Controlled Document Template for WHS: Fields and Versions

A supervisor opens a SWMS on a phone while the crew pulls a different revision from the site box. The office has approved another copy, but nobody can establish which version applies to today's work. A controlled document template needs to resolve that situation, not just provide a tidy approval box.

For a PCBU, the useful outcome is a clear record of what was approved, when it became effective, who received it and what happened to the replaced copy. The template and document register need to work together, including when workers are offline.

Table of Contents

• The Fields Every Controlled Template Needs
  • The entries that establish which version applied
• How to Set Up Versioning and Approvals
  • Approval is a release gate, not completion
• Review Triggers That Force an Early Revision
  • Changes need an identifiable release
• Controlling Distribution and Removing Uncontrolled Copies
  • A distribution process that reaches the field
• Retention Periods by Record Type
  • Classification must come before deletion
• Test the Template Against an Inspection
  • Evidence to put beside each checklist item
  • A focused field check

The Fields Every Controlled Template Needs

Controlled document template fields with example values

The entries below describe a hypothetical civil crew. The dates and review interval are example decisions, not prescribed deadlines.

The entries that establish which version applied

Version, effective date and superseded version deserve particular attention. A revision number distinguishes files, but the change summary tells the reviewer what needs checking. In the civil crew example, the approver should examine the stair-core protection arrangements rather than treat the revision as a formatting update.

The effective date establishes when the approved instructions become operational. It shouldn't automatically copy the drafting date, especially when the crew still needs briefing or equipment must be installed.

The superseded entry must identify the replaced revision and its withdrawal date. Without both, the register can't establish which instructions were live when a particular shift started.

Practical rule: Every mandatory field should support a decision, an action or evidence that someone can verify.

The owner and approver should be different people where practical. The supervisor maintains task accuracy; the construction manager provides a separate check before release.

The example's routine review interval reflects a site decision about the work, not a universal schedule. Optional administrative detail belongs in the register rather than crowding the form workers complete beside the slab.

How to Set Up Versioning and Approvals

Safe Work Australia's risk-management code of practice recommends keeping evidence of hazards, risk assessments, controls, implementation, monitoring, review, consultation, training and planned changes. It also says workers should know which records are accessible and where they're kept.

A workable setup connects those records to the document, rather than leaving the safety manager to reconstruct the connections later.

1. Assign the document details. The document controller establishes a unique ID, title, site or project scope, owner and approver. A common slip is making the owner the only approver, leaving no independent check of whether the instructions match the work.

2. Record the release details. The register captures the revision number, effective date, review date and superseded version before publication. A new revision without a replaced-version entry leaves an unresolved gap in the release history.

3. Connect the risk-control evidence. The author links the hazard, risk assessment, selected controls and applicable WHS or operational requirements. A control listed without its risk register reference is harder to check when the assessor changes its design or application.

4. Record consultation with affected workers. The consultation entry identifies participants, the issues discussed and the resulting decisions. A toolbox-talk entry without names doesn't establish whether the workers doing the task took part.

5. Allocate implementation responsibilities. Training, monitoring, corrective actions and review activities each need a named responsible person and a completion requirement. A training instruction without an owner can remain unfinished even after the document receives approval.

6. Separate editing, approval and access. Authorised roles manage changes while workers open the released copy at the point of work. Giving every supervisor unrestricted master-template editing rights creates opportunities for unapproved local changes.

Approval is a release gate, not completion

The written workflow should define who can edit a draft and who authorises its release. Even an approver's amendment should pass through a recorded revision process rather than overwrite the approved copy.

A signature doesn't establish implementation. The civil crew still needs access, briefing and confirmation that the specified protection is available before stripping begins. A completed approval record cannot substitute for those operational checks.

The depth of documentation should reflect workplace size and the potential for serious WHS harm. A short procedure can be well controlled, while a lengthy procedure can lack usable consultation evidence or implementation responsibilities.

For organisations preparing for ISO 45001 audits, this arrangement also provides a coherent evidence package to assess against their documented-information requirements. The register should preserve the decisions behind a release, not merely display a green approval status.

Review Triggers That Force an Early Revision

A calendar reminder isn't enough when the work changes between scheduled reviews. Safe Work Australia's guidance on reviewing controls identifies ineffective controls, workplace changes introducing different risks, newly identified hazards and consultation findings as reasons to review and, where necessary, revise controls.

A trigger forces a review, not automatically a rewritten document. The reviewer must establish whether the existing instructions remain adequate and record the decision.

Changes need an identifiable release

For construction, the reviewer checks whether changes to plant, sequencing, access or site conditions affect the WHS management plan and relevant SWMS. Moving the stripping sequence around the stair core, for example, requires a check of the protection arrangements before the altered sequence begins.

An out-of-cycle revision normally retains the document ID and receives a new revision number. Its change record identifies the reason, affected control, consultation completed, approver and effective date.

An open investigation isn't a reason to leave workers exposed while the organisation waits for final findings.

Immediate controls and interim instructions may be necessary before the investigation closes. The owner then checks the final findings against the released procedure and captures any further changes.

A review that finds no amendment necessary still needs a recorded outcome. The next routine review date should reflect the task's risk and stability, rather than an organisation-wide interval applied without judgement.

Controlling Distribution and Removing Uncontrolled Copies

On a civil job, the crew beside the slab works from whatever copy reached the site box that morning. A printout labelled uncontrolled still becomes the working instruction once the pour starts. The label warns that currency is not guaranteed, which is why the crew has to confirm the revision against the current source before relying on the paper.

Digital access carries the same risk. Anything stored online looks current until someone checks it, so digital systems need governance equal to the paper copy in the site box. The discussion of workplace technology and data governance in Corrs' workplace-regulation commentary provides broader context for treating digital systems as governed workplace infrastructure.

A distribution process that reaches the field

• One current-version source. The opening screen or document header shows the ID, revision and effective date. Workers reach the approved source directly, with no email attachment history to search.
• A recorded withdrawal. The document controller logs removal of superseded working copies from site boxes, vehicles and shared drives. Archived evidence remains separate from operational copies.
• A refresh rule for devices. Downloaded and cached copies are checked when a replacement is released. The next toolbox talk records confirmation that affected workers have refreshed their copies.

The document management program guide supports the written distribution process by assigning withdrawal and communication responsibilities to named roles, so removal of old copies is a task with an owner.

Safety Space provides a document library, document versions, review dates and review histories, and documents can be shown within forms while they are filled. Those functions support access and review. The organisation still sets the rule for confirming current copies on offline devices.

The useful test is the copy in the worker's hand.

Worker change requests enter the same register as scheduled reviews. Advance reminders leave enough time for consultation, approval and communication before the document becomes overdue.

Distribution is under control when someone can name the revision in use at each point of work and produce the withdrawal log for every copy it replaced.

Retention Periods by Record Type

Minimum retention periods in the model WHS Regulations

Safe Work Australia's model WHS Regulations set specified minimums: health monitoring reports require at least 30 years, with specified records requiring 40 years; particular risk assessments require at least 28 days after work completion; SWMS are retained until the relevant work is completed; and specified plant records require five years or the life of the plant.

Classification must come before deletion

Each row binds a specific record under a specific provision. Before assigning a disposal date, the custodian does one job: match the record to the provision that created it, then check for any incident-related extension. A live operational procedure and a completed worker sign-on are different records even when they sit in the same folder, so the template carries record class, custodian, confidentiality level, retention trigger and disposal authorisation.

Investigation holds suspend disposal of approvals, photographs, sign-ons, downloaded copies and historical revisions. The safeguard is a preservation hold applied by an authorised person and lifted by one, with the decision logged. Building that hold into the wider system is part of the work covered in the guide on implementing an HSE management system.

The document retention policy guide turns those classification decisions into assigned responsibilities and a disposal schedule. The destruction record itself is audit evidence: what was disposed of, under which provision and on whose authorisation.

Physical archives need suitable storage as well. For businesses considering site containers, Pacific Mobile Structures, Inc.’s temperature controlled container specs and trade-offs provide useful procurement context, separate from deciding how long records must remain available.

Jurisdiction matters. State and territory legislation implements the Australian model provisions, so custodians must check the applicable version before automating disposal. New Zealand's Health and Safety at Work Act 2015 and WorkSafe NZ requirements need separate checking, and operations under US jurisdictions need their own retention analysis under the rules that apply there.

Test the Template Against an Inspection

A practical internal target is a ten-minute retrieval exercise: produce the current site SWMS, the revision workers signed and the record of its last change. If any of the three needs a phone call to the document controller, there is a gap.

Inspectors rarely ask for the policy itself. They ask who signed, when it changed and which version was in force at the point of work.

WorkSafe ACT's record-keeping guidance says employers must keep health and safety records organised and available for reference, including consultation, orientation and training, inspections, incident investigations and first-aid records. A template that captures information without making those records retrievable has not finished the job.

Evidence to put beside each checklist item

Three tests sit underneath the retrieval exercise. Each has a single piece of evidence that either exists or does not.

1. Worker-located access. Ask a supervisor or worker to open the procedure they used most recently. Evidence: they reach the released revision from the approved source without being handed a filename or folder path.

2. Revision on the sign-on. Consultation records, toolbox talks and sign-on sheets should identify the revision workers acknowledged. Evidence: a sign-on sheet whose revision matches the version that was live on that date.

3. Signature-to-version trace. Pick one signed record and follow it backwards. Evidence: the author, the approval timestamp and the change that triggered the signature, all attached to the same document.

The audit trail guide frames those connections between author, timestamp, approval and subsequent action. A folder of signed PDFs is less useful when nobody can connect a signature to the version that was available during the task.

For manufacturers, American Additive Manufacturing's QA practices for 3D printed parts provide a related quality-assurance perspective. The WHS check is more specific: the organisation needs traceable instructions and evidence for the work performed.

A focused field check

Select three high-risk documents this week, such as the next-stage construction SWMS, a plant-isolation procedure and a hazardous-chemical handling instruction. Have the supervisor retrieve the working copies cold, without the document controller supplying filenames. Run the exercise without warning and without tidying the shared drive first; the point is to test what a worker would find on the day.

Each failed check needs a named owner and a corrective action. The exercise is complete when the missing evidence can be retrieved and the field copy matches the authorised release.

Safety Space keeps document control, review histories and document references inside forms in one system, and automatically generates the documentation and reporting required for regulatory inspections. Teams can visit Safety Space to discuss a setup for their sites, then test it against current-version access, worker sign-on and inspection retrieval.