Health and safety: what a small employer must actually do

Health and safety occupies a strange place in small business. Owners either ignore it entirely, on the reasonable-sounding basis that nobody has been hurt in twelve years, or they pay a consultant four figures for a folder of documents nobody opens and nothing changes on the floor.

The actual legal requirement sits between the two and is considerably smaller than the folder. For a business with a handful of staff it is genuinely an afternoon's work, and the value of doing it is not compliance theatre — it is that the exercise usually finds two or three real hazards you had stopped noticing.

What the law asks of you

The Health and Safety at Work etc. Act 1974 puts a general duty on an employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of employees — and to protect anyone else affected by the business, which means customers, visitors, contractors and the public.

'Reasonably practicable' is the load-bearing phrase, and it is more forgiving than people assume. It means weighing the risk against the time, cost and trouble of controlling it. You are not required to eliminate every conceivable hazard. You are required to have thought about the real ones and done something proportionate.

Underneath that sits the Management of Health and Safety at Work Regulations, which require a suitable and sufficient assessment of the risks — the risk assessment everyone has heard of and comparatively few have actually done.

The five-employee line

Two obligations change once you employ five or more people, and this is the single most useful threshold to know.

Below five employees, you must still assess risks and act on them; you just do not have to write the findings down. At five or more, you must record the significant findings of your risk assessment, under regulation 3(6) of the Management Regulations, and you must have a written health and safety policy, under section 2(3) of the 1974 Act.

That policy does not need to be long. A statement of intent, who is responsible for what, and how you actually manage it in practice will do — one or two pages, signed and dated, reviewed when something changes.

The number counts everyone on the payroll, not full-time equivalents. Five part-timers is five employees.

A risk assessment is not a document. It is you walking round your own premises asking what could actually hurt somebody — the document is just the bit you keep afterwards.

A risk assessment that is worth doing

The method is five steps and it has not changed in years: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record your significant findings, then review it.

In practice, walk the premises with someone who does the work. In a workshop the answers are usually machinery guarding, manual handling, electrical equipment, slips and trips, noise and dust. In a café: hot surfaces, sharp equipment, wet floors, cleaning chemicals, and the door staff back through carrying a full tray. In an office: display screen equipment, trailing cables, and the stepladder somebody uses to reach the top shelf.

For each one, write what you already do and what you will change. 'Guard fitted, checked weekly by MB' is a control. 'Staff to be careful' is not.

Then do the four things that are almost always missing in a small business: a properly stocked first aid kit and someone nominated to look after it, an accident book, a fire risk assessment with a workable escape route, and a record that new staff were shown how to do the job safely rather than handed a broom on day one.

What it costs to get wrong

Employers' liability insurance is compulsory for almost every business with employees, at a minimum indemnity of £5 million. The penalties for going without are unusual in that they are charged per day: up to £2,500 for each day you are uninsured, plus up to £1,000 for failing to display or produce the certificate on request. It is one of the few small-business obligations where the cost of ignoring it accrues while you sleep. What employers' liability insurance actually covers is worth reading alongside this.

Then there is fee for intervention. If an HSE inspector finds a material breach — a contravention serious enough to be recorded in writing — you pay for the HSE's time investigating it and putting it right, at £188 an hour from 1 April 2026. Because the clock covers everything associated with the breach, including the inspector's report writing and any follow-up visit, a single afternoon's inspection can produce a four-figure invoice on top of whatever fixing the problem costs you.

RIDDOR: what you have to report

Some incidents must be reported to the HSE by law, and the categories are narrower than people fear. Deaths and specified injuries such as fractures other than to fingers, thumbs or toes, amputations and serious burns must be reported without delay.

Injuries that leave a worker incapacitated for more than seven consecutive days must be reported within fifteen days of the incident — and separately, any absence of more than three days must be recorded even where it does not need reporting.

Certain dangerous occurrences and specified occupational diseases are also reportable. Everything else goes in the accident book, which is not optional either.

The one-afternoon version

Walk the premises with a member of staff and write down what could genuinely hurt someone. Note what you already do and the two or three things you will change, with a name and a date against each. Write a one-page policy if you employ five or more. Check the employers' liability certificate is current and on display. Buy a first aid kit and an accident book. Diary a review for twelve months, or sooner if you change the work, the equipment or the premises.

That is most of the way there, and it is a far better use of an afternoon than a folder. The businesses that come unstuck are almost never the ones that did a rough-and-ready job honestly — they are the ones that did nothing at all, which is also the version that shows up when you take on an apprentice or anyone else young and new to the work.

Common questions

Does a small business need a written health and safety policy?

Only if you employ five or more people. At that point section 2(3) of the Health and Safety at Work etc. Act 1974 requires a written health and safety policy, and regulation 3(6) of the Management of Health and Safety at Work Regulations requires you to record the significant findings of your risk assessment. Below five employees you must still assess and control risks — you simply do not have to write the findings down. The count is people on the payroll rather than full-time equivalents, so five part-timers takes you over the line. The policy itself can reasonably run to one or two pages.

Does a risk assessment have to be written down?

Only where you employ five or more people, but the assessment itself is required regardless of size. The method is five steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the significant findings, and review it periodically. The practical version is walking your own premises with someone who actually does the work and writing down what could genuinely cause harm, what you already do about it, and what you will change — with a name and a date attached. A control is 'guard fitted, checked weekly'; 'staff to be careful' is not a control.

What is HSE's fee for intervention and how much does it cost?

Fee for intervention is the HSE's power to recover its costs from a duty holder found to be in material breach of health and safety law — a contravention serious enough that the inspector notifies it in writing. The rate is £188 an hour from 1 April 2026, and it covers all the time associated with the breach, including identifying the problem, writing it up, and any follow-up visits. Because the clock runs on the whole investigation rather than the site visit alone, a single inspection can generate a four-figure invoice on top of the cost of putting the underlying problem right.

What accidents must I report to the HSE under RIDDOR?

Deaths and specified injuries must be reported without delay — these include fractures other than to fingers, thumbs or toes, amputations, serious burns and injuries causing loss of consciousness. Injuries that leave a worker unable to do their normal work for more than seven consecutive days must be reported within fifteen days of the incident. Certain dangerous occurrences and specified occupational diseases are also reportable. Separately, any work-related absence of more than three days must be recorded even where no report is needed, and all other incidents go in the accident book, which itself is not optional for an employer.