Eighteen months after practical completion, an FM team needs a replacement fan section on a roof. Somebody remembers there is a file: four lever-arch binders in a cupboard behind a spare kettle, opened for the first time this morning. The residual-risk section is there and it reads sensibly. It refers to a roof plan by number, with no revision, and that sheet has been superseded twice since the binder was printed.
The awkward part is that nobody in this story did anything wrong. CDM 2015 asks for a health and safety file that anyone doing later work can actually use: residual hazards, safe access, significant services, the structural principles you must not cut through. The binder contains all of it. It is a photograph of a building that has since moved on. Compiled in the last fortnight of the job, it was late before it was handed over.
Two different objects
A binder answers whether something was compiled. The live alternative answers what is true about this place, on this revision, if you have to work on it after we leave.
| Binder at completion | Live asset | |
|---|---|---|
| When it is built | Last weeks of the job | From the first residual risk that will survive construction |
| What it points at | A pile of PDFs and as-built dumps | The current issued identity for each relevant title |
| How you find a fact | Contents page, then a hunt | A query: location, system, hazard, access |
| What happens when a sheet revises | Hope someone reprints the appendix | The file row follows the supersede |
If you cannot say, for a given plant room, which residual hazards still apply and which drawing revision they sit on, what exists is a compilation rather than a file.
The questions it has to survive
The people who use the file are never the people who compiled it. A roofing contractor pricing a re-cover, a demolition designer on a later strip-out, a principal designer on an alteration, and — most often — a maintenance engineer with ninety minutes before the tenant complains. None of them will read two hundred pages to find the one sentence about the void they are about to climb into.
So the file has to survive a short list of questions:
- What residual hazards remain in this location after construction?
- How do you reach the plant, the roof, the façade, the void — and what must you not do on the way?
- Which significant services run here, and where are the isolation points that still matter?
- Which structural principles must later work respect?
- Which hazardous materials were left in place, and where?
If those answers need a ZIP opened and a filename guessed, the file is not queryable in any sense the next contractor would recognise. A contents page tells you where paper sits; a folder called 08_H+S_FILE_FINAL tells you when somebody stopped. A query returns the location, the hazard, the access method and the current drawing identity in one move.
None of which requires a new file type — only that each entry carries enough metadata for a stranger to the job to find it at all.
Tied to revisions, or it is fiction
The characteristic failure is a safety paragraph citing “see drawing 123” with no revision. The sheet moved. The residual risk did not. The binder still looks complete.
Think of the file as a set of statements that have to remain true against the issued set. When C02 supersedes C01 on a roof plan, every entry that pointed at C01 has to move, retire, or be reconfirmed. Risk that no longer exists — a temporary shaft since closed, a live edge that became a parapet — should leave the live file the way a superseded sheet does: still findable as history, no longer readable as instruction. That is revision control applied to safety sentences. If the file can still send a roofer to a drawing that is no longer current, it has failed, whatever the spine says.
A practical rule, and not an expensive one: no entry without a title, a current revision, and a date the entry was last checked against that revision.
The argument arrives eighteen months later
Handover is when the project wants to call the file finished; operations is when somebody first needs it, and those are rarely the same year.
Eighteen months is a fair guess at the first serious test. A chiller is replaced, a tenant fit-out opens a riser, a façade panel fails on a windy Sunday. The people on site were not on the original job, so they will either ask the file the questions above or assemble an unofficial version from whoever still has a plot on a laptop. In my experience, once that second file exists it is the one the building runs on.
O and M manuals that arrive as four hundred PDFs, an asset register rebuilt from scratch, a golden thread that cannot say what is current — the same failure in a different folder. Wait until completion and you have scheduled the eighteen-month hunt.
Build the file while the residual risks are still being decided. When a designer closes a hazard, record what remains and on which revision. When a trade changes an access route, update the entry before the next issue. As-built information updates the file rather than starting it.
A test you can run on Monday
Pick one space the client will still have to maintain: a plant room, a roof, a basement void. Accept a record as the answer, not a recollection.
- Can you list the residual hazards in that space without opening a ZIP?
- For each hazard, which title and revision is current — and is that the revision in the issued set?
- How do you access the space safely, and is that method still true after the last design change?
- When was each entry last confirmed against that revision?
- If that revision were superseded tomorrow, who would move the file entry?
If (1)–(4) point at a live list tied to the register, you have an asset. If they point at a binder compiled for completion, you have a snapshot that will be late twice: once at handover, and again when somebody has to work on the building.
CDM 2015, the Building Safety Act, ISO 19650 and the project-specific pre-construction information each have owners, and they assume a file that later work can use. None of them treats a ring binder as proof that the duty was met, and none of them treats a method like this one as a certification.
The client and the principal designer can change what gets delivered, and most of it is a question of when. Ask for the file in the information requirements at the design stage, with named fields — location, system, residual risk, related title and revision, date last confirmed — instead of a close-out line item. Put it on the agenda at every design review, so entries get written while the person who closed the hazard is still under appointment. Give one named person the job of moving entries when a sheet supersedes, and pay for that time, because it will not happen in somebody's spare afternoon. Then, before the final account is agreed, name a plant room and have someone produce its residual hazards and current revisions while you watch. The bill is a fee line in the principal designer's appointment and an argument about who owns the register. The bill for skipping it lands on a maintenance engineer with a spanner and a superseded drawing, long after anyone is counting.
Read next: Permit to work on paper: a system designed to fail quietly, CDM 2015, ten years on: what the regulations assume about information, O and M manuals: from four hundred PDFs to a queryable dataset.