Do I Need a Health and Safety Policy?

Every employer wants to keep their workforce safe, but do you legally need a written health and safety policy? The answer depends on how many people you employ — and if you do need one, it must cover three specific sections.

The legal requirement

Section 2(3) of the Health and Safety at Work etc. Act 1974 (HSWA 1974) states:

"Except in such cases as may be prescribed, it shall be the duty of every employer to prepare and as often as may be appropriate revise a written statement of his general policy with respect to the health and safety at work of his employees and the organisation and arrangements for the time being in force for carrying out that policy, and to bring the statement and any revision of it to the notice of all of his employees."

In plain English:

• If you employ 5 or more people, you must have a written health and safety policy
• It must describe your policy (overall approach), organisation (who does what), and arrangements (how you manage specific risks)
• You must bring it to the attention of all employees
• You must review and update it when necessary

Why does this requirement exist?

The written policy serves several purposes:

• Forces planning — writing things down makes you think systematically about risks and controls
• Communication — ensures everyone knows the approach to health and safety
• Clarity — defines who is responsible for what
• Evidence — demonstrates to inspectors (and courts) that you take health and safety seriously
• Accountability — creates a benchmark against which performance can be measured

The three parts of a health and safety policy

A compliant health and safety policy has three distinct sections:

Part 1: Statement of Intent

This is the "what and why" — your organisation's general commitment to health and safety.

What to include:

• Declaration of commitment to protecting employees and others
• Recognition that health and safety is a business priority
• Promise to comply with legal requirements
• Statement that you'll provide resources for health and safety
• Commitment to continuous improvement
• Signature of the most senior person in the organisation
• Date of issue and review date

Who signs it:

The most senior person with authority:

• Managing Director or Chief Executive for companies
• Owner or senior partner for partnerships
• Chair of trustees for charities
• Head teacher (often with governor endorsement) for schools

Example wording:

"As Managing Director of [Company Name], I recognise that ensuring the health, safety, and welfare of our employees and others affected by our activities is fundamental to our success.

We are committed to:

• Providing and maintaining safe working conditions, equipment, and systems
• Ensuring safe use, handling, storage, and transport of materials and substances
• Providing information, instruction, training, and supervision for all employees
• Consulting with employees on health and safety matters
• Continuously improving our health and safety performance
• Complying with all relevant health and safety legislation

This policy will be reviewed annually and revised as necessary to reflect changes in our operations or legal requirements.

Signed: [Name] Position: Managing Director Date: [Date] Next review: [Date]"

Part 2: Organisation

This is the "who" — defines who is responsible for what in your organisation.

What to include:

• Overall responsibility (usually managing director or senior manager)
• Day-to-day responsibility (often operations manager or health and safety coordinator)
• Specific responsibilities for managers and supervisors
• Responsibilities of all employees
• Details of competent person(s) appointed to assist with health and safety
• Names and roles of key people (or at least job titles if names change frequently)

Avoid vague statements like:

• "Everyone is responsible for health and safety" (too broad, creates confusion)
• "The health and safety officer will manage all risks" (unrealistic and incorrect)

Instead, be specific:

• "The Operations Manager is responsible for conducting monthly workplace inspections and maintaining inspection records."
• "Line managers must ensure all new employees receive induction training within their first week, including site-specific hazards."

Part 3: Arrangements

This is the "how" — the practical systems and procedures you have in place to manage risks.

What to include:

This section should cover all significant risks in your workplace and how you manage them. Common topics include:

General arrangements:

• Risk assessment process
• Monitoring and review
• Accident and incident reporting and investigation
• Emergency procedures (fire, first aid, evacuation)
• Consultation with employees
• Training and competence
• Contractor management

Specific hazards (relevant to your business):

• Fire safety
• First aid provision
• Manual handling
• Display screen equipment (computers)
• Work at height
• Electrical safety
• Hazardous substances (COSHH)
• Personal protective equipment (PPE)
• Workplace transport
• Lone working
• Noise and vibration
• Stress and mental health
• New and expectant mothers
• Young persons
• Violence and aggression
• Asbestos (if present in building)
• Legionella (if you manage water systems)

Example arrangement (Fire Safety):

"Fire Safety

• A fire risk assessment is conducted and reviewed annually by [External Consultant Name/Internal Competent Person].
• Fire detection and alarm systems are tested weekly by the Facilities Manager, with records kept in the fire log.
• Emergency lighting is tested monthly, with full discharge tests annually.
• Fire extinguishers are serviced annually by [Service Company].
• Fire evacuation drills are conducted twice yearly, with findings recorded and acted upon.
• All new employees receive fire safety briefing during induction.
• Fire exits are checked daily to ensure they remain clear and accessible.
• A designated fire marshal (or warden) is appointed for each floor/area.
• The fire risk assessment and evacuation plans are available at [location]."

This shows:

• What you do (assessments, testing, training)
• How often you do it (annually, monthly, daily)
• Who does it (roles, not just names)
• Where records are kept

What makes a good policy?

It's proportionate

A one-person accountancy firm working from serviced offices doesn't need a 50-page policy covering confined spaces, radiation, and heavy machinery. Equally, a construction company shouldn't have a two-page generic policy.

Match the detail to the risks:

• Low-risk office: 5-10 pages may be sufficient
• Medium-risk retail or light manufacturing: 15-25 pages
• High-risk construction, engineering, or chemicals: 30+ pages with appendices

It's specific to your business

Generic policies downloaded from the internet are obvious and useless. Good policies:

• Use your company name, not "[Insert Company Name]"
• Reference your actual premises, processes, and equipment
• Name (or at least define roles for) real people
• Describe your genuine arrangements, not theoretical best practice

It's accessible and understandable

Written in plain English, not jargon. Structured logically with headings and sections. Available where employees can actually read it (not just locked in the MD's office).

It's signed and dated

The statement of intent must be signed by the most senior person, with a clear date and next review date. This demonstrates commitment and currency.

It's reviewed and updated

Health and safety policies are not "write once and forget." They must be reviewed:

• At least annually
• When significant changes occur (new premises, equipment, processes)
• After serious incidents
• When legal requirements change
• If inspection or audit identifies gaps

Who needs to sign the policy?

The Statement of Intent

Must be signed by the most senior person in the organisation:

Limited companies: Managing Director, Chief Executive Officer, or most senior director

Partnerships: Senior partner or managing partner

Charities and voluntary organisations: Chair of trustees or chief executive

Schools: Head teacher (often countersigned by chair of governors)

Public sector: Chief executive, director, or equivalent accounting officer

Why seniority matters

The signature demonstrates:

1. Board-level commitment — health and safety is not delegated away completely
2. Accountability — the senior person is publicly associated with the policy
3. Authority — signals to employees that this has top-level backing
4. Legal compliance — Section 37 of HSWA 1974 allows personal prosecution of directors and senior managers for offences committed with their consent, connivance, or neglect

What if the senior person is reluctant to sign?

This is a red flag. If your managing director or chief executive won't sign the health and safety policy, ask why:

• Do they not understand it? (They should read and approve it before signing)
• Do they think it's too ambitious? (Scale it back to what's realistic)
• Do they not think health and safety is important? (They have a legal duty — this is not optional)

The signature is a legal requirement for policies under Section 2(3). If the senior person won't sign, the policy is not compliant.

How often should the policy be reviewed?

Legal requirement

The Act says "as often as may be appropriate" — there's no fixed interval. However:

Best practice: Review annually as a minimum, with documented evidence of the review.

Triggers for earlier review

You should review and update your policy whenever:

1. Significant changes to your business:

   • New premises or major refurbishment
   • New equipment, processes, or substances
   • Organisational restructuring
   • Significant expansion or contraction
   • Change of senior personnel

2. After serious incidents:

   • Major injury or dangerous occurrence
   • Near-miss that could have caused serious harm
   • Enforcement action (improvement or prohibition notice)
   • Prosecution or formal caution

3. Changes in legislation or guidance:

   • New or amended regulations
   • Updated Approved Codes of Practice
   • Industry-specific guidance changes

4. Audit or inspection findings:

   • HSE or local authority inspection identifies gaps
   • Internal or external audit recommendations
   • Insurance survey highlights issues

Document the review

Keep a record of when you reviewed the policy and what (if anything) you changed. Simple log example:

This demonstrates that the policy is a living document, not a static compliance exercise.

Communicating the policy to employees

Having a written policy is pointless if your employees don't know it exists or what it says.

Legal requirement

You must "bring the statement and any revision of it to the notice of all of his employees."

This doesn't mean every employee needs to read every word of a 40-page document, but they must:

• Know the policy exists
• Know where to find it
• Understand the key points relevant to their role
• Be made aware when it's updated

Effective communication methods

What about non-English speakers?

If you employ people who don't read English well, you must communicate the policy in a way they can understand:

• Translate key sections into their language
• Use visual aids, diagrams, or videos
• Provide face-to-face briefings with interpreters if needed
• Ensure safety-critical information is definitely understood

Evidence of communication

In the event of an incident or inspection, you may need to prove you communicated the policy. Keep records such as:

• Induction training sign-off sheets
• Email distribution lists and read receipts
• Photos of noticeboards displaying the policy
• Training attendance registers
• Meeting minutes where policy was discussed

Small business exemption (under 5 employees)

If you employ fewer than 5 people, Section 2(3) does not require you to have a written health and safety policy.

What you still must do

The exemption is only from the written policy. You still have all the same health and safety duties:

• Ensure the health, safety, and welfare of your employees (Section 2(1))
• Protect non-employees affected by your work (Section 3)
• Conduct risk assessments (Management of Health and Safety at Work Regulations 1999)
• Implement control measures
• Provide information, instruction, training, and supervision
• Appoint a competent person
• Consult with employees

Should you have a policy anyway?

Even if you're not legally required to, many small businesses choose to document their approach:

Benefits of a written policy for small businesses:

• Clarity — forces you to think through your arrangements systematically
• Consistency — ensures everyone knows what's expected
• Evidence — demonstrates commitment if questioned by insurer, client, or inspector
• Professionalism — reassures customers and employees that you take safety seriously
• Preparation — if you grow to 5+ employees, you'll already have the foundation

Proportionate approach for micro-businesses:

You don't need 30 pages. A simple 2-3 page document covering:

1. Brief statement of your commitment
2. Who is responsible (probably you as the owner)
3. Key arrangements (risk assessments, first aid, fire, reporting)

This takes a couple of hours to prepare using a template but gives you a solid foundation.

Self-employed and no employees

If you're genuinely self-employed with no employees, you don't need a health and safety policy.

Your duties under HSWA 1974

Under Section 3(2), self-employed persons must:

"Conduct his undertaking in such a way as to ensure, so far as is reasonably practicable, that he and other persons (not being his employees) who may be affected thereby are not thereby exposed to risks to their health or safety."

In practical terms:

• Protect yourself — don't take unnecessary risks with your own safety
• Protect others — ensure your work doesn't harm clients, members of the public, or other workers
• Manage risks — assess what could go wrong and put controls in place
• Comply with specific regulations — e.g., electrical safety, working at height, use of equipment

When working on others' premises

If you work on a client's site or in their building, you must:

• Follow their health and safety rules
• Co-operate with their arrangements
• Not create risks for their employees or visitors
• Provide information about any risks your work introduces

Similarly, the client or building owner has duties to you under Section 3 and Section 4.

When might you still want a documented approach?

Even without a legal requirement, some self-employed people prepare a simple health and safety document because:

• Clients ask for it — particularly corporate or public sector clients tendering work
• Insurance requires it — some insurers want evidence of risk management
• Supply chain demands — if you're part of a larger project, the principal contractor may require documentation
• Good practice — demonstrates professionalism and thought about risks

A simple 1-2 page document covering how you manage your main risks (e.g., driving, working at height, electrical tools, lone working) may be sufficient.

Common mistakes with health and safety policies

1. Copying a template without customisation

The mistake: Downloading a generic policy and just changing the company name, leaving placeholder text like "[Insert risk assessment process]" or references to hazards you don't have.

Why it's a problem: Inspectors spot generic policies immediately. It suggests you haven't thought about your actual risks and arrangements.

The fix: Use templates as a starting point, but make them specific to your business. Remove irrelevant sections, add details about your real processes, name actual people or roles.

2. Filing it and forgetting it

The mistake: Creating a policy to tick a compliance box, then never looking at it again until an inspector asks for it 5 years later.

Why it's a problem: An out-of-date policy is evidence that health and safety is not actively managed. It may reference people who've left, equipment you no longer have, or procedures you don't follow.

The fix: Schedule annual reviews in your calendar. Assign someone (competent person or senior manager) to review it and ensure it's current.

3. Making it inaccessible

The mistake: The policy exists only as a printed document in the MD's locked filing cabinet, or a file on someone's personal computer.

Why it's a problem: Employees can't read or refer to it. You haven't "brought it to their notice" as required by law.

The fix: Make it accessible — physical copies in common areas, uploaded to shared drives, referenced in induction, summarised on noticeboards.

4. Promising more than you can deliver

The mistake: Writing ambitious arrangements that sound impressive but aren't realistic for your organisation (e.g., "Weekly health and safety committee meetings" when you can barely manage quarterly).

Why it's a problem: Creates a gap between policy and practice. You'll be judged against the standards you set yourself. If you promise monthly inspections but don't do them, that's evidence of failure.

The fix: Be honest. Document what you actually do and can sustain. Modest, realistic arrangements that are followed are better than impressive-sounding promises that aren't.

5. No ownership or accountability

The mistake: Vague statements like "Everyone is responsible for health and safety" without specific roles or accountabilities.

Why it's a problem: When everyone is responsible, no one is responsible. Key tasks fall through gaps.

The fix: Define specific responsibilities clearly. Name roles (or job titles) and state exactly what each is accountable for.

6. Not involving employees

The mistake: The policy is written in a back office by HR or an external consultant, with no input from the people who actually do the work.

Why it's a problem: You miss practical insights. Employees don't buy in because it was imposed on them. Arrangements may not reflect reality on the ground.

The fix: Consult employees (or their representatives) when preparing or reviewing the policy. They often know the risks and practical solutions better than management.

UK regulatory context

Health and Safety at Work Act 1974, Section 2(3)

The requirement for a written health and safety policy comes from Section 2(3) of the HSWA 1974:

"Except in such cases as may be prescribed, it shall be the duty of every employer to prepare and as often as may be appropriate revise a written statement of his general policy with respect to the health and safety at work of his employees and the organisation and arrangements for the time being in force for carrying out that policy, and to bring the statement and any revision of it to the notice of all of his employees."

The Employers' Health and Safety Policy Statements (Exception) Regulations 1975

These regulations prescribe the exception: employers with fewer than 5 employees are not required to prepare a written statement.

Relationship to other regulations

While the policy requirement comes from HSWA 1974, your policy must reflect compliance with other regulations, including:

• Management of Health and Safety at Work Regulations 1999 — risk assessment, arrangements for competent assistance, health surveillance
• Workplace (Health, Safety and Welfare) Regulations 1992 — workplace conditions, facilities
• Fire Safety Order 2005 — fire risk assessment and emergency procedures
• Specific regulations relevant to your industry (COSHH, working at height, electricity, etc.)

Your policy's "arrangements" section should demonstrate how you comply with these regulations.

Enforcement

Failure to prepare a written policy (when required) or to bring it to employees' attention is a breach of Section 2(3) and can result in:

• Improvement notice requiring you to prepare a policy within a specified time
• Prosecution if you fail to comply
• Fine (unlimited in Crown Court)

In practice, lack of a policy is often one of several breaches identified during an investigation following an incident or complaint.

Frequently asked questions

Next steps

If you need a written health and safety policy:

1. Assess your risks — conduct or review risk assessments so you know what your policy needs to address
2. Define organisation — clarify who is responsible for what in your business
3. Document arrangements — write down how you actually manage the key risks (or how you will, if starting from scratch)
4. Draft the statement — prepare the signed commitment from your senior person
5. Consult employees — get input from those who do the work
6. Finalise and communicate — obtain signature, date it, and make it accessible to all employees
7. Schedule review — set a reminder for annual review (and review earlier if significant changes occur)

Related articles:

• What is the Health and Safety at Work Act 1974?
• What is a Competent Person?
• Risk Assessment Guide

Useful tools:

• Policy Builder Tool
• Responsibility Checker