The week after Hyrox, an inspector asks for 12 months of records

More than 1,000 participants used shared equipment after an elite competitor was allowed to continue in a race she should have been withdrawn from. The organiser has since apologised, changed its rules and refunded entry fees. If you run a shopping centre in Singapore, that sequence is the one an inspector will replay against your building, and the week after is when they ask for the paperwork.

You will not get a week's notice. You will get a request, usually by email, usually with a date on it.

The stakes: a named person must own the duty

When something unforeseen happens in a building you run, such as a spill on a travelator, a food court incident or a fire alarm activation during trading hours, the question is not whether you cared. It is whether a named person had the authority to act, acted, and wrote it down. The Hyrox case is instructive precisely because the organiser said so itself: co-founder Moritz Fürste admitted "it is my job to foresee these potential incidents – and I did not", and the brand conceded that protocols became unclear, "creating ambiguity in how they were applied and understood".

That is the failure mode in a shopping centre too. Not a missing policy, but a policy nobody was authorised to apply at 2.40pm on a Saturday.

What falls due in the first 24 hours

This is the window where the record is either made or lost. In Beijing, the organiser closed and isolated the affected areas and race lanes, disinfected them, removed affected equipment and replaced venue carpet overnight before competition resumed the next day. That is a defensible sequence, but only because someone wrote down the times.

• Isolation log. Who closed the area, at what time, and who authorised reopening. Owner: the duty manager on shift, countersigned by the centre manager.
• Contamination and cleaning record. What was removed, what was disinfected, what was replaced. Owner: the cleaning contractor's supervisor, verified by your facilities manager.
• Incident report. Facts only, no conclusions. Owner: the person who first attended.
• Notification decision. Whether SCDF, NEA, MOM or the building's Fire Safety Manager needed to be told, and who decided. Owner: the Fire Safety Manager, with the centre manager informed.

If you cannot produce those four items within a day, you are relying on memory. Memory is not a record.

What falls due in the first week

This is when the inspector, the insurer or your own board asks the harder question: was the decision to act or not act made by someone with the standing to make it? Hyrox's revised rule now permits a Race Director to withdraw a racer on medical grounds if their blood, vomit, urine or contamination poses a welfare or contamination risk, recorded as Did Not Finish. The rule matters less than the role it names. A Race Director. One person, one call, one entry on the leaderboard.

It is worth being precise about whose money this is. Under the Workplace Safety and Health Act, a body corporate convicted of a first offence faces up to S$500,000 — but an individual, which includes a director, a manager or an occupier's named officer, faces up to S$200,000 or two years' imprisonment. The records you cannot produce in the first week are the ones that decide which of those two sentences gets read out.

Translate that to a retail asset. Your equivalent is a written delegation: who may close a zone, who may stop a lift, who may call a contractor out at 11pm without waiting for approval. Then the evidence that the delegation was used.

• Delegation of authority. A current document naming roles, not job titles that changed last quarter. Owner: head of property.
• Contractor attendance records. Time in, time out, scope of works, sign-off. Owner: facilities manager.
• Equipment and asset register update. What was taken out of service, what was reinstated, and on whose authority. Owner: building manager.
• Occupier communication. What tenants were told, when, and by whom. Owner: centre management, with the leasing team copied.

The refund decision in Beijing, covering competitors who started before 2.40pm and had not finished, and those who departed in heat batches between 2.40pm and 8.40pm, was a commercial call made from a factual timeline. You cannot make that call from a timeline you reconstructed three weeks later.

What falls due in the first month

By now the incident is closed operationally and open commercially. This is where the pattern repeats across a portfolio: one building handled it well, another did not, and nobody can explain the difference because the records are held differently in each.

Singapore's regulators expect documented arrangements, and the aviation sector shows how granular that gets. The Ministry of Transport publishes air safety investigation reports down to individual turbulence events and runway incursions, and CAAS maintains versioned advisory circulars with effective dates. You are not held to aviation standards, but you are held to the same principle: a version, a date, a named owner.

• Corrective action tracker. Every finding from the incident, with an owner and a due date. Owner: head of property.
• Review of the written procedure. Did the procedure cover this? If not, what changed and when does the new version take effect? Owner: Fire Safety Manager and head of property jointly.
• Insurer notification and file. What was reported, what was claimed, what was reserved. Owner: risk or finance, with property copied.
• Board paper. One page: what happened, what it cost, what changed. Owner: head of property.

The gap that shows up across a portfolio

Hyrox had "clear biocontaminant and medical procedures in place", according to its own global statement. The procedures existed. What failed was application under pressure, and the organiser said as much. That is the same gap that appears when a shopping centre has a spill procedure, a fire procedure and a lift-entrapment procedure, and three different buildings apply them three different ways.

An inspector does not ask whether you have procedures. They ask to see the record of the last time each one was used, and who signed it. The Hyrox apology and rule change is a public example of what happens when that record is thin.

Your 60-second self-check

• Could you name, today, the single person authorised to close a trading zone in each of your buildings without seeking approval?
• Could you produce the isolation, cleaning and reinstatement record from your most recent incident within one working day?
• Does every building in your portfolio hold its incident records in the same structure, so you could compare them side by side?

If any of those is a no, the free 5-minute Director's Risk Check shows which statutory deadlines and penalties apply to your portfolio, each with its official source, so you can see where the exposure sits before someone else maps it for you. Run it at the Director's Risk Check, or send the link to the building manager who holds the files.

Herman's verdict

The rule change in Beijing is not the lesson. The lesson is that a procedure nobody was empowered to apply is a document, not a control. Your buildings will be judged on the timestamps, the names and the version dates, and those are written in the hour after something goes wrong, not the month after.

— Herman