Who is accountable for health and safety in your organisation?
Not who does the paperwork — who answers for it
Why managing it matters
Health and safety law does not simply list rules to follow. Section 2 of the Health and Safety at Work etc. Act 1974 requires employers to ensure the health, safety and welfare of employees so far as is reasonably practicable — which is a duty to manage, not a duty to tick.
Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires employers to have arrangements for the effective planning, organisation, control, monitoring and review of preventive and protective measures. Those with five or more employees must record those arrangements.
In practice, most serious failures are not caused by someone not knowing a rule. They are caused by nobody checking whether the rule was being followed.
The health and safety policy
If you employ five or more people, you must have a written health and safety policy. It has three distinct parts, and the second and third are the ones that get neglected.
What a policy must contain
| Part | What it does | Common failing |
|---|---|---|
| Statement of intent | Your commitment, signed and dated by the most senior person | Signed years ago by someone who has left |
| Organisation | Who is responsible for what, by name or role | Vague — 'all staff are responsible' |
| Arrangements | How specific risks are actually managed | Generic text that describes no real process |
The arrangements section is the part an inspector will test against reality. If it says fire drills happen twice a year, there must be records of fire drills twice a year. A policy that promises more than the organisation does is worse than one that promises less.
See our guide to health and safety policy requirements.
Plan, Do, Check, Act
The HSE's framework in HSG65 is deliberately ordinary — it is the same cycle used to manage anything else in a business.
The management cycle
0 of 4 completeThe management cycle
0/4Most organisations do Plan and Do. Check and Act are where systems quietly stop working — the assessments exist, the training happened once, and nobody has looked since.
HSG65 — Managing for health and safety sets this out in full.
Checking: monitoring that means something
There are two kinds of monitoring, and relying on only one gives a misleading picture.
Active monitoring (before)
- •Workplace inspections
- •Checking controls are in place and used
- •Reviewing training records against need
- •Testing whether procedures are followed
- •Tells you about risk before harm occurs
Reactive monitoring (after)
- •Accident and incident records
- •Near miss reports
- •Ill health and absence data
- •Complaints and enforcement action
- •Tells you what has already failed
An organisation with no accidents is not necessarily safe — it may simply be lucky, or it may have a reporting culture in which nothing gets reported. Active monitoring is what distinguishes the two.
Investigating incidents
The purpose of investigation is to prevent recurrence, which means finding the conditions that allowed it, not the person at the end of it.
"Human error" is where an investigation should start, not where it should stop. If the finding is that someone made a mistake, the next question is why the system allowed that mistake to cause harm — and what would have caught it.
Consulting your workers
Every employer must consult employees on health and safety. Where a recognised trade union appoints safety representatives, you must consult them; otherwise you consult employees directly or through elected representatives.
Consultation means involving people before decisions are made — not announcing them afterwards. The people doing the work usually know where the controls fail first.
HSG263 — Involving your workforce in health and safety covers how to do it properly.
Reviewing
Review is the step that closes the loop, and the one most often skipped because nothing forces it.
Trigger a review when:
- The work, premises, equipment or people change significantly
- An incident or near miss reveals something the system missed
- Monitoring shows controls are not being followed
- Legislation or guidance changes
- Enough time has passed that nobody can remember the last one
Common mistakes
A policy nobody has read. If staff cannot say what it requires of them, it is not managing anything.
Responsibility without authority. Naming someone who cannot stop unsafe work or authorise spending sets them up to fail.
Auditing the file, not the floor. Records show what was written down, not what happens.
Blame-led investigation. Finding who did it ends the enquiry before it reaches the cause.
Consulting after the decision. That is communication, not consultation, and the law requires the latter.