Health and Safety at Work Act 1974: Employer Duties & Compliance Documents

The Health and Safety at Work etc. Act 1974 is the primary piece of UK health and safety legislation. It sets the overarching framework of duties. But understanding the Act in isolation is not enough: the duties it creates are given practical, document-specific shape by a web of subordinate regulations. This page maps the Act's duties — section by section — directly to the named documents your business must produce, and presents a worked scenario showing exactly how that plays out for a real SME.

---

What the Health and Safety at Work etc. Act 1974 Actually Is (and Is Not)

The Act is an enabling statute. It creates general duties and grants the Secretary of State power to make subordinate regulations — COSHH, the Management Regulations, RIDDOR, CDM — that translate those duties into specific, documented requirements. The Act itself does not prescribe the format of a risk assessment or the contents of a construction phase plan. That is the work of the regulations made under it.

Understanding this structure matters because it determines which document satisfies which legal obligation. When an enforcing authority or principal contractor asks for evidence of compliance, they are asking for documents demanded by the subordinate regulations — not the Act itself.

---

Section 2: Employer Duties to Employees — What 'So Far As Is Reasonably Practicable' Means in Practice

Section 2(1) of the Health and Safety at Work etc. Act 1974 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all their employees. (legislation.gov.uk)

The qualification "so far as is reasonably practicable" (SFARP) is critical. It is not an absolute duty. It means you must weigh the risk against the cost — in time, money, and effort — of eliminating or reducing it. If the risk is trivial relative to the cost of control, you are not legally required to act. If the risk is severe and the control straightforward, you must act.

Section 2(2) particularises the duty. It extends to: the provision and maintenance of plant and systems of work that are, so far as is reasonably practicable, safe and without risks to health; arrangements for safe use, handling, storage and transport of articles and substances; the provision of such information, instruction, training and supervision as is necessary; the maintenance of places of work under the employer's control in a safe condition; and the provision of a working environment that is safe and adequate as regards welfare facilities.

Section 2(3) requires every employer to prepare and, as often as appropriate, revise a written statement of general policy with respect to health and safety at work, and to bring the statement and any revision of it to the notice of all employees. (legislation.gov.uk)

---

Section 3: Duties Beyond Your Own Workforce — Contractors, Visitors, and the Public

Section 3(1) of the Act requires every employer to conduct their undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in their employment who may be affected by the way the business is conducted are not exposed to risks to their health or safety. (legislation.gov.uk)

This is the provision that catches contractors on your site, visitors to your premises, and members of the public passing by a work activity. It is why risk assessments under reg.3 of the Management Regulations explicitly cover both employees and non-employees — the underlying legal duty runs to both groups.

---

The Written Health and Safety Policy: When It Is Legally Required and What It Must Contain

The Act imposes the duty to prepare a written policy statement (s.2(3)) "except in such cases as may be prescribed" — and the prescribed exception is employers with fewer than five employees (Employers' Health and Safety Policy Statements (Exception) Regulations 1975). In practice: five or more employees, the policy must be written down; fewer than five, writing it down is not mandatory but is useful. (hse.gov.uk)

The policy must set out your general approach, explain who does what, when and how, and be shared with all employees — and shared again whenever it is revised. It has three components: a statement of intent (your commitment), an organisation section (who is responsible for what), and an arrangements section (the specific procedures for managing significant risks).

---

How the Management of Health and Safety at Work Regulations 1999 Translate the Act into Documented Risk Assessments

Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to the health and safety of employees whilst at work, and of persons not in their employment arising out of or in connection with the conduct of the undertaking — for the purpose of identifying the measures needed to comply with statutory requirements. (legislation.gov.uk)

Where you employ five or more employees, regulation 3(6) requires you to record the significant findings of that assessment and any group of employees identified as being especially at risk. (legislation.gov.uk)

HSE's risk management guidance describes the process as a sequence of steps: identify hazards, assess the risks, control the risks, record your findings, and review the controls. (hse.gov.uk)

Regulation 13(1) adds a linked obligation: when entrusting tasks to employees, the employer must take into account their capabilities as regards health and safety. Regulation 13(2) requires employees to be provided with adequate health and safety training on recruitment and whenever they are exposed to new or increased risks — including when new equipment, technology or systems of work are introduced — and that training must take place during working hours. (legislation.gov.uk)

---

The Subordinate Regulations Every Employer Must Know: A Compliance Document Map

This is the unique asset no competitor page provides: a direct mapping from statutory duty to the named document the law demands, with the threshold at which recording becomes mandatory.

Statutory duty	Regulation / section	Document required	Who must produce it	Recording threshold
General duty to employees	HSWA 1974, s.2(1)	Health and safety policy statement	Employer	Must be written: 5+ employees (HSE policy guidance)
Risk assessment — employees and non-employees	Management Regs 1999, reg.3	Risk assessment record (significant findings)	Employer	Must be recorded: 5+ employees (reg.3(6))
Training and capabilities	Management Regs 1999, reg.13	Training records / competency evidence	Employer	No explicit threshold — good practice to record for all
Substances hazardous to health	COSHH 2002, reg.6	COSHH assessment record	Employer	Must be recorded: 5+ employees (reg.6(4))
Prevention / control of exposure	COSHH 2002, reg.7	Control measures documented in COSHH assessment	Employer	Tied to reg.6 recording obligation
Manual handling — operations that cannot be avoided	Manual Handling Ops Regs 1992, reg.4	Manual handling assessment	Employer	No separate recording threshold — derives from general risk assessment duty
Work at height — avoid, prevent, minimise	Work at Height Regs 2005, reg.6	Work at height risk assessment and method statement	Employer	No separate recording threshold — derive from Management Regs reg.3
Selection of work equipment for work at height (collective before personal protection)	Work at Height Regs 2005, reg.7	Equipment selection record / method statement	Employer	No separate threshold
Reporting and recording of work-related injuries	RIDDOR 2013, reg.4	Incident report; injury record	Responsible person (employer / person in control of premises)	Mandatory for all reportable events
Construction phase — projects with more than one contractor	CDM 2015, reg.12 & reg.13	Construction phase plan	Principal contractor	Required before construction phase begins
Fire risk — all non-domestic premises	RRO 2005, art.9	Fire risk assessment record	Responsible person	Must be recorded as soon as practicable after assessment
PPE — where risk not adequately controlled by other means	PPE at Work Regs 1992, reg.4	PPE assessment / provision record	Employer	No explicit recording threshold in reg.4

---

Industry-Specific Duties: Construction, Roof Work, Hazardous Substances, and Lone Workers

Work at Height

The Work at Height Regulations 2005 aim to prevent death and injury from a fall from height. Falls from height are one of the biggest causes of workplace fatalities and major injuries. (hse.gov.uk/pubns/indg401.htm) Work at height means work in any place where, if there were no precautions in place, a person could fall a distance liable to cause personal injury — there is no minimum height in the definition. (hse.gov.uk/pubns/indg401.htm)

Regulation 6(2) of the Work at Height Regulations 2005 requires that work is not carried out at height where it is reasonably practicable to carry it out safely otherwise than at height. Regulation 6(3) requires suitable and sufficient measures to prevent, so far as is reasonably practicable, any person falling a distance liable to cause personal injury. (legislation.gov.uk)

When selecting work equipment for work at height, regulation 7(1)(a) requires employers to give collective protection measures priority over personal protection measures — so edge protection and scaffolding take precedence over harnesses and lanyards in the selection hierarchy. (legislation.gov.uk)

Every time a ladder is used, a pre-use check should be carried out by the user before the task, and after anything has changed — such as a ladder being dropped. (hse.gov.uk)

Roof Work

Roof work accounts for a quarter of all deaths in the construction industry; falls through fragile materials such as roof lights and asbestos cement roofing sheets account for more of these deaths than any other single cause. Notably, not only trained roofers are at risk — many of those killed while working on roofs are maintenance workers. (hse.gov.uk/pubns/books/hsg33.htm)

COSHH

Regulation 6 of COSHH 2002 prohibits an employer from carrying out work liable to expose employees to any substance hazardous to health unless a suitable and sufficient assessment has been made and its required steps implemented. (legislation.gov.uk) Health hazards are not limited to substances labelled as 'hazardous' — harmful substances can be produced by the process itself, for example wood dust from sanding, silica dust from tile cutting, and fumes from welding. (hse.gov.uk) Where substances are classified as carcinogens, mutagens or asthmagens, exposure must be controlled to as low as is reasonably practicable (ALARP) under COSHH 2002. (hse.gov.uk)

Lone Workers

As an employer, you must manage any health and safety risks before people can work alone. This applies to anyone contracted to work for you, including self-employed people. (hse.gov.uk) There will always be greater risks for lone workers without direct supervision or anyone to help if things go wrong — this risk gap must appear in the general risk assessment.

---

RIDDOR: What Must Be Reported, Recorded, and How Quickly

RIDDOR requires employers and people in charge of work premises to report and keep records of work-related fatalities, work-related injuries, diagnosed cases of reportable occupational diseases, and certain dangerous occurrences. (hse.gov.uk)

Regulation 4 of RIDDOR 2013 sets out the duty to report non-fatal injuries to workers. The specified injuries that must be reported include any bone fracture (other than to a finger, thumb or toe), amputation, and any injury causing loss of consciousness from head injury or asphyxia. Where a worker is incapacitated for routine work for more than seven consecutive days (excluding the day of the accident), the responsible person must send a report to the relevant enforcing authority as soon as practicable and in any event within 15 days of the accident. (legislation.gov.uk)

---

Worked Scenario: A 12-Person Building Maintenance Company

Company: MidSpec Maintenance Ltd — 12 employees carrying out planned and reactive building maintenance, including roof repairs, application of hazardous cleaning chemicals, and lone working at remote sites.

Risk / activity	Regulation triggered	Document MidSpec must produce
All work activities (general)	HSWA 1974 s.2; Management Regs reg.3	Written H&S policy (mandatory: 12 employees); general risk assessment records
Roof repairs — fragile roofs, pitched roofs	Work at Height Regs 2005, reg.6 & reg.7	Work at height risk assessment; method statement specifying collective protection (edge protection, scaffolding) as priority over harnesses per reg.7; pre-use ladder check records
Hazardous cleaning chemicals	COSHH 2002, reg.6	COSHH assessment for each product; control measures record under reg.7
Lone workers at remote commercial sites	HSWA 1974 s.2; Management Regs reg.3	Lone working risk assessment within general RA; lone working procedure/safe system of work
Training for new starters and role changes	Management Regs 1999, reg.13	Training records; competency evidence for work at height tasks
Any reportable injury on site	RIDDOR 2013, reg.4	Incident report submitted within required timescales; internal injury record
Projects at client sites involving a second contractor	CDM 2015, reg.12 & reg.13	Construction phase plan (if MidSpec is appointed principal contractor)
Fire risk at own workshop/depot	RRO 2005, art.9	Fire risk assessment record

The gap most SMEs in this sector leave open: they produce a generic risk assessment but have no separate COSHH assessment for cleaning products, no documented lone working procedure, and no work at height method statement that records the reg.7 collective-before-personal protection decision. Each of those gaps is a distinct regulatory failure — not just an absence of good practice.

ramsdocs can generate the risk assessment, COSHH assessment, work at height method statement, lone working procedure, and construction phase plan templates for a business like MidSpec. Each document must then be reviewed and adapted to the specific site, task, and workforce by a competent person before use.

---

Employer Compliance Checklist: 10 Documents and Controls Derived from Primary Law

Use this checklist to identify gaps in your current documentation. Every item is grounded in a named primary source.

• 1. Written health and safety policy — required in writing if you employ 5 or more people; must be shared with all employees and revised as necessary. (HSWA 1974, s.2(3); HSE policy guidance)
• 2. General risk assessment record — suitable and sufficient assessment of risks to employees and non-employees; significant findings recorded if 5+ employees. (Management Regs 1999, reg.3)
• 3. COSHH assessment — completed for every substance or process capable of producing a hazardous substance (including process-generated hazards such as solvent vapours and abrasive dusts) before work begins; recorded if 5+ employees. (COSHH 2002, reg.6)
• 4. Manual handling assessment — for all manual handling operations involving a risk of injury that cannot be avoided; risk reduced to lowest level reasonably practicable. (Manual Handling Ops Regs 1992, reg.4)
• 5. Work at height risk assessment and method statement — documenting the avoid-prevent-minimise hierarchy; recording the reg.7 decision to prioritise collective protection measures over personal protection measures. (Work at Height Regs 2005, reg.6 & reg.7)
• 6. Training records — evidence that employees have received adequate health and safety training on recruitment and on exposure to new risks; training delivered during working hours. (Management Regs 1999, reg.13)
• 7. PPE provision record — evidence that suitable PPE has been provided where risk cannot be adequately controlled by other means. (PPE at Work Regs 1992, reg.4)
• 8. Lone working risk assessment and procedure — all lone working risks identified and managed before work commences; applies equally to self-employed contractors engaged by you. (HSWA 1974, s.2; HSE lone working guidance)
• 9. RIDDOR records — an internal record of all work-related injuries; reportable injuries submitted to the relevant enforcing authority within the timescales in reg.4, including the 15-day window for over-seven-day incapacity injuries. (RIDDOR 2013, reg.4)
• 10. Fire risk assessment record — a suitable and sufficient assessment of fire risks to all relevant persons; recorded as soon as practicable after the assessment. (RRO 2005, art.9)

---

How ramsdocs Generates and Manages the Documents the Act Requires

ramsdocs is designed around the document obligations created by the Act and its subordinate regulations. The platform generates editable templates for: health and safety policies, general risk assessments, COSHH assessments, manual handling assessments, work at height risk assessments and method statements, lone working procedures, and construction phase plans.

The compliance document map above is the architecture on which ramsdocs templates are built — each template corresponds to a named regulatory obligation, not a generic "health and safety document."

The output is designed to be PC review-ready and to reduce RAMS rework — but every document generated must be reviewed and adapted to the specific site, task, and contractor by a competent person before it is used or submitted. ramsdocs does not constitute legal compliance; your documented, site-specific implementation does.

---

Frequently Asked Questions

What does the Health and Safety at Work etc. Act 1974 actually require employers to do? Section 2(1) requires employers to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. Section 2(2) particularises this across plant and systems, substances, information and training, premises, and the working environment. Section 3(1) extends the duty to non-employees affected by the way the business is run.

Which section covers employees and which covers non-employees? Section 2 covers employees. Section 3 covers persons not in the employer's employment — including contractors, visitors, and members of the public — who may be affected by the conduct of the undertaking.

How many employees do you need before you must write down your health and safety policy? Five or more employees. The Act imposes the written-policy duty in s.2(3) "except in such cases as may be prescribed", and the Employers' Health and Safety Policy Statements (Exception) Regulations 1975 prescribe that exception for employers with fewer than five employees — so the threshold is statutory. Employers below it remain subject to the s.2(3) policy duty but need not write the policy down.

What subordinate regulations sit under the Act? The Act enables a wide body of subordinate regulations. The most significant for most employers include: the Management of Health and Safety at Work Regulations 1999 (risk assessment, training, capabilities); COSHH 2002 (hazardous substances); RIDDOR 2013 (incident reporting); the Manual Handling Operations Regulations 1992; the Work at Height Regulations 2005; CDM 2015 (construction); and the Regulatory Reform (Fire Safety) Order 2005.

What is the link between the Act and risk assessment under the Management Regulations? The Act creates the general duty. Regulation 3 of the Management Regulations operationalises it by requiring a documented, suitable and sufficient risk assessment. The assessment is the mechanism by which the employer identifies what measures are needed to comply with the statutory provisions — it is the bridge between the general duty and specific control measures.

What documents does an employer need to produce to demonstrate compliance? The answer is regulation-specific. At minimum: a written H&S policy (5+ employees); a risk assessment record (5+ employees); a COSHH assessment (5+ employees, where applicable); a fire risk assessment; training records; and RIDDOR records for reportable incidents. Businesses with work at height, manual handling, or lone working activities need additional documented assessments. The compliance document map above sets out the full picture.

---

Disclaimer: This page is for general information only. The documents and assessments described must be reviewed and adapted to the specific site, task, workforce, and circumstances by a competent person before use. Nothing on this page constitutes legal advice or guarantees compliance with health and safety law. What is a RAMS and why does it matter on a construction site? RAMS stands for Risk Assessment and Method Statement — a paired document that combines the identification of hazards and their controls with a step-by-step sequence for carrying out the work safely. The risk assessment answers what could go wrong and how risks will be controlled; the method statement answers how the work will actually be done, naming the people responsible, the plant and PPE required, and the first-aid and emergency arrangements. Together they form a task-specific safe system of work and are the practical compliance document most commonly produced to demonstrate that an employer has met their duties under the Act and the subordinate regulations made under it.

What duties do employees have under the Act — and can they be held liable? Section 7 of the Health and Safety at Work etc. Act 1974 places duties directly on employees: each employee must take reasonable care for their own health and safety and for that of anyone else who may be affected by their acts or omissions at work, and must co-operate with their employer so far as is necessary to enable the employer to comply with their own duties. These are not merely advisory — they are statutory obligations that can be enforced against individual employees.