A health and safety policy sets out how you manage health and safety: your general commitment, who is responsible for what, and the arrangements you have in place. If you employ five or more people it must be in writing, revised when it needs to be and brought to the notice of every employee. HSE publishes a free template.
On this page
- Who must have a written health and safety policy
- The three parts of a health and safety policy
- Part 1: the statement of intent
- Part 2: responsibilities
- Part 3: arrangements
- Who signs it and how often to review it
- Bringing the policy to employees' attention
- Where to get a health and safety policy template
- Keeping the policy in SafetyPro360
Who must have a written health and safety policy
Every employer with five or more employees. The duty is in section 2(3) of the Health and Safety at Work etc. Act 1974, which requires every employer to do three things:
- prepare a written statement of their general policy on the health and safety at work of their employees, and of the organisation and arrangements for carrying that policy out
- revise it "as often as may be appropriate"
- bring the statement, and any revision of it, to the notice of all their employees
The exception is in the Employers' Health and Safety Policy Statements (Exception) Regulations 1975: an employer who for the time being employs fewer than five employees does not have to comply with section 2(3).
HSE's guidance is that every business must have a policy for managing health and safety, and that with fewer than five employees you do not have to write it down, though it is useful to do so. There is a practical reason as well. Customers, principal contractors and accreditation schemes ask for a copy long before you reach five people.
The three parts of a health and safety policy
The Act asks for a general policy, plus the "organisation and arrangements" for carrying it out. HSE's guidance turns that into three parts, and almost every policy you will see follows them.
| Part | The question it answers | Typical length for a small firm |
|---|---|---|
| 1. Statement of intent | What are we committed to? | Half a page |
| 2. Responsibilities | Who does what? | Half a page to a page |
| 3. Arrangements | How do we do it in practice? | One to three pages |
HSE's own wording is that the policy "should clearly say who does what, when and how". If yours does that, it is doing its job.
Part 1: the statement of intent
This is your general policy: a short statement of your commitment to managing health and safety and what you aim to do. HSE's worked example, written for a firm of 22 people, lists aims such as these:
- prevent accidents and cases of work-related ill health
- manage health and safety risks in the workplace
- provide clear instructions, information and adequate training
- provide personal protective equipment
- consult employees on matters affecting their health and safety
- provide and maintain safe plant and equipment
- implement emergency procedures, including evacuation in case of fire
- review and revise the policy regularly
Write it in your own words and keep only what you mean to do. "We will achieve zero harm through a culture of excellence" tells nobody anything. "We will not ask anyone to work on a roof without edge protection" does.
The statement carries a signature, the date and the date of the next review.
Part 2: responsibilities
HSE's guidance is to list the names, positions and roles of the people who have specific responsibility for health and safety. Its template asks four questions, and they are the right ones for a small firm:
- Who has overall and final responsibility? In a small company this is the owner or managing director. It cannot be handed to a consultant.
- Who has day-to-day responsibility for putting the policy into practice? Often the same person, or a works or site manager.
- Who is responsible for which areas? For example: risk assessments, training, first aid, accident investigation, equipment maintenance, fire and evacuation, consulting employees.
- What is expected of every employee? HSE's template says all employees should co-operate with supervisors and managers on health and safety matters, take reasonable care of their own health and safety, and report all health and safety concerns to an appropriate person.
Use names, not job titles alone, and change them when people leave. A policy that names a supervisor who left two years ago shows that nobody has read it since. This section is also the natural place to record who your competent person is.
Part 3: arrangements
This is the practical part: what you do, in enough detail that a new supervisor could follow it. HSE's template gives four headings to start from: risk assessment, training, consultation and evacuation. Most small firms need a few more.
| Arrangement | What to say |
|---|---|
| Risk assessment | Who carries them out, where they are kept and when they are reviewed |
| Training and induction | What every new starter is told on day one, what training each job needs and where the records are kept |
| Consultation | How you ask employees for their views: a regular meeting, toolbox talks, directly |
| Fire and evacuation | Who the fire marshals are, where the assembly point is, how often alarms and drills are tested |
| First aid and accidents | Who the first aiders are, where the first aid box and accident record are, who decides whether something is reportable under RIDDOR |
| Equipment | Who checks and maintains machinery, vehicles, ladders and lifting equipment, and how defects are reported |
| Hazardous substances | Who does the COSHH assessments and where the safety data sheets are |
| PPE | What is provided, who issues and replaces it |
| Contractors and visitors | How they are signed in, briefed and supervised |
| Monitoring | What checks and inspections are done, by whom and how often |
Leave out anything that does not apply. A firm of office-based surveyors does not need a paragraph on lifting equipment. The policy should point to your detailed documents and not repeat them: "risk assessments are kept in the site office and reviewed every January by the contracts manager" is enough.
The test. Hand Part 3 to someone who started last week and ask them where the first aid box is, who to tell about a broken guard and what to do when the alarm sounds. If the policy answers all three, it works.
Who signs it and how often to review it
Who signs. HSE's guidance is that the employer or the most senior person in the company should sign the statement. The law does not mention a signature, but a signed and dated statement shows who stands behind it and when it was last looked at.
How often to review. The Act says "as often as may be appropriate". It sets no interval. HSE says to review the policy regularly, and the firm in its worked example chose to review every year, or straight away if there is a significant change in the workplace. Once a year is what most small firms settle on, and it is what customers' questionnaires usually expect to see.
Review it sooner when:
- someone named in it leaves or changes job
- you take on a new kind of work, new premises or new equipment
- an accident or near miss shows that an arrangement is not working
- the law changes in a way that affects you
A review can end with "no changes". Re-sign it, re-date it and set the next review date.
Bringing the policy to employees' attention
This is the part of section 2(3) that gets forgotten. The policy, and every revision, must be brought to the notice of all your employees. The Act does not say how. What works in a small firm:
- go through it with every new starter as part of their health and safety induction
- put the signed statement of intent on the noticeboard, with a note of where the full policy is kept
- talk through any changes at a team meeting or toolbox talk when it is revised
- keep a note of who has been shown it and when
A policy in a folder that nobody has opened does not meet the duty, however well it is written.
Where to get a health and safety policy template
HSE publishes a free template and a completed example on its page How to write your policy. The template is three pages, one for each part, with the questions already set out. For most small, lower-risk firms it is all you need. We do not publish a template of our own, because HSE's is free and comes from the regulator.
Two cautions with any template:
- Fill it in yourself. A policy describes how your firm works. One bought off the shelf with your name pasted in describes somebody else's.
- Be wary of length. A 40-page policy from a template pack is harder to keep true than three pages you wrote. If it commits you to monthly audits you do not carry out, it records a promise you are not keeping.
The policy is one of several things an employer has to put in place. For the full list in order, see health and safety for small businesses.
Keeping the policy in SafetyPro360
SafetyPro360 does not write a policy for you. Once yours is written and signed, you upload the file to the document register with a title, a category and a review date. The register shows each document as current, due a review, expired or archived. The document matrix lists the documents your business should hold, each with a review period, and shows which are current, due, expired or missing, so a policy that has passed its review date appears there and on the dashboard when you log in. Uploaded files are private to your account.
Questions people ask
Is a health and safety policy a legal requirement?
Yes. Section 2(3) of the Health and Safety at Work etc. Act 1974 requires every employer to prepare a written statement of their health and safety policy, revise it as appropriate and bring it to the notice of employees. Employers with fewer than five employees are excepted from that subsection, so they need not put the policy in writing.
How many employees before you need a written health and safety policy?
Five. An employer who for the time being employs fewer than five employees is excepted by the Employers' Health and Safety Policy Statements (Exception) Regulations 1975. HSE's guidance is that smaller employers do not have to write anything down, but that it is useful to do so.
What are the three parts of a health and safety policy?
A statement of intent, which sets out your general commitment and aims. Responsibilities, which names who is responsible for what. And arrangements, which describes the practical steps you take, such as risk assessment, training, consultation, first aid and emergency procedures.
How often should a health and safety policy be reviewed?
The law says "as often as may be appropriate" and sets no fixed interval. HSE says to review it regularly, and its worked example uses an annual review or sooner if there is a significant change. Most small firms review once a year and whenever people, premises or work change.
Who should sign a health and safety policy?
HSE's guidance is that the employer or the most senior person in the company should sign the statement of intent. In a small firm that is the owner or managing director. The signature should be dated, with the date of the next review beside it.
Can I use a health and safety policy template?
Yes. HSE publishes a free three-page template and a completed example. A template gives you the structure, but the content has to describe how your own business works: your people, your risks and your arrangements. A generic policy with your name added does not do that.
Where this comes from
- Health and Safety at Work etc. Act 1974, section 2 (legislation.gov.uk)
- Employers' Health and Safety Policy Statements (Exception) Regulations 1975 (legislation.gov.uk)
- HSE: Prepare a health and safety policy
- HSE: How to write your policy (template and example)
This guide is general information for small employers in Great Britain, checked against the sources above on the date shown. It is not legal advice. If something serious depends on it, check the source or ask a competent adviser.