05 Document Control and Records

Documents tell people what the department has decided; records show what it did. Both are evidence of due diligence and both are discoverable. This note sets the document hierarchy, the numbering and version rules, who approves what, how often each kind is reviewed, how documents reach members and how the department knows they were read, how long each record type is kept, and the privacy posture for the records that must never be read by the wrong person. ISO 45001 requires documented information to be controlled for availability, suitability, protection, distribution, access, retrieval, storage, change control and retention (ISO 45001:2018, cl. 7.5). The CFAI model expects documents and procedures reviewed at least every three years and records retained and disposed of under an adopted procedure (CPSE, 2019, criteria CC 9C.3 and 9C.4). The applicable provincial or territorial law requires records and statistics, with minimum retention periods for some record types (J09 Records Retention).

• Document: information the department intends people to follow: policy, procedure, operating guideline, safe work procedure, job aid, form template. Controlled by version.
• Record: evidence of what happened: a completed form, a test certificate, minutes, a report. Controlled by retention; never edited after creation, only corrected by a dated addendum.
• Controlled copy: the current approved version held in {{Records system}}; every other copy is uncontrolled and says so.
• Policy: a statement of what the department commits to and who is accountable; approved by the fire chief (or council where the municipality requires).
• Procedure: how a management or administrative process is carried out, department-wide.
• Operating guideline (OG): how operations are conducted, with room for judgment; the fire service’s SOG.
• Safe work procedure (SWP): the step-by-step safe way to perform a specific hazardous task; written with the people who do it.
• Job aid: a one-page memory aid (checklist, decision card) derived from a procedure or SWP; carries no new requirements.
• Form: a template that becomes a record when completed.
• Acknowledgement: a dated, individual confirmation that a member received and read a document.
• Retention period: the minimum time a record is kept before it may be destroyed under the schedule.
• Confidential health record: medical, clinical, psychological and exposure-health information about an identifiable member; kept separate from operational records with restricted access.

A lower-level document may not contradict a higher one. Where a member finds that it does, that is a hazard report, and the procedure, not the member, is presumed wrong until the program team has looked (Hollnagel, 2014).

{{Department prefix}}-<TYPE>-<PROGRAM>-<NNN> where TYPE is POL, PRO, OG, SWP, JA or FRM; PROGRAM is a two- or three-letter program code from the register (for example RP respiratory protection, PPE, DEC decontamination, EO emergency operations, TR technical rescue, HW health and wellness, GOV governance); NNN is a sequence within the program. Package documents carry their FSSMS doc_id as the source reference in the header until the department adopts them under its own numbers. The numbering register is one table in {{Records system}}: number, title, type, owner role, approver role, current version, effective date, review date, status, superseded number if any.

• Versions are v<major>.<minor>. A minor change (wording, a contact, a form field) increments the minor number and is approved by the owner. A major change (a requirement, a step, a role, a threshold) increments the major number and goes through the full approval and consultation route.
• Drafts are v0.x and are watermarked DRAFT; a draft is never posted as the current version.
• Every document carries a header with number, title, version, effective date, review date, owner role and approver role, and a change log at the end stating what changed and why (one line per version).
• Superseded versions are withdrawn from every point of use within five working days of the new effective date and kept in the archive for the retention period of the records made under them, so an old record can be read against the procedure that was current when it was made.
• One controlled copy, in {{Records system}}; printed copies on apparatus and in stations carry “uncontrolled when printed; check the current version” and a print date, and are replaced on every new version by the station officer, who records the swap.

A document is effective on the date in its header, never on the date it was signed, and the effective date is at least 14 days after issue for any document that requires training, so the training can happen first.

The review is recorded even where nothing changed (“reviewed, no change, by role, date”). Documents past their review date are listed in the monthly indicator report; a document more than 90 days past review is a register item.

• Distribution. Every new or revised policy, procedure, OG and SWP is issued by a dated change notice (one page: what changed, why, what members must do differently, training required, effective date) to every station and every member through {{Records system}} and the station briefing. Change notices are posted on the station board for 30 days.
• Acknowledgement. Members acknowledge policies, OGs and SWPs that apply to them individually and by date, in the records system or on a station sign-off sheet entered into it within 10 days. Acknowledgement means “I have read it and know where it is”; competence is shown by training records, not by the signature.
• Training before effect. Where a document introduces a new task, control or piece of equipment, the training is delivered and recorded before the effective date; the change notice says so.
• Volunteer stations. Change notices are read at the next training night, with the acknowledgement sheet; the records system shows volunteer acknowledgement rates by station, and the HSO reports them.
• Availability at the point of use. The current OGs, SWPs and job aids are on every apparatus (mobile device or binder) and in every station; the audit checks a sample against the controlled version.

Minimums; where the applicable statute, regulation, workers’ compensation requirement, municipal records bylaw or collective agreement sets a longer period, the longer applies (J09 Records Retention). Retention runs from the end of the fiscal year in which the record was made unless stated.

• Write everything as if it will be disclosed. Safety records are routinely requested in workers’ compensation claims, litigation, regulator proceedings and freedom-of-information requests. Minutes, reports and register entries use roles not names where a name is not needed, describe conditions not characters, and state facts and decisions, not opinions about people.
• Health information is separate. Medical, clinical, psychological and exposure-health records sit in a separate system or a separate, access-controlled part of the records system under the custody of the provider or occupational health, and never in the operational personnel file. Supervisors see fitness status and restrictions, not diagnoses. The department follows the applicable health information and privacy law (J10 Privacy and Health Information) and the municipality’s privacy program.
• Learning information is protected. Learning-team write-ups, near-miss reports and learning review narratives are held for learning, de-identified where practicable, and are never the basis for discipline; the Records, Privacy and Health Information policy and the Incident Investigation and Learning program state the firewall and what the department will do if a legal process compels disclosure.
• Members own their data. A member may see every record about them, obtain a copy of their training, fit test and exposure records at any time and on leaving, and have factual errors corrected by a dated addendum.
• Freedom of information. The department has a named freedom-of-information contact (municipal), a process for routing requests, and a practice of releasing safety performance information proactively through the annual report, so that requests are rare and unsurprising.

The package is records-system neutral. Whatever the department uses must:

1. Hold one controlled version of every document with its number, version, dates, owner and approver, and show members the current version only.
2. Record individual acknowledgements by date and report acknowledgement rates by station and by career or volunteer status.
3. Hold the Corrective Action Register with every field in Corrective Action Register section 3, report by priority, age and source, and send reminders at plan due, closure due, 30 and 60 days overdue.
4. Link each exposure report to the member’s exposure register and to the incident, and produce a lifetime exposure summary for the member on request.
5. Hold equipment records by serial number with inspection, test, cleaning and repair history, and flag items past their interval.
6. Hold training and certification records by member with expiry flags, and report currency by station.
7. Keep health information in a separate, access-controlled store with an access log.
8. Apply the retention schedule with a hold facility for litigation and investigation.
9. Export every record type in a standard format so the department is never locked in, and so the audit can sample.
10. Be available at the point of use: on apparatus and at volunteer stations, offline if the network is not.

Loop test. The audit finds a binder on a volunteer tanker holding a two-year-old SWP for drafting from open water. The same day the station officer replaces it from the controlled version and records the swap; within five working days the item is in the register against the policy coordinator; the fix is a quarterly point-of-use check added to the station inspection form and the change notice route reviewed with the volunteer officers; the crew that used the old SWP hears what changed from their officer at the next training night.

This chapter relies on the following legal requirements, which differ by province and territory. Check your jurisdiction’s section on each topic page before adopting it.