CorrectTrack

The Problem

Safety and compliance work was living in spreadsheets, email threads, and paper inspection forms. Nobody could answer a regulator's question (what was the hazard, who was assigned, when was it closed, what evidence exists) without reconstructing it by hand from several sources. Reporting periods meant days of manual collation, and the answer was only as good as whoever assembled it.

The Approach

1. 1

   Model the regulatory workflow properly rather than digitizing the paper form. Hazards, controls, risk sources, likelihood and severity scoring, audit checklists, and corrective tasks are first-class entities with their own history, not free-text fields on a record.

2. 2

   Make every consequential change reconstructable. Hazard and control changes write to dedicated audit tables, and administrator impersonation is itself audited, so a support session can never be mistaken for the customer's own action.

3. 3

   Let each organization shape the system without a code change. Custom columns, saved queries, configurable dashboards, and per-tenant email templates are data, so a new customer with a different regulatory regime is a configuration exercise.

4. 4

   Treat the grid as a server-side concern. Filtering, sorting, and paging happen in the database against tenant-scoped queries, so the task and risk views stay fast as history accumulates instead of degrading with the third year of data.

What It Does

• ▸Hazard register with risk scoring: likelihood and severity matrices, risk sources, and hazard controls with full change history
• ▸Audit checklists with per-run history, so an inspection performed twice produces two independently reviewable records
• ▸Corrective task management with recurrence, relationships between tasks, subscriptions, and status-change notifications
• ▸Per-organization custom columns and saved queries, defined by the customer rather than requested as a feature
• ▸Configurable dashboards built from widgets, charted with live compliance metrics
• ▸Document and evidence attachment against hazards, tasks, and resources, stored in Azure Blob Storage
• ▸Full localization in English, French, and Russian: ICU MessageFormat, database-backed entity translation, and per-user locale preference
• ▸Source-control traceability: Git, Mercurial, and Subversion revisions link to the tasks they resolve, so a code change ties back to the safety finding that prompted it
• ▸Administrator impersonation for support, recorded to a dedicated audit trail

Engineering Decisions

The choices worth defending in a technical conversation, and why they were made.

The Stack