Workplace Health and Safety Policy and Statement Requirements

H&S Policy in Brief

Health and Safety at Work etc. Act 1974 requires a written policy for employers of five or more, signed by senior leadership and brought to workers attention. Three parts: statement of intent, organisation and arrangements.

Health and Safety Policy

A written health and safety policy is a UK legal requirement for any employer with five or more employees, under section 2(3) of the Health and Safety at Work etc. Act 1974. Smaller organisations are not required to have a written policy, but will often choose to do so anyway because it provides clarity and supports pre-qualification for customer tenders and SSIP schemes.

The policy is not a standalone piece of paperwork. It is the top-level document that sits above the risk assessments, procedures, training records and everything else that makes a health and safety system work. If the policy is wrong, the system built on top of it will not work well either.

The Three Parts of a Health and Safety Policy

A conventional health and safety policy has three parts:

Statement of intent - a short statement from top management setting out the organisation's commitment to health and safety, including commitments to legal compliance, prevention of harm, consultation with workers and continual improvement
Responsibilities - who is responsible for what within the organisation, from directors and managers down to individual workers
Arrangements - the practical arrangements for managing specific risks, typically referring out to risk assessments, procedures and other documents rather than duplicating them

The statement of intent is the part most people read. It should be short enough to be useful - a single page is usually enough - and clear enough that a new starter can understand the organisation's position without needing anything else explained.

What a Health and Safety Policy Should Commit To

The core commitments a policy should include are relatively standard:

Compliance with applicable health and safety law and other requirements
Provision of a safe workplace, safe equipment and safe systems of work
Identification and control of hazards through risk assessment
Provision of information, instruction, training and supervision
Consultation with workers on health and safety matters
Prevention of work-related injury and ill health
Continual improvement of the H&S management system
Provision of adequate resources to support all of the above

Each commitment should be one the organisation actually intends to honour. A policy that promises things the organisation has no way of delivering is worse than no policy at all.

Top Management Approval and Communication

The policy should be approved and communicated by top management - typically the most senior person in the organisation, such as the managing director or chief executive. This is not a formality. The policy carries more weight when workers can see it is owned at the top of the organisation.

In the UK, under the Health and Safety Information for Employees Regulations, the policy must be made available to workers. That can be done through the staff handbook, the intranet, induction packs, noticeboards, or a combination. The important thing is that workers know it exists, can find it when they need to, and understand the parts of it that apply to them.

The policy should be reviewed whenever the organisation changes significantly, when legislation changes in a way that affects its commitments, or when audits, incidents or management reviews show that the policy does not match what is actually happening. Some organisations review every year as a matter of routine; others review less frequently but only if the organisation is stable.

Common Problems with Health and Safety Policies

The most common problem is a policy that does not match the organisation - written generically, full of commitments to activities the organisation does not do, referring to arrangements that do not exist. The next most common is a policy that nobody in the organisation has seen. Both problems tend to be caught at audit.

Less obvious but equally common is a policy that commits to standards the organisation does not achieve in practice. An auditor will check the policy against the reality on the ground. If the policy says "all workers receive annual H&S refresher training" and the training records show otherwise, that is a nonconformity and a symptom that the system is not working.

The policy is often the first document an auditor or regulator asks to see, and it tells them a lot about how seriously the organisation takes H&S. A short, specific, clearly owned policy sets a good tone. A generic template with the wrong company name at the top sets a very different one.

My advice on drafting: write the statement of intent in plain English, get the senior person to sign it, and review it when something changes. That is enough. The arrangements section can reference out to the risk assessments and procedures - it does not need to repeat them.

We review the policy every year as part of management review. It does not usually change much, but the exercise of reading it fresh each year catches anything that has drifted out of date.

The arrangements section is where ours used to get unwieldy. We cut it back to a summary that points at the actual risk assessments and procedures, and it has been easier to maintain ever since.

On an ISO 45001 audit I check the policy against Clause 5.2. It has to include the commitments the standard requires, it has to be signed and dated, it has to be available to workers and it has to be communicated in a way workers actually receive.

A common finding is a policy that ticks the boxes on paper but is not communicated. The staff handbook contains it, but nobody got a copy, or it is on the intranet in a folder nobody opens. I ask workers whether they have seen it and what it says - that is the real test.

Practical Compliance Guidance

The health and safety policy sits at the top of the operational controls within the IMS1 Manual. Where the integrated management system is in use, the H&S policy often sits alongside quality and environmental policies and can be combined into a single integrated policy if the organisation prefers.

The alphaZ documents below provide both standalone policy templates and the combined policy-procedure format that works well where H&S is managed as a single integrated topic rather than as separate documents.

alphaZ document	How to use it
ISO 9001, 14001 and 45001 IMS Toolkit	Full integrated management system toolkit containing the policy documents listed below alongside the wider management system templates.
P-3 Health and Safety Policy	Standalone health and safety policy template covering the statement of intent, responsibilities and arrangements in a single document.
PP-7-100 Health and Safety Policy-Procedure	Combined policy and procedure that covers the policy content plus the procedures for implementing it - useful where the two are best kept together.
PP-1-14 Health and Safety	High-level policy-procedure covering the overall approach to H&S - suits organisations that want a shorter top-level document with detail held in supporting documents.
ACP24 Commitment to Health and Safety at Work	Commitment statement suitable for inclusion in a broader integrated policy where a dedicated H&S policy document is not used.
ACP25 Health and Safety at Work Guidance and Arrangements	Template arrangements section for use in an integrated management system manual, covering the practical arrangements for H&S.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

Is a written health and safety policy compulsory?

In the UK, section 2(3) of the Health and Safety at Work etc. Act 1974 requires employers with five or more employees to prepare, and revise as appropriate, a written statement of general policy with respect to the health and safety of their employees, and bring it to the notice of all employees. Employers with fewer than five employees do not have this specific duty but still have the general duty under the Act.

Who should sign the health and safety policy?

The most senior person in the organisation - typically the managing director, chief executive or equivalent. The policy should be dated at the point it is approved. Signature by a senior person is not a legal requirement but is expected by customers, auditors and regulators as a demonstration that the policy is owned at the top of the organisation.

Can the H&S policy be combined with other management system policies?

Yes. Many organisations with integrated management systems have a single integrated policy covering quality, environment and health and safety. The commitments required by each standard are all included, the policy is shorter to maintain, and workers only have one document to become familiar with. A separate H&S policy and an integrated policy are both acceptable - it is a matter of preference.

How often should the policy be reviewed?

There is no prescribed frequency. The policy should be reviewed when the organisation changes significantly, when legislation changes materially, or when incidents or audits indicate the policy is out of date. Many organisations review annually as a matter of routine; others review less often but formally every few years. An annual review tied to management review is a sensible default.

UK Legislation

The following UK legislation is directly relevant to the health and safety policy. Organisations outside the UK should identify the equivalent legislation applicable in their jurisdiction.

Further Resources