It’s one of the questions we’re asked most often, usually by organisations that have grown a little and are wondering what they’ve missed. The short answer depends on one number: five.
Every business needs a policy
The law says every employer must have a policy for managing health and safety. A policy is simply your approach: what you’re committing to, who’s responsible for what, and how you’ll actually do it.
If you employ 5 or more people, you must write that policy down and share it with your employees. If you have fewer than five, you don’t have to write anything down, but it’s still useful to do so. A written policy makes it far easier to show your team, your insurer and your clients that you’ve thought it through.
The same number applies to risk assessments. With 5 or more employees, you must record the significant findings: the hazards, who could be harmed and how, and what you’re doing to control the risks.
Fire is the exception
In England, the five employee rule doesn’t apply to fire. Since October 2023, every business must record its fire risk assessment in full, along with its fire safety arrangements, whatever its size.
What a good policy looks like
A useful policy usually has three parts:
- A statement of intent: your commitment, signed by the most senior person.
- Responsibilities: who does what, by name or by role.
- Arrangements: how you’ll manage the risks that matter in your work, from risk assessment and training to first aid and accident reporting.
It doesn’t need to be long. The best policies we see are short, specific and recognisable to the people who work there. If your team couldn’t tell you what’s in it, it isn’t doing its job.