Health & Safety Documentation: What Your Business Actually Needs

Most businesses have health and safety paperwork. Far fewer have the right paperwork, kept current, in a form that would stand up if an inspector asked to see it. This guide sets out what the law actually requires you to record, what depends on the work you do, and how long you need to keep it.

Ask most business owners whether their health and safety documentation is in order and you will get a confident yes. Ask to see it and what usually appears is a folder of templates downloaded three years ago, a policy signed by a director who left in 2023, and a set of risk assessments that describe a building the company no longer occupies.

That is not unusual, and it is not laziness. Health and safety documentation has a habit of being created once, filed, and then quietly forgotten until a client audit, an insurance renewal or an accident forces someone to go looking for it. The problem is that documentation is the primary evidence of how you manage risk. When something goes wrong, the paperwork is what an inspector, an insurer or a court will examine first.

So it is worth being clear about what you genuinely need, rather than accumulating documents for the sake of a full folder.

The Records the Law Requires From Everyone

A small number of documents are required by legislation regardless of what your business does. The thresholds matter, and they are lower than most people assume.

Your Health & Safety Policy

If you employ five or more people, the Health and Safety at Work etc. Act 1974 requires your health and safety policy to be written down. A policy has three parts that work together: a statement of intent signed and dated by a director or owner, a section setting out who is responsible for what, and a section explaining the arrangements you have in place to control the risks you have identified. The third part is the one that gets skipped, and it is the one that carries the weight. A statement of intent without arrangements is a promise with nothing behind it.

Your Risk Assessments

The same five employee threshold applies here. Under the Management of Health and Safety at Work Regulations 1999, employers with five or more staff must record the significant findings of their risk assessments. Note the wording. You are not required to write down every hazard you considered, but you are required to record the risks that matter, who might be harmed, and what you have done about them. Assessments should be reviewed when work changes, when something goes wrong, or when they are simply no longer a fair description of what happens on site.

Your Fire Risk Assessment

Under the Regulatory Reform (Fire Safety) Order 2005, every responsible person must record their fire risk assessment, whatever the size of the business. Before 1 October 2023 the duty applied only where there were five or more employees, the premises were licensed or an alterations notice was in force, which is why that threshold still appears in older guidance. The record must include the findings, the measures taken or planned as a result, and any group of people the assessment identifies as especially at risk. Our guide to Fire Risk Assessment services covers what a proper assessment involves.

Accident Records and RIDDOR Reports

Employers with ten or more employees are required to keep an accident book under social security law, though in practice every employer should have one because it protects the business as much as the injured person. Separately, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require certain incidents to be reported to the HSE. Specified injuries and dangerous occurrences must be reported without delay and followed up with a report within ten days. Injuries that leave someone unable to do their normal work for more than seven days must be reported within fifteen days. Records of reportable incidents must be kept for at least three years.

Training Records

There is no single regulation that says “keep a training matrix”, but there is a duty to provide adequate health and safety training, and the only practical way to demonstrate you have met it is to record who was trained, in what, by whom, and when. Certificates filed in a drawer are not a training record. A simple matrix showing every role, the training that role requires, and the expiry date against each name is worth more than a box file of laminated cards.

The Basics That Are Easy to Overlook

You must display the HSE health and safety law poster or issue the equivalent leaflet to every employee, and your employers’ liability insurance certificate must be displayed or otherwise made accessible to staff. Both are quick wins, and both are among the first things an inspector will notice are missing.

The Records That Depend on What You Do

Beyond the universal requirements, your documentation is shaped by your activities. A print firm, a care home and a groundworks contractor have very different obligations, and this is where generic template packs fall down.

If you use hazardous substances, COSHH assessments must be recorded once you have five or more employees, and any health surveillance records generated under COSHH need to be kept for forty years because the conditions they relate to can take decades to appear. If you have lifting equipment, thorough examination reports are required at set intervals, typically every six months for equipment that lifts people and for lifting accessories, and every twelve months for other lifting equipment. If you occupy non-domestic premises built before 2000, you need an asbestos register and a written management plan. If you have a water system that could generate a spray, you need a written legionella control scheme. Display screen equipment assessments, manual handling assessments, noise assessments and a first aid needs assessment all follow the same logic: the duty is triggered by the activity, not by the size of the company.

Construction adds its own layer. Every project needs a construction phase plan, projects with more than one contractor need a health and safety file, and notifiable projects need an F10 submitted to the HSE. Our CDM Consultancy page sets out how those duties are allocated.

Where Documentation Usually Goes Wrong

The most common failure is not absence, it is drift. The documents exist, but they describe a version of the business that no longer exists. New machinery arrives and the risk assessment is not updated. A department moves floors and the fire risk assessment still references the old layout. A supervisor leaves and nobody notices that the policy still names them as the person responsible for first aid.

The second failure is generic content. Templates are a reasonable starting point, but a risk assessment that could apply to any company in your sector tells an inspector that nobody actually walked the site. Specificity is what makes documentation credible.

The third is inaccessibility. Documentation that lives on one person’s laptop, or in a locked cabinet in an office nobody can get into at weekends, fails the test the moment it is needed. Employees are entitled to see the risk assessments that apply to their work, and if they cannot find them, the paperwork is not doing its job.

The fourth, and the one that causes the most trouble commercially, is that nobody has checked the set against what clients require. Businesses bidding for contracts increasingly need to satisfy an SSIP assessment, and the assessor will ask for the documents above in a specific form. Our article on what SSIP accreditation involves explains what that process looks like in practice.

How Long to Keep Things

Retention is where a lot of otherwise well organised businesses come unstuck. As a working rule, keep RIDDOR records and accident book entries for at least three years, keep health surveillance records generated under COSHH for forty years, keep risk assessments and policies for as long as they remain current plus a reasonable archive of superseded versions, and keep training records for the duration of employment and beyond. Old employers’ liability certificates are no longer legally required to be retained, but keeping them is strongly advised because long latency claims can arrive decades after the exposure.

Getting the Set in Order

The practical way to approach this is not to start writing documents. It is to start with a list of what your business actually does, work out which duties that triggers, and then compare that against what you hold. Most businesses find they have three or four documents they do not need, two or three that are badly out of date, and one or two significant gaps they had not realised were there.

That review is a normal part of a Health & Safety Audit, and it is one of the first things a competent person will do when they take on a new client. If you do not have that capacity internally, our article on whether your competent person should be in-house or outsourced is a useful starting point. Where that support is provided as part of a retained arrangement, it usually sits alongside the wider Health & Safety Consultancy service rather than as a standalone exercise.

But when your arrangements are challenged, whether by an inspector, an insurer or a client procurement team, the paperwork is the only version of your safety management that anyone else can see. It is worth making sure it tells the truth.

Health & Safety Documentation: Frequently Asked Questions

Do I need a written health and safety policy?

If you employ five or more people, yes. The Health and Safety at Work etc. Act 1974 requires the policy to be written down at that point. Below five employees you still need a policy, it simply does not have to be in writing. Most businesses under the threshold write one anyway, because clients and insurers routinely ask to see it.

How often should risk assessments be reviewed?

There is no fixed interval in law. The requirement is that assessments remain valid, so they should be reviewed whenever work, equipment, premises or personnel change significantly, after an accident or near miss, and as a matter of routine at least annually. An assessment that no longer describes how the work is done is not a valid assessment, whatever date is on it.

Can I use downloaded templates for my documentation?

Templates are a reasonable starting point, but they need to be adapted to your business to be worth anything. A risk assessment that has not been changed from the template is evidence that nobody assessed the actual work. Inspectors and SSIP assessors recognise generic content immediately.

How long do I need to keep health and safety records?

It depends on the record. Keep RIDDOR reports and accident book entries for at least three years, and health surveillance records generated under COSHH for forty years. Policies, risk assessments and training records should be kept for as long as they are current, with superseded versions archived rather than deleted.

What documentation will a client or SSIP assessor ask to see?

Typically the health and safety policy, current risk assessments, method statements relevant to the work, training records and competency evidence, insurance certificates, accident records and evidence of who provides your competent person support. Having these in one place, current and consistent with each other, is what makes the assessment straightforward.