Temporary controls register
The register of overrides and bypasses that can't quietly expire.
Every plant runs abnormal sometimes — an isolation waiting on parts, a defeated trip, equipment limping to the next outage. Amberhold gives each one a declared life: monitoring bound to it while it's live, and an authorised act — not a lapsed timer — to end it.
Override, inhibit, defeat, bypass — every site has a word for it. Few have a register that survives an audit.
Most temporary controls are born in the middle of other work — maintenance, a shutdown, fault-finding at three in the morning. Weeks later, everyone remembers the job. Not everyone remembers the bypass.
The risk assessment gets done. The isolation goes in. And then the temporary state lives on a whiteboard, a line in the shift log, or a spreadsheet tab that one person maintains. The monitoring it depends on — “check the standby pump each shift while B is out” — depends on people remembering.
Temporary controls fail in a characteristic way: they outlive the risk assessment that justified them. The defeat stays in after the job finishes. The extra checks fade after a fortnight. Restoration happens — but nobody can say who authorised it, or show what was watching the plant in between.
The audit question this answers
“Show me every temporary defeat in the last twelve months, the monitoring that ran while each was live, and who authorised putting things back.”
From a shift log, that's an afternoon of archaeology and an email thread. From Amberhold, it's one printable timeline per control.
Declare it, and Amberhold keeps watch.
Amberhold keeps the temporary condition visible — on the board, shift after shift — until it is deliberately returned to normal.
Declaration is a record
What's abnormal, why, declared by whom, since when. The control exists as a first-class thing on the board — not a margin note — with its status visible to every shift.
Monitoring binds to the control
The checks the risk assessment asked for are attached to the control itself. They fall due every shift alongside the rounds, and they cannot silently stop while the control is live.
Concerns need an authorised close
An abnormal finding on a bound check opens a concern that stays open until someone authorised records a disposition. Nothing times out; nothing closes itself.
Clearance is an authorised act
A control ends when someone with the authority ends it — not when a timer lapses. Checks that were never needed close honestly as "Not required — control ended before due."
One printable timeline
Declaration, every check, every concern, every disposition, clearance: the whole life of the control in order, exportable with a reproducible integrity fingerprint.
Visible at handover
The board carries the live count of active controls. An incoming shift manager sees what's abnormal right now — walking out of handover knowing, not hoping.
Straight talk
Amberhold's register is used alongside your approved isolation, permit and MOC processes — never instead of them. The risk assessment, the authorisation to defeat a device and the engineering judgement stay with your people and your procedures.
What Amberhold adds is the part paper loses: a declared, visible life for the temporary state, monitoring that cannot quietly stop, and an append-only record of how it ended. It supports compliance and produces evidence — it never certifies your site.
Questions we actually get asked
- Is this a permit-to-work or MOC system?
- No. Your permit process and your management-of-change procedure stay exactly where they are. Amberhold evidences the operational half those processes assume but rarely record: that while the control was live, somebody was actually watching — every shift, on the record.
- What counts as a temporary control?
- Whatever your site declares as one: an isolation in place while parts are on order, equipment out of service, a defeated or inhibited protective device, a temporary operating restriction. The site decides the vocabulary and the risk process; Amberhold holds the declaration and binds the monitoring to it.
- What happens if a bound check finds something wrong?
- The abnormal entry opens a concern on the control's own timeline, and it stays open until someone authorised records a disposition. Nothing closes by itself, and nothing closes anonymously — the flag, the decision and the person who made it are one linked trail.
- What if the control ends before a check falls due?
- The check closes honestly as "Not required — control ended before due." That distinction matters in an audit: a check that was never needed is a different fact from a check that was missed, and the record keeps them apart.
- Can I print the history of a control?
- Yes. The whole life of a control — declaration, every check, every concern, every disposition, clearance — is one timeline you can print and hand over. That is the artefact an auditor actually wants when they ask about last year's defeats.
Keep reading
Operator rounds software
Guided, scheduled walks with append-only evidence behind every reading — the core of Amberhold.
Evidence for HSEQ
How the record answers the six questions every audit asks, across COMAH, PSM and more.
See your own controls in it
A 20-minute demo. Bring the last override your site declared and we'll walk its life together.