Key takeaways
- A safety record only protects you if it can be produced in a readable form when someone with authority asks for it, which makes retention and retrieval part of the control itself.
- Records sit in several places at once, including the site office, the principal contractor’s system, subcontractor paperwork and your own accounting files, so a single register of what is held and where is the practical starting point.
- The retention period you apply should be set by the longest relevant requirement across WHS, tax, contractual and insurance obligations, not by whichever one you happen to remember.
- Storage decisions should account for the fact that sites are temporary, phones are lost and cloud accounts are closed, so at least one copy of every record needs to live somewhere that outlasts the project.
- The most expensive failure is not a missing record at the time of an incident, but a missing record two or three years later when a claim, coronial process or dispute finally asks for it.
Every control you put in place on a site exists for a reason. Fall protection stops a fall. Isolation stops an electric shock. A toolbox talk moves information from one head into several. None of that survives a dispute unless there is a record of it. When a regulator, insurer or lawyer asks what you did, the only answer that counts is the one you can produce in writing, with a date and a name on it.
Most builders do not lose cases because they failed to manage risk. They lose them because they cannot prove what they did. The record was made, but it was on a phone that was replaced, in an email account that was closed, or in a folder on a laptop that walked off site with a subcontractor.
This article is about the part of safety management that gets the least attention: retention, storage and retrieval. It is not about writing better SWMS or running better inductions. It is about making sure the evidence of those things still exists, and can still be found, at the point where it matters.
Why a safety record is a legal document, not an administrative one
Under work health and safety law, the duty to manage risk sits with the person conducting the business or undertaking, and that duty extends to recording and retaining the things the law requires you to document. The reason is straightforward: obligations that cannot be verified cannot be enforced, and the system assumes you will be able to demonstrate compliance if asked.
That assumption cuts both ways. If you have done the work and kept the evidence, the records protect you. If you have done the work and lost the evidence, you are in the same position as someone who never did it. The regulator cannot see your intentions, your memory or your reputation. It can only see what is in front of it.
The people who will ask for your records are not all regulators. Safe Work Australia’s electrical safety guidance, for example, sits behind a set of inspection and testing obligations that only make sense if the results are recorded and retrievable. Your insurer will ask after an incident. Your certifier may ask during a dispute. A lawyer acting for an injured worker will ask during discovery. Each of those requests arrives with a deadline, and each of them is answered with documents, not explanations.
The records that actually get requested
Not every piece of paper on a site carries the same weight. In practice, a small number of record types do most of the work when a claim or investigation starts.
- Risk assessments and SWMS for high-risk work, signed and dated by the people who were actually doing the task.
- Induction records showing who was inducted, when, and by whom, including subcontractors and labour hire.
- Toolbox talk and pre-start records, which are the main evidence that information was communicated on a given day.
- Plant, electrical and scaffold inspection records, including the outcome and any action taken.
- Incident, near miss and injury records, with the corrective action that followed.
- Training, licence and competency evidence for the people performing high-risk work.
- Subcontractor safety documentation, including their own SWMS, insurances and inductions.
Each of these is only useful if it can be matched to a project, a date and a person. A folder full of unsigned risk assessments is not evidence; it is a liability, because it shows the form existed and was not used.
Checks before you close out a project
- Every SWMS, JSA and risk assessment is signed, dated and matched to the project it belongs to.
- Plant and electrical inspection records are held, not just the tags on the gear.
- Toolbox talk, induction and training records name the people who attended.
- Incident, near miss and injury records are complete, including the follow-up action taken.
- Subcontractor safety documentation is held on your file, not only on theirs.
- At least one copy of everything sits outside the site office and outside a personal device.
- The retention period for each record type is written down somewhere you can find it.
Retention: how long, and why the answer is usually longer than you think
There is no single retention period that applies to every safety record. Different obligations pull in different directions, and the practical rule is to retain for the longest period that any of them could require.
Work health and safety law sets retention requirements for specific records, particularly those connected to health monitoring, hazardous chemicals and certain incident notifications. Tax law requires business records to be kept for a period set out in the tax legislation, and those records often overlap with employment and payroll evidence. Insurance policies and construction contracts frequently impose their own retention obligations, and limitation periods for personal injury claims can run for years after a project is finished.
The ATO’s record keeping guidance is worth reading even if your interest is safety, because it explains the logic: records need to be kept for the period the relevant law requires, they need to be in a form that can be produced, and they need to be retained even if the business changes structure or ownership. That same logic applies to safety evidence.
Where a specific figure matters, check the current requirement rather than relying on what you were told years ago. The relevant sources are the Work Health and Safety Regulation for WHS record retention, the tax legislation for business records, and the specific clauses of your contract and insurance policy for anything they add on top. If you do not know which period applies to a particular record type, keep it longer rather than shorter.
Storage: three things go wrong, and they go wrong quietly
Storage failures rarely announce themselves. They accumulate. By the time you notice, the record is gone and the request has arrived.
1. The site office is not a filing system
Site offices are temporary. They get packed up, and the contents get distributed between a ute, a storage unit and a bin. If the only copy of a signed SWMS was in a folder on site, it is at risk from the day the project finishes. Anything that matters needs to leave the site before the site is demobilised.
2. Personal devices and personal accounts
Photos of inspections, notes on a phone, emails to a personal address. These are common and convenient, and they are also the most likely to disappear. A phone is replaced, an email account is closed, a subcontractor leaves and takes their records with them. If the record only exists on a device that belongs to an individual, you do not control it.
3. The cloud account that nobody owns
Cloud storage solves the device problem and creates a different one. If the account is in the name of a former employee, or a subscription lapses, or the project folder is deleted during a tidy-up, the records go with it. The system needs an owner, a naming convention and a backup that is not in the same account.
A practical structure is to keep a master project register that lists every record type, where it is held and who is responsible for it. That register is the thing you check before the project is closed out, and it is the thing you look at when a request arrives.
The life of a safety record
- CreatedThe record is made on site, on paper or in an app, at the time the task or inspection happens.
- CapturedIt is moved into the project’s document system, named consistently and linked to the relevant project.
- StoredIt is held in at least one location that survives the end of the project and the loss of a phone or laptop.
- RetainedIt is kept for the period the longest relevant obligation requires, even after the project is finished.
- RetrievedIt can be located, read and produced when a regulator, insurer, lawyer or certifier asks for it.
- DisposedIt is destroyed in an orderly way once every retention obligation has genuinely expired.
Naming, indexing and the retrieval problem
A record that exists but cannot be found within a reasonable time is, for practical purposes, a record that does not exist. Retrieval is where most builders discover that their storage was never as organised as they believed.
The fix is not complicated, but it has to be consistent. Every record should carry four pieces of information: the project it belongs to, the date it was created, the type of record it is, and the person or people it concerns. A file named “SWMS” tells you nothing. A file named with the project, date and trade tells you everything you need to know before you open it.
The same applies to physical records. If you keep signed paperwork, it needs to be filed by project and by record type, not in a box marked “site stuff”. And it needs to be scanned, because paper burns, floods and gets lost in moves. The NSW Government’s flood risk management manual is written for a different purpose, but the principle it reflects is relevant to any business holding records in a flood-prone area: some risks are foreseeable, and planning for them is cheaper than recovering from them.
The test of a retrieval system is simple. Pick a project that finished a few years ago and try to produce, within a few minutes, the induction records for a named worker and the inspection records for a named piece of plant. If you cannot, the system needs work before you need it.
The mistake that costs the most. Treating records as a site issue rather than a business system. When the paperwork lives only on site, or only on someone’s phone, it disappears at demobilisation, and the loss is not discovered until a claim or investigation asks for it years later, when nothing can be recreated.
Worked example: a builder who could not produce the file
A builder in western Sydney runs a small residential operation, typically two or three projects at a time, with a mix of direct labour and subcontractors. Safety documentation is done properly on site. Inductions are run, toolbox talks happen, plant is inspected, and SWMS are signed. The records are kept in a folder in the site shed, with photographs taken on the supervisor’s phone and emailed to the office when someone remembers.
Two and a half years after practical completion on a project, a former subcontractor lodges a claim relating to an injury they say occurred during the build. The insurer asks for the project’s safety records: induction records, SWMS, toolbox talks, plant inspections and any incident reports. The office has some of it. The site shed is long gone. The supervisor has changed phones twice. The subcontractor’s own paperwork was never collected. What remains is a partial picture that cannot be matched to dates or people.
The builder did the work. The builder cannot prove it. The claim is not necessarily lost, but the position is far weaker than it needed to be, and the cost of defending it falls largely on the business. A register of record types, a consistent naming convention, and a single cloud folder that outlives the project would have changed the outcome at a fraction of the cost.
That is the commercial reality of record keeping. The expense is small, recurring and predictable. The cost of not doing it is large, occasional and arrives without warning.
What to do before the next project starts
The work is not complicated, but it has to be done deliberately. The following steps are enough to move from ad hoc storage to something that will hold up.
- List the record types you generate on a typical project, and identify which ones are required by law, by contract or by your insurer.
- Write down the retention period for each type, based on the longest relevant obligation, and check the current requirement where you are unsure.
- Set up a single project folder structure that every project uses, with a consistent naming convention.
- Nominate one person who owns the register, and make closing out the records part of project completion, not an afterthought.
- Keep at least one copy outside the site and outside any personal device or account.
- Run an annual retrieval test on a completed project, and fix whatever you cannot find.
If you already use a WHS management plan, the record register belongs alongside it. Our free WHS management plan template is a reasonable starting point, and the related article on WHS management plans for small builders covers how to keep the plan itself workable. Builders working on higher-risk projects should also read our piece on working alone on site, because the record burden rises with the risk category.
Retention, storage and retrieval as continuing professional development
Record keeping sits inside the broader duty to manage risk, and it is one of the areas where the gap between what builders know and what they do is widest. Knowing that records matter is not the same as having a system that produces them on demand.
For NSW builders, this is the kind of practical topic that fits naturally into continuing professional development. The PointCPD guide to how NSW builder CPD works explains the framework, and the course catalogue covers safety, compliance and documentation topics that map directly onto the work described here. If you are new to the platform, start at the PointCPD home page and work through the safety category first.
The point is not to accumulate certificates. It is to build a business where the evidence exists, is findable, and can be relied on when it matters. Records are how a well-run site proves it was well run.
Questions builders ask
How long do I need to keep WHS records for a residential project?
It depends on the record type. Work health and safety law sets retention requirements for specific records, tax law sets a period for business records, and your contract and insurance policy may require longer. The practical approach is to identify the longest applicable period for each record type and retain for that. Where you are unsure, check the current requirement in the Work Health and Safety Regulation or the relevant tax legislation rather than relying on memory.
Can I keep safety records on my phone?
You can capture them on a phone, but you should not rely on the phone as the storage location. Devices get replaced, lost or wiped, and a record that only exists on one person’s phone is not under your control. Move the record into a project folder that belongs to the business as soon as it is created, and keep the phone as a capture tool only.
What should I do with subcontractor safety documentation?
Collect it and keep it on your own file, not just on theirs. If a subcontractor’s SWMS, insurance or induction records are only held by the subcontractor, you may not be able to produce them when a regulator or insurer asks. Include subcontractor documentation in your project register and treat it the same way you treat your own records.
How do I organise records so I can find them years later?
Use a consistent structure across every project, with a folder per project and subfolders per record type, and name each file with the project, date and record type. Keep a master register that lists what is held and where. Test the system by trying to retrieve a specific record from an old project; if it takes more than a few minutes, the structure needs simplifying.
Do I need to keep paper copies of signed documents?
You need to be able to produce a readable copy when required, and a clear scan of a signed document usually satisfies that. Keeping the original paper as well is sensible for records that are hard to replace, but paper alone is fragile and difficult to retrieve. The safest approach is a scanned copy in a controlled digital system, with the original retained only where it adds value.
What happens if I cannot produce a safety record when it is requested?
You may be treated as though the control or process was never in place, because there is no evidence to show otherwise. That weakens your position in an investigation, a claim or a dispute, and the cost of defending the matter falls on the business. The remedy is preventive: a register, a consistent naming system and storage that survives the end of the project.
Sources
- Record keeping for business · Australian Taxation Office
- Flood risk management manual · NSW Government
- Electrical safety · Safe Work Australia
- Key WHS statistics Australia · Safe Work Australia · 2025-10-01
Published 19 September 2026. General information for builders, not legal, financial or engineering advice for a specific job. Check current requirements with the relevant regulator or standard before relying on them.
