Do we need digital OHS software?

No. The requirement is the content of internal control, not a particular tool. Small employers can meet it with simple documents.

What should we look for?

That it covers the items in section 5, that deviations and review are actually used, and that it does not collect more personal data than necessary.

Can we run OHS work in Word and Excel?

Yes. The regulation sets requirements for content and verifiability, not for software. What matters is that the routines exist, are used, and leave a trace that can be reviewed.

What separates an OHS system from an OHS handbook?

The handbook is the text. The system is how that text becomes action: who does what, how deviations are reported, and when the whole is reviewed.

OHS system for small and medium employers

Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS. Last reviewed 15 September 2026.

An OHS system is not primarily a piece of software. It is how an employer governs health, safety and the working environment: what has been decided, who does what, what happens when something is found, and how that is reviewed. Software can keep order in it — it cannot decide it for you.

What the system must cover

Section 5 of the Norwegian Internal Control Regulations sets the minimum: objectives, responsibility, mapping with risk assessment, plans and measures, deviation routines, and review of the system itself. A system covering those in a way employees actually recognise beats a system with more modules nobody uses.

Before you buy anything

Write down the four things no vendor can supply: what you have decided, who is responsible, which hazards exist here, and what happens when something is reported. Without those, software becomes a place to file empty forms. With them, choosing a tool is a practical decision about price and usability.

How to judge whether it governs anything

Ask three questions. What has to happen before anything happens? Who has to take the initiative? Which needs are covered by default, without anyone having to ask for them? If almost everything is triggered by an employee reporting a case, the system is reactive in form, no matter how many modules it has.

Privacy belongs in the choice

An OHS system collecting more about individuals than it needs creates a new risk instead of removing one. Consider what is stored about whom, and for how long. Our own review reads only the governance document — not employees — and is designed to avoid processing health data.

Paper, spreadsheet or software

All three can meet the requirements. Paper and shared documents work for few employees and stable operations, but become fragile once several people update at once. A spreadsheet keeps order in measures and deadlines, and is often the first step. Software adds alerts, history and roles, and earns its price once deviations are reported often enough that follow-up would otherwise slip. Choose by how many people will use it, not by module count.

What is enough for a small employer

Under ten employees and low risk: a short document, a list of measures with deadlines, and somewhere to record deviations covers the requirements. Spend the money on mapping and training rather than licences. As you grow, or add sites, deviation follow-up is what becomes unmanageable first — that is the signal that should trigger a tool purchase.

Common mistakes when choosing

Buying before the decisions are made: the system fills with generic forms and becomes an archive. Measuring use in forms completed rather than deviations closed. Putting health data into the OHS system because the field exists. And choosing a system none of the employees has tried before signing — usability decides whether deviations get reported at all.

Questions to ask a vendor

Where is data stored, and who has access? What kind of information does the system invite us to record about individuals, and can those fields be switched off? How long is it kept, and how do we delete it? Can we take the content with us if we switch? And what does a deviation look like from report to closure? The first two answers tell you most about the privacy risk you are taking on.

What to do first

Before looking at tools, write down the four things no vendor can supply. With those in hand, demos are easy to judge. If you want to know whether your governance document actually governs anything before you invest, you can have it read through.

Test your governance document

One document reviewed free of charge. No individual cases, no health data.

Sources

Frequently asked questions

Do we need digital OHS software?: No. The requirement is the content of internal control, not a particular tool. Small employers can meet it with simple documents.
What should we look for?: That it covers the items in section 5, that deviations and review are actually used, and that it does not collect more personal data than necessary.
Can we run OHS work in Word and Excel?: Yes. The regulation sets requirements for content and verifiability, not for software. What matters is that the routines exist, are used, and leave a trace that can be reviewed.
What separates an OHS system from an OHS handbook?: The handbook is the text. The system is how that text becomes action: who does what, how deviations are reported, and when the whole is reviewed.