Enterprise EHS Software RFP: Requirements Checklist

Why buying EHS software for a group is different

A single plant can choose an EHS tool by watching a demo and checking that its forms fit. A multinational or industrial group cannot. The system has to hold dozens or hundreds of sites in several countries, respect each country's legal recordkeeping, give the group one set of comparable numbers, and still be quick enough that a supervisor on a night shift will use it from a phone. Before the RFP you usually need an approved budget: our guide to the business case for enterprise EHS software shows how to build one.

Most failed rollouts do not fail on features. They fail because the organization model does not match the group, access rules leak data between companies, or sites keep their own spreadsheets because reporting is too slow. This checklist is built around those risks. Use it to write your request for proposal (RFP) and to structure vendor demos.

1. Start from your group reporting standard, not the vendor's

Before you talk to vendors, agree what the group will measure: the definitions dictionary, the injury rate basis (200,000 or 1,000,000 hours), who is in scope (employees, contractors, visitors), the event taxonomy and the severity scale. Our playbook for standardizing HSE reporting across countries walks through each decision, and our guide to leading vs lagging safety KPIs covers the scorecard.

Then put that standard into the RFP and ask every vendor to show it working in their system with your own categories. A tool that forces its own taxonomy on you will force a second migration later.

2. Organization model and access control

This is the requirement that separates enterprise systems from site tools. Ask vendors to model your real structure during the demo, not a sample company.

Hierarchy: can the system hold group, region, country, legal entity or cluster, and site in one model? Can a site move between clusters after a reorganization without losing its history?
Scoped access: can a country manager see only their country and everything below it? Is that scope enforced on the server, or only hidden in the screens and reports? (See our guide to role-based access in EHS software.)
Roles: who can approve investigations, close actions, change risk matrices or edit forms? Can configuration be limited to a small group of roles?
Audit trail: when a record or classification changes, does the system keep who changed it, when and what it was before?
Drill-down: can every number on a group dashboard be clicked through to the records behind it?

3. Workflows and modules: test the loop, not the list

Every vendor has a long module list. What matters is whether each process closes the loop from report to verified action. In the demo, ask the vendor to run one event end to end.

Process	What to test in the demo
Incidents and investigation	Report from a phone with a photo, classify it with your categories, run a root-cause analysis and record lessons learned for other sites.
Hazards and near misses	How long does a report take on a phone? Who is notified, and how is the response time measured?
Risk assessment	Can the group publish one risk matrix and let sites assess against it?
Actions and CAPA	Every finding becomes an action with an owner and due date; overdue actions are visible at each level; effectiveness is checked before closure.
Audits and inspections	Checklists with photos, scheduled by site; findings flow into actions automatically.
Training and competence	A matrix of required versus completed training per person and site, with refreshers due.
Contractors and visitors	Contractor cases recorded in the same system and flagged, so they can be reported with or without employees.
Emergency preparedness	Teams, drill schedules and drill reports kept as evidence for each site.

4. Country recordkeeping: the statutory layer

Group software does not remove local legal duties; it should make them easier to meet. Ask each vendor how the system keeps the extra fields and outputs that a country's rules require, while the same record feeds group KPIs. One example from the United States shows the kind of detail involved:

US OSHA allows injury and illness records to be kept on a computer, provided it can produce equivalent forms when they are needed (29 CFR 1904.29(b)(5)).
A recordable case must be entered within seven calendar days of receiving information that it occurred (29 CFR 1904.29(b)(3)).
Since 2024, establishments with 100 or more employees in designated industries must also submit case-level data from their OSHA Form 300 and 301 electronically each year, by 2 March.

Other countries have different rules, forms and deadlines. Make a list of the countries in scope, the local owner for each, and the outputs they need, and ask vendors to show how each is produced. (This is general information, not legal advice. Confirm local duties with qualified advisers in each country.)

5. ISO 45001 across many certified sites

Many groups certify several sites under one ISO 45001 management system. Accredited certification bodies audit such organizations under IAF MD 1, the International Accreditation Forum's mandatory document for multi-site organizations. Among other things, IAF MD 1:2023 says that a central function must ensure "data is collected and analyzed from all sites", that all sites are subject to the internal audit programme, and that when a nonconformity is found at one site, the organization checks whether other sites are affected. For the initial audit, the sample of sites is based on the square root of the number of sites, rounded up.

That has practical consequences for software. Ask vendors to show:

internal audit coverage by site, so you can prove every site is in the programme;
how a nonconformity at one site is reviewed for the others;
evidence grouped by ISO 45001 clause, so gaps show up before the certification body arrives.

Our guide to ISO 45001 multi-site certification explains the sampling rules in detail.

6. Data protection and security

EHS records contain personal data about employees, contractors and visitors, and injury records can include health information. If you operate in the EU or process EU residents' data, your EHS vendor will usually act as a processor under the GDPR, and Article 28 sets what the contract must contain. Use it as a checklist for the data processing agreement. Article 28(3) requires, among other things, that the processor:

processes personal data only on your documented instructions;
ensures its staff are bound by confidentiality;
takes the security measures required by Article 32;
uses other processors (sub-processors) only with your prior written authorization, and tells you about changes so you can object (Article 28(2));
helps you respond to data subject requests and meet your duties under Articles 32 to 36;
deletes or returns all personal data at the end of the service, at your choice;
makes available the information needed to demonstrate compliance, and allows audits and inspections.

Ask about breach handling too. Under Article 33, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people; the processor must tell the controller without undue delay. Ask the vendor how fast it will tell you, and how. Where processing is likely to result in a high risk, Article 35 requires a data protection impact assessment, so ask what support the vendor provides. Laws outside the EU differ; check the ones that apply to you. Our guide to the GDPR data processing agreement for EHS software goes through each clause.

7. Front-line adoption

The best group dashboard is worthless if sites do not report. Test the system with the people who will use it most:

A supervisor reports a near miss on a phone, with a photo, in under a minute.
Labels and forms appear in the languages your sites work in, while the codes behind them stay the same for group reporting.
The person who reported can see that something was done, which keeps reporting alive.

8. Pilot and score before you sign

Shortlist two or three vendors and run a time-boxed pilot in one country or business unit, using real events and your own categories. Score with a weighted table agreed before the demos. The weights below are an example only; set your own.

Criterion	Example weight	Evidence to collect
Organization model and scoped access	20%	Your structure modelled; access tested with three different roles
Workflows close the loop	20%	One incident and one inspection run end to end
Group reporting and drill-down	15%	Your KPIs, your rate basis, clicked through to records
Front-line usability	15%	Time to report on a phone, measured with site users
Country and ISO 45001 evidence	10%	Statutory outputs and clause-grouped evidence shown
Data protection and security	10%	Draft DPA reviewed against Article 28(3); breach process
Rollout support and total cost	10%	Rollout plan for your site count; all costs for the full term

RFP question list

#	Question to every vendor
1	Show our group, regions, countries, clusters and sites in one hierarchy. What happens to history when a site moves?
2	How is access scoped, and is it enforced on the server?
3	Which roles can approve, close and configure, and can we restrict them?
4	Does every record keep a full change history?
5	Can every dashboard number be drilled back to its source records?
6	Can we load our own taxonomy, risk matrix and KPI definitions?
7	Which rate basis do your dashboards use, and can we set it?
8	How are contractor cases and hours recorded and reported?
9	How do you support each in-scope country's statutory records and outputs?
10	How do you evidence internal audit coverage and cross-site review of nonconformities?
11	Please provide your data processing agreement and list of sub-processors.
12	How quickly, and how, will you notify us of a personal data breach?
13	How long does a phone report take, and in which languages?
14	What does a rollout to our number of sites look like, and who does what?
15	What happens to our data at the end of the contract?

Where AccelSafety fits

AccelSafety, our enterprise HSE software, was built for this kind of evaluation. It uses one organizational hierarchy from group to region, country, cluster and site; access is scoped to each user's part of the hierarchy and below and enforced on the server; approvals, reviews and configuration stay with the roles you choose; and dashboard numbers drill back to auditable source records with their history. Modules cover incidents and investigation, hazards and near misses, risk assessment, actions and CAPA, audits and inspections with photos, training and competence, visitor control, emergency response and the safety committee, with work grouped by ISO 45001 clause and reporting from phones. Our platforms are designed in line with the GDPR, including Articles 28, 32, 33 and 35; see our data protection page.

Put us on your shortlist: book a free demo and we will model a structure like yours, with your own categories.

Enterprise EHS software RFP: a requirements checklist for global groups