A health and safety policy is one of those documents that many small business owners know they probably need but put off creating. It sounds bureaucratic, time-consuming, and frankly, a bit daunting. The good news is that for most small businesses, a health and safety policy doesn't need to be complicated. This guide explains exactly when you need one, what it must contain, and how to create a policy that genuinely helps you manage safety.
How many employees do you have?
This determines whether you legally need a written policy.
Do I need a written health and safety policy?
The answer depends primarily on how many people you employ.
The 5-employee threshold: If you employ 5 or more people, you must have a written health and safety policy. This is a legal requirement under Section 2(3) of the Health and Safety at Work Act 1974.
5 or more employees: Written policy is mandatory
If your business employs 5 or more people, you have no choice - a written health and safety policy is a legal requirement. This applies regardless of:
- Your industry or sector
- Whether you consider your work "low risk"
- How long you've been in business
- Whether you work from home or have premises
The 5-employee count includes:
- Full-time employees
- Part-time employees
- Temporary and casual workers
- Fixed-term contract staff
- Agency workers (where you direct their work)
It doesn't include:
- Genuine self-employed contractors (unless you control how they work)
- Volunteers (though good practice to cover them)
Under 5 employees: No legal requirement but recommended
If you employ fewer than 5 people, you're exempt from the requirement to have a written policy. However, this doesn't mean you're exempt from health and safety duties. You must still:
- Assess risks in your workplace
- Implement control measures
- Provide information and training
- Have emergency procedures
- Appoint a competent person to help with health and safety
You just don't have to write it all down. That said, many small businesses choose to create a written policy anyway because:
Client and contract requirements: Many larger clients require evidence of health and safety arrangements before awarding contracts. A written policy demonstrates professionalism.
Insurance purposes: Some insurers ask for evidence of health and safety management. A documented policy can help with claims and premiums.
Consistency and clarity: Even in a small team, writing down who does what prevents confusion and ensures nothing is forgotten.
Future growth: If you're planning to grow, having a policy in place before you hit 5 employees means you're ready.
Self-employed with no employees
If you're genuinely self-employed with no employees, you don't need a written health and safety policy. Your main duties are:
- Not to endanger yourself or others through your work activities
- To comply with specific regulations relevant to your work (working at height, electrical safety, etc.)
- To follow site rules when working on client premises
However, clients increasingly ask self-employed contractors for evidence of competence and safety awareness. A brief document outlining your approach to safety can help win work.
If you engage anyone to help you - even occasionally, even family members - check whether they count as employees. If you exercise significant control over how they work, they may be employees for health and safety purposes, regardless of how they're classified for tax.
Industries where a policy is required regardless
Some situations require a written health and safety policy even if you have fewer than 5 employees:
- Certain licences and registrations may require documented safety arrangements
- Working with specific clients (government, NHS, large corporations) often have non-negotiable policy requirements
- Some insurance policies require documented procedures
- Regulatory requirements in certain sectors (e.g., care providers registered with CQC)
Always check requirements specific to your industry and client base.
The three parts of a health and safety policy
A health and safety policy must contain three distinct parts:
- Statement of Intent - Your commitment to health and safety
- Organisation - Who is responsible for what
- Arrangements - How you manage health and safety day-to-day
Each part serves a different purpose, and all three are necessary for compliance.
Think of the three parts as: your commitment (Statement), your people (Organisation), and your processes (Arrangements). Together they form the complete framework for managing health and safety in your business.
Part 1: Statement of Intent
The Statement of Intent is your public commitment to health and safety. It sets the tone for the entire policy and must be signed by the most senior person in your organisation.
What to include:
- A clear statement that health and safety is a priority for your business
- Recognition of your legal duties
- Commitment to providing resources for health and safety
- Expectation that all employees will cooperate
- Promise to consult with employees
- Signature, name, job title, and date
Example Statement of Intent:
[Company Name] is committed to ensuring the health, safety, and welfare of all employees and anyone else who may be affected by our work activities.
We recognise our duties under the Health and Safety at Work Act 1974 and will:
- Provide safe working conditions and equipment
- Assess risks and implement appropriate controls
- Provide information, instruction, training, and supervision
- Consult with employees on health and safety matters
- Review and improve our arrangements regularly
Health and safety is everyone's responsibility. All employees are expected to cooperate with this policy and take reasonable care of themselves and others.
Signed: _________________ Date: _________________
[Name], [Job Title]
Tips for the Statement:
- Keep it to one page maximum
- Use clear, straightforward language
- Make genuine commitments you can deliver on
- Display it where employees can see it
- Re-sign when you review the policy
The Statement of Intent should be signed by whoever has ultimate responsibility for the business - the owner, managing director, or senior partner. This shows leadership commitment. A statement signed by a junior manager sends the wrong message.
Part 2: Organisation
The Organisation section identifies who is responsible for what. This is where you name names and assign specific duties.
What to include:
- Senior management responsibilities: Overall accountability, resource allocation, policy approval
- Manager/supervisor responsibilities: Day-to-day implementation, risk assessments, training, monitoring
- Employee responsibilities: Following procedures, reporting hazards, cooperating with arrangements
- Competent person: Who provides health and safety advice (internal or external)
- Specific roles: Fire wardens, first aiders, safety representatives (if applicable)
Example Organisation section:
Managing Director (Jane Smith) is responsible for:
- Overall implementation of this policy
- Ensuring adequate resources for health and safety
- Reviewing health and safety performance
- Approving significant changes to procedures
Operations Manager (Tom Brown) is responsible for:
- Conducting and reviewing risk assessments
- Ensuring staff receive appropriate training
- Investigating accidents and near misses
- Maintaining equipment and the workplace
All Employees are responsible for:
- Following safe working procedures
- Using equipment correctly
- Reporting hazards, accidents, and near misses
- Cooperating with health and safety arrangements
- Not interfering with safety equipment or procedures
Competent Advice is provided by: [External consultant name] / [Internal person with training]
Tips for the Organisation section:
- Use actual names, not just job titles (so people can be held accountable)
- Be specific about duties - "responsible for health and safety" is too vague
- Include everyone from directors to the most junior employee
- Identify who provides competent health and safety advice
- Update immediately when people change roles or leave
The Organisation section is often where policies fail in practice. If it's not clear who is responsible for a particular task, that task often doesn't get done. Be specific: "John Smith is responsible for testing the fire alarm every Monday morning" is much better than "fire alarms will be tested regularly."
Part 3: Arrangements
The Arrangements section describes how you actually manage health and safety day-to-day. It's the most detailed part of the policy and covers your systems, procedures, and processes.
What to include:
Risk assessment:
- How you identify hazards and assess risks
- Who conducts assessments and how often
- How findings are communicated and acted upon
- When assessments are reviewed
Training:
- Induction for new employees
- Job-specific training
- Refresher training frequency
- How training is recorded
Emergency procedures:
- Fire evacuation procedures
- First aid arrangements (who, where, what equipment)
- What to do in serious emergencies
- Assembly points and roll call procedures
Accident reporting:
- How employees report accidents and near misses
- Who investigates incidents
- RIDDOR reporting (who is responsible)
- How you learn from incidents
Consultation:
- How you consult employees on health and safety matters
- Safety representatives (if applicable)
- How concerns are raised and addressed
Monitoring and review:
- Workplace inspections (who, how often)
- How you check arrangements are working
- When the policy is reviewed
- How improvements are identified and implemented
Specific hazard controls:
Depending on your business, you may need sections on:
- Manual handling
- Display screen equipment
- Working at height
- Hazardous substances
- Workplace transport
- Lone working
- Contractor management
- Any other significant hazards in your workplace
The Arrangements section must describe what you actually do, not what you think you should do. If you write that you conduct monthly inspections but don't actually do them, you've created evidence of your own non-compliance. Be honest about your current arrangements, then create an action plan to address any gaps.
How to write each section: Practical guidance
Getting started
Before writing, gather the information you need:
- Walk your workplace - Identify hazards and note current controls
- Review your team - List who currently does what for health and safety
- Check existing documents - Risk assessments, training records, procedures
- Talk to employees - They know what actually happens day-to-day
- Identify gaps - Where are your arrangements weak or missing?
Writing tips
Be specific and practical:
Instead of: "Staff will be trained in health and safety"
Write: "All new employees receive health and safety induction on their first day, covering fire procedures, first aid locations, accident reporting, and hazards specific to their role. Records are kept in the training folder."
Use names where possible:
Instead of: "A manager is responsible for fire safety"
Write: "Sarah Jones (Office Manager) is responsible for fire safety, including weekly alarm tests, monthly emergency lighting checks, and coordinating fire drills."
Match reality:
If you can't commit to weekly inspections, don't write weekly inspections. Write what you can actually deliver consistently.
Keep it proportionate:
A small, low-risk office might need a 5-10 page policy. A medium-sized manufacturing business might need 20-30 pages. Don't pad it out unnecessarily, but do cover everything relevant.
Using templates
Templates are a good starting point but must be customised. When using a template:
- Delete sections that don't apply to your business
- Expand sections that are particularly relevant
- Replace all generic text with your specific arrangements
- Add your actual names, locations, and procedures
- Review every line - does this reflect what we actually do?
A generic template with your company name inserted is not a health and safety policy. Inspectors spot them instantly, and they're useless for actually managing safety. Invest the time to make it genuinely yours.
Common mistakes to avoid
1. Copying a template without customising it
Using a downloaded template word-for-word doesn't meet your legal obligations. Your policy must reflect your specific organisation, risks, and arrangements.
Fix: Use templates as a starting point, then adapt every section to your actual business.
2. Writing aspirational arrangements you don't follow
Promising monthly inspections, quarterly drills, and daily checks that never happen creates evidence of your own failure.
Fix: Write what you actually do. If it's inadequate, acknowledge the gap and create an action plan.
3. Being too vague about responsibilities
"Managers are responsible for health and safety" doesn't tell anyone what they should actually do.
Fix: Name specific people with specific duties. "Tom Brown is responsible for ensuring all warehouse staff complete manual handling training before operating pallet trucks."
4. Never reviewing or updating
A policy written five years ago when you had different staff, premises, and activities is not compliant.
Fix: Review at least annually. Update immediately when significant changes occur. Set calendar reminders.
5. Not communicating it to employees
A policy filed away that no one has seen doesn't meet legal requirements and serves no practical purpose.
Fix: Discuss the policy in induction. Display the Statement of Intent. Make the full policy accessible to all staff.
6. Making it too complicated
Small businesses sometimes produce 40-page policies trying to cover every conceivable scenario, resulting in documents no one reads.
Fix: Be proportionate. Cover your significant risks adequately. A clear 10-page policy people actually read is better than 40 pages of generic text that gathers dust.
How to communicate the policy to staff
Creating the policy is only half the job. Section 2(3) of the Health and Safety at Work Act 1974 requires you to bring the policy to the notice of all employees.
New employees
- Cover key points during induction on the first day
- Explain where to find the full policy
- Highlight their specific responsibilities
- Test understanding of emergency procedures
Existing employees
- Team meeting to introduce new or updated policy
- Email with link to document or physical copy
- Summary handout of key points
- Discussion of any changes from previous version
Ongoing accessibility
- Display Statement of Intent in a visible location
- Keep full policy accessible (shared drive, notice board, staff room)
- Reference the policy in training sessions
- Include in employee handbook
When the policy changes
- Communicate updates promptly (within one month of change)
- Explain what changed and why
- Ensure affected employees understand new arrangements
- Update displayed copies
Create a one-page summary of the policy highlighting key points: emergency contacts, who to report accidents to, main hazards and controls, where to find the full policy. This is easier for employees to digest than a lengthy document and serves as a quick reference.
When to review and update your policy
Your policy is never "finished." It must be kept current to remain compliant and useful.
Scheduled reviews
At least annually: Set a calendar reminder for the policy anniversary. Even if nothing has changed, document that you reviewed it.
Triggered reviews
Review immediately following:
- Changes to your organisation: New premises, equipment, activities, or significant growth/reduction in staff
- Changes to personnel: When named individuals leave or change roles
- After incidents: Serious accidents, near misses, or cases of work-related ill health
- After enforcement action: HSE notices, warning letters, or prosecution
- Regulatory changes: New laws or updated guidance relevant to your business
- When audits reveal gaps: Internal reviews or external assessments identify deficiencies
Review checklist
When reviewing your policy, check:
- Does the Statement of Intent still reflect our commitment? Is it recently signed?
- Are all named individuals still in those roles? Are the names correct?
- Do the responsibilities match what people actually do?
- Do the arrangements describe our current practices?
- Are there new hazards or activities not covered?
- Have there been incidents suggesting arrangements are inadequate?
- Has relevant legislation or guidance changed?
- Do employees know about the policy and understand their responsibilities?
Document the review
Keep a simple log showing:
- Date of review
- Who conducted it
- Changes made (or "no changes required")
- Next review date
An outdated policy is almost as problematic as no policy at all. It demonstrates that health and safety isn't actively managed and can be used as evidence against you following an incident. Regular review shows you're taking your duties seriously.
Policy vs procedures: What's the difference?
Small business owners often confuse policy with procedures. Understanding the difference helps you structure your documentation correctly.
Health and safety policy
- High-level document setting out your overall approach
- Covers your commitment, responsibilities, and general arrangements
- Relatively stable - changes when your business changes significantly
- Required by law if you have 5+ employees
- Typically 5-30 pages depending on business size/complexity
Procedures (or safe working procedures)
- Detailed step-by-step instructions for specific tasks
- Tell employees exactly how to do something safely
- More likely to change as methods or equipment change
- Not specifically required by law, but good practice
- Can be any length - from a single page to detailed manuals
Example:
Your policy might say: "Manual handling risks are assessed for all tasks involving lifting, carrying, or moving loads. Employees receive training in safe manual handling techniques."
A procedure would provide the specific detail: "When lifting boxes from the delivery pallet: 1. Assess the weight before lifting (check label). 2. If over 15kg, use the pallet truck or get assistance. 3. Position feet shoulder-width apart... [etc.]"
How they work together
Your policy provides the framework. It says what you'll do and who's responsible.
Procedures provide the detail. They tell employees exactly how to do things safely.
For small businesses, the Arrangements section of your policy may include enough detail that you don't need separate procedure documents. Larger or higher-risk businesses often have the policy as the master document with detailed procedures attached or referenced.
Where to get templates
Several sources provide health and safety policy templates:
HSE (Health and Safety Executive)
The HSE provides free guidance and example policies for different sectors. Visit hse.gov.uk and search for policy templates relevant to your industry.
Pros: Free, authoritative, sector-specific options Cons: Basic - still need significant customisation
Trade associations
Many trade associations provide templates and guidance for their members. These are often more tailored to your specific industry.
Pros: Sector-specific, often includes additional support Cons: Usually requires membership
Professional consultants
Health and safety consultants can either provide templates or create a bespoke policy for your business.
Pros: Tailored to your specific situation, professional quality Cons: Cost (typically £500-£2,000 for a full policy)
Commercial providers
Various websites sell policy templates. Quality varies significantly.
Pros: Convenient, often reasonably priced Cons: Variable quality, still needs customisation
Whichever source you use, remember that a template is a starting point, not a finished product. Every template needs thorough customisation to reflect your specific business, people, and arrangements.
Frequently asked questions
You're in breach of Section 2(3) of the Health and Safety at Work Act 1974. An HSE inspector can issue an improvement notice requiring you to produce a policy. Continued failure, or failure combined with other breaches, can lead to prosecution with unlimited fines. In practical terms, if an accident occurs and you don't have a policy, it's strong evidence of inadequate health and safety management.
Absolutely. While there's no legal requirement, having a written policy is good practice. It demonstrates professionalism to clients, helps with consistency, and means you're prepared if you grow. Many small businesses with 2-4 employees choose to create a simple policy for these reasons.
There's no prescribed length. For a small, low-risk business (office, shop, simple service business), 5-15 pages is typically adequate. Medium-sized businesses or those with more significant risks might need 20-30 pages. Focus on covering your actual risks and arrangements clearly rather than hitting a page count. Quality and accuracy matter more than length.
Not necessarily. You can have one overarching policy that covers your whole organisation, with site-specific appendices for different locations. The Statement of Intent and Organisation typically apply across the business, while Arrangements may vary by site. However, each site still needs its own risk assessments and may need specific procedures for local hazards.
Next steps
To create your health and safety policy:
- Determine if you need one: 5+ employees means a written policy is mandatory
- Understand the structure: Statement of Intent, Organisation, Arrangements
- Gather information: Your current people, processes, and arrangements
- Choose your approach: DIY with templates, professional consultant, or hybrid
- Write each section: Be specific, honest, and proportionate to your risks
- Review before finalising: Check it matches your actual business
- Communicate to employees: Bring it to everyone's notice
- Implement the arrangements: Make sure what you've written actually happens
- Review regularly: At least annually and whenever your business changes
For comprehensive guidance on health and safety for small businesses, see our Small Business Health and Safety Guide.
Need help creating a compliant health and safety policy? A qualified consultant can assess your business, develop a proportionate policy, and ensure you meet your legal obligations without unnecessary bureaucracy.
Related articles:
- Small Business Health and Safety Guide
- How to Write a Health and Safety Policy
- Do I Need a Health and Safety Policy?
- Risk Assessment Guide
Useful tools:
This article provides general guidance on health and safety policy requirements under UK law. It is not legal advice. Requirements may vary based on your specific circumstances, industry, and regulatory context. If you're unsure about your obligations, consult a qualified health and safety professional.