Risk Assessments vs Health and Safety Policies: What's the Difference

A risk assessment and a health and safety policy are not the same document, and mixing them up is one of the most common gaps small businesses have when they get inspected. In short, a risk assessment identifies and controls the specific hazards in your workplace, while a health and safety policy sets out your overall approach, who is responsible for what, and how you manage health and safety across the whole business. You need both, they do different jobs, and one cannot substitute for the other.

What a risk assessment actually does

A risk assessment is a practical, task-by-task or area-by-area exercise. Under the Management of Health and Safety at Work Regulations 1999, every employer must assess the risks to employees and anyone else affected by their work, and put suitable controls in place. A risk assessment for a stockroom looks completely different to one for a hairdressing salon or a construction site, because it's built around the actual hazards present: trip hazards, chemical exposure, manual handling, working at height, whatever genuinely applies. Good ones identify who might be harmed, how, what's already being done to control it, and what further action is needed, with a review date attached.

What a health and safety policy actually does

A health and safety policy is a higher level document. Under section 2(3) of the Health and Safety at Work etc. Act 1974, any employer with 5 or more employees must have a written policy statement. It covers three parts: your general statement of intent (what you're committing to), the organisation section (who holds responsibility, from the business owner down to individual staff), and the arrangements section (the practical systems you have in place, like how accidents get reported, how risk assessments get carried out and reviewed, training arrangements, and so on). It's a governance document, not a hazard checklist.

How they fit together

The policy's arrangements section is really where the two connect. A well written policy will say that risk assessments are carried out for all significant work activities, reviewed at set intervals or after an incident, and that named people are responsible for making sure that happens. The risk assessments themselves are then the evidence that the policy is actually being followed, not just a document sitting in a drawer. An inspector or a client asking to see your paperwork will usually want to see both, because a policy with no risk assessments behind it looks like intent without action, and risk assessments with no policy behind them look ad hoc rather than managed.

Where small businesses get this wrong

The most common mistake is treating one as a substitute for the other, usually because a generic template was downloaded and never adapted. A policy copied from the internet with the wrong company name still in it, or a single generic risk assessment used across completely different tasks, will not hold up to scrutiny. The other common gap is having both documents but no real link between them, so the policy claims risk assessments are reviewed annually and nobody can produce one that's actually been looked at in the last two years. Both documents need to be live, specific to the business, and dated.

If you want to see how the practical side works before tackling the policy, it's worth looking at what actually makes a risk assessment hold up under scrutiny, since the same principles of being specific and evidenced apply to both documents. It's also worth checking exactly what a compliant health and safety policy is legally required to contain, since a lot of the templates in circulation miss out the organisation section entirely.

If you're not sure your current policy and risk assessments would stand up to a client or an inspector asking questions, that's usually worth sorting before it becomes a problem rather than after. I write professional health and safety policies for UK small businesses, built around what your business actually does rather than a generic template.

Comments

Post a Comment

Got a question about your own situation? Ask below and I will get back to you. Comments are checked before they go live so there may be a short delay.

Popular posts from this blog

CDM 2015 Duties Explained for Small Contractors

CDM 2015 applies to every construction project in the UK, not just the big notifiable ones, and it hands small contractors real legal duties whether they realise it or not. The Construction (Design and Management) Regulations 2015 set out who is responsible for managing health and safety risk at every stage of a build, from a single tradesperson doing a domestic extension to a full site team. If you're a small contractor and you've assumed CDM only applies to large sites with a principal contractor sign on the gate, that assumption is the most common and most costly mistake in the trade. Who counts as what under CDM 2015 The regulations define five duty holders: client, principal designer, principal contractor, designer and contractor. On a small job with only one contractor involved, that contractor takes on the contractor duties directly, which means planning, managing and monitoring the work under their control, and making sure workers are competent and adequately supervi...
Read more

RAMS Explained: What a Risk Assessment and Method Statement Actually Is

 Short answer: RAMS stands for Risk Assessment and Method Statement, two connected documents that most UK construction sites will ask you to produce before they let you start work. If you've been asked for one and aren't sure what it actually needs to contain, here's the plain version. WHAT THE TWO PARTS ACTUALLY ARE A risk assessment identifies the hazards in a specific work activity: who could be harmed, how likely it is, how severe it could be, and what you'll do to control it. A method statement is the practical companion document. It sets out the actual sequence of works, step by step, so anyone reading it knows exactly how the job will be carried out safely. Put together, RAMS answers two questions a site manager or principal contractor needs answered before they let anyone start: what could go wrong, and exactly how you're going to stop it going wrong. WHERE THE LEGAL REQUIREMENT COMES FROM The Management of Health and Safety at Work Regulations require risks...
Read more

HMO Fire Safety Requirements, Room by Room

 Short answer: what counts as compliant changes depending on which room you're standing in. HMOs get treated differently to a normal let because more unrelated people are sharing escape routes, so the requirements are more detailed room by room rather than one blanket rule for the whole property. BEDROOMS Doors opening onto an escape route generally need to be fire doors, rated FD30, with a self closer, intumescent strips and smoke seals fitted. Distance matters too: a bedroom should be within 18 metres of a way out, or 7.5 metres if there's only one direction of escape available. Smoke detection in bedrooms is normally covered by the property's interlinked alarm system rather than a standalone unit. KITCHENS Kitchens are usually the highest fire risk room in an HMO, and the requirements reflect that. Fire doors here need to be to the same FD30 standard as bedrooms. Detection is different though, shared kitchens should have heat detectors rather than smoke alarms, since coo...
Read more