How ComplyFlow Rolled Out a Contractor Compliance System for Fortstone in 5 Days

Most case studies are written to sell. This one is worth reading for a narrower reason: it is a dated record of what one business asked for, what was configured, and what happened afterwards, written at the time rather than reconstructed later.

The two halves are different kinds of claim, so they are kept apart. Everything under a heading naming Fortstone is what Fortstone or ComplyFlow recorded in 2022; nothing has been added to it and nothing has been rounded up. The two sections before it are general Australian law, cited to the model WHS Act and Safe Work Australia, and are not statements about Fortstone.

The Duty That Comes With Engaging Contractors.

Under the model WHS Act, version dated 5 December 2025, a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers engaged, or caused to be engaged by the person, and of workers whose activities in carrying out work are influenced or directed by the person.¹ Safe Work Australia is explicit that a worker under these laws includes a contractor, a subcontractor, and a self-employed person.² Engaging a contractor does not put the work outside the duty. It puts a second duty holder beside you.

Three sections decide what follows. Section 14 says a duty cannot be transferred to another person. Section 16 says more than one person can concurrently have the same duty, and each must discharge it to the extent they can influence and control the matter. Section 46 says that where more than one person has a duty for the same matter, each must consult, co-operate, and co-ordinate activities with the others so far as is reasonably practicable.¹ A separate duty falls on the person with management or control of a workplace, to ensure so far as is reasonably practicable that the workplace and the means of entering and leaving it are without risks to health and safety.¹ A property or facilities business usually holds both.

Why the Evidence Has to Exist Before the Incident.

This is what makes contractor compliance an operations problem rather than a filing one, and the timings in the Act are the reason.

A business must notify the regulator immediately after becoming aware of a notifiable incident, by the fastest possible means.¹ The person with management or control of the workplace must, so far as is reasonably practicable, preserve the site until an inspector releases it, and preserve the evidence of the occurrence, including electronic and digital records and witness details.¹ A record of each notifiable occurrence must be kept for at least 5 years from the day notice is given.¹

Read those together and the shape of the problem is clear. Immediately does not leave time to assemble anything. Whether a contractor’s licence was current on the morning of an incident is a fact about the past; it either already exists in a record or it does not. That is the argument for checking supplier and worker compliance continuously rather than at tender time.

One caveat on the December 2025 amendments. Safe Work Australia notes that the updated notification duties, which extend to violent incidents, work-related suicide, and extended worker absences, take legal effect only once adopted into local WHS laws, and that each jurisdiction sets its own timeline.³ Check with your own regulator before changing a notification process.

What Fortstone Was Looking to Fix.

Fortstone is a building, asset and facilities management company based in Victoria, with a number of properties under their management. They were looking for a way to ensure safety across their sites and to streamline their safety management processes, with particular interest in how they managed incidents, contractor access, high risk works, and general contractor compliance.

In Q4 of 2022, a discovery session identified the key challenges Fortstone wanted to address with a digital solution:

• A consistent way to manage records, or an audit trail, to capture information on critical incidents, meaning those required for WorkSafe.
• Complete visibility over supplier compliance at the company and the worker level, to reduce exposure to liability risk, for example if someone was injured on site without a valid High Risk Work Licence, or if insurance was out of date.
• A reduction in the administrative burden on site managers and safety teams managing compliance across multiple sites.

It also needed to be flexible enough to handle their own business processes, such as mapping to their existing incident forms and compliance criteria for the contracted workforce, it needed to be easy-to-use, and it needed to be implemented fast. In summary, Fortstone was looking for a single platform that could solve their immediate compliance, safety, and administrative challenges in one place.

What ComplyFlow Rolled Out for Fortstone, in 5 Days.

In November 2022, ComplyFlow implemented a solution for Fortstone in 5 days. Using our existing library of global documents, a standard industry matrix of roles and competency documents or qualifications, we set up Fortstone’s account in less than a week with an automated contractor worker management system to request the correct documentation from all contractors and their workers joining.

The expedited implementation included set-up, configuration, and rollout of five modules, in one platform:

• Supplier and contractor management, used to onboard, prequalify, and manage all of Fortstone’s suppliers across all their sites.
• Workforce management, which let suppliers add their workers and had the system request the right documentation for them based on job description or role.
• Live Access, giving Fortstone real-time monitoring of on-site supplier and worker compliance, sign-in times, and a digital register of all workers or visitors signing in at site, so the team could manage by exception.
• Incident management, a single place to report on, track, and manage incidents through corrective actions to close-out, with a record trail for future audits.
• Forms, for work permits, a paperless route for the application, review, approval, and tracking of work permits for contractors across their sites, working with the Live Access applications.

The solution enabled the Fortstone team to streamline administration for the people managing contractor compliance, incidents, and work permits, and to automate notifications and alerts, reviews, and corrective action tasks.

What Fortstone Reported After a Fall From Height.

In our follow-up with the Fortstone team, one member reported:

We had a reportable fall from height incident this week, and Work Safe were very satisfied with our compliance system, forms and steps taken…. they were happy with how things were managed.

After WorkSafe’s triage investigation into the fall from height incident, and its conclusion that no further inquiry was necessary, they noted they would be interested to drop by to see how Fortstone’s compliance processes were implemented and managed.

With ComplyFlow, Fortstone were able to demonstrate that the incident was appropriately reported, with a clear record of incident investigation and corrective actions including documentation uploaded, a record of all the long-term preventative actions, and notification to the regulator, all captured in one audit trail.

Within a month of rollout, the team at Fortstone were using ComplyFlow as their source of truth on incidents, contractor compliance, and permits, to ensure that work is tracked correctly through the job. Fortstone Director Ben Fristch reported:

“The software pays for itself in one incident”

Photograph courtesy of service seeking.

What One Rollout Can and Cannot Tell You.

One customer is one data point, and it is worth being plain about what this case does and does not establish.

It establishes that a rollout of this scope was done in 5 days, on an existing document library rather than a bespoke build, and that the business was running on the system as its record of truth inside a month. It does not establish a typical timeline, a saving, or a result that will repeat elsewhere, and no figure of that kind appears above because none was recorded.

What travels is the sequence, not the number. The compliance question that matters is always asked afterwards, about a date that has already passed, and the answer is only as good as the record that existed on the day. If you want to see what that looks like against your own sites and contractors, book a demo. If you are further back than that, setting up a contractor portal covers the order the work is best done in.