When you need a written health and safety policy

The threshold and who counts

The duty starts at five employees. Count everyone on the payroll including part time, casual and seasonal staff. Agency workers and labour only subcontractors under your direction are normally counted too. Directors who are employees count.

Below five employees the policy does not have to be written, but the duty to manage health and safety is identical. Clients, insurers and pre qualification schemes such as CHAS, SafeContractor and Constructionline all ask for a written policy regardless of headcount, so most small firms write one anyway.

The arrangements section is where your assessments live, so read what a risk assessment legally needs to include before you write it.

Part one: the statement of intent

One page, in the owner or chief executive's own words, setting out the commitment to health and safety, the general aims and the fact that adequate resources will be provided. It must be signed and dated personally by the most senior person, not by an adviser or a consultant.

A statement dated four years ago with a signature from a director who has left is the single most common finding in policy reviews and immediately suggests nobody is managing the system.

Fire arrangements are the section inspectors turn to first, covered in our guide to fire risk assessment duties.

Part two: organisation and responsibilities

This part answers who does what. It should name roles rather than only individuals so it survives staff changes, and it should reach all the way down.

• The director with overall responsibility for health and safety.
• The competent person or persons appointed under regulation 7 of the Management Regulations, whether internal or an external adviser.
• Managers and supervisors, with the specific duties they hold, such as inductions, toolbox talks and inspections.
• Employees, with their duties under section 7 of the Act to take care of themselves and others and to cooperate.
• Any specific appointments: first aiders, fire wardens, DSE assessors, responsible persons for asbestos, legionella, PUWER and LOLER.

Say plainly how incidents are reported, using the accident book and record keeping rules.

Part three: arrangements

This is the working part of the document and the part that should be longest. Each significant risk area gets a short section describing how it is actually controlled in your business, with references to the relevant procedures and forms rather than restating the law.

For most organisations the arrangements cover risk assessment, training and competence, consultation with employees, accident reporting and investigation, first aid, fire and emergency procedures, contractor and visitor management, equipment inspection and maintenance, COSHH, manual handling, display screen equipment, work at height where relevant, occupational health surveillance, and monitoring and audit.

Consultation, communication and review

The Safety Representatives and Safety Committees Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996 require consultation with employees on matters affecting their health and safety, either through recognised union representatives or directly. Consult on the policy before it is finalised rather than issuing it as a fact.

Bring it to the attention of employees properly. An induction sign off, a copy on the noticeboard or intranet, and a summary card for site staff covers it. Keep the record that you did so.

Review the policy at least annually and whenever the business changes: new premises, new activities, significant growth, a serious incident, or a change in legislation. Record the review even where nothing changed, because a dated review log is what shows the policy is alive.

What good looks like

A good policy is specific enough that a stranger could read it and describe how your business manages safety. It avoids copying regulation text, names real roles, references documents that exist, and matches what happens on site.

The quickest self test is to pick three arrangements at random and ask for the evidence. If the policy says quarterly workplace inspections and there is no inspection record for the last two quarters, the policy is not a policy, it is an aspiration, and that gap is what an inspector will pursue after an incident.

Keeping it alive once it is written

A policy dies the day it stops matching how the business actually runs. Set a review date, normally annually, and review sooner whenever the work, the premises, the equipment or the people named in it change. Sign and date each version, and keep the superseded copies: showing an inspector a clear version history is strong evidence that safety is managed rather than filed.

Make it reachable. A policy in a locked cabinet in the office is not brought to the attention of employees in any meaningful sense. Issue it at induction, cover the arrangements that matter to each role in a toolbox talk, and keep the current version somewhere every worker can open on a phone.

Keep the arrangements section practical. Named people, real timescales and the actual forms in use beat generic paragraphs copied from a template. If a line in the policy describes something the business does not do, delete it rather than leave a promise you are failing.

Common questions

How long should a health and safety policy be?

For a small business, ten to twenty pages including arrangements is typical. Length is not the measure; specificity is.

Can we use a template?

As a starting structure, yes. It must then be edited so every arrangement describes your business. An unedited template is easily spotted and carries no weight.

Who should sign it?

The most senior person in the organisation, personally, with the date. Reissue and resign it whenever that person changes.

Related guides

• what a risk assessment legally needs to include
• fire risk assessment duties
• accident book and record keeping rules