Does this replace our critical incident plan?

No. The plan, the call tree and any mandatory external reporting stay exactly where they are. This is the record and the accountability afterwards.

Can a staff member report without a login?

A register can run as an internal log for authenticated staff or as a form that accepts submissions from outside the system. Weigh that before opening one: do not put a register holding confidential content behind a public form, and treat the privacy behaviour of the external path as something to verify for your own use.

Who closes an incident?

Somebody other than the person who did the work, against the evidence on the record. That separation is the difference between a closed incident and an asserted one.

Can we prove the record has not been quietly edited?

Persisted entries carry a history of edits. What the record said and what it says now are both answerable.

Do the actions afterwards go anywhere, or just sit on the incident?

They carry a named owner and a date and sit in the same queue as the school's other commitments, which is what makes them survive a term.

What can the AI do here?

Summarise the patterns in entries somebody is already authorised to see, and summarise a history with its events cited. It cannot reach a conclusion about an incident, choose an audience or work out access rules.

Risk and Compliance is a Focus module at $5,000 a year on top of Core at $15,000 a year with unlimited users. Every price is published.

Risk and Compliance, in full: what does it cover?

Triage assigns it to an accountable owner, the actions that follow carry owners and dates, evidence attaches to the record where it is generated, and the engagement is closed out by someone other than the person who did the work. The history shows what was known, what was decided and what changed afterwards, and persisted entries carry a record of edits. It is part of Risk and Compliance, a Focus module at $5,000 a year on top of Core.

Risk and Compliance

Critical incident management software for independent schools

The hour after, and the year after.

This does not replace the phone call. Emergency response is the school's own plan and its own people.

Book your school a demo See the free pack

The AI Risk Register overview: the scope and context, then the risk distribution as two five-by-five heat maps, inherent on the left and residual on the right, with the count of risks in each cell, Hogwarts demo tenant.

A risk open in the AI Risk Register, the Year 9 science practical: the five-by-five matrix with the inherent rating of 15 and the residual of 4 drawn as From and To, the category, and the four controls the draft proposed beneath, Hogwarts demo tenant.

The snapshots tab of the School Board Risk Register: named point-in-time captures with dates and a Compare action.

The Review AI Risk Draft panel in the AI Risk Register: a Year 9 science practical named as the risk, the drafted cause and consequence as bullet lists, the AI-suggested rating beneath, and Regenerate and Create Risk buttons, Hogwarts demo tenant.

Real captures · Risk and Compliance · Hogwarts demo tenant.

In one paragraph

An incident at a school produces two obligations: respond now, and be able to account for it later.

EthosOne carries the second one. A staff member reports into a structured record rather than an email, so every report arrives in the same shape with an identifier of its own.

What we keep hearing

A student was hurt at the athletics carnival in March. Everyone did the right thing on the day. In November a letter arrives asking three questions: when was it reported, who was accountable for the follow-up, and what changed as a result.

The answers exist, distributed across an email thread, a first aid book, the minutes of one leadership meeting and the memory of a staff member who has since left.

The problem

Reporting by email loses the shape
Two reports of the same kind of event arrive with different fields, different detail and different people copied, so nothing can be counted and nothing can be compared.
Follow-up is the part that evaporates
The response is usually good. The actions agreed a week later have a name against them until that person changes role, and then they have nobody.
Closure is asserted, not evidenced
"That was dealt with" is a sentence. A reviewer asks who decided it was dealt with, on what basis, and whether they were the same person who did the work.

Free template pack

The evidence, organised by the question a regulator asks

An agreed set of assurance areas, a named verifier on every row, and a board summary you can table.

What it does

Five views, one reconciled picture. Each one drills to the record it came from.

01
Report an incident
A staff member records what happened in a structured form with required and optional fields, from inside the system or through a form opened to people outside it. Every entry takes an identifier derived from its profile, so it can be cited in a paper, a letter or a response to a regulator.
02
Triage and ownership
The report is assigned to an accountable owner. What follows is attached to the record rather than to an inbox, so a handover does not lose it.
03
Actions and dates
The commitments made after an incident carry a named owner and a date. They sit in the same queue as every other commitment the school has made, which is the only way they survive a busy term.
04
Evidence
Statements, photographs, correspondence and check records attach to the record as the work happens, rather than being assembled the week a reviewer asks.
05
Review and closure
The engagement is closed by someone other than the person who did the work, against the evidence on the record. What was known, what was decided and what changed are all answerable afterwards, and persisted entries carry a history of edits.

What it does not do

It is not the emergency response. It does not replace the school's critical incident plan, its call tree, its specialist response providers or any mandatory external reporting. Those are decided and practised by people; this holds the record they generate and the accountability that follows.

It does not decide severity for you. The AI can summarise entry patterns and summarise a history with the events cited. It cannot reach a conclusion about an incident, choose who should see it, or infer access rules. That judgement is the school's and stays with a named person.

The School Board Risk Register overview for Hogwarts: scope and context, then the inherent and residual risk distributions on the five-by-five matrix side by side.

Where it sits

Incidents feed school assurance software, which is where the school's evidence registers live, and material exposure moves into the register in school risk management software. Where an incident arises on an activity, the assessment behind it is in school risk assessment software.

Who it is for

The staff member who has to report something and wants it to land somewhere real. The business manager who owns the follow-up. The principal who signs the letter. The board or audit committee member asking what changed as a result.

Stored in AustraliaAWS Sydney and Melbourne, one database per school
AI stays in the country tooAmazon Bedrock; never trained on your content
Published, not describedTrust Centre · ISMS policy · How we handle your data

Everything you asked us, answered

The eight we are asked every time.

Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.

Book your school a demo

01Does this replace our critical incident plan?
No. The plan, the call tree and any mandatory external reporting stay exactly where they are. This is the record and the accountability afterwards.
02Can a staff member report without a login?
A register can run as an internal log for authenticated staff or as a form that accepts submissions from outside the system. Weigh that before opening one: do not put a register holding confidential content behind a public form, and treat the privacy behaviour of the external path as something to verify for your own use.
03Who closes an incident?
Somebody other than the person who did the work, against the evidence on the record. That separation is the difference between a closed incident and an asserted one.
04Can we prove the record has not been quietly edited?
Persisted entries carry a history of edits. What the record said and what it says now are both answerable.
05Do the actions afterwards go anywhere, or just sit on the incident?
They carry a named owner and a date and sit in the same queue as the school's other commitments, which is what makes them survive a term.
06What can the AI do here?
Summarise the patterns in entries somebody is already authorised to see, and summarise a history with its events cited. It cannot reach a conclusion about an incident, choose an audience or work out access rules.
07What does it cost?
Risk and Compliance is a Focus module at $5,000 a year on top of Core at $15,000 a year with unlimited users. Every price is published.
08Risk and Compliance, in full: what does it cover?
Triage assigns it to an accountable owner, the actions that follow carry owners and dates, evidence attaches to the record where it is generated, and the engagement is closed out by someone other than the person who did the work. The history shows what was known, what was decided and what changed afterwards, and persisted entries carry a record of edits. It is part of Risk and Compliance, a Focus module at $5,000 a year on top of Core.