Central ops team multi-site fitness: building a RIDDOR-compliant audit trail

A letter arrives from the Health and Safety Executive. It is addressed to your head office, not to any individual site. The subject line references a reportable injury at one of your clubs — a member who caught their hand in a cable-pulley mechanism on a functional trainer that had been flagged internally three weeks earlier. The HSE wants your maintenance logs, your incident timeline, and evidence that a competent person reviewed the equipment before it was returned to service. You have fourteen days to respond.

If you operate more than two or three fitness facilities from a central ops function, this scenario is not hypothetical. It is a foreseeable event. And the question the HSE is really asking is not what happened on the day — it is whether your organisation had a system that should have prevented it.

What RIDDOR actually requires from a multi-site operator

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) places a duty on the 'responsible person' — in most gym groups, that is the employer or the person in control of the premises — to report specified injuries, over-seven-day incapacitation, dangerous occurrences, and certain occupational diseases to the HSE.

For a multi-site fitness operator, the practical compliance burden breaks down into three layers:

1. Incident identification — every site must be able to recognise a RIDDOR-reportable event, including dangerous occurrences that cause no injury at the time (a treadmill belt that snaps and throws a member is a dangerous occurrence regardless of whether they are hurt).
2. Reporting within the statutory window — fatal and specified injuries must be reported without delay; over-seven-day injuries within fifteen days of the accident; dangerous occurrences without delay. Missing a window is itself a breach.
3. Record retention — RIDDOR records must be kept for at least three years. The HSE can request them at any point during that period.

What the regulations do not spell out — but what an inspector will look for — is the chain of evidence connecting an incident to whatever maintenance, inspection, or remedial action preceded it. That chain is where most multi-site operators have gaps.

What an HSE inspector will actually check on a gym floor

The HSE publishes its inspection methodology and, within the fitness sector, inspectors typically cross-reference RIDDOR records against a broader picture of how equipment safety is managed. A proactive inspection at a multi-site group will generally look at:

• Whether there is a written scheme for inspecting and maintaining exercise equipment, and whether it is actually followed
• Whether defect reports from staff and members are logged, timestamped, and acted upon within a defined timescale
• Whether equipment taken out of service following a defect report is clearly quarantined and not returned to use until a competent person has cleared it
• Whether the central ops team can demonstrate oversight — not just individual site managers operating independently
• Whether RIDDOR records match internal incident logs (discrepancies suggest under-reporting)

For a central ops team overseeing, say, eight to twenty sites, the inspector is also assessing whether the system scales. A process that works at one club managed by a hands-on owner does not automatically translate to a chain where the ops director is 200 miles from the incident.

ukactive's facility standards and CIMSPA's professional standards framework both reinforce this point. ukactive's Approved Operator Scheme requires members to demonstrate systematic maintenance records and incident management processes. CIMSPA's Code of Professional Practice places an obligation on fitness professionals to work within safe systems. Neither body has enforcement powers equivalent to the HSE, but both are referenced by leisure trusts and local authority procurement panels when assessing operators — and gaps flagged during a ukactive audit have a habit of appearing in subsequent HSE correspondence.

The gap that scaling creates for a central ops team

At a single site, a diligent site manager can hold the entire maintenance and incident picture in their head and in a paper folder. The system is fragile but it can work.

At five sites, that model fails. Equipment defects reported verbally during a shift handover at Site 3 never reach the central ops team. A treadmill that was taken out of service on a Tuesday is back on the floor by Thursday because a different duty manager assumed someone else had cleared it. An incident that should have been reported under RIDDOR was logged as a minor first-aid entry because the site manager was not clear on the threshold.

At fifteen sites, the failure modes multiply. There is no single picture of which equipment is currently under a defect flag, no audit trail showing who authorised return-to-service decisions, and no way for the central ops team to demonstrate to an inspector that they exercised oversight.

The core problem is not negligence — most operators are not indifferent to safety. The core problem is information fragmentation. Defect logs live in different formats across sites. Engineer visit reports are filed locally. Incident records may be on paper, on a shared drive, or in an email thread. When the HSE asks for a coherent timeline, assembling one takes days and still leaves gaps.

What a missed log entry can cost

The financial and reputational consequences of a RIDDOR compliance failure at scale are worth stating plainly:

1. Prosecution under RIDDOR — failure to report carries an unlimited fine on indictment in the Crown Court. For a mid-sized gym group with multiple sites, a fine at this level is a material business event.
2. Improvement or prohibition notices — an inspector who finds systemic record-keeping failures can issue an improvement notice requiring corrective action within a specified timeframe, or a prohibition notice closing equipment or, in serious cases, an entire facility until the breach is remedied. A prohibition notice on a 24-hour club during peak January trading is commercially significant.
3. Civil liability — in a personal injury claim, the absence of maintenance logs and defect records strengthens the claimant's case significantly. Your insurer will want to know why the audit trail is incomplete.
4. Reputational exposure — HSE enforcement action is a matter of public record. Leisure trust and local authority partners conducting recompete procurement will find it.
5. Internal accountability gaps — when a central ops team cannot demonstrate that they exercised oversight, personal liability for directors and senior managers under the Health and Safety at Work etc. Act 1974 becomes a live question.

None of these consequences requires a serious injury to trigger. A dangerous occurrence with no injury, poorly documented, can initiate the same chain of scrutiny.

Building an audit trail that holds at scale

For a central ops team managing multi-site fitness facilities, a RIDDOR-compliant audit trail needs to satisfy four practical tests:

• Completeness — every defect report, engineer visit, return-to-service decision, and incident record is captured in one system, not distributed across site-level folders.
• Timeliness — records are created at the point of event, not retrospectively. A defect reported at 6:00 in the morning should have a log entry timestamped at 6:00, not at the end of the shift.
• Accountability — every action in the log is attributed to a named person. 'Equipment removed from service' is not a compliant record. 'Equipment removed from service by [name], duty manager, following member report of unusual noise from drive belt' is.
• Accessibility — the central ops team can pull a complete maintenance and incident history for any piece of equipment at any site within minutes, not hours.

The fourth test is the one that most multi-site operators fail on inspection. Site-level records may be reasonably complete. The central picture is absent.

What good looks like in practice

Operators who perform well in HSE inspections and ukactive audits tend to have several things in common. They are not necessarily larger or better-resourced than their peers — they have made different structural choices about how information flows.

A central ops team that handles RIDDOR compliance effectively at scale typically operates something like this:

• Equipment defect reports are raised through a single channel — a service desk or ticketing system — that is accessible to all sites and visible to the central ops team in real time.
• Every open defect ticket has a status that is visible centrally: reported, engineer assigned, under repair, cleared for return to service.
• Return-to-service decisions require a named authorisation step — not an assumption that because the engineer left, the equipment is safe to use.
• Incident records are created and classified at the point of event, with the RIDDOR threshold applied consistently across all sites, not left to individual site manager interpretation.
• Monthly or quarterly compliance reviews pull a report across all sites — open defects by age, incidents by type, RIDDOR-reportable events, average time from defect report to resolution.

None of this requires a large team. It requires a system that captures the right information at the point it is created and surfaces it centrally.

How Pulse Fitness supports central ops compliance at scale

Pulse Fitness is built around the operational reality of multi-site fitness groups that need a central ops team to maintain genuine oversight without being present at every site.

The service desk module captures equipment defect reports and member service issues in a single ticketed system — every report logged, timestamped, and attributed. The equipment downtime tracking layer gives the central team a live view of which assets are out of service, why, and for how long. The Partner Engineer network means that when a defect requires a field engineer, the dispatch and visit record sits inside the same audit trail, not in a separate supplier system.

For RIDDOR purposes, that means the chain of evidence — defect reported, engineer dispatched, fault confirmed or cleared, return-to-service authorised — is in one place, retrievable in minutes, and covers every site in the group.

When the HSE letter arrives, your response time is fourteen days. The operators who answer comfortably are the ones who built the audit trail before the letter, not after it.

---

Book a demo with Pulse Fitness and see how a central ops team managing multi-site fitness facilities can build a RIDDOR-compliant audit trail from day one: https://pulsefitness.ai/demo-request