HSWA 1974 section 2(3), UK wide
Health and Safety Policy and Documentation
Almost every employer we meet has a health and safety policy. Far fewer have one that describes what actually happens on site, names the people who do it and has been opened since the day it was signed. AL23 Safety writes, rebuilds and maintains policies and the document set beneath them, for clients UK wide.
What is a health and safety policy?
The document that says what you intend, who is responsible and how it gets done
A health and safety policy is the written statement of how your organisation manages risk. It is not a procedures manual and it is not a risk assessment. It is the document everything else hangs from.
Section 2(3) of the Health and Safety at Work etc. Act 1974 requires an employer to prepare a written statement of general policy on the health and safety of employees, together with the organisation and arrangements in force for carrying it out. The employer must revise it as often as is appropriate and bring the statement and any revision to the notice of employees. That last part is the one most often missed. A policy nobody has seen has not been brought to anyone's notice.
The difference between a policy in a drawer and a policy in use
A policy in a drawer is generic. It names job titles that do not exist and commits to reviews that never happen. It does no harm until something goes wrong, when it becomes evidence that the arrangements were never real.
A policy in use is short, specific and current. Supervisors find the arrangement covering their activity. The named people know what they are named for. When an inspector asks how a control is managed, someone points at a paragraph and then at the record proving it happened.
Three readers, three different tests
An inspector reads the policy to see whether you understand your own risks and have allocated them to real people. The test is whether the arrangements match what has just been seen on the floor. A mismatch turns a technical failing into a management failing, which raises culpability.
An insurer reads it to judge how the business is run before pricing the risk, looking for named responsibility, contractor control and evidence that incidents lead to change. A pre-qualification assessor scores it against a question set, most often the SSIP core criteria, wanting it signed, recently dated and backed by the evidence it names.
Who needs one
The trigger is a headcount, not a sector or a turnover
- You employ five or more people. Below that number the Employers' Health and Safety Policy Statements (Exception) Regulations 1975 lift the written duty. The duty to manage the risk does not go away
- Your headcount crossed five since the policy was last looked at, the most common trigger we see
- A pre-qualification assessor, principal contractor or insurer has asked for a signed and dated policy
- Your policy names a director who left, a site you closed or a regulation that has since been replaced
- You inherited a policy from a previous adviser that describes a generic organisation rather than yours
The regulations that apply
Your legal framework, in plain terms
The written policy duty comes from the Health and Safety at Work etc. Act 1974. The organisation and arrangements it must describe are given detail by the Management of Health and Safety at Work Regulations 1999, which set out how risk is assessed, planned for, controlled and reviewed. They also say who must be appointed to help.
HSWA 1974 section 2(3)
Prepare a written statement of general policy, revise it as often as is appropriate and bring it to the notice of all employees. Applies where five or more people are employed.
MHSWR 1999 regulation 3
Suitable and sufficient risk assessment. Where five or more people are employed the significant findings must be recorded, along with any group identified as especially at risk.
MHSWR 1999 regulation 5
Arrangements for the effective planning, organisation, control, monitoring and review of preventive and protective measures. These are the third part of your policy, not a separate universe.
MHSWR 1999 regulation 7
Appointment of one or more competent persons to assist in complying with the law. Name that appointment in the policy rather than leave it implied.
What the service covers
Intent, organisation and arrangements that match the floor
- The statement of intent, short enough to be read, signed and dated by the most senior accountable person
- The organisation section, mapped role by role from the board to the individual employee, with named post holders rather than job families
- The arrangements section, covering risk assessment, safe systems of work, training, first aid, fire, incident reporting, contractor control, consultation and monitoring
- The supporting document set, indexed so a reader can find the procedure a policy paragraph refers to
- Record retention mapped by type, including RIDDOR records kept at least three years and COSHH health records at least 40 years from the last entry
- The communication step, covering induction, toolbox delivery and the sign-off record proving employees were told
- Version control, a revision history and a review date, letting you evidence a change rather than assert it
- A pre-qualification view of the same documents, aligned with the SSIP core criteria assessors work to
Our process
Read it, walk it, then write it
- 01
Read what you have
The current policy, the risk assessments, the training matrix and three years of incident records. The gap between them is usually the story.
- 02
Walk the operation
We visit the sites that matter and talk to the people named in the document. A policy is tested against practice, not another policy.
- 03
Draft in three parts
Statement of intent, organisation, arrangements. We write for the supervisor using it at eight in the morning, not the assessor who reads it once.
- 04
Agree responsibilities
Named roles are confirmed with the holders before signing. Handing someone a duty they did not know about is how policies fail.
- 05
Issue, brief and diarise
We help you communicate it, record that you did and set the review trigger. Our health and safety management systems work takes it further into a full framework.
What you get
A signed policy you own and can use
- A signed and dated policy in three parts, supplied in editable format so you own it
- An organisation chart of health and safety responsibilities with named post holders and deputies
- A written arrangements set covering each significant risk you run
- A document register naming every supporting procedure, assessment and record, with owner and retention period
- A short gap report listing what is missing, ranked by legal exposure rather than ease
What we need from you
Your records, your sites and director sign-off
- The current policy and any earlier versions, including the ones you are not proud of
- Risk assessments, training records and the accident book for three years
- Access to the sites and to the managers named or to be named in the document
- Confirmation at director level of who holds each responsibility
Why AL23 Safety
Written to be used, not to be filed
Accountable
If your policy describes an organisation that does not exist, we say so in writing rather than changing the date and returning it.
Written to be used
Short, specific arrangements a supervisor can follow. Length is not evidence of control.
One team, three disciplines
Health and safety, fire safety and fire engineering in-house. The fire arrangements in your policy are written by people who assess fire risk for a living.
UK wide
We prepare and maintain policies for single site employers and multi-site groups across the UK from our Manchester base.
Get your policy looked at properly
Send it over and we will tell you what is wrong with it
No charge for an initial read. We will say whether it meets section 2(3), whether the arrangements match your operation and what putting it right takes.
Common questions
Answers, up front
Cannot see your question? Get in touch and we will answer it directly.
Contact usNo. The Employers' Health and Safety Policy Statements (Exception) Regulations 1975 remove the written statement duty below five employees. Everything else still applies. You must assess risks, control them and provide information, instruction, training and supervision. Many small employers write one anyway for clients.
The most senior accountable person. A managing director, chief executive, partner or owner. The Act does not prescribe a signature. This is convention rather than a stated legal requirement. It matters as the clearest evidence of ownership an inspector, insurer or assessor can see.
The Act says as often as may be appropriate. It sets no interval. Annual review is industry convention rather than a legal requirement and we recommend it. What actually triggers a review is change. A new site, new plant, a change of duty holder, an enforcement visit or a serious incident.
No. Assessors work to the SSIP core criteria, which look for the evidence behind the policy as well as the policy itself. They want training records, assessments, monitoring evidence and incident data. A strong policy makes the submission coherent without substituting for it. See our SSIP and accreditation support page.
Cost follows scale and complexity. A single site employer with one main activity is a short piece of work. A group with several trading entities and contractor duties is not. Drafting typically runs two to four weeks from site visit to issue. Our published pay as you go rates are £95 per hour or £695 per day plus VAT. Policy work is often folded into a retainer from £250 per month. Where you want it maintained rather than written once, our competent person services do that.
Related services