Safety management system software: ONRSR accreditation for Australian rail operators

Why rail and transport SMS sits under a distinct regulatory framework

Australian rail safety is governed nationally rather than through the general state-based WHS system that applies to most other industries, which is what makes rail SMS software a distinct requirement rather than a variant of generic safety software.

• Rail Safety National Law (RSNL): the harmonised law adopted across all Australian states and territories, including Western Australia, which moved from separate mirror legislation to full application of the RSNL in October 2024, that sets the legal basis for rail safety regulation, including the requirement that rail transport operators hold and maintain an accredited SMS.

• Office of the National Rail Safety Regulator (ONRSR): the single national regulator responsible for accrediting rail transport operators, auditing their SMS against RSNL requirements, and receiving and acting on notifiable occurrences, running its own compliance investigations to establish whether the RSNL has been breached.

• Accreditation as an ongoing obligation, not a one-off approval: an operator's SMS is not assessed once and filed away. ONRSR conducts ongoing compliance monitoring and audits, meaning the SMS has to remain current, evidenced and operational at all times, not simply compliant on the day of accreditation.

• Interface risk between multiple operators: rail corridors are frequently shared between infrastructure managers, freight operators and passenger operators, each with their own accredited SMS, connected through formal safety interface agreements that themselves need to be documented and kept current.

The risk profile that makes rail and transport SMS distinct

Rail and transport operations carry risk characteristics that a generic safety system was never built to manage.

• Level crossing and public interface risk: risk that extends beyond the workforce to the public, requiring hazard controls and reporting obligations that generic occupational safety systems do not typically cover.

• Fatigue risk in safety-critical roles: train drivers, network controllers and other safety-critical roles operate under specific fatigue risk management requirements that need active roster and hours tracking, not a static policy document.

• Multi-operator interface risk: incidents at the boundary between two operators' networks or responsibilities, where unclear or outdated interface agreements are a recurring contributing factor in rail safety investigations.

• Notifiable occurrence obligations: RSNL requires certain categories of incidents to be reported to ONRSR within defined timeframes, which depends on the operator actually knowing, in real time, that a notifiable threshold has been met.

The core capabilities of rail and transport SMS software

Software built to support an accredited rail SMS needs to operationalise the specific elements ONRSR expects to see evidenced at audit, not just provide a general incident register.

• Risk and hazard register: a live register of identified hazards and their controls, linked to the specific operations and locations they apply to, rather than a static risk assessment filed at accreditation.

• Safety interface agreement tracking: a record of every interface agreement with other operators sharing infrastructure, including review dates and the specific responsibilities each party holds.

• Fatigue risk management: active tracking of rostered hours and fatigue indicators for safety-critical roles, against the operator's fatigue risk management program.

• Notifiable occurrence workflow: structured incident capture that flags when a notifiable occurrence threshold has been met and drives the report toward ONRSR within the required timeframe.

• Document control for the SMS itself: version control, review cycles and approval workflows for the SMS documentation ONRSR audits directly.

• Audit and accreditation evidence trail: a single, exportable record connecting hazards, controls, interface agreements, incidents and corrective actions, structured the way an ONRSR audit actually tests it.

Mapping RSNL and ONRSR obligations to SMS software controls

The table below sets out how core Rail Safety National Law and ONRSR obligations translate into the software controls an SMS platform needs to provide.

Evaluating an SMS software solution for rail and transport

Operators assessing SMS software should test it against what an ONRSR audit actually examines, not just its ability to log incidents.

• Does the risk and hazard register connect directly to specific operations, assets and locations, rather than sitting as a generic company-wide document?

• Can the system track safety interface agreements with other operators, including review dates and defined responsibilities, in one place?

• Does it support active fatigue risk management for safety-critical roles, rather than a static policy reference?

• Does the incident workflow identify notifiable occurrences and drive reporting within ONRSR's required timeframe, rather than relying on manual judgement?

• Is the SMS documentation itself under version control, with review cycles and approvals that an auditor can trace?

• Can the system produce a single, exportable audit trail linking hazards, controls, interface agreements, incidents and corrective actions?

Ideagen's safety management system capability is built around this accreditation lifecycle: hazard and risk management, document control for SMS content, incident and notifiable occurrence workflows, and a consolidated audit trail, configurable to the specific obligations a rail or transport operator holds under Rail Safety National Law.

Conclusion

Safety management for Australian rail and transport operators is governed by a national framework with its own regulator, its own accreditation process, and its own ongoing compliance expectations, which is why a generic safety platform is rarely sufficient on its own. Software built for rail and transport SMS needs to operationalise hazard management, interface agreements, fatigue risk and notifiable occurrence reporting as live, evidenced processes, not static documents produced once for accreditation and left unchanged. That is what turns an SMS from a compliance artefact into an operational safety system ONRSR can audit with confidence.