Start with the official route for your jurisdiction
Great Britain (England, Scotland and Wales): the Health and Safety Executive says the steps for most small, low-risk businesses are straightforward. Start with the HSE's health and safety basics for your business.
Northern Ireland: start with HSENI's Health and safety made simple. Then turn the correct official guidance into named actions, realistic dates and evidence that the controls work.
1. Confirm the duty and who will help
Employers must protect employees and other people who may be affected by the work. Someone competent must help the business meet its health and safety duties. That may be the employer, one or more workers, an external adviser, or a suitable combination. Competence should match the work and its risks; a simple office and a high-hazard process do not call for the same knowledge or experience.
Begin by naming the person who coordinates the work, but do not treat that appointment as transferring the employer's responsibility. If the in-house team is not confident about a hazard, control or legal boundary, obtain competent advice before relying on a template.
2. Set the policy and assess the real work
Every business needs a health and safety policy. HSE says it should explain who does what, when and how; if the business has five or more employees, the policy must be written down. Share it with workers and update it when arrangements change.
A risk assessment should identify hazards, who might be harmed and how, and what will eliminate or control the risk. Look at the work as it is actually performed, including non-routine tasks, maintenance, contractors, visitors and people who may need additional protection. Record significant findings and make sure the controls are put into practice, not merely written into a file.
If the business has five or more employees, the significant findings of the risk assessment must be recorded. Below five employees, HSE says you do not have to write the assessment down, but keeping a proportionate record is useful good practice for actions, review and continuity.
3. Consult workers and make training usable
Consultation is a two-way process. Ask workers about the hazards they encounter, how the controls operate in practice and what information or training would help. In a small business this may be direct; other workplaces may consult through elected or trade-union health and safety representatives.
Provide clear information, instruction, training and supervision at a level people can understand and apply. Check whether training worked, and revisit it when people, equipment, processes or risks change. Attendance records can support the evidence, but they do not prove that a person can perform the work safely.
4. Cover the other Great Britain small-business basics
For workplaces in Great Britain, policy, risk assessment and training are not the whole system. Check the other HSE basics that apply and keep personal information appropriately protected. Northern Ireland businesses should follow the equivalent HSENI requirements.
- HSE (Great Britain) — Report certain injuries, diseases and dangerous occurrences under RIDDOR
- HSE (Great Britain) — Assess and provide first-aid arrangements
- HSE (Great Britain) — Provide suitable welfare and workplace facilities
- HSE (Great Britain) — Display the health and safety law poster or give workers the equivalent leaflet
5. Route fire safety to the right jurisdiction
Fire safety has its own duty-holder and jurisdiction rules. In England and Wales, the responsible person for a workplace or other non-domestic premises must carry out and regularly review a fire risk assessment, maintain appropriate precautions, plan for emergencies and provide information and training. Shared premises may have more than one responsible person who must cooperate and coordinate.
Scotland and Northern Ireland use different fire-safety legislation. Northern Ireland also has a separate workplace health and safety regulator. Follow the official route for the premises before applying any generic checklist or template.
- GOV.UK — Fire safety in the workplace: who is responsible
- Scottish Fire and Rescue Service — Business fire safety guidance
- Health and Safety Executive for Northern Ireland — workplace health and safety
- Northern Ireland Fire & Rescue Service — Business fire risk assessments
6. Record, assign, evidence and review the actions
- Record: describe the hazard, who could be harmed, the current controls and what remains to be done.
- Assign: give every action one accountable owner and a realistic due date.
- Evidence: keep the inspection, photograph, maintenance record, briefing record or other proof that shows the action was completed and the control is present.
- Review: check whether the control works and revisit the assessment after relevant changes, incidents, concerns or other evidence that it may no longer be valid.
7. Know when a starting point is not enough
Seek competent or professional help when the work or premises are complex, the consequences could be severe, specialist law or engineering judgment is involved, people are especially vulnerable, the building or escape arrangements are unusual, or you are unsure whether the proposed controls are adequate. Regulators' guidance, manufacturers' instructions and competent inspection evidence take priority over a generic template.
About this guidance
Knowhubs tools and guides are practical starting points, not regulator approval, certification, legal advice or a site-specific assessment. See the knowhubs editorial and review method, browse all practical guides, or return to the current product catalogue. Only verified, currently available products are promoted here.
Jurisdiction: general HSE workplace guidance covers Great Britain. Northern Ireland has its own regulator, and fire safety rules differ across England and Wales, Scotland and Northern Ireland. Always follow the official guidance for the location, premises and work involved.