Building an RI&E tool and action plan
Every employer with staff must have a risk inventory and evaluation (RI&E), with an action plan that sets out what will happen for each measure and when. Appfront builds the tool that turns that plan into a living document rather than a PDF from 2022, with measures that each have an owner and a date.
What the RI&E and action plan require of you
The obligation derives from the Working Conditions Act (Arbowet) and applies to every employer with staff, regardless of size. You identify the risks the work poses to your employees, assess them, and record in an action plan which measures you will take and within what timeframe. The Netherlands Labour Inspectorate enforces this, and after an accident the RI&E is the first document requested.
Whether your RI&E must be reviewed by a certified core expert depends on your size and the instrument you use. Above twenty-five employees, review is always mandatory. If you have twenty-five or fewer employees, that review requirement only lapses when you use a recognised sector instrument; if you work without such an instrument, your RI&E must still be reviewed.
Where almost everyone goes wrong is not the inventory but the action plan. It is drawn up, approved and then becomes a file on a drive. Measures have no owner, deadlines pass unnoticed, and at the next update half of them are still open. That is precisely why we build the action plan as the heart of the tool, with the inventory around it, and not the other way round.
If you are designated a critical entity, a second assessment follows that goes beyond occupational risks: disruption, sabotage and natural disasters affecting your critical processes. See Wwke software.
If you work with large quantities of hazardous substances, the Seveso regime also applies. Since 2024 it forms part of the Environment and Planning Act. The practical side of this is covered in the Seveso app.
How we build your RI&E tool
We start with the measures and their owners. An assessment that does not lead to assigned actions changes nothing on the shop floor.
We review your current assessment: which risks have been identified, which measures remain open and how old they are. This immediately shows you where things have stalled, which is usually more persuasive than any argument.
Risks vary by location, department and role. We design the structure so that a warehouse worker sees different risks from an office worker, and so that a manager only sees the measures for which they are responsible.
We work in sprints and begin with the action plan, assigning owners and deadlines, as that is where most of the gains lie. Your health and safety officer takes part and checks each sprint against the measures that are currently open.
If your RI&E needs to be reviewed, we set up the export in the format the occupational health expert wants to receive, with their comments fed back into the system. After that, we hand over to your health and safety officer and managers.
What the tool actually does
Six components that turn a document into a working process. What you need depends on your size and the number of locations.
Assessment by department and role
Risks recorded where they occur, with ratings you set yourself. Employees see what applies to their workstation rather than the entire document, which makes it more likely they will actually read it.
Action plan with owner and date
Each measure is given a responsible person and a deadline, and appears on their list. An approaching deadline triggers a signal to both them and the health and safety officer. A deadline passing unnoticed is exactly what you want to rule out.
Reports and incidents that feed back
Unsafe situations, near misses and accidents come in through the same route and are linked to the risk they relate to. A report that does not lead to a reassessment remains visibly open.
Updates with history
A renovation, a new machine or a changed process calls for the RI&E to be revised. The system keeps track of versions, so you can show what applied when and why something was changed.
Access for the works council and occupational health expert
The works council has a right of consent and the occupational health expert needs to be able to review the assessment. Both receive their own role with the appropriate access, rather than a PDF by email where nobody knows which version is the latest.
Overview for the board
How many measures are open, how many are overdue and where they sit. That is the conversation a board needs to have, and it is a different conversation from the substantive assessment itself.
Who we build for
Four situations in which a bespoke tool offers more than an off-the-shelf package. The difference lies in the complexity of your risks and the number of locations.
Construction, technical and installation work
Changing project sites with their own risks, where the general RI&E is supplemented with an assessment for each project. Often combined with the VCA file, as toolbox talks and reports belong to the same process.
Manufacturing and industry
Machine-related risks and the obligation regarding work equipment that follows from them. The assessment shows which equipment requires statutory inspection; those items go into the inspection log.
Healthcare, education and government
Large workforces with very different roles, where a single document does not work for everyone. Here the key point is that an employee sees what applies to their workstation.
Organisations with multiple locations
A separate assessment for each site, with an overview for the board above it. If this is linked to your HR system, roles and departments are carried over automatically.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →Technology and integrations
What we deploy follows from your organisation. The focus here is not the technology but usability: a tool that only the prevention officer opens changes nothing. Managers and employees must be able to use it without any explanation.
Why Appfront
The action plan is the heart of it
Almost every organisation has an RI&E; far fewer have an action plan that is actually followed through. We therefore build from measures with an owner, with the inventory around them.
Visible to those it concerns
A document of eighty pages is not read. By attaching risks to a role and a workplace, each person sees only what applies to them, and something actually happens as a result.
Connecting to what is already running
Roles, departments and employees are already in your HR system. We pull them in so that the structure keeps pace as your organisation changes.
Honest about our role
We are not an occupational health service and not a core expert, and we do not complete your RI&E on the content side. We build the system in which your own experts and managers work.
Security and privacy
An RI&E tool holds more sensitive data than most quality systems. Accident reports can describe injuries and be traceable to an employee; where psychosocial workload is concerned, it deals with work pressure, unwanted behaviour and sometimes a colleague or manager. This is data that causes harm in the wrong hands, and sometimes it is special category personal data.
We therefore design for that deliberately. Reports of unwanted behaviour go through a separate, protected route that does not reach the line manager, with the option of anonymous reporting where appropriate. Health data belongs with the occupational health service and not in your system; we deliberately build no field for it. Reports focus on risks and measures, not on individuals. Access is granted by role and by department, with a temporary role for the core expert who sees only what they need to assess. How we handle security ourselves is set out in our information security policy; reports of vulnerabilities from outside go through our CVD policy.
Frequently asked questions about the RI&E
Yes, as soon as you have staff on your payroll. The obligation follows from the Working Conditions Act and has no lower threshold based on company size. What does vary is whether your RI&E must be assessed and what level of detail is appropriate. Temporary agency workers and interns also fall under your duty of care, so they belong in the inventory even if they are not on your payroll.
For organisations with more than twenty-five employees, assessment by a certified core expert is always mandatory. If you have twenty-five employees or fewer, that obligation lapses only if you use a recognised sector instrument. If you do not use a recognised instrument, your RI&E must still be assessed, even for a small business. This detail is often overlooked and is immediately noticed during an inspection.
For each risk, the measure you will take, who is responsible for it, and within what timeframe it will happen. That last part is what distinguishes the action plan from a wish list. In practice it is precisely the owner and the date that are missing, and the document then stalls after approval. We therefore build those two as mandatory fields and make the measure appear on the responsible person's list.
There is no fixed deadline in the law. The rule is that the RI&E must be kept current: it should be revised when a building is renovated, new machinery is introduced, a work process changes, a reorganisation takes place, or after an accident. In practice, many organisations also run a periodic review alongside this. We build those triggers in as signals, so that updates follow from what is actually happening and not only from a date.
That is often a good starting point, and with twenty-five employees or fewer it also reduces the assessment burden. Where a sector instrument falls short is with organisations that have unusual processes, several locations, or roles that don't fit the template. It also doesn't solve the underlying problem: it produces a document, not a living action plan. We are upfront about when an instrument is sufficient and when a bespoke tool isn't worth the effort.
Those go through a separate, protected route that does not reach the line manager, and can be anonymous where desired. These are sensitive reports that require different handling from a report about a loose cable, so they don't belong on the same list. We deliberately do not build in health data: that belongs with your occupational health service, not in a system that managers work in.
That software is intended for the service provider itself: client records, consultation hours and sickness absence support. This tool is for you as the employer: your own risks, your own measures and your own action plan. The two meet when your occupational health service reviews your RI&E, and for that we build a temporary role with limited access rather than an export sent by email.
That depends on the number of locations and roles, whether HR integrations are needed and whether the reporting route must be included. The action plan with owners and deadlines is usually quick to put to use and delivers the most value; the differentiated risk structure per role takes more effort. We give a reasoned estimate after the discovery phase, once we have reviewed your current RI&E.
Ready to build a RI&E tool?
Tell us how many employees and locations you have and where your action plan currently stands, and we will help you think through the structure per role, the measures with owners, and the reporting route. We build this as a standalone application or as part of a broader custom software development project or a web application. For the evacuation side, attendance registration is the practical next step.