A health and safety management system for a small firm
A health and safety management system is how you plan the work, do it, check it and act on what you find. Most of that is decisions only you can make; the rest is records, which is the part software can hold.
14 days free, then from £9.99 a month, with no card needed to start.
What a health and safety management system is
It is the way your business decides what needs doing about health and safety, does it, checks it is working and puts right what is not. HSE calls this Plan, Do, Check, Act, and sets it out in full in its guidance Managing for health and safety (HSG65).
The legal root is short. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 says every employer must make, and follow, arrangements for the effective planning, organisation, control, monitoring and review of their preventive and protective measures. The arrangements are to suit the nature of the work and the size of the business. An employer with five or more employees must record them.
That does not mean buying a system. HSE's guidance is that most small, low-risk businesses do not need a formal management system, and that whether to adopt a formal framework such as ISO 45001 is your decision. What you need is the four steps, working, and written down once you employ five or more.
Plan: the policy, and who does what
Planning is where you describe how you will manage health and safety: who is responsible for which tasks, how you will prepare for an emergency, what you need to improve first. In HSE's guidance that description is your health and safety policy. It is yours to write, or your consultant's to write with you.
What health and safety management software can do is hold the result and stop it going stale. In SafetyPro360 you list the documents your business should hold, each with a review period, and upload each one with its review and expiry dates. The document matrix then shows which are current, which are coming up, which are overdue and which are missing altogether.
- Your own list of the documents you should hold
- A review period on each one
- Anything not uploaded shows as missing
Do: training, briefings and the records of the day
Doing is putting the plan to work. HSE's list for this step includes assessing your risks, giving people information and training, and reporting incidents.
The risk assessments are yours to make. SafetyPro360 does not write them. It holds them as uploaded documents with a review date. The records that build up around them are what it is for.
- Training. Each role lists the courses it needs, and the training matrix shows who is in date, who is running out and who has a gap.
- Toolbox talks. Each talk is kept with its key points, who should have attended and who did.
- Incidents. Accidents and near misses are written up with what happened, where, who was hurt and what was done straight away. Where one has to be reported under RIDDOR, the report to HSE is still yours to make.
- PPE. A count of what is in stock and what is running low.
Check: inspections, and looking into what went wrong
Checking is measuring how you are doing. HSE's examples include regular planned checks of the workplace, maintenance, refresher training and investigating accidents and near misses.
In SafetyPro360 you build a checklist for anything you inspect, with your own questions, and run it on a phone. Every completed check is kept with its date, who did it and a score, and a No or a Fail is flagged as an issue. An incident report has a place for the root cause once you have looked into it. Training that needs a refresher turns amber on the matrix 30 days before it runs out.
- Your own checklists and questions
- Every completed check kept with its score
- A No or a Fail flagged as an issue
Act: review, and finish what you started
Acting is reviewing how it went and changing what needs to change. HSE says to look again at your policy and risk assessments and update them if the workplace or the work has changed, if there are improvements still to make, or if an accident or near miss has taught you something.
Two things in SafetyPro360 serve that. A document past its review date shows on the dashboard as overdue for review, so a policy nobody has read for two years does not sit quietly in a folder. And anything that needs doing becomes an action with a person and a due date on it. Overdue actions stay in the first group on the dashboard until someone completes them, and completed ones are kept as the record of what was done.
What software cannot be
A management system is more than software, and it would be dishonest to sell you one in a box. The policy is yours. The risk assessments are yours. So are the decisions: what is safe enough, who is fit to do the job, what changes after a near miss.
You must also appoint a competent person to help you. HSE's guidance is that this can be you, one or more of your workers, or someone from outside, and that managing health and safety remains your legal duty as the employer if you use a consultant. Our guide to the competent person goes through the choice.
SafetyPro360 holds the records those decisions produce and shows you where they have gaps. If you do use a consultant, you can give them access to the parts of your account you choose, so the person who knows the records best can keep them straight.
Putting yours together
The four steps in the order HSE gives them, with where the software comes in.
Write down how you manage safety
Your policy, who is responsible for what and what happens in an emergency. Upload it and give it a review date.
Assess your risks
Decide what could hurt people and what controls it. The training each role needs and the checks you run come out of this.
Set up the records
Add your people, roles and courses, list the documents you should hold and build a checklist for each thing you inspect.
Look at the list on a set day
Open the dashboard once a month at least. Clear what is overdue, and turn anything new into an action with a name and a date.
What SafetyPro360 does not do
- It does not write risk assessments or COSHH assessments. There is no guided module for either. You write them, or your consultant does, and they are uploaded as documents with a review date.
- It does not report to HSE. You record the incident in SafetyPro360. If it is reportable under RIDDOR, the report itself is made to HSE, not through us. Our RIDDOR guide covers what is reportable.
- It does not send reminders or schedule your checks. Nothing is emailed and nothing repeats automatically. What is overdue or coming up is on the dashboard when you log in.
- It does not export PDFs or reports. An auditor or a customer sees your records on a screen.
Questions people ask
Does a small business need a health and safety management system?
Every employer must have arrangements for planning, organising, controlling, monitoring and reviewing their health and safety measures, and must record them once they employ five or more people. HSE's guidance is that most small, low-risk businesses do not need a formal management system and can follow a Plan, Do, Check, Act approach instead.
What is Plan, Do, Check, Act?
It is the approach HSE sets out for managing health and safety. Plan: describe how you will manage it and who is responsible. Do: assess your risks, train people and put controls in place. Check: inspect, monitor and investigate incidents. Act: review and update your policy and risk assessments. The outcome of each review becomes the next plan.
What is the difference between a management system and health and safety management software?
The management system is the whole arrangement: your policy, risk assessments, responsibilities, training, checks and reviews. Safety management software is a place to keep the records that arrangement produces and to see what is overdue. A small firm can run a sound system on paper. Software earns its place when there are too many dates to keep track of by hand.
Is SafetyPro360 an ISO 45001 system?
No. ISO 45001 is an international standard that an organisation can choose to adopt and be certified to, and HSE notes that in some respects it goes beyond what the law requires. SafetyPro360 is not a route to certification. It keeps the records a small firm gets asked for and shows which need attention.
Does it write our risk assessments?
No. A risk assessment is a judgement about your work, made by someone who knows the work. SafetyPro360 stores the finished assessment as a document with a review date, shows it as missing if it is on your required list and has not been uploaded, and flags it on the dashboard when its review is overdue.
Can our safety consultant run it for us?
They can keep the records for you. You connect your consultant and choose which parts of your account and which sites they can work on. They work through SafetyHub360, the sister product for consultants, and you can end their access at any time. The decisions stay with you.
Have the answer ready before anyone asks.
Add your people, the training each role needs and the documents you hold. From then on, what is overdue or missing is on one screen.
14 days free, then from £9.99 a month, with no card needed to start.