrative, from a demonstration dataset rather than a customer.

Ask your crew the question you’ve been avoiding.

Pick one crew and one question — usually “have you ever decided not to report something”. We’ll set it up anonymous, you send it, and we look at the response rate together.

Book a walkthrough A day on site

Forty-five minutes, your crew, no slides.