Most businesses have health and safety paperwork. Far fewer have the right paperwork, kept current, in a form that would stand up if an inspector asked to see it. This guide sets out what the law actually requires you to record, what depends on the work you do, and how long you need to keep it.
Ask most business owners whether their health and safety documentation is in order and you will get a confident yes. Ask to see it and what usually appears is a folder of templates downloaded three years ago, a policy signed by a director who left in 2023, and a set of risk assessments that describe a building the company no longer occupies.
That is not unusual, and it is not laziness. Health and safety documentation has a habit of being created once, filed, and then quietly forgotten until a client audit, an insurance renewal or an accident forces someone to go looking for it. The problem is that documentation is the primary evidence of how you manage risk. When something goes wrong, the paperwork is what an inspector, an insurer or a court will examine first.
So it is worth being clear about what you genuinely need, rather than accumulating documents for the sake of a full folder.
The Records the Law Requires From Everyone
A small number of documents are required by legislation regardless of what your business does. The thresholds matter, and they are lower than most people assume.
Your Health & Safety Policy
If you employ five or more people, the Health and Safety at Work etc. Act 1974 requires your health and safety policy to be written down. A policy has three parts that work together: a statement of intent signed and dated by a director or owner, a section setting out who is responsible for what, and a section explaining the arrangements you have in place to control the risks you have identified. The third part is the one that gets skipped, and it is the one that carries the weight. A statement of intent without arrangements is a promise with nothing behind it.
Your Risk Assessments
The same five employee threshold applies here. Under the Management of Health and Safety at Work Regulations 1999, employers with five or more staff must record the significant findings of their risk assessments. Note the wording. You are not required to write down every hazard you considered, but you are required to record the risks that matter, who might be harmed, and what you have done about them. Assessments should be reviewed when work changes, when something goes wrong, or when they are simply no longer a fair description of what happens on site.
Your Fire Risk Assessment
Under the Regulatory Reform (Fire Safety) Order 2005, the significant findings of your fire risk assessment must be recorded if you employ five or more people, if your premises are licensed, or if an alterations notice is in force. Even below those thresholds, an unrecorded fire risk assessment is very difficult to evidence, which is why almost every insurer and most commercial landlords will expect to see a written one. Our guide to Fire Risk Assessment services covers what a proper assessment involves.
Accident Records and RIDDOR Reports
Employers with ten or more employees are required to keep an accident book under social security law, though in practice every employer should have one because it protects the business as much as the injured person. Separately, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require certain incidents to be reported to the HSE. Specified injuries and dangerous occurrences must be reported without delay and followed up with a report within ten days. Injuries that leave someone unable to do their normal work for more than seven days must be reported within fifteen days. Records of reportable incidents must be kept for at least three years.
Training Records
There is no single regulation that says “keep a training matrix”, but there is a duty to provide adequate health and safety training, and the only practical way to demonstrate you have met it is to record who was trained, in what, by whom, and when. Certificates filed in a drawer are not a training record. A simple matrix showing every role, the training that role requires, and the expiry date against each name is worth more than a box file of laminated cards.
The Basics That Are Easy to Overlook
You must display the HSE health and safety law poster or issue the equivalent leaflet to every employee, and your employers’ liability insurance certificate must be displayed or otherwise made accessible to staff. Both are quick wins, and both are among the first things an inspector will notice are missing.
The Records That Depend on What You Do
Beyond the universal requirements, your documentation is shaped by your activities. A print firm, a care home and a groundworks contractor have very different obligations, and this is where generic template packs fall down.
If you use hazardous substances, COSHH assessments must be recorded once you have five or more employees, and any health surveillance records generated under COSHH need to be kept for forty years because the conditions they relate to can take decades to appear. If you have lifting equipment, thorough examination reports are required at set intervals, typically every six months for equipment that lifts people and for lifting accessories, and every twelve months for other lifting equipment. If you occupy non-domestic premises built before 2000, you need an asbestos register and a written management plan. If you have a water system that could generate a spray, you need a written legionella control scheme. Display screen equipment assessments, manual handling assessments, noise assessments and a first aid needs assessment all follow the same logic: the duty is triggered by the activity, not by the size of the company.
Construction adds its own layer. Every project needs a construction phase plan, projects with more than one contractor need a health and safety file, and notifiable projects need an F10 submitted to the HSE. Our CDM Consultancy page sets out how those duties are allocated.
Where Documentation Usually Goes Wrong
The most common failure is not absence, it is drift. The documents exist, but they describe a version of the business that no longer exists. New machinery arrives and the risk assessment is not updated. A department moves floors and the fire risk assessment still references the old layout. A supervisor leaves and nobody notices that the policy still names them as the person responsible for first aid.
The second failure is generic content. Templates are a reasonable starting point, but a risk assessment that could apply to any company in your sector tells an inspector that nobody actually walked the site. Specificity is what makes documentation credible.
The third is inaccessibility. Documentation that lives on one person’s laptop, or in a locked cabinet in an office nobody can get into at weekends, fails the test the moment it is needed. Employees are entitled to see the risk assessments that apply to their work, and if they cannot find them, the paperwork is not doing its job.
The fourth, and the one that causes the most trouble commercially, is that nobody has checked the set against what clients require. Businesses bidding for contracts increasingly need to satisfy an SSIP assessment, and the assessor will ask for the documents above in a specific form. Our article on what SSIP accreditation involves explains what that process looks like in practice.
How Long to Keep Things
Retention is where a lot of otherwise well organised businesses come unstuck. As a working rule, keep RIDDOR records and accident book entries for at least three years, keep health surveillance records generated under COSHH for forty years, keep risk assessments and policies for as long as they remain current plus a reasonable archive of superseded versions, and keep training records for the duration of employment and beyond. Old employers’ liability certificates are no longer legally required to be retained, but keeping them is strongly advised because long latency claims can arrive decades after the exposure.
Getting the Set in Order
The practical way to approach this is not to start writing documents. It is to start with a list of what your business actually does, work out which duties that triggers, and then compare that against what you hold. Most businesses find they have three or four documents they do not need, two or three that are badly out of date, and one or two significant gaps they had not realised were there.
That review is a normal part of a Health & Safety Audit, and it is one of the first things a competent person will do when they take on a new client. If you do not have that capacity internally, our article on whether your competent person should be in-house or outsourced is a useful starting point. Where that support is provided as part of a retained arrangement, it usually sits alongside the wider Health & Safety Consultancy service rather than as a standalone exercise.
Documentation is not the point of health and safety management. Keeping people safe is. But when your arrangements are challenged, whether by an inspector, an insurer or a client procurement team, the paperwork is the only version of your safety management that anyone else can see. It is worth making sure it tells the truth.
