How to Use Microsoft Copilot to Review SWMS
A principal contractor can end up with a pile of subbie Safe Work Method Statements (SWMS) to check before high-risk construction work starts on an Australian site, and no quick way to tell a SWMS written for the job from a master with the project name swapped. Microsoft Copilot reads the SWMS you paste or upload and returns a list of what's missing: hazards with no control, controls that don't match a job step, generic text and missing risk ratings. You still make the call and sign it off, with the gaps already in front of you.
Trusted by companies, projects and teams of all sizes
The short answer
Paste or upload the SWMS and ask Copilot to check it against what a good one contains: every job step with its hazards, a control for each hazard, a risk rating before and after controls, and a sign-on. It returns a list of gaps rather than a pass or fail. A competent person reads the findings and makes the call before signing the SWMS off.
How to Get Copilot Reviewing Your SWMS
A useful review comes down to what you ask for. Give Copilot the SWMS and the standard to hold it to, and ask for specific findings instead of a verdict. Save that prompt and you can run it on every subbie SWMS that lands.
-
Step 1
Give Copilot the SWMS and Your Standard
Paste or upload the SWMS and tell Copilot what to hold it to: the high-risk construction work it should cover, a control against every hazard, a risk rating at each step, and job steps that follow the actual work.
- The SWMS itself, pasted as text or uploaded as a file
- The task and site it's meant to cover
- Your own SWMS template or the principal contractor's checklist, if you have one
- The points that matter most to you, such as controls, risk ratings or sign-on
-
Step 2
Ask for a List of Gaps, Not a Verdict
Asked whether a SWMS looks fine, Copilot will usually say it does. Ask for a list instead, with each finding tied to the job step it's about, so you can send it straight back to the subbie.
- Hazards named but never controlled
- Controls with no matching job step
- Generic text that could belong to any job
- Steps with no risk rating, or no rating after controls
- No sign-on section, or no one named as approving it
-
Step 3
Make the Call on Each Finding
The list is a first pass. Read each finding against the site and the task, and send the real gaps back to whoever wrote the SWMS. A competent person still signs it off, with the weak spots already caught.
Prompt Guidance for Reviewing SWMS with Copilot
A sharp review starts with a specific prompt. Name the high-risk work the SWMS is meant to cover and ask for findings against a clear standard. Then save the prompt, so the next subbie SWMS gets the same check.
- "This is a subcontractor's SWMS for [task] on [site]. List every hazard with no control, and every control that isn't tied to a job step."
- "Check the risk ratings. Flag any step with no rating, or no rating after controls, and any rating that doesn't fit the hazard."
- "Quote every line that reads like generic text and could apply to any job, so I can send it back."
- "Compare this SWMS against our template, attached, and list what's missing."
- "Does this SWMS name the high-risk construction work it covers, and who approved it and who signed onto it? List anything missing."
- "Give me the five gaps I should send back to the subbie before I sign this off, most serious first."
Troubleshooting Thin Results When Reviewing SWMS
When the findings come back thin, the SWMS template is usually the cause. A review can only check what the form records, so these are the things to add or fix in the template your subbies fill in.
- Controls can't be matched to steps: hazards and controls sit in separate tables. Use a template with each control in the same row as its job step
- Risk ratings read as missing: the rating is a matrix image or a scanned page. Make it a text field on each step, before and after controls
- Every SWMS gets the same findings: there's nothing specific to check against. Add fields for the site, the task and the high-risk work it covers
- Sign-on can't be checked: the sign-on sheet is a separate scan. Build the sign-on into the template, with each worker's name and date
- Standard controls get flagged as vague: they're worded differently every time. Set them as a pick list in the template so they read the same way
Limitations
Copilot returns a list of gaps, not a verdict, and a competent person keeps the sign-off. It can help draft a SWMS and review one, but it doesn't run the work: the crew still signs onto the SWMS on site and works to it. To write one rather than check it, see how to use Microsoft Copilot to draft a SWMS.
What Copilot Does Well When Reviewing a SWMS
Given the SWMS and a clear standard, Copilot gets through the reading fast and points you at the lines worth a second look.
- Read a full SWMS and check it against what a good one contains
- Flag hazards with no control, and controls with no job step
- Spot generic text that doesn't fit the task
- Check that each step carries a risk rating, before and after controls
- Compare a SWMS against your own template or the principal contractor's checklist
What Copilot Leaves to You When Reviewing a SWMS
These stay with the people on the job, so the review never stands in for the sign-off.
- Know the site. It reads the document, not the ground conditions on the day
- Decide whether a control is adequate. A competent person owns that call
- Sign the SWMS off, or tell you it meets your WHS duties
- Guarantee it caught everything. Your own review still runs
What This Assumes You Already Do
This page assumes you already collect a SWMS from each subbie before high-risk work starts, and someone checks them. Copilot speeds that checking up. It doesn't replace the person who owns it.
- You collect a SWMS from every subbie doing high-risk construction work
- Someone on your side owns checking them before work starts
- A competent person signs off each SWMS, or sends it back
- You know the work well enough to tell a site-specific SWMS from a generic one
Why Use Copilot to Review SWMS
Checking one SWMS properly takes time. Checking a dozen before a Monday start is where it slips, and the generic ones get through on a skim. If something goes wrong on site, the gap traces back to a control that was never in the SWMS, and to the person who signed it.
A structured first pass changes where your time goes. Copilot reads each SWMS against a clear standard and hands you the gaps, so you spend the time on the calls that matter instead of reading every page cold.
What a Good SWMS Review Catches
A review worth running checks the SWMS against what the WHS regulations ask for and what principal contractors expect on top. In most states and territories a SWMS has to name the high-risk construction work, the hazards and risks, the controls, and how those controls get put in place, monitored and reviewed. Most principal contractors also want a risk rating and a crew sign-on.
- The high-risk construction work it covers, named plainly
- Hazards named but never controlled
- Controls with no matching job step, or that fall straight back on PPE
- Generic text that fits any job, not this one
- Risk ratings missing, or not updated after controls
- No record of who approved it and who signed onto it
It's Sunday night and six subbie SWMS are sitting in your inbox for a Monday start. Your name goes on the sign-off, and a skim lets the generic ones through.
Connecting Sitemate MCP to Copilot
Three things have to be in place, and the first two aren't in Copilot. An Org Controller switches MCP access on in Dashpivot by Sitemate. Then, because the Sitemate app is a Microsoft 365 agent, a Microsoft 365 admin deploys it once for everyone from the Microsoft Marketplace. You'll also need a Microsoft 365 Copilot subscription, the premium plan rather than the basic add-on.
-
Step 1
Turn On MCP Access in Dashpivot
An Org Controller opens Settings, then Security, and sets the MCP Access toggle to anything other than None. Save changes. Until this is on, the agent won't authenticate.
-
Step 2
Deploy the Sitemate App from the Microsoft Marketplace
A Microsoft 365 admin opens the Sitemate MCP listing on the Microsoft Marketplace, selects Get it now, and signs in with a Microsoft 365 admin account. That opens the Microsoft 365 admin console. Choose who gets access, everyone or a pilot group, accept the permissions, and finish the deployment. It then appears under Settings, Integrated apps.
-
Step 3
Check the Agent Is There
Open Microsoft Copilot at copilot.microsoft.com or in the Microsoft 365 app, and the Sitemate agent shows up as an available tool. Allow a few minutes after deployment for it to appear. Sitemate MCP is read-only, so Copilot can read your records but can't create, edit or delete anything.
If the Agent Won't Appear
Three things account for almost every failed connection, and the first is the most common by a distance.
- Nothing connects at all: MCP Access is still off in Dashpivot, and only an Org Controller can turn it on
- The app can't be deployed: uploading the Sitemate agent needs a Microsoft 365 Global Administrator or AI Administrator role, plus a Microsoft 365 Copilot subscription
- The agent doesn't show after install: allow a few minutes to propagate, refresh Copilot or open a new chat, then check Integrated apps in the Microsoft 365 admin console
Where the SWMS and Its Review Live
A reviewed SWMS still has to be signed onto and kept, and the review is worth more when it sits with the record. Here's where both go.
-
Storm Captures It on Site
Once the gaps are fixed, Storm, Sitemate's data capture agent, rebuilds the SWMS as a template from the PDF or Word file with AI Templates. The crew then signs onto it on a phone or tablet on site.
-
Dashpivot Holds It as the Record
Each SWMS and its sign-on lands against its job as a structured record, versioned and audit-ready, so the version you reviewed is the version the crew signed onto.
-
Sitemate MCP Reads It Back
With each SWMS held in Dashpivot, Copilot can read across them over Sitemate MCP, for example which jobs have a signed SWMS and where the same gap keeps coming back. It only reads, and your own permissions still apply.
Storm Fills the Records Copilot Reads
Copilot reviews the SWMS, but it still has to be run and signed onto. Storm, Sitemate's data capture agent, captures the SWMS and its sign-on on site, so the signed record sits in Dashpivot by Sitemate where Copilot can read it.
AI Form Fill
Capture what you see and say, and Storm drafts the form for you. The details land in the right fields, so there is a record to check the moment the work is done, and you review and submit it yourself.
Listens to the work
Captures voice cleanly through machinery, wind, and movement. Accents and trade language understood. No headset needed.
Works on site
Built for gloves, cabs, and screen protectors. Captures inputs offline and processes in the background. No waiting on the field.
You stay in control
Storm never commits a record on its own. Every output is a draft for human review. Admins control what Storm can write to.
Frequently Asked Questions
Can Copilot sign off a SWMS?
No. Copilot reviews the document and lists the gaps. Whether a control is adequate, and whether the SWMS is signed off, is a competent person’s call, and the review gives that person a better place to start.
Does Copilot check the SWMS against the site?
No, only against the document and the standard you give it. It doesn’t know the ground conditions on the day or which other trades are on site, so your own site check still runs.
Will Copilot catch every gap in a SWMS?
No, so don’t run it as if it will. It’s a fast first pass that catches the common gaps, such as hazards with no control and missing risk ratings. Your own review still runs on top of it.
Can Copilot write the SWMS as well as review it?
Yes. Drafting is a separate job with its own prompts: describe the high-risk construction work, the site and the crew, and Microsoft Copilot drafts a SWMS written for that job. Whoever drafts it, a competent person still reviews it and signs it off before work starts.
Where does the reviewed SWMS end up?
Run and signed onto on site with Storm, Sitemate’s data capture agent, then held in Dashpivot by Sitemate as the record. Copilot can read it back over Sitemate MCP, which is read only, so it can’t change the record.