Table of Contents
The 4 key principles of workplace health and safety are practical foundations for preventing harm at work. They are not an official HSE list. This guide covers each one: understanding the work, choosing proportionate controls, involving and training people, and checking what works. Each comes with a small-business example, and we show which parts are legal duties and which are good practice.
Understand the work and its risks
Every other step builds on this one. If you don’t understand how the work is really done, controls end up aimed at the wrong hazards. Training then covers the wrong things, and reviews check paperwork instead of practice.
The duty to assess risks
Many small employers asking what health and safety requirements apply to them should start with regulation 3 of the Management of Health and Safety at Work Regulations 1999. It requires every employer to make a suitable and sufficient risk assessment. That assessment covers risks to employees and to other people affected by the business’s work.
HSE sets out five steps: identify the hazards, assess the risks, control the risks, record your findings, and review the controls. If you employ five or more people, you must record the significant findings of your risk assessment.
How work actually happens
Look at how people actually do the job, including any shortcuts that have become habit, not just what the job description or procedure says. Evidence can come from machinery, substances, workplace conditions, cleaning, maintenance, manual handling, stress, and past accidents, ill health and near misses. Manufacturer instructions and chemical safety information help, but they don’t replace looking at the work itself. For example, a small delivery business could follow one job from the warehouse and loading area, through the drive, to unloading at the customer’s premises and any lone work. That can reveal risks you would miss by treating manual handling as a single task.
People affected and findings to record
Think about contractors, visiting drivers, customers and the public as well as your own staff. Also consider workers who may be more vulnerable, such as young, new, inexperienced, disabled or pregnant workers. HSE’s lone-working guidance says risks have to be managed before anyone works alone, including self-employed people you contract. Those risks can include driving, violence and stress.
Every employer has to assess risk, whatever their size. Once you have five or more employees, the Management Regulations also require you to record the significant findings and any groups of employees who are especially at risk.
Choose proportionate controls
Once you understand the risks, the next job is deciding what to do about them. Good risk control matches the effort to the level of risk and deals with the cause wherever it can. This is how employers get from an assessment on paper to a safe workplace.
Start with the source of harm
The Health and Safety at Work etc. Act 1974 is the UK’s main health and safety law. It requires employers to protect their employees’ health, safety and welfare so far as is reasonably practicable. It also gives them duties towards other people exposed to risks from their work.
HSE explains “reasonably practicable” as weighing the level of risk against the money, time or trouble needed to control it. You don’t need a measure that would be grossly disproportionate to the risk. But that doesn’t mean picking the lowest-cost option. The Management Regulations also require measures to follow the general principles of prevention, which set out an order to work through:
- Remove the hazard: if the risk can be taken out of the work completely, start there.
- Use a safer alternative: replace a substance, tool or method with one that causes less harm.
- Change the work or equipment: redesign the task, the sequence or the kit so there is less exposure.
- Add supporting measures: signs, instruction and protective equipment deal with whatever risk is left.
Take slippery steps outside a small shop. Treating or replacing the surface deals with the cause far more directly than putting up a warning sign.
Protect people through the layout
Measures that protect everyone in an area, such as barriers or good ventilation, are often better than relying on each person’s behaviour or on protective equipment. They keep working when people are busy, tired or new to the job.
In a small warehouse yard shared by pedestrians and forklifts, HSE recommends separate routes wherever reasonably practicable. Where people and vehicles still meet, barriers, marked crossing points, less reversing and clear site rules can manage what remains.
A “Beware of forklifts” sign should not be your main answer if the yard could reasonably be laid out to keep people and vehicles apart. Information, training and protective equipment don’t replace stronger safety controls where those controls are reasonably practicable.
Meet equipment and first-aid needs
According to HSE, you should consider personal protective equipment only after looking at other reasonably practicable controls. If the assessment shows it is needed, the employer has to provide it to employees free of charge. Work equipment has to be maintained, and inspected where necessary. How often depends on the risk and how quickly the equipment deteriorates, so there is no single interval for everything. For lifting equipment, a thorough examination is a separate thing from routine servicing.
First-aid provision has to be adequate for your workplace, your staff and your hazards. A small, low-risk workplace may be covered by an appointed person and a suitably stocked kit, without a trained first-aider.
Involve and train the people doing the work
The people doing a job usually know first when something isn’t working. Regular communication with them and real involvement in decisions build a practical safety culture. That supports people’s wellbeing as well as their safety.
Consult workers about real conditions
HSE lists the matters to consult workers on. They include significant changes affecting safety, risks and precautions, training plans, arrangements for competent help, and the safety effects of new technology.
Workers can tell you where the written procedure differs from what really happens, where controls are being bypassed and where new hazards have appeared. Their reports only help if they reach someone who can act on them and something is actually done.
Give instruction and relevant training
The Management Regulations require employees to be given clear, relevant information about the risks assessed, the protective measures, emergency procedures and the people nominated to help. HSE says workers need clear instructions, adequate training and appropriate supervision, especially when they are new, change jobs or take on extra responsibilities. Training builds competence, but it doesn’t replace suitable equipment, layout or work design.
Say a small engineering workshop brings in a cutting machine. It would check the guarding and emergency stops, decide who is authorised to use the machine, train those operators and check they are competent, ask them about any problems, and supervise early use. Our e-learning courses in risk assessment, manual handling and display screen equipment sit on a learning management system that assigns courses and tracks progress.
Arrange competent help
Regulation 7 of the Management Regulations requires competent help that is adequate for the size of your organisation and its risks. A competent person has sufficient training, experience, knowledge and other relevant qualities. If you as the employer have that competence, you can fill the role yourself. Where employers share a workplace, they have to co-operate, co-ordinate and exchange appropriate information about risks and controls.
Some organisations don’t have enough internal capacity or specialist knowledge. Salusphere Global offers health and safety consultancy for UK employers, working alongside leadership, HR and operations teams. We review arrangements, clarify responsibilities, identify gaps and help you prioritise proportionate action.
Check controls and improve what works
A control only protects people if it works in practice. Regular checks show whether you are actually preventing injuries and ill effects. They also make it clear who is accountable for fixing what falls short.
Test controls in everyday work
HSE’s “Check” stage asks whether planned measures were put in place and whether the risks are actually controlled. The “Act” stage uses findings, incidents and what workers tell you to improve your arrangements. A signed assessment doesn’t prove a control works. You can test it in these ways:
- Observe the task: watch the job being done at a normal, busy time.
- Inspect equipment: check that guards, barriers and kit are in place and working.
- Read maintenance information: confirm that servicing and examinations have actually happened.
- Ask workers: find out whether the control fits the job or gets worked around.
An audit or inspection finding only helps when someone owns the corrective action and a later check confirms the change was made and works. Clear accountability for each action is what makes the difference.
Know when reassessment is needed
Regulation 3 requires a review when there is reason to suspect an assessment is no longer valid, or when there has been a significant change in what it covers. Accidents, near misses, work-related sickness, controls that aren’t working, and changes to the work or equipment can all be reasons to reassess. There is no general legal rule to review every 12 months.
A small building contractor, for example, might take on a new roof type, use different access equipment, bring in inexperienced workers or change the order of the work. Any of these can justify reassessing the job before the planned review date.
Make improvement part of management
HSE’s Managing for health and safety (HSG65), published in its third edition in 2013, presents Plan, Do, Check, Act as guidance, not a separate legal requirement. HSE says a small, low-risk business can manage health and safety with a simple approach, without a formal safety management system.
Think about the risks when you buy equipment, take on trainees or change a layout. Doing it at the point of decision stops your existing controls from quietly going out of date and keeps your health and safety performance steady.
Salusphere Global provides ongoing reviews, action tracking and practical follow-up. We help employers find gaps in their health and safety management and decide what level of support suits their size, structure and risks. If you’d like to talk through your current arrangements, we’re happy to help.
Frequently Asked Questions
Does a small business need a written health and safety policy?
According to HSE, every business needs a health and safety policy. If you have fewer than five employees, you generally don’t have to write it down. Once you have five or more, it has to be written.
Do employers have to buy a particular template, course or management system to meet their health and safety duties?
No. HSE’s guidance doesn’t require any particular template, course or commercial system. Your legal duties are about having suitable arrangements and controlling risk effectively. HSE also says a simple Plan, Do, Check, Act approach can suit a small, low-risk business.
Does the same health and safety law apply in Northern Ireland?
No. The framework in this article covers England, Scotland and Wales. Northern Ireland has its own primary health and safety legislation and its own enforcement.
