Compliance management software: what it must do
Requirements for compliance management software, worked back from the US duties it has to support: OSHA equipment standards for cranes, slings, extinguishers and lockout/tagout, and the NFPA standards your authority having jurisdiction enforces. What records must hold, what the audit trail must show, how reminders should escalate, and what no software can do.
By Hovermarks team
Quick answer. Compliance management software must know which assets carry which inspection requirements and when each is next due, hold a complete record of every inspection against the specific item, follow every deficiency through to a repair, and show who did what and when without allowing silent edits. In the US, OSHA equipment standards and the NFPA standards your authority having jurisdiction (AHJ) adopts set what those records must contain.
Feature lists are written by vendors. Duties are written by regulators. Start from the duties and every requirement has a reason you can point to.
Work back from the requirements
| Requirement | Source | What the record needs | What the software must do |
|---|---|---|---|
| Monthly hook and hoist chain inspection | 1910.179(j)(2) | Certification record: date, inspector's signature, serial number or other identifier | Capture a signature and the item ID on each record |
| Monthly running rope inspection | 1910.179(m)(1) | Certification record with date, signature, rope identifier | Same, per rope |
| Crane preventive maintenance | 1910.179(l)(1) | A program based on the manufacturer's recommendations | Schedule maintenance tasks per crane |
| Alloy steel chain sling periodic inspection | 1910.184(e)(3) | At least every 12 months; record of the most recent month inspected | One record per sling with a next-due date |
| Portable extinguisher inspection and maintenance | 1910.157(e) | Monthly visual; annual maintenance date kept for a year after the last entry or the shell's life, whichever is less | Monthly and annual schedules per unit; keep history |
| Lockout/tagout periodic inspection | 1910.147(c)(6) | At least annually; certification naming the machine, date, employees and inspector | Track per procedure; capture all four elements |
| Fire protection ITM | NFPA 10, 25, 72 as adopted by your AHJ | Inspection, testing and maintenance records per the adopted edition | Templates per standard; records per device |
Three requirements fall out of that table that spreadsheets handle badly: a next-due date for every item, an identifier that ties each record to one physical item, and a history that is never overwritten.
For the NFPA side in more detail, see NFPA compliance software: what the standards require of your records.
Evidence: what each record must hold
A record is evidence when someone who was not there can tell what happened:
- The item, by a unique ID and, where the standard asks, its serial number.
- The date and the person who did the work, with a signature where the standard calls for a certification.
- What was checked and the result, item by item.
- What was found, with photos where words are not enough.
- The correction: who it was assigned to and when it was completed.
- The next due date.
Audit trail: who changed what
A completed record should not change silently. Look for:
- A log entry for every create, edit and delete, with who and when.
- A log that cannot itself be edited, with a way to detect tampering.
- An export of the log for a date range, to hand to an auditor, insurer or AHJ.
No OSHA standard asks for a software audit log by name. The reason is practical: a record that could have been altered without trace carries less weight than one that could not.
Reminders that escalate
- Due today goes to the assigned technician.
- Overdue goes to the technician again and to a supervisor.
- Unassigned work goes to a manager, not into a void.
- Open deficiencies are chased, not just inspections.
Test it during a trial: create an inspection due yesterday, assign it, and see who hears about it and when.
Reporting
- Current position: due, overdue and completed, by site and equipment type.
- Item history: every inspection, deficiency and repair for one asset.
- Period pack: everything completed in a date range, with the audit trail, for an auditor or insurer.
What software cannot do
No software makes a facility compliant. It cannot decide whether a hook with a twist should come out of service, whether an inspector is qualified, or which NFPA edition your AHJ enforces. It can make sure the decision is recorded, attributed and followed up.
How Hovermarks maps to these requirements
- Templates. Built-in checklists for OSHA 1910.179 (monthly hook, chain and rope, and periodic crane), 1910.147 periodic lockout/tagout, 1910.178 daily forklift and 1926.1412 cranes, plus NFPA 10, 25, 72, 101 and 110 and ASME B30.9 slings. Records come out as branded PDF reports with the inspector's sign-off signature.
- Per-item schedules. Each QR-tagged asset carries its schedule and next-due date; a short code identifies it and is never reissued.
- Deficiencies. A failed or flagged inspection creates defects and corrective actions automatically, and a defect can become a work order.
- Audit trail. A hash-chained, tamper-evident audit log checked daily, with CSV and PDF export, on Professional. An auditor pack bundles a period's inspections and audit-log entries into one PDF.
- Reminders. Daily due-today emails to assignees, overdue digests with an optional summary to admins and site managers, overdue deficiencies and work orders chased, and a weekly compliance email.
- Data location. Your data is stored in the UK (Microsoft Azure UK South, backups in UK West). US hosting is available on request.