WHS obligations for schools: the assessment that matched the activity, and the trail that proves it

Every WHS matter we have followed in Sector Signal this year has turned on the same question: was there an assessment that matched the activity, and did the people on the ground know what it said. A register that lists "excursions" as a risk does not answer it. An assessment that names the creek crossing, the ratio, the weather call and who makes it does. The register is strategic, rated against appetite and owned at leadership level; the assessment is the analysis of one thing on one day, with its hazards, the safeguards in place and the person responsible for each. Coordinators tell us the honest reason assessments do not get written: it takes an hour they do not have, and the template is longer every time someone opens it. That is a tooling problem rather than a competence problem, and it is the argument of our story The risk assessment is the control.

In EthosOne, assessments live in their own module, in folders by operating context, with statuses from Draft and In review through Approved, Review required, Expired and Superseded. Each hazard records a cause, a consequence, a matrix rating, a response and a responsible owner. Approval fixes an immutable version with the approver, the time and a validity date, and a high or critical hazard without an adequate response or owner makes the assessment unapprovable. The embedded helper drafts the hazards, safeguards and bow-tie text from a description of the activity while you are still in ratio, and a person selects, edits and approves. It is the school risk assessments module.

The August issue (3 August 2026) reported four matters with one fact pattern: South Australia laid its first industrial manslaughter charges over a death where, on the allegations, an external technician had put a safety concern in writing two days beforehand; a Melbourne builder was fined $400,000 for failing to have a competent person verify someone else's welding documentation; Fenner Dunlop was fined $212,500 after SafeWork NSW noted the risk controls "are well known"; and Central Queensland University signed an Enforceable Undertaking after self-reporting underpayments caused by payroll configuration and manual processes. In the safety matters the control existed; nobody checked it on the day, and nobody could show that they had. Two turned on failing to verify a third party's documents, which is the position a school occupies during capital works or grounds maintenance. It is Stop assessing documents. Start managing the trail.

Issue 07 (24 August 2026) put it as "the rules did not change, the checking did", reporting that regulators are resourced to look and publishing what they find, and that the findings are things a school believes it has and cannot usually evidence on demand; it is The rules did not change. The checking did. The pattern began early: issue 01 (3 May 2026) covered reportable conduct schemes and state reporting obligations stacking up, in What the past fortnight tells us about risk in independent schools, and issue 03 (31 May 2026) reported three regulators saying schools cannot outsource accountability, in The end of the outsourced school.

Where an undertaking or a regulator engagement follows a WHS incident, EthosOne provides the system that evidences its commitments over time: each commitment tracked as an obligation with a named owner, evidence captured in the assurance logs as it happens, and progress reported on the cadence the undertaking sets, with the school's legal adviser in the loop. We do not give legal advice.