A Guide to Workplace Health and Safety for Small Businesses

Workplace health and safety doesn't have to feel like bureaucracy. The phrase itself probably makes you think of clipboards, risk registers, and three-hour meetings about ladder safety. But here's the thing: health and safety is actually just about preventing your employees from getting hurt at work. That's it. The rules exist because workplace injuries are preventable, and the consequences of ignoring them are bad—both for your people and for your business.

This guide covers what you actually need to do to manage workplace health and safety for a small business, without the jargon or unnecessary complexity.

Your Legal Obligations

As an employer, you have a legal duty to ensure the health, safety, and welfare of your employees "so far as is reasonably practicable." That phrase—"reasonably practicable"—is the key. It doesn't mean you need to eliminate every conceivable risk. It means you need to take reasonable steps proportionate to the actual level of risk in your workplace and the size of your business.

In the UK, the Health and Safety Executive's guidance for small businesses spells this out. In the US, OSHA's Small Business Handbook covers equivalent obligations. At a high level, your responsibilities are:

• Provide a safe working environment
• Ensure equipment is safe and properly maintained
• Give your people adequate training and information
• Assess and manage risks systematically
• Provide basic welfare facilities (toilets, water, rest areas)
• Consult with employees on health and safety matters

That last point matters: your employees know where the actual hazards are. A good health and safety culture is built on listening to them.

Start with a Risk Assessment

A risk assessment is the foundation of everything else. It's a systematic process of identifying what could go wrong, deciding how likely it is, and putting controls in place to prevent it.

Walk around and identify hazards

Step one is simple: look around your workplace. What could harm someone? Common hazards in small offices include:

• Slipping and tripping (wet floors, tangled cables, worn carpets)
• Display screen equipment (poor ergonomics, eye strain from staring at monitors)
• Manual handling (lifting boxes, carrying equipment)
• Stress and mental health pressures
• Fire risks
• Electrical hazards
• Broken furniture or equipment

If you're in a trade—plumbing, construction, engineering—you'll have additional hazards like working at height, power tools, or hazardous substances. But the process is the same.

Evaluate who's at risk and how

For each hazard, ask: who could be hurt, and how? A wet floor is more risky for a pregnant employee or someone with mobility issues than for a young, fit person. A stressful deadline is more risky for someone already struggling with their mental health. Think beyond the obvious.

Decide what controls you need

For each risk, you have options in this order:

Can you eliminate it entirely? Remove the hazard entirely if possible. That's the gold standard.

If not, can you engineer it out? Use physical controls—guards, barriers, better layout.

If not, can you change the process? Use administrative controls—procedures, training, job rotation.

As a last resort, use personal protective equipment (PPE). Gloves, goggles, masks. These protect people from an existing hazard but don't remove the hazard itself.

Record it

If you have five or more employees, you're legally required to record your risk assessment in writing. Even if you don't, do it anyway—written records keep you honest and help you remember what you decided and why. Keep it proportionate: a two-page document covering the main hazards in your office is fine. Don't write a 50-page manual nobody will read.

Keep it updated

Risk assessments aren't one-and-done. Review them whenever something changes: new equipment, a new process, after an incident, or at least once a year. The world changes. So should your assessment.

Health and Safety Policy and Training

If you employ five or more people, you need a written health and safety policy. Below that, it's not strictly required, but it's still good practice because it clarifies responsibilities and procedures.

Your policy should include:

A statement of intent. A sentence or two from you (the owner or senior manager) committing to health and safety. This sets the tone: health and safety matter here.

Who's responsible for what. In a small business, this might be simple—"the owner is responsible for health and safety; the office manager is responsible for maintaining the first aid kit and scheduling risk assessment reviews." Name specific people. If you're building your team and defining roles, clarifying health and safety responsibilities should be part of your employment contracts.

The practical arrangements. How do risk assessments happen? How do people report hazards or incidents? How and when is training provided? How do you communicate health and safety information?

Keep it concise and practical. Three to five pages is enough.

Training your people

Employees need to know how to work safely. This isn't complicated, but it does need to happen.

Induction. Every new employee should receive basic health and safety information on their first day (or first week): fire exits, emergency procedures, first aid arrangements, how to report a hazard or incident, and any specific risks related to their role.

Role-specific training. Depending on what they do, people may need additional training: manual handling (for roles involving lifting), display screen assessment (for desk workers), working at height, use of specific equipment or machinery.

Refresher training. Run annual refresher training to keep awareness current and cover any procedure changes.

Keep records. Log who attended what training, when it happened, and what was covered. Store these alongside your employee records—modern HR software for small businesses makes this easy because it centralises training records with everything else, eliminating the spreadsheet chase.

Incident Reporting and Investigations

When an accident or near-miss happens, you need a process.

Internal reporting

Every incident gets recorded, no matter how minor. A simple one-page form should ask:

• What happened, when, where?
• Who was involved?
• Any injuries?
• What action was taken?

The point isn't to blame—it's to learn. When you spot a pattern (three trips on the same cable, two back injuries from the same task), you can fix it.

External reporting

Certain incidents must be reported to the relevant authority:

• Deaths
• Serious injuries (bone fractures, loss of consciousness, hospitalisation)
• Dangerous occurrences (near-misses with serious potential)
• Occupational diseases

In the UK, these go to the Health and Safety Executive. In the US, serious incidents go to OSHA. Know your thresholds and timescales—failure to report is an offence.

Investigate serious incidents

For minor incidents, a brief chat with the line manager may suffice. For serious incidents, conduct a proper investigation: what happened, why did it happen, what's the fix, how will you prevent it happening again?

Fire Safety, First Aid, and Mental Health

These three deserve specific attention because they're legal requirements with non-negotiable elements.

Fire safety: Conduct a fire risk assessment. Ensure you have detection (smoke alarms), warning systems (fire alarms), and evacuation routes. Train people in evacuation procedures. Run at least one fire drill per year. Appoint someone responsible for fire safety. For a small office, this isn't complicated—but it matters. Fires in small premises can be deadly precisely because people assume "it won't happen here."

First aid: You must provide adequate first aid. At minimum: a stocked first aid kit, a designated person responsible for first aid arrangements, and clear information posted about where to find both. Depending on your workforce size and the nature of your work, you may need formally trained first aiders. A small, low-risk office might just need an appointed person and a kit. A larger or higher-risk workplace needs trained staff.

Mental health and wellbeing: Work-related stress is one of the most common causes of sickness absence. Your obligation is to assess stress-related risks as part of your general risk assessment, and to manage the risk through reasonable measures: managing workloads, providing support, creating a culture where people can raise concerns. Training managers to spot signs of stress helps. If mental health support is a priority in your workplace, you may want to consider appointing Mental Health First Aiders—they're trained to have initial conversations with colleagues in distress. A supportive workplace also means taking concerns seriously: if bullying or harassment emerges, address it promptly and fairly.

Frequently Asked Questions

Q: Do I really need a health and safety policy if I have fewer than five employees?

A: Legally, no. Practically, yes. A written policy clarifies roles and procedures. It doesn't need to be long—one or two pages is enough. It's your evidence that you've thought about H&S systematically.

Q: How often should we update our risk assessment?

A: At least annually, or whenever something changes. New equipment, new process, after an incident, changes in staffing (e.g. maternity leave, a new hire), or if the nature of work changes. If nothing major changes, annual review is fine.

Q: What counts as a "serious injury" that we need to report?

A: Broken bones, loss of consciousness, hospitalisation for more than 24 hours, anything that prevents someone working for more than a week. If you're unsure, check the HSE or OSHA website for your jurisdiction—they have detailed definitions.

Q: Do we need trained first aiders if we're a small office?

A: If you have low risk and a small workforce, you may only need an appointed person and a first aid kit. But it depends on your actual risk profile. If people work with machinery, at height, or in physically demanding roles, trained first aiders are wise. Check the HSE or OSHA guidance for your specific situation.

Q: How do we manage stress-related risks and employee wellbeing?

A: Start by assessing where stress is likely: tight deadlines, high workload, unclear expectations, lack of control. Then act: manage workload proactively, communicate clearly about expectations, give people some control over how they work (that's where flexible working arrangements help), provide support for those struggling, and create a culture where it's okay to flag when things are unsustainable.

Q: Is health and safety the responsibility of the owner, or can we delegate it?

A: You (the owner or senior manager) can't delegate responsibility entirely, but you can and should delegate specific tasks to capable people. You remain accountable. Someone needs to own the risk assessment, someone else might own fire safety, another person manages incident reporting. But you're ultimately answerable if something goes wrong.

Q: What happens if we don't take health and safety seriously?

A: Fines for non-compliance can range from thousands to hundreds of thousands of pounds, depending on seriousness. More importantly, your people get hurt. Accidents cost time, money, morale, and sometimes careers. Fix the fundamentals—risk assessment, training, incident reporting, records—and compliance usually follows naturally.

Q: Where should we start if we've never done this before?

A: Do a simple risk assessment first. Walk around, list hazards, note controls. Write a one-page policy. Set up a basic incident report form. Train people at induction. That's 80% of what you need. From there, refine based on what you learn.