On the morning of 27 March 2026, Severe Tropical Cyclone Narelle crossed the North West Cape of Western Australia at Category 3, with sustained gusts of 200 km/h on the coast. Fifty schools were shut. Flights to the Pilbara were cancelled. Four LNG facilities — supplying roughly two-thirds of WA's domestic gas — went offline. The Port of Dampier's general cargo precinct was damaged badly enough that import operations remained suspended for weeks.
What that meant on the ground was thousands of workers — FIFO mining crews, camp services contractors, port workforces, gas-facility maintenance teams, mutual-aid responders — sheltering in place across an arc of the Pilbara for somewhere between 24 and 96 hours, with cellular networks patchy or down, satellite weather windows narrow, and incident-management apps in survival mode.
Eight weeks later, the post-event reviews are landing. And the consistent question being asked of operators — by WorkSafe WA inspectors, by client safety auditors, by board risk committees — is some variant of the same thing:
Show me the continuous-communications evidence for every remote or isolated worker on your roster during the storm window.
The operators who can produce that evidence inside 48 hours are the ones still on tender lists. The ones who can't are spending May explaining why.
This post is about the gap between those two outcomes — and the four specific artefacts that close it.
What Reg 48 actually says
The relevant regulation is Regulation 48 of the Work Health and Safety (General) Regulations 2022 (WA), Division 6 — Remote or isolated work. The substantive text is short:
In minimising risks to the health and safety of a worker associated with remote or isolated work, a person conducting a business or undertaking must provide a system of work that includes effective communication with the worker.
The penalty for failing to do so is $7,000 for an individual and $35,000 for a body corporate — small enough to be unmemorable on paper, large enough to matter when it shows up as an exclusion clause on a $40m mining-services tender.
Note what the regulation does not say. It doesn't specify a technology. It doesn't list approved devices. It doesn't define "effective" as a signal-strength metric. Almost every operator we talk to interprets the regulation as a device compliance question — do my workers have satellite communicators? — and then treats the question as answered when Procurement signs off on a fleet purchase.
That's not the question inspectors are asking. The question inspectors are asking is whether the operator has a system — a thing with a feedback loop and an audit trail — that includes effective communication. Devices are an input. Evidence is the output. Inspectors look at the output.
The four evidence categories WorkSafe is using in 2026
Inspectors don't have a published "Reg 48 audit checklist" in the same way they have, say, a confined-spaces inspection protocol. What they have is a practitioner consensus that has emerged across enforcement notices and post-incident interviews in 2024 and 2025. Across the operators we've talked to who have been through a Reg 48 audit since Cyclone Sean (April 2025) or Cyclone Narelle (March 2026), four questions show up almost without variation.
1. Connectivity proof — was the device actually reachable during the window?
The first question is the one operators almost always get right: was the worker carrying a communications device of some kind? Spot Gen4, Garmin inReach Mini 2, Iridium Extreme, or a roster-issued satellite phone. Procurement records will usually answer this fine.
The follow-up — and was that device actually reachable continuously over the period in question? — is where things start to wobble. A Garmin inReach pings home on a tracking interval the user has set; if the worker accidentally set the interval to "ten minutes" instead of "thirty minutes," and the device battery died at 4pm, the gap between 4pm and the next morning is unreachable-by-default, not just "no message logged."
What inspectors want is a per-worker, per-shift, per-device connectivity record that says, in effect: device X was reachable from this satellite or this tower for these minutes of this shift, and was not reachable for these minutes — and here's why (battery, terrain, planned dead-zone transit, etc.). Most standalone device fleets produce the first half (positions logged when reachable) but not the second half (a positive accounting of unreachable intervals).
2. Check-in cadence — was there a cadence, and did both sides own it?
The second question separates safety devices from evidence systems. A Spot device sends location pings; it does not enforce a cadence. If a worker is supposed to check in every two hours and doesn't, the device doesn't know. It hasn't been told what the cadence is.
Inspectors want to see a documented check-in cadence that's specific to the worker, the shift type, and the risk profile (low for an established mine site with strong cell coverage, high for a contractor doing a one-day inspection on an unsealed bush road). They want to see that the cadence is enforced bidirectionally: the worker knows they have to check in at the prescribed interval, and the manager knows the cadence and has a queue showing whose check-in is overdue.
The reason this matters is that "the worker was carrying a satellite device" is not, on its own, evidence of an effective communication system. A device that never gets used and never gets missed is indistinguishable from a system that's broken — until the day there's an incident.
3. Escalation trail — when the check-in didn't happen, what happened next?
The third question is the one that opens the trapdoor under operators who are otherwise doing reasonably well. The trapdoor is: what was the response when an expected check-in didn't arrive?
Inspectors want a time-stamped chain. At 14:00 the check-in was due. At 14:15 the duty manager received an automated alert. At 14:25 the duty manager attempted contact via satellite. At 14:35 the duty manager attempted contact via radio. At 14:50 the duty manager contacted the worker's nominated emergency contact. At 15:05 the emergency response procedure was activated.
Or — equally valid — at 14:35 the worker checked in late with a satellite acknowledgement; reason "vehicle stuck in floodway, recovered by 14:30," logged and resolved.
What inspectors will not accept is the equivalent of a shrug. "We didn't notice the check-in was missed until 17:00 when the daily report ran." That's not an escalation trail. That's a four-hour silence followed by a paperwork artefact.
The four-hour silence is the audit finding. Everything else is paperwork around it.
4. Manager response — was someone authorised, awake, and reachable — and did they respond?
The fourth question is the human one. On the night in question, who was the duty manager? Were they on the roster? Did they have the authority to escalate? Did they actually have a working device? Did they respond to alerts within the documented response time?
This is the question that catches operators who have outsourced their after-hours monitoring to a duty-of-care service but haven't tested the handover. The duty-of-care service has someone awake; the operator's named manager doesn't; the alert pings into a void; the service tries to reach a manager and reaches a voicemail.
Inspectors want to see that, on the specific night in question, a specific named human with specific authority received the alert, acknowledged it within the documented response time, and either resolved it or escalated it further. That's the human equivalent of the connectivity log: a response log, by name, by time, by action.
Where standalone satellite devices fall short
To restate the point made in the opening: Spot Gen4 and Garmin inReach Mini 2 are excellent safety devices. They are not evidence systems. They reliably answer category 1 (the device was reachable when the satellite saw it). They partially answer category 2 (tracks were logged at user-set intervals). They do not, on their own, answer category 3 or category 4.
The way operators close the gap is not by buying a different device. It's by adding the integration layer that takes the device's data — connectivity windows, position pings, SOS signals — and feeds it into a system that does the rest: cadence enforcement, escalation routing, manager response logging, audit-ready export.
The integration layer is the thing inspectors are actually asking about. The device fleet is the substrate.
What a defensible Reg 48 evidence pack looks like in 2026
If you can produce these four things on demand — for any worker, on any shift, for any 24-hour window in the last twelve months — you are defensible:
-
Per-worker connectivity log. A timestamped record of when the worker's communications device was reachable and when it was not, with a reason code (battery, terrain, planned dead-zone, device fault) for every unreachable interval longer than the documented threshold.
-
Per-shift check-in record. A timestamped log of every scheduled check-in: due time, actual time, method, status (on-time, late-but-acknowledged, missed-and-escalated).
-
Per-incident escalation chain. For every missed check-in or SOS event, a complete time-stamped chain showing alert raised → alert received by named manager → contact attempts and outcomes → resolution or further escalation.
-
Per-week aggregate report. A cadence-held summary by team, by site, by shift type — showing 95%+ cadence compliance is the soft floor most inspectors now expect.
If you can't produce these four things on demand, you have a 2026 compliance project. Not an urgent one — the regulator is not going to come kicking your door down tomorrow — but a real one, because the next post-event review (cyclone, bushfire, regional cell outage, lone-worker incident) will land in your inbox with these four questions attached, and we didn't have visibility because the system was down is a defence that has stopped working.
What's actually changed since 2024
Two things, broadly:
The first is that the regulator's interpretation has tightened. The 2022 regulations were the first major rewrite under the harmonised national WHS framework, and the enforcement window since then has produced a practitioner consensus around what "effective" means in practice. That consensus is the four-category framework above. It's not a published checklist, but it's now a shared expectation across WorkSafe WA, NT WorkSafe, SafeWork NSW, and (with state-level variations in wording) the other state regulators.
The second is that the technology landscape has caught up. Through 2024 and 2025, integrated journey-management platforms from other vendors started shipping the kind of evidence-export capability that auditors now ask for: per-worker timelines, cadence reports, escalation chains, manager-response logs — all queryable by date range and exportable as PDF or CSV. TetraSense entered that category with our January 2026 App Store launch; we are not claiming we were available during the 2024–2025 enforcement window that shaped today's audit expectations.
What has not changed, and what creates the audit risk, is that the adoption of platforms in this category has lagged the regulator's tightening. Most operators we talk to are still running their device fleet through a vendor portal that produces device-level reports rather than worker-level evidence, and through a manual process for after-hours escalation that doesn't survive contact with a real incident.
That gap — between available and adopted — is what 2026 audits are catching.
A self-assessment you can run today
If you're an HSE manager or operations lead reading this, the practical action is a 15-minute self-audit. Pick a worker, any worker. Pick a 24-hour window in the last 90 days. Try to produce, from your current systems, the four artefacts above for that worker and that window.
Three things will happen:
- If you can produce all four cleanly, you're probably defensible. Stress-test by picking a worker who was on shift during a known disruption (Cyclone Narelle, Cyclone Sean, the October 2025 regional cell outage, a recent FIFO mobilisation week) and run the same exercise.
- If you can produce three of the four, you have a known gap. The most common is category 3 (escalation trail) because most operators rely on the duty manager's recall rather than a logged system.
- If you can produce one or two, you don't yet have a Reg 48 evidence system. You have a device fleet and a roster. The next post-event review will be uncomfortable.
Run the audit. The result will tell you what to do next.
Sources: Western Australia Work Health and Safety (General) Regulations 2022, Regulation 48 (AustLII). Cyclone Narelle damage assessment: ABC News 27–28 March 2026; Pilbara Ports Authority operational bulletins, March–April 2026; Rio Tinto and Chevron operational statements, March 2026. Practitioner consensus on the four-category audit framework: synthesised from WorkSafe WA enforcement notices, mining-services WHS audit reports, and post-incident interviews 2024–2026.
