Record Lifecycle
An environmental record walks a seven-step flow — with one short circuit that skips three of them.
| Stage | What happens |
|---|---|
| Draft | The record is being written: the key, the direction, the responsibles. Also where a rejected record and a new revision start. |
| Pending approval | With the responsibles, who say whether the record was opened correctly. |
| Control | Where the scoring is entered, the control methods and compliance obligations are named, and the measures are opened. |
| Waiting for measures | Parked until every measure closes. Nobody holds a task here. |
| Verification | Where the measures are judged to have been enough. |
| Active | The record in force for its key. |
| Inactive | Stood down, superseded by a revision, or a preparation given up. |
The beneficial-aspect short circuit
A record whose aspect direction is positive skips control, waiting and verification entirely. Approving it puts it straight into force.
There is nothing to control, nothing to measure and nothing to verify — and parking a beneficial aspect on a verification step would ask somebody to confirm measures that nobody took.
What the control step opens and locks
The control step is where the substance of the assessment is filled in, and it deliberately locks the parts that identify the record:
| Locked at control | Opened at control |
|---|---|
| The six key parts — main form, process, life cycle stage, aspect, impact, operating condition | Severity, probability, legal status |
| Aspect direction | Control methods |
| Control degree | Compliance obligations |
| The measures |
The process step text stays editable throughout. It is free text and not part of the key, so correcting it produces no collision.
Locking the key at the control step is what makes the six-part uniqueness rule enforceable. If the key could still change while the record was being scored, two records could converge on the same key after both had passed approval.
Waiting for measures has two exits
The ordinary exit fires the moment the last measure closes — pushed from the measure itself, not found by a periodic scan. Reaching either terminal state releases the record: cancelling a measure stops it counting without claiming it was done.
The second exit exists for a specific case. If the control step is completed with no measures opened at all, the record would otherwise park on a state that carries neither a task nor a button — waiting for work that does not exist. The system re-asks the question as soon as the record lands there and moves it straight on.
A band marked requires measure is the flag that should prevent this situation in the first place. If your significant bands do not carry it, records can pass the control step with nothing opened against them — and they will move on rather than wait, which reads like completion.
If the measures were not enough
At verification, the reviewer judges whether what was done achieved the intended result. If it did not, the record goes back to the control step — where new measures can actually be opened — carrying the reason.
It does not go back to waiting for measures. No measure can be opened from the waiting state, so returning it there would strand the record waiting for work nobody could create.
Rejection carries its reason, and there is no field for it
Rejecting asks for a reason, and it lands on the record's history rather than in a field on the form.
A field would keep only the last reason and would record neither its author nor its date. The history panel keeps every round with both.
There is no Save button
Every editable field is stored by the action that takes the record out of the state it is in. A record being worked on is somebody's open task, and the way out of a task is to say what happens next.
Revisions
A record is re-assessed by opening a revision — a new record carrying the same code and the same six-part key, with the revision number raised.
The previous round stands down the moment the revision is opened, not when the new round takes effect: one key, one row on the working list. Giving the revision up puts the predecessor back in force.
Every round carries the identity of the chain's first record, so the history answers from whichever round the reader is standing on.
Three buttons are deliberately absent in specific places:
- No eye on a screen that already renders the whole record.
- No past-revisions button on a superseded round.
- No start-revision button anywhere but on the round in force.
Start revision navigates away from the nested route. This is not cosmetic: staying on the same route pattern would reuse the detail page, which would then go on asking about the round that was just superseded.
The review flag
When a linked process gains a revision, records naming that process are flagged as needing review. The flag is cleared when a revision of the record is opened.
The flag raises no task and carries nothing over automatically. It is a marker on the record and a filter on the register — somebody has to read the register and act on it. Build that into your management review rather than expecting a notification.