Updated September 2026

Tier-1 Assurance Guide

Zero Harm Construction Software (2026) — group assurance for enterprise and tier-1 contractors

ByThe QHSE Standard Editorial Team·Independent QHSE / EHS / ESG software analysts·2026-09-18

At tier-1 scale the zero-harm problem is not choosing an inspection app. It is whether a group HSE function can produce, for one named worker on one named date under one named tier, the evidence a client, an insurer or an inspector will ask for — and whether the number that reaches the board is honest.

Quick Facts

Duty regime: CDM 2015 (GB)
Management system: ISO 45001
Scope: Injury + ill health
Vendors evidenced: 2 of 13

Zero harm and zero incident: same aspiration, different regulatory grammar

The variation in wording marks national and industry traditions rather than genuinely different approaches. Sven Ove Hansson's chapter on zero visions in The Vision Zero Handbook (Springer, 2022) makes the point directly: the phrase an organisation picks tells you very little about how its safety work is actually done.

Where a real distinction does get drawn, it is one of scope. Zero harm is used more broadly — extending past safety incidents to occupational ill health, which is to say dust and silica, hand-arm vibration, noise and mental health, and sometimes to environmental harm as well. Zero incident is more often framed around eliminating accidents. That scope difference has a direct software consequence, covered below.

You are probably on the wrong page if you are a US general contractor working to OSHA 29 CFR 1926 and measured on TRIR and EMR — see zero-incident construction technology 2026, which is built around Focus Four, the OSHA 300 log and site-level programme design.

What a board-level zero KPI does to the data underneath it

A zero target published at board level exerts steady downward pressure on anyone's willingness to come forward with something that would affect the score. Sidney Dekker's account of this in Professional Safety (ASSP, 2025) describes the organisational response as safety theatre: the visible apparatus of assurance grows while the appetite for bad news shrinks. Serious incidents can and do follow long injury-free runs — studies in aviation and construction have found that the greener the audit or culture survey, the higher the fatal risk (Barnett and Wang, 2000; Saloniemi and Oksanen, 1998, both as cited in Dekker, 2025).

The counter-evidence is real and belongs here. Bellamy (2015) and Yorio and Moore (2018) found fatalities predictable from lesser severities; Marshall and colleagues (2018), across roughly 50,000 companies over 28 months, found Heinrich's triangle not statistically valid but the discrepancies small enough to conclude cautiously that minor incidents may still carry signal. All are cited as they appear in Dekker (2025); we have not read the originals.

Read as governance requirements rather than philosophy, Dekker's prescriptions are concrete: trade perfection for integrity; disavow incentives tied to achieving zero; declutter the system so critical risks are not lost among slips and trips; run learning reviews on work that went right; and connect safety performance to business continuity and reputation at board level. Dekker and Tooma made the measurement half of the argument in the International Labour Review (2022), proposing a capacity index in place of incident-based metrics.

We are aware this sits oddly on a page recommending zero-harm software. Tier-1 contractors will run these programmes whatever we think of the banner; the platform choice determines whether the programme gets honest data, and that is worth getting right either way.

What a principal contractor has to evidence under CDM 2015

Duties as set out in HSE's guidance for principal contractors, each paired with the artefact the software actually has to produce.

Prepare a written construction phase plan before the construction phase begins, then implement, review and revise it

A living CPP with version history and an audit trail of who revised what, not a PDF frozen at mobilisation

Plan, manage, monitor and coordinate the whole construction phase

Coordination records tied to work packages, not to calendar meetings

Account for risks to everyone affected, including the public

Risk records whose scope field can name non-workers

Liaise with the client and principal designer throughout

Design-change and MOC records that cross the contractor/designer boundary

Ensure all workers have site-specific inductions plus any further information and training they need

One induction record per worker per site, retrievable by name and date

Ensure suitable welfare facilities from the start and for the duration

Welfare inspection records dated from before first work, not from first audit

Consult and engage with workers on health, safety and welfare

Consultation records that are distinguishable from a briefing acknowledgement

Verify competence before appointment

A competence verification record timestamped at appointment, and re-checked since

Prevent unauthorised access to the site

An access log reconcilable against the induction record

The ISO 45001 clauses the platform has to evidence

▸8.1.1 — operational planning and control criteria
▸8.1.2 — eliminating hazards and reducing OH&S risk through the hierarchy of controls
▸8.1.3 — management of change, for planned temporary and permanent changes
▸8.1.4 — procurement: contractor selection, prequalification, contractual arrangements, performance monitoring, on-site coordination and outsourcing
▸8.2 — emergency preparedness and response

In practice 8.1.4 is the clause that separates an enterprise platform from a site tool, because it demands evidence about organisations you do not employ.

The standard text is paywalled. The above is a paraphrase of the clause subjects by number, not a quotation, and should be read against your own copy.

The half of zero harm that injury software does not cover

Health surveillance and exposure records — dust and silica, hand-arm vibration, noise — and mental-health records need to exist as first-class record types with their own retention periods and access rules, not as a subtype of incident. Injury-shaped platforms routinely model them as the latter, and the problem only surfaces at the first health-surveillance audit.

Make the access question a demonstration rather than an assurance: ask the vendor to show you that a site supervisor cannot open a restricted occupational-health record. Watch it happen in the demo tenant.

We treat this as an open question for every platform on this page, including Cority — whose own entry in our evidence file records restricted health-record access as something a buyer must have demonstrated rather than something we have confirmed. See also occupational health software.

Evidence through tiers: who holds the record when the work is two subcontractors deep

This is the section that decides an enterprise evaluation, and it is the one no competing page treats as a buying axis. Run it as a demo script rather than a questionnaire — every vendor answers yes to a questionnaire.

1. The named-worker test. One named worker, one named date, one named tier. Ask for their induction, competency and permit evidence in a single query, without a second login. Time it.
2. Status decay. Prequalification captured at award — does the platform re-validate it at week 30, or has it simply stored a document that expired in month two?
3. Reconciliation versus duplication. Does it reconcile with ISNetworld, Avetta, Veriforce and Highwire, or does it duplicate them and leave you maintaining two versions of the truth?
4. Demobilisation. What happens to the evidence when the subcontractor leaves and stops paying for their side of the platform?
5. Joint ventures. Who owns the data in a JV or consortium, and what happens at close-out? This is where group assurance usually breaks, and it is almost never agreed before work starts.

For the prequalification platforms themselves see contractor management software 2026 and contractor safety management software 2026.

Group, client and insurer reporting

Multi-country and multi-entity rollup needs one taxonomy with room for local variation — a group that forces identical process on every region gets compliance on paper and workarounds everywhere else. JV and consortium reporting boundaries have to be modelled explicitly, because a number that silently includes or excludes a JV is worse than no number.

Carry the editorial spine of this page into the board pack itself: reporting volume and unique-reporter participation belong in front of the board as health signals alongside the lagging rates, and a falling near-miss rate is an item for the board to interrogate, not to celebrate. A board that only ever sees a rate going down has been given a reason not to ask questions.

Nine questions for an enterprise evaluation

1. Can one group process model be configured without forcing every region onto an identical process?
2. Does the entity and permission model match how you are actually structured — operating companies, JVs, consortia?
3. Is offline proven for the specific module you are buying, rather than for the brand?
4. Is management of change a first-class workflow, or a form someone fills in afterwards?
5. Do the contractor and procurement workflows map to ISO 45001 8.1.4, including performance monitoring and on-site coordination?
6. Can occupational-health records be restricted so a site supervisor cannot open them? Ask for a demonstration, not an assurance.
7. Is severity reclassification audit-logged and versioned, so a later downgrade stays visible?
8. What are the data-residency and works-council or consultation constraints in each country you operate in?
9. What does exit look like — can you get your evidence chain out in a usable form, and who owns the JV data?

Module scope differs by tier. A capability described for one product in a vendor's portfolio is not automatically available in the deployment you are being quoted for — confirm it against the specific SKU.

Platforms we could evidence

Enablon (Wolters Kluwer)

The reference enterprise pick for a board-level zero-harm programme at a tier-1 major: EHS and sustainability alongside operational risk, process safety and control-of-work in one portfolio. That combination is what infrastructure and EPC majors need when a single programme spans construction sites and live process assets. Enablon Go documents offline inspections, checklists, observations, comments and action-plan creation.

Limitation: Offline is documented for Go, not for every control-of-work module. If your permit workflow has to survive a basement or a tunnel, get that specific module demonstrated offline before signing.

Intelex

The pick when the enterprise problem is standardising one EHSQ process model across dozens of operating companies and acquisitions. Configurable applications with form and workflow building let a group HSE function impose a single taxonomy without forcing every region onto an identical process — which is usually what kills a global rollout.

Limitation: Safety Essentials, Advanced and Enterprise are different buying scopes with different mobile capability. Intelex's own pricing page describes Essentials mobile access as responsive web while Advanced and Enterprise list an app. A packaged safety deployment is not the full configurable platform, and should not be evaluated as though it were.

Ordered by the depth of independent evidence we hold, drawn from our own vendor profile research rather than from vendor marketing. Commercial partners are never ranked. Two of thirteen candidates cleared that bar; the rest are named below.

Vendors we looked at and did not list, and why

Each line describes what we could not establish as of September 2026. None of it asserts that a capability does not exist.

Cority. Not a capability failure — an unresolved verification item. Our evidence entry records restricted-access occupational-health records and offline scope as things a buyer must have demonstrated rather than things we have confirmed. We will not rank a platform on a health-record claim we have not seen proven.
VelocityEHS. Its contractor-safety and permit-to-work material lists construction as one of fifteen industries, and the permits named are hot work and confined-space entry — a process-plant permit set rather than a construction one.
Evotix. The testimonial companies named on its construction page are not construction contractors, and the product tier that supplies permits is not stated.
Ideagen Workforce Safety (formerly Damstra). Capability checks out, but its own positioning is mining-heritage and it is not covered by our Ideagen EHS evidence profile, so we will not link it as an evidenced pick.
EcoOnline / eCompliance. No construction, contractor-management, induction or permit evidence in our profile for it.
Novade. No evidence profile on this site, and its market-leadership and multi-country claims are its own — we could not corroborate them independently.
HammerTech, SiteDocs and the GC-tier tools. Genuinely strong at project-site level — HammerTech is our first pick on the general-contractor page — but we found no evidence of multi-entity group rollup, JV data-ownership handling or group assurance reporting, which is what this page is about.

An enterprise rollout sequence

Set critical risks at group level — and let regions add, not subtract. A group list that every region can edit downward is not a group list.
Prove the evidence chain on one JV and one three-tier package before any global rollout. If the named-worker test fails there, it will fail everywhere, and it is cheaper to find out on one package.
Instrument participation rate before outcome rate. You need a baseline for how much people are telling you before you can interpret any change in what they are telling you about.
Agree with the board, in writing and before go-live, that reporting volume going up is the expected first result. Without that agreement the programme's first success looks like its first failure, and someone will react accordingly.

What we could not verify

×Any audited outcome data from any platform on this page.
×Any evidence that a zero-harm vision, as a defined variable, reduces incident rates.
×ISO 45001 clause content beyond clause subjects — the standard is paywalled and we paraphrase.
×Per-module offline and permission behaviour, which is unproven for most vendors here.
×Enterprise pricing, which none of these vendors publishes.

How this list was built

Thirteen platforms were considered and each checked twice: once on whether it does what is claimed at group scale, and once on whether the cited source actually says what it is claimed to say. Ambiguous evidence counted against inclusion. We did not test any of these platforms hands-on, and enterprise capability varies by purchased tier — treat every capability statement here as a question to put to the vendor, not as a specification.

The numbered list is editorial and carries no commercial relationship. Tekmon is a commercial partner of The QHSE Standard and appears only in the disclosed featured card above the list. More on how we work: our editorial team and methodology.

Building an enterprise shortlist?

Answer six questions and we will match you to platforms sized for your entity structure, country count and supply-chain depth — not to whoever paid the most.

Get matched

Frequently Asked Questions

What is zero harm, and how is it different from zero incident?

They are near-synonyms with different national provenance. Zero harm is the British and Australian lineage, spreading through major contractors from the early 2000s; zero accidents and zero injuries are the North American lineage, traceable to the Construction Industry Institute's 1993 publication SD-86. Sven Ove Hansson's chapter in The Vision Zero Handbook argues that the phrase an organisation adopts says little about how its safety work is actually conducted. Where a real distinction is drawn, zero harm tends to be used more broadly — extending past safety incidents to occupational ill health such as dust and silica exposure, hand-arm vibration, noise and mental health, and sometimes to environmental harm — while zero incident is framed around eliminating accidents.

What is the best zero harm software for enterprise and tier-1 contractors in 2026?

Of thirteen platforms considered, two had enterprise capability we could evidence from our own profile research: Enablon, which is the reference pick where a programme spans construction sites and live process assets because EHS sits alongside operational risk, process safety and control-of-work in one portfolio, and Intelex, which is the pick where the problem is standardising one process model across many operating companies and acquisitions. Both have stated limitations we name on this page. We are not padding the list to five — the other eleven are named with the reason each was left out.

Which ISO 45001 clauses does zero-harm software have to evidence?

Principally clause 8. Paraphrasing, because the standard text is paywalled: 8.1.1 covers operational planning and control criteria; 8.1.2 covers eliminating hazards and reducing OH&S risk through the hierarchy of controls; 8.1.3 covers management of change for planned temporary and permanent changes; 8.1.4 covers procurement, including contractor selection, prequalification, contractual arrangements, performance monitoring, on-site coordination and outsourcing; and 8.2 covers emergency preparedness and response. In practice 8.1.4 is the clause that separates an enterprise platform from a site tool, because it demands evidence about organisations you do not employ.

What must a principal contractor evidence under CDM 2015?

Per HSE's guidance for principal contractors: prepare a written construction phase plan before the construction phase begins and then implement, review and revise it; plan, manage, monitor and coordinate the whole construction phase; account for risks to everyone affected including members of the public; liaise with the client and principal designer throughout; ensure all workers have site-specific inductions plus any further information and training they need; ensure suitable welfare facilities from the start; consult and engage with workers on health, safety and welfare; verify competence before appointment; and prevent unauthorised access. Each of those maps to an artefact the software has to be able to produce on demand, which is the table in the CDM section of this page.

How do you prove competency and induction when the work is done by a sub of a sub?

The test we would apply in a demo: pick one named worker, one named date and one named tier, and ask the platform to produce that worker's induction, competency and permit evidence in a single query, without logging into a second system. Then ask three follow-ups — does prequalification status captured at award get re-validated at week 30, or only stored; does the platform reconcile with ISNetworld, Avetta, Veriforce and Highwire or duplicate them and leave you maintaining two versions of the truth; and what happens to the record when the subcontractor demobilises and stops paying for their side of it. Joint ventures and consortia are where this usually breaks, because nobody agreed who owns the data before work started.

Should a board measure group safety performance on TRIR?

Not on TRIR alone, and not with anything attached to it. Dekker and Tooma argued in the International Labour Review in 2022 for replacing incident-based metrics with a capacity index, on the grounds that rates built on low-frequency events say more about reporting behaviour than about risk. The practical governance position: present reporting volume and unique-reporter participation to the board as health signals alongside the lagging rates, and treat a falling near-miss rate as an item to interrogate rather than to celebrate. Above all, do not tie remuneration to an incident count — that is the single most reliable way to make the data underneath a zero-harm programme go quiet.

Does zero harm cover occupational ill health as well as injuries?

In the traditions that use the phrase, generally yes — and this is the half of the programme that injury-shaped software tends not to cover. Health surveillance and exposure records for dust and silica, hand-arm vibration and noise, and mental-health records, need to exist as first-class record types with their own retention and access rules, not as a subtype of incident. The buying test is an access test: ask the vendor to demonstrate that a site supervisor cannot open a restricted occupational-health record. We treat that as an open question for every platform on this page.

Why are the enterprise EHS suites not all listed here?

Because the shortlist was built on evidence rather than on market presence. Each candidate was checked twice — once on whether it does what is claimed at group scale, and once on whether the source cited actually says what it is claimed to say — and dropped by default where the evidence was ambiguous. Cority is the clearest example: it is excluded not because it lacks capability but because our own evidence entry records its health-record permissions and offline scope as items a buyer must have demonstrated, and we will not rank a platform on a claim we have not seen proven.