Every business needs a policy for managing health and safety. If an organisation has five or more employees, that health and safety policy must be written down. But having the document is only the starting point. The policy needs to be reflected in how responsibilities are assigned, risks are controlled, employees are consulted, resources are provided and performance is reviewed.
For directors, the useful question is therefore not simply, Do we have a health and safety policy? It is: Can we show that the arrangements described in it are actually happening?
That distinction matters because HSE guidance on leadership expects health and safety to be managed as part of the organisation’s wider decision-making, with clear leadership, worker involvement, monitoring and review.
A health and safety policy sets out how an employer intends to manage health and safety within the organisation. According to HSE, it should make clear who is responsible for what, when action needs to be taken and how the organisation’s arrangements will work.
For a director, this makes the policy more than a statement of good intentions. It should describe an operating approach that can be followed in practice.
A business may have an impressive-looking document that promises safe working conditions, competent staff and effective risk controls. If nobody knows who owns those commitments, training is not provided or identified problems remain unresolved, the wording has limited practical value.
HSE recommends that a health and safety policy covers three areas.
The statement of intent explains the organisation’s overall approach, commitments and aims for health and safety.
The responsibilities section identifies the people, positions and roles with specific health and safety responsibilities.
The arrangements section explains the practical measures used to achieve the policy’s aims. These might cover risk assessments, employee training, equipment, workplace inspections, emergency arrangements or other controls relevant to the business.
This last part is where directors need to pay particular attention. “We will provide suitable training” is a commitment. An arrangement explains who identifies training needs, who organises the training, how completion is checked and what happens when requirements change.
Businesses looking specifically at how to structure these sections can use the Human Focus health and safety policy template and guidance on responsible parties for more detail.
UK health and safety law requires every business to have a policy for managing health and safety. Where the organisation employs five or more people, the policy must be recorded in writing. Employers with fewer than five employees do not have to write the policy down, although HSE says it is useful to do so.
The policy must also be shared with employees, including when it changes.
This is an important distinction. Saying that every company is legally required to have a written health and safety policy would be inaccurate. The written requirement applies at the five-employee threshold.
For larger organisations, the challenge is usually less about producing the document and more about making sure it still reflects how the organisation actually operates.
HSE’s leadership guidance uses a Plan, Do, Check, Act approach. Directors and board members are expected to provide strategic leadership on health and safety rather than treating it as an isolated operational responsibility.
That does not mean directors personally carry out every risk assessment, inspection or training session. It means they need confidence that suitable arrangements exist, appropriate people have been given responsibility and the organisation checks whether those arrangements work.
A policy that says “management is responsible for health and safety” leaves too much unanswered.
Which manager? Responsible for doing what? Who checks that the action has been completed?
Clear ownership might mean a facilities manager is responsible for workplace inspections, line managers are responsible for local supervision and a competent health and safety adviser provides specialist support.
Directors still need visibility over whether these arrangements are operating effectively. HSE leadership guidance stresses that boards have collective and individual responsibility for health and safety leadership.
An organisational chart can show reporting lines, but directors should also know where important safety information goes once a problem is identified.
Consider a repeated equipment defect reported by employees. If staff tell a supervisor, who reports it to a manager, who emails another department and nobody knows who authorises the repair, responsibility exists on paper but accountability is unclear.
Health and safety commitments require people, time and resources.
If a policy states that employees will receive suitable information and training, the organisation needs a process for identifying what training is necessary and for checking that it has been completed.
Competence also involves more than holding a certificate. The person carrying out a task needs the right combination of skills, knowledge, training and experience for the work involved.
Directors should consider whether managers responsible for safety-critical decisions have enough authority, time and support to carry out those duties properly.
If the person named as responsible for this control said tomorrow that they did not have enough time, budget or competence to manage it properly, would we know?
General statements need to lead to specific activity.
If the policy commits the business to controlling workplace risks, practical arrangements may include risk assessment, preventive measures, maintenance, supervision and emergency procedures.
If it promises regular inspections, decide who carries them out, what is inspected, how frequently they happen, where findings are recorded and who follows up outstanding actions.
The same principle applies to training, first aid, contractors, hazardous substances, workplace transport or any other significant risk.
This is also where a broader health and safety management system can help an organisation turn policies into repeatable processes.
A formal management system is not mandatory for every organisation, but HSE notes that management approaches can generally be understood through Plan, Do, Check and Act.
Employers must consult employees on health and safety matters. HSE describes consultation as a two-way process in which workers can raise concerns and influence decisions about how health and safety is managed.
This makes employees a useful test of whether the health and safety policy has moved beyond paper.
Ask workers what happens when they report a hazard. Do they know who to contact? Are they told what was done? Were they consulted before a change to working methods introduced new risks?
HSE also requires employers to share the policy, and any changes to it, with employees.
Uploading a policy to an intranet may make it technically accessible, but directors should consider whether people actually understand the arrangements that affect their work.
A policy may describe sensible arrangements that gradually stop happening.
Inspections are missed. Training records become outdated. Actions from risk assessments stay open. New equipment is introduced but existing procedures are not reviewed.
Monitoring should identify those gaps.
Useful information for directors may include overdue corrective actions, inspection findings, training gaps, audit results, incidents and near misses, recurring employee concerns and significant changes to risk.
The aim is not to create the biggest possible dashboard. Directors need information that helps them judge whether the arrangements described in the policy remain effective.
Recent enforcement action illustrates the difference between stated responsibility and practical control.
In August 2026, HSE reported that Truro Sawmills Ltd and its managing director had been fined after the company failed to comply with Improvement Notices concerning wood dust and lift-truck safety.
Inspectors found, among other issues, that employees had not been appropriately trained to operate rider-operated lift trucks, respiratory protective equipment had not been properly face-fit tested and suitable health surveillance was not in place. According to HSE, the company failed to act even after enforcement notices had been served.
The company was fined £20,000 plus costs. The managing director was separately fined £5,000 plus costs and disqualified from acting as a company director for five years.
The case was not about whether the company had a well-worded policy document. The enforcement action concerned what was happening at work. That is why directors need evidence that policy commitments translate into real controls.
HSE says the employer or most senior person should sign the policy and review it regularly.
There is no universal legal rule requiring every health and safety policy to be rewritten on a fixed annual date. Review should respond to what is happening in the organisation.
HSE’s wider management guidance says policies and risk assessments should be revisited when there have been workplace or process changes, improvements are still required or lessons have been learned from accidents or near misses.
A review may be appropriate when an organisation moves premises, introduces new machinery or technology, changes working processes, expands into new activities, restructures responsibilities or experiences substantial changes in staffing.
Hybrid working, new contractors, increased automation or changes to shift arrangements can also affect how existing controls operate.
The question is whether the current document still describes the business that exists today.
An incident does not automatically mean the entire policy needs rewriting. It should, however, prompt the organisation to consider whether the incident revealed a weakness in its existing arrangements.
The same applies when an audit identifies repeated failures or when the same corrective action appears month after month without being resolved.
If you selected one major commitment from your current health and safety policy today, could you trace it through to evidence that it is actually being delivered?
That simple exercise can reveal more about implementation than the date printed on the front page.
A policy can be current in terms of its review date but outdated in practice.
Warning signs include responsibilities assigned to people who have left the organisation, arrangements that describe processes no longer used, recurring safety actions with no clear owner and employees who do not know how to report concerns.
Another sign is a mismatch between what senior management believes happens and what employees describe.
The policy might say workers receive regular training, for example, while managers cannot produce current training records. It might state that incidents are reviewed, yet nobody tracks whether actions from those reviews are completed.
These gaps should not simply trigger another rewrite. Directors need to understand why the arrangement failed and what needs to change operationally.
This is part of the wider reason health and safety is important in the workplace: effective management depends on controls working consistently, not simply existing in company documentation.
Directors do not need to become the organisation’s technical health and safety specialists. They do need enough understanding to ask sensible questions, recognise when information is inadequate and make informed decisions about resources, responsibilities and risk.
HSE guidance specifically addresses directors and board members because effective health and safety leadership is expected to come from the top of the organisation. Its core themes include visible leadership, worker involvement, competent advice, monitoring and review.
Human Focus IOSH Safety for Executives and Directors is designed to help senior decision-makers understand their role in health and safety governance and how leadership decisions affect the management of workplace risk.
Training does not by itself demonstrate compliance or competence. It can, however, help directors understand what effective governance should look like and identify the questions they need to ask of the organisation.
A good health and safety policy should describe the way the organisation actually manages risk.
For directors, the strongest test is to move away from the document for a moment and look at the evidence behind it. Who owns each important responsibility? What resources have they been given? How are workers consulted? What happens when a problem is reported? What does the board monitor? When weaknesses are found, who makes sure they are corrected?
If those answers are clear and supported by what happens in the workplace, the policy is doing its job. If the answers exist only in the document, the next task is implementation.
HSE recommends three main sections: a statement of intent, responsibilities for health and safety and the practical arrangements used to achieve the policy’s aims. The arrangements should reflect the organisation’s actual activities and risks rather than relying on generic wording.
Yes. Every business needs a policy for managing health and safety, but businesses with fewer than five employees are not legally required to record it in writing. HSE says writing it down can still be useful.
HSE guidance says the employer or the most senior person in the company should sign the statement of intent. The signature helps demonstrate senior-level commitment to the organisation’s stated health and safety aims.
HSE says the policy should be reviewed regularly, but there is no single fixed review interval that applies to every organisation. It should also be revisited when changes to the workplace or processes occur, improvements are required or lessons emerge from incidents and near misses.
Employers hold legal duties for managing health and safety, while specific activities may be allocated to managers, competent advisers and other employees. Directors should ensure responsibilities are clear, suitable resources are available and performance is monitored.
