What a Health and Safety Policy Must Legally Contain

Short answer: a health and safety policy is not just a formality, it is a legal document with three required parts, a statement of intent, an organisation section setting out who does what, and arrangements setting out how you actually manage risk day to day. Get any one of those three missing and the policy does not meet the legal standard, however professional it looks.

Who actually needs one

Under the Health and Safety at Work etc. Act 1974, every employer has a general duty to look after the health, safety and welfare of employees. Section 2(3) of the Act specifically requires any employer with 5 or more employees to have a written health and safety policy. Below that number you still need to manage risk properly, you just are not legally required to write it down, though in practice most small businesses find having something written keeps them organised and gives them evidence of compliance if anything is ever questioned.

Part one: the statement of intent

This is the top level commitment, usually a short signed statement from the owner or most senior person in the business, setting out that health and safety is taken seriously, that resources will be made available to manage it properly, and that the policy will be reviewed regularly. It should be dated and signed, and reviewed at least annually or whenever something significant changes in the business.

Part two: organisation

This section names names. It sets out who is responsible for what, who has overall responsibility (usually the owner or director), who manages health and safety day to day, who is responsible for specific areas like fire safety or first aid, and how staff are expected to report hazards or raise concerns. A policy that just says "management will ensure safety" without naming an actual person responsible is a common weak point inspectors pick up on.

Part three: arrangements

This is the practical detail, the actual systems in place to manage risk. It typically covers risk assessments and how often they are reviewed, how accidents and near misses are reported and investigated (tying into RIDDOR where relevant), fire safety arrangements, first aid provision, training arrangements for new starters and ongoing refreshers, and how the business manages specific risks relevant to what it actually does, whether that is manual handling, display screen equipment, or work equipment. This is the part that has to reflect what genuinely happens in your business, not a generic list copied from a template.

Common mistakes that undermine a policy

The most frequent problems are policies that are clearly downloaded templates with the wrong business type still referenced somewhere in the text, policies that have never been reviewed or dated, policies with no named responsible person, and policies that describe arrangements that do not match what actually happens on the ground. A policy is only useful, legally or practically, if it reflects the real business.

If you are also working out whether you need one at all with a small headcount, it is worth reading through the threshold rules for smaller employers, and once the policy is in place it is worth pairing it with a risk assessment that will actually stand up to scrutiny, since the two documents are meant to work together rather than sit in isolation.

Writing a policy that ticks the legal boxes but also genuinely reflects how your business runs takes a bit of care, and it is exactly the kind of document worth getting right the first time rather than downloading a generic template and hoping. If you would rather have it written properly for your specific business, take a look at my health and safety policy writing service.