What's New: Week of 20 July 2026

Risk assessments lead this week: you control what readers see first, and you can keep an external PDF as the assessment itself. Company contracts and training certificates round it out.

Risk assessment overview widgets

Risk assessment pages used to open with a fixed summary block whether or not it helped the reader. Authors could not put Highest Risks above the overview, surface linked tasks, or leave the top of the page clean when nothing useful belonged there.

You now curate a summary widget zone on editable assessments. Add, remove, and reorder widgets such as Risk Overview, Highest Risks, Tasks, and People Impacted. The selection is stored on the assessment version, so it survives draft, publish, duplicate, and template flows, and print or PDF export uses the same widgets in the same order. Published and learner views show the widgets without the curation controls. New assessments start with an empty summary; if you add nothing, readers see no summary chrome at the top.

Editable risk assessment with curated summary widgets above the sections

Upload a PDF as the assessment

Plenty of risk assessments still arrive as finished PDFs from a consultant or an older system. Until now you either retyped them into structured sections or kept the file outside CalmCompliance and hoped people found the right copy.

When you create a risk assessment, choose Upload PDF as Assessment. The uploaded file becomes the authoritative content for that assessment: draft, approval, publish, version history, review, and distribution all work the same way as a structured assessment. Readers open and acknowledge the PDF in the ordinary assessment chrome. Replacement versions take a new PDF; structured tools such as the hazard matrix stay out of the way. Lists show a PDF badge, and insights place these assessments under Unscored rather than treating them as scored structured records.

Keep company contracts with the supplier

Supplier agreements usually lived in email or a finance folder, separate from the company record you already use for contacts and training providers. Rolling contracts were awkward to track next to fixed-term renewals.

On a company detail page you can keep inline notes, and add multiple Contract blocks: dates, commercial terms, linked contact, notes, and per-contract attachments. Fixed-term contracts require an expiry on or after the start date and appear in the consolidated expirations report. Turn auto-renew on for a rolling contract and leave the expiry blank; rolling contracts stay out of that report so reminders track fixed renewals only. Inherited companies from a parent site stay read-only for notes and contracts on the child.

Company detail page with notes and a Contract block covering dates, terms, contact, and attachment

Certificates that stay with the person

External courses and Calm courses often need a validity window, a named provider, and a certificate on file. Previously those details sat in a note or a shared drive, and completing training did not update the personnel record that auditors ask for.

You can set a validity period in months on a custom or Calm course. When someone completes without typing an expiry, the certificate date is derived from that period; an explicit date you enter still wins. On the external training register, set a provider on the course or override it per result (linked company or free text), and attach a PDF certificate. You can also configure a course to grant a cert-like personnel block on completion, with provenance on the block card and the certificate file carried across when you want it. Completed certificates appear in the shared expiry report, and the training matrix colours cells by expiry health.

Course validity and block grant settings alongside a person training card showing certificate expiry