An employer's health and safety responsibilities come down to ten things: appoint a competent person, have a policy, assess your risks, consult your employees, give information and training, provide welfare facilities, provide first aid, display the law poster, hold employers' liability insurance and report serious incidents. With five or more employees the policy and risk assessment must be written down.
On this page
- What the law expects of an employer
- Steps 1 to 3: get organised
- Steps 4 and 5: involve and train your people
- Steps 6 to 8: the workplace itself
- Steps 9 and 10: insurance and reporting
- Other duties that depend on your work
- What is different with fewer than five employees
- What records to keep
- Keeping on top of it in SafetyPro360
What the law expects of an employer
Two pieces of law sit behind everything on this page.
The Health and Safety at Work etc. Act 1974 puts a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all their employees. Section 3 extends that to people who are not your employees but could be affected by your work: customers, visitors, contractors, passers-by.
The Management of Health and Safety at Work Regulations 1999 say how: assess the risks, make arrangements to control them, appoint someone competent to help, and inform and train your people.
"Reasonably practicable" is the phrase that matters. HSE explains it as balancing the level of risk against the measures needed to control it in terms of money, time or trouble. You are not expected to remove every risk. You are expected to deal with the real ones in proportion.
HSE's own message to small, low-risk businesses is that a few basic steps may be all you need. The ten below follow HSE's list, with employers' liability insurance added.
Steps 1 to 3: get organised
1. Appoint a competent person
Regulation 7 of the Management Regulations requires every employer to appoint one or more competent persons to help them meet their health and safety duties. It can be you, one of your employees or someone from outside, and HSE says that in most small firms you can do it yourself with the help of your workers. Do this first, because that person does or oversees everything else on the list. See who can be your competent person.
2. Prepare a health and safety policy
A policy says how you manage health and safety: your commitment, who is responsible for what, and your arrangements. Section 2(3) of the Act requires it in writing if you have five or more employees, and requires you to bring it to the notice of every employee. For a small firm it is two or three pages. See what a health and safety policy has to say.
3. Assess the risks
Regulation 3 requires every employer to make a "suitable and sufficient" assessment of the risks to employees and to anyone else affected by the work. HSE sets it out as five steps: identify the hazards, assess the risks, control the risks, record your findings and review the controls. With five or more employees you must record the significant findings and any group of employees especially at risk.
HSE publishes a template and example assessments for offices, shops, warehouses and workshops on its page on managing risks and risk assessment at work. Its warning is worth repeating: do not copy an example and put your name on it. The assessment has to be about your work.
Steps 4 and 5: involve and train your people
4. Consult your employees
You must consult your employees on health and safety. Where no trade union is recognised, the duty is in regulation 3 of the Health and Safety (Consultation with Employees) Regulations 1996, and you can consult people directly or through representatives they elect. The regulation lists what you must consult on, including any change that may substantially affect their health and safety, who you appoint as your competent person, and the planning of health and safety training. Where a union is recognised, the Safety Representatives and Safety Committees Regulations 1977 apply.
In a firm of ten people this is a conversation, not a committee. A standing item at the weekly meeting, or a toolbox talk where people are asked what worries them, does the job. Keep a note that it happened.
5. Provide information and training
Section 2 of the Act requires the information, instruction, training and supervision needed to keep employees safe. Regulation 10 of the Management Regulations requires you to tell employees about the risks and the precautions. Regulation 13 requires training when someone is recruited and when they face new or increased risks, repeated periodically where appropriate, and in working hours. HSE adds that training must be free for employees.
Start with a proper health and safety induction for every new starter, then work out what each job needs. Our guide to mandatory training separates what the law requires from what is only expected.
Steps 6 to 8: the workplace itself
6. Provide welfare facilities
The Workplace (Health, Safety and Welfare) Regulations 1992 require, among other things:
- toilets and washbasins, with hot and cold or warm water, soap and a means of drying
- drinking water
- somewhere to keep clothing, and somewhere to change if special clothing is worn for work
- somewhere to rest and to eat meals
They also cover the working environment: ventilation, lighting, space, cleanliness and a reasonable temperature, which HSE's guidance puts at usually at least 16°C, or 13°C for strenuous work. Construction sites have their own welfare rules.
7. Make first aid arrangements
Regulation 3 of the Health and Safety (First-Aid) Regulations 1981 requires equipment, facilities and people that are "adequate and appropriate in the circumstances". HSE's guidance gives the minimum for any workplace: a suitably stocked first aid kit, an appointed person to take charge of first aid arrangements, and information for all employees about those arrangements. Whether you need trained first aiders, and how many, depends on your own assessment of the work and the people. There is no fixed ratio in law. See our first aid kit checklist.
8. Display the law poster
The Health and Safety Information for Employees Regulations 1989 require you to display the approved health and safety law poster where employees can easily see and read it, or to give each employee the approved leaflet. The poster is sold by HSE Books. The leaflet is a free download from HSE, which is the simpler route for staff who work from vans or other people's sites.
Steps 9 and 10: insurance and reporting
9. Hold employers' liability insurance
The Employers' Liability (Compulsory Insurance) Act 1969 requires every employer carrying on business in Great Britain to insure against liability for injury or disease to their employees. The government's guidance is that you need it as soon as you become an employer, for at least £5 million, from an authorised insurer, and that you can be fined £2,500 for every day you are not properly insured. You must also display the certificate where employees can read it, which can be electronically. You do not need it if the only people you employ are close family members, but HSE points out that this exemption does not apply to a family business incorporated as a limited company.
10. Report and record accidents
RIDDOR requires you to report deaths, specified serious injuries, injuries that keep a worker from their normal work for more than seven days, certain occupational diseases and listed dangerous occurrences, and to keep records for three years. Our guide to RIDDOR reporting covers what is reportable and by when. If ten or more people are normally employed at the same time on or about the same premises, you must also keep an accident book.
Other duties that depend on your work
The ten steps apply to every employer. Others apply only if the hazard is present. The ones a small firm most often meets:
- Fire. Fire safety is separate law, enforced by the fire and rescue authority. In England and Wales the Regulatory Reform (Fire Safety) Order 2005 requires the responsible person to carry out a fire risk assessment and keep it under review. Scotland has its own fire safety legislation.
- Hazardous substances. COSHH requires an assessment before work that exposes employees to substances hazardous to health, from cleaning chemicals to wood dust.
- Work equipment. PUWER requires equipment to be maintained in good repair. LOLER requires lifting equipment to be thoroughly examined: at least every six months if it lifts people or is a lifting accessory, and at least every twelve months otherwise, unless an examination scheme says differently.
- PPE. Where a risk cannot be controlled another way, you must provide suitable protective equipment. See our guide to the PPE regulations.
- Asbestos. If you are responsible for maintaining or repairing non-domestic premises, the Control of Asbestos Regulations 2012 require you to find out whether asbestos is present and manage it.
Your risk assessment is what tells you which of these apply.
What is different with fewer than five employees
Less than people think. The duties are the same. What changes is how much has to be written down.
| Duty | Fewer than five employees | Five or more employees |
|---|---|---|
| Health and safety policy | HSE says you must have one, but it need not be written | Must be in writing |
| Risk assessment | Must be done, need not be recorded | Significant findings must be recorded |
| Health and safety arrangements | Must be made, need not be recorded | Must be recorded |
| COSHH assessment | Must be done, need not be recorded | Significant findings must be recorded |
| Fire risk assessment (England and Wales) | Must be recorded | Must be recorded |
| Competent person, consultation, training, welfare, first aid, law poster, insurance, RIDDOR | Apply in full | Apply in full |
The accident book has a different threshold: ten or more people normally employed at the same time on or about the same premises.
Even where writing is not required, a page of notes on your risks and what you do about them is worth having. A customer, an insurer or an inspector will ask how you know the work is safe, and "it is in my head" is hard to show.
If you are self-employed and employ nobody, HSE's guidance is that health and safety law applies to you only if your work could put other people at risk, or you work in one of six higher-risk activities, which include construction, agriculture, gas and asbestos work.
What records to keep
At the least, a firm of five or more should be able to put its hands on:
- the signed policy
- risk assessments, and COSHH assessments if you use hazardous substances
- the fire risk assessment
- training records for each person
- accident and RIDDOR records
- the current employers' liability certificate, and past ones
- inspection and examination reports for equipment
Our guide to health and safety documents has the full table with how long to keep each. Once the basics are in place, a yearly self-audit shows whether they are still true.
Keeping on top of it in SafetyPro360
SafetyPro360 holds the records behind these steps. Staff are listed with their roles, and each role lists the training it requires, so the training matrix shows what is in date, running out, expired or missing. Documents such as the policy and insurance certificate are uploaded with review and expiry dates. Incidents, checks you build yourself, toolbox talks and actions with due dates are recorded in the same account. When you log in, the dashboard lists what is overdue, missing or expiring. It keeps records and shows gaps. Deciding what your business needs remains your job.
Questions people ask
What are the health and safety responsibilities of an employer?
To protect, so far as is reasonably practicable, the health, safety and welfare of employees and of others affected by the work. In practice that means assessing risks and controlling them, appointing a competent person, having a policy, consulting and training employees, providing welfare and first aid, displaying the law poster, holding employers' liability insurance and reporting serious incidents.
Does health and safety law apply to a business with fewer than five employees?
Yes. The duties to assess risks, train people, provide welfare and first aid, insure and report incidents apply to every employer. The difference under five employees is that the policy, the risk assessment findings and your arrangements do not have to be written down, although writing them down is still useful.
Do I need a health and safety consultant?
Not necessarily. The law requires you to appoint a competent person, and HSE says that in most small, low-risk businesses the owner can do it with the help of their workers. Outside help is worth having where the work is high risk or complex, or where nobody in the business has the knowledge.
Is a risk assessment a legal requirement for a small business?
Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to assess the risks to employees and others, whatever the size of the business. With five or more employees, the significant findings must be recorded. With fewer, the assessment must still be done.
Do I need employers' liability insurance for one employee?
Yes, unless that employee is a close family member, and HSE says even that exemption does not apply if your business is a limited company. The government's guidance is that you need cover of at least £5 million from an authorised insurer as soon as you become an employer, and that you can be fined £2,500 for each day you are not properly insured.
Who enforces health and safety law?
HSE enforces it in factories, farms, building sites, schools, hospitals and nursing homes, among others. Local authority environmental health departments cover offices, shops, hotels, restaurants, pubs, leisure premises and care homes. Fire safety is enforced separately by the fire and rescue authority.
Where this comes from
- Health and Safety at Work etc. Act 1974, section 2 (legislation.gov.uk)
- Management of Health and Safety at Work Regulations 1999 (legislation.gov.uk)
- Health and Safety (Consultation with Employees) Regulations 1996, regulation 3 (legislation.gov.uk)
- Health and Safety (First-Aid) Regulations 1981, regulation 3 (legislation.gov.uk)
- Health and Safety Information for Employees Regulations 1989, regulation 4 (legislation.gov.uk)
- Workplace (Health, Safety and Welfare) Regulations 1992, regulations 20 to 25 (legislation.gov.uk)
- Employers' Liability (Compulsory Insurance) Act 1969, section 1 (legislation.gov.uk)
- GOV.UK: Employers' liability insurance
- HSE: Employers' Liability (Compulsory Insurance) Act 1969, a brief guide (HSE39)
- Regulatory Reform (Fire Safety) Order 2005, article 9 (legislation.gov.uk)
- GOV.UK: Fire safety in the workplace
- Control of Substances Hazardous to Health Regulations 2002, regulation 6 (legislation.gov.uk)
- Lifting Operations and Lifting Equipment Regulations 1998, regulation 9 (legislation.gov.uk)
- Provision and Use of Work Equipment Regulations 1998, regulation 5 (legislation.gov.uk)
- Personal Protective Equipment at Work Regulations 1992, regulation 4 (legislation.gov.uk)
- Control of Asbestos Regulations 2012, regulation 4 (legislation.gov.uk)
- HSE: Health and safety basics for your business
- HSE: Managing risks and risk assessment at work
- HSE: Self-employed workers, when health and safety law applies
- HSE: Is HSE the correct enforcing authority for you?
This guide is general information for small employers in Great Britain, checked against the sources above on the date shown. It is not legal advice. If something serious depends on it, check the source or ask a competent adviser.