Health and Safety Compliance: A UK Guide for 2026

124 workers were killed at work in Great Britain in 2024/25, while the HSE also secured 246 criminal prosecutions with a 96% conviction rate and fines over £33 million according to these reported HSE figures. That should end the tired idea that health and safety compliance is just paperwork.

For UK employers, this is a board-level issue. It affects people, operations, legal exposure, insurance conversations, tender credibility, and leadership reputation. It also exposes a hard truth. Many mid-market businesses still run compliance through spreadsheets, paper forms, inboxes, and disconnected policies that nobody reads until something goes wrong.

That approach is too fragile for modern organisations. If your business runs on Microsoft 365, your health and safety processes should be integrated, searchable, auditable, and easy for managers to use. Compliance fails most often in the gap between what the policy says and what the business can prove.

Why Health and Safety Compliance Matters Now More Than Ever

124 workers were killed at work in Great Britain in 2024/25. As noted earlier, enforcement action in the same period also showed that regulators are still prosecuting employers successfully and issuing substantial fines. The message is plain. Health and safety compliance is a live management issue, not an admin task.

What gets businesses into trouble is rarely the absence of a document. It is the absence of control. A policy sitting in SharePoint or a signed paper file in a cabinet does not prove that hazards were identified, actions were assigned, staff were trained, or reviews happened on time.

That is why smart firms treat safety as an operating system issue. The same discipline used in finance, audit, and governance applies here. If you want a useful parallel for accountability, evidence, and oversight, understanding COSO internal controls helps because the underlying principle is the same. Clear ownership, clear records, and clear proof.

A weak safety setup is easy to spot:

• Policies are written once and left to age
• Training happens, but records are incomplete or scattered
• Managers depend on memory, email trails, or local spreadsheets
• Near misses are logged late, inconsistently, or not at all
• Corrective actions are assigned loosely and never verified as closed

Practical rule: If a manager cannot pull up the latest risk assessment, training record, action owner, and review date in under a minute, the process is not under control.

This problem gets worse fast in mid-market organisations. More sites, more supervisors, more contractors, more movement, more variation. Paper forms and disconnected folders create blind spots. HR cannot see who is overdue for training. Operations cannot track open actions across locations. Leadership gets a false sense of assurance because the paperwork exists somewhere.

The fix is straightforward. Build health and safety into the systems your teams already use every day. For employers taking their wider duty of care in employment seriously, that means replacing paper-first compliance with structured digital workflows, live records, automated reminders, and audit trails that stand up under scrutiny.

For businesses already running Microsoft 365, this is an obvious next step. Dynamics 365 and the Power Platform can capture incidents, route approvals, assign actions, store evidence, and surface compliance gaps before they become enforcement problems. That is how you turn health and safety from a periodic scramble into a repeatable business process.

Understanding the UK Legal Framework

UK health and safety law is easier to manage when you stop treating it as a pile of disconnected rules. Think of it as a structure. The Health and Safety at Work etc. Act 1974 is the foundation. The supporting regulations are the pillars that make the duties specific and enforceable.

Start with the core legal duty

At the top level, employers must protect the health, safety, and welfare of people affected by their work activities. That broad duty isn't optional and it isn't limited to factories or construction sites. It applies to offices, warehouses, mobile workers, service teams, and mixed environments.

One basic legal checkpoint catches many businesses out. Under the Health and Safety at Work etc. Act 1974, any business in the UK with five or more employees is legally required to have a written health and safety policy, as explained in this UK overview of the written policy requirement.

If you want the employment side of that responsibility framed clearly, the principles in this guide to duty of care in employment are a useful reminder that safety duties sit inside a wider employer obligation, not outside it.

The main regulations that shape day-to-day compliance

The legal framework becomes practical through regulations. Three areas matter most for most mid-market employers:

These rules aren't abstract. They shape what inspectors ask for and what managers need to maintain.

What regulators expect to see

The law expects working systems, not broad statements. A compliant business should be able to show:

• A current written policy that reflects real operations
• Risk assessments that match roles, locations, and hazards
• Defined responsibilities so people know who owns what
• Training records that support competence
• Reporting routes for incidents and dangerous occurrences
• Maintenance and workplace controls that reduce avoidable risk

A policy without working arrangements is decoration. An assessment without action is evidence against you.

The smart move is to treat the law as an operating model. Put duties into repeatable processes. Assign ownership. Record completion. Review when work changes. That's how businesses stay compliant without turning every manager into a legal specialist.

Conducting a Suitable and Sufficient Risk Assessment

Risk assessment is where health and safety compliance becomes real. If this part is weak, everything built on top of it is weak as well. Training becomes generic, policies become vague, and audits become theatre.

The legal test matters. UK regulations mandate a "suitable and sufficient" risk assessment, and failure to document the process or prove employee competence via training records is a primary trigger for enforcement during HSE inspections, according to this explanation of what inspectors examine.

What suitable and sufficient actually means

It doesn't mean writing the longest document. It means the assessment reflects the actual work, the actual hazards, and the actual people exposed.

A poor assessment is easy to spot. It uses generic wording, ignores contractors and visitors, misses environmental changes, and never gets reviewed after incidents or operational shifts. A strong assessment is specific enough that a manager could act on it immediately.

If your organisation wants a wider governance lens on identifying and prioritising risk, Lighthouse Consultants' risk expertise is a useful reference point because enterprise risk discipline and safety risk discipline should support each other.

A five-step method that holds up under scrutiny

Use a straightforward process and document it consistently.

1. Identify hazards
   Look for anything that could cause harm. Machinery, slips, poor manual handling, lone working, fatigue, workstation layout, vehicle movement, heat, poor housekeeping, and unmanaged contractor activity all belong here.

2. Decide who might be harmed and how
   Don't stop at employees. Include agency workers, new starters, remote staff, engineers on customer sites, visitors, expectant mothers, and anyone whose exposure differs from the norm.

3. Evaluate the risk and decide controls
   Ask two questions. How likely is harm, and how severe could it be? Then decide what control measures are reasonable and effective. Eliminate where possible. If not, reduce and manage.

4. Record the findings
   Write down significant hazards, affected groups, existing controls, further actions, owners, and review dates. If you can't evidence it, don't assume it will count.

5. Review and update
   Revisit the assessment when people, equipment, premises, workload, or process changes. Also review after incidents, near misses, or complaints.

What inspectors look for beyond the form

Many businesses often slip at this stage. They complete a template and think the job is done. It isn't.

Inspectors tend to test whether the assessment connects to reality. They'll look at whether the named controls exist, whether training supports them, and whether staff understand the procedure. They'll often compare paperwork against what's happening on the ground.

Good assessments are operational documents. Site managers should use them. Supervisors should recognise them. Employees should see their controls reflected in the way work is organised.

A practical checklist for mid-market employers

Use this as a working standard:

• Match the assessment to the role rather than forcing one generic template across every team.
• Include location-specific risks because a warehouse, office, vehicle, and customer site won't share the same exposure profile.
• Assign named action owners so follow-up doesn't disappear into committee language.
• Link controls to training because a control that depends on employee behaviour must be taught and refreshed.
• Store reviews centrally so managers aren't relying on old versions saved locally.

The right risk assessment process isn't bureaucratic. It reduces confusion, sharpens accountability, and gives the business something solid to stand on when scrutiny arrives.

Designing Your Health and Safety Policy and Processes

A health and safety policy should tell people how your organisation manages risk. If it reads like a generic download with your logo pasted on top, rewrite it.

A good policy turns assessments into rules, responsibilities, and repeatable routines. It also needs to reflect the legal duty to maintain safe workplaces, suitable equipment, and proper welfare arrangements, which is why the practical effect of the Workplace Regulations matters so much in live operations.

The three parts every policy needs

Most effective policies are built around three core elements.

Statement of intent

Keep this concise and senior. It should make clear that the organisation takes responsibility for managing risks, providing resources, and reviewing performance. If the board signs it once and never refers to it again, the statement carries no weight.

Organisation

Policies often become vague. Don't write that “managers are responsible for safety” and leave it there. Specify who approves assessments, who delivers inductions, who checks contractor competence, who owns DSE reviews, who handles incidents, and who signs off corrective actions.

Arrangements

This is the part employees live with. Include the actual systems used for:

• Risk assessment and review
• Training and induction
• Fire and emergency procedures
• Workstation and ergonomic controls
• Incident and near-miss reporting
• Equipment checks and premises maintenance
• Contractor and visitor management

The best policy is one that a manager can use on a busy Tuesday, not one that only looks impressive in a tender pack.

Make the policy usable, not ceremonial

A policy becomes effective when it connects directly to working documents and workflows. If the arrangements say incidents must be reported, there should be a simple form and a named owner. If the policy says managers review assessments, there should be a schedule and reminders.

Property-heavy organisations need this discipline even more because premises, access, maintenance, and building-related duties often sit across multiple teams. In that context, a resource like Nimbio for property managers is helpful because it reflects how building operations and compliance records need to stay connected.

Review the policy whenever operations change. New sites, new equipment, hybrid working patterns, contractor dependence, and environmental conditions all change the risk picture. If the business evolves and the policy doesn't, the document is already behind.

Building Competence Through Training and Recordkeeping

Most compliance failures involving people come down to one question. Can the employer prove competence?

That doesn't mean proving someone attended a session once. It means showing they had the right information, the right instruction, and enough understanding to carry out work safely. In practice, competence is built from training, experience, supervision, and job-specific knowledge.

Why training records matter so much

Businesses often focus on delivering training and neglect the evidence. That's a mistake. If records are scattered across emails, spreadsheets, local folders, and LMS exports, managers can't tell who is current, who needs refreshers, or which teams are exposed.

Strong recordkeeping should show:

• What training was required for the role
• When it was completed
• Who delivered or approved it
• Whether understanding was checked
• When refresher training is due
• What restrictions apply if training lapses

That last point matters. If a task requires a current certificate or specific instruction, the business needs a clear rule for what happens when that evidence expires or goes missing.

Build role-based competence, not generic awareness

A proper training matrix should be tied to real responsibilities. A field engineer, office administrator, first aider, warehouse operative, and line manager do not need the same safety training.

Separate training into practical layers:

Evidence must go beyond attendance

The legal and practical standard is higher than “they were invited”. If training is important enough to rely on as a control, it's important enough to verify properly.

Employees don't become competent because HR uploaded a slide deck. They become competent when the business checks understanding and managers reinforce it in the flow of work.

Use sign-offs, short assessments, observed practice where relevant, and manager confirmation. Then store the evidence somewhere central. Not in one trainer's inbox. Not in a shared drive nobody trusts. Somewhere with clear ownership and searchability.

What good looks like in a Microsoft environment

For organisations already using Microsoft 365, the obvious answer is to connect competence records to employee data, role data, site data, and workflow approvals. That creates one version of the truth. It also makes audits far less painful because training, acknowledgement, and expiry information can be surfaced quickly.

If your system can't answer simple questions about current competence, the problem isn't the law. It's your process design.

Managing Incident Reporting and Proactive Audits

Most employers still treat incident reporting as a reactive administrative task. That misses the point. Reporting is one half of performance monitoring. The other half is proactive checking that finds weaknesses before someone gets hurt.

RIDDOR is the legal floor, not the whole system

Under UK rules, certain work-related incidents must be reported where workplace factors such as machinery, supervision, or poor premises maintenance contributed, as outlined in this guide to workplace duties and RIDDOR reporting. That legal threshold matters, but it shouldn't be your only trigger for recording an event internally.

Near misses, minor injuries, unsafe conditions, and repeated complaints often reveal the pattern earlier than a reportable event. If your internal system only captures serious incidents, you're learning too late.

For teams reviewing their reporting process, this incident report form sample is useful because it shows the kind of structure managers need when they're trying to capture facts quickly and consistently.

Complex reporting systems suppress reporting

Many businesses undermine themselves; if reporting takes too long, asks the wrong questions, or feels punitive, staff stop engaging.

The research is clear on the organisational barrier. Complex incident reporting had a statistically significant negative effect on occupational safety outcomes with β = –0.292, P < 0.001, as discussed in this analysis of behavioural and organisational barriers to workplace safety. That aligns with what most consultants see on the ground. If reporting is cumbersome, incidents stay hidden.

Use a short internal form first. Capture the essentials. Then route the event for investigation, escalation, or external reporting if required.

Audit what really matters in 2026

Reactive monitoring tells you what already happened. Proactive audits tell you what's likely to happen next unless you intervene.

The HSE has signalled where attention is going. For 2025/26, the HSE plans around 14,000 proactive inspections with a strategic focus on mental health, stress, and musculoskeletal disorders, integrating psychological risk assessments into standard safety checks, according to this outlook on compliance priorities.

That should change your audit plan. Don't limit inspections to physical hazards and housekeeping.

A stronger audit schedule now includes:

• Psychological risk checks such as workload pressure, role clarity, support, and management behaviours
• Musculoskeletal exposure reviews involving workstation setup, repetitive tasks, lifting, and vehicle-based work
• Follow-through checks on whether previous actions were closed and sustained
• Manager practice reviews to confirm local procedures are being used, not bypassed

If your audits only check extinguishers, exits, and trip hazards, you're auditing the easy bits and ignoring the current enforcement direction.

Keep the feedback loop short

The best reporting and audit systems share one quality. They make action visible. Staff report an issue. A manager investigates. Actions are assigned. Deadlines are tracked. Trends are reviewed. Lessons feed back into training and assessments.

That loop is what builds trust. People keep reporting when they can see the business acts.

Automating Compliance with Dynamics 365

Most health and safety problems in mid-market businesses aren't caused by a lack of intent. They're caused by fragmented systems. HR holds training records. Operations own inspections. Facilities track maintenance elsewhere. Incidents sit in email chains. Policies live in SharePoint folders with unclear version control.

That fragmentation is exactly why compliance becomes hard to prove.

A critical challenge now is joining digital HR compliance with physical safety controls. The HSE context shows the gap clearly. Businesses need to connect items such as automated Right to Work checks with physical safety actions such as heatwave risk assessments, and unified platforms like Microsoft Dynamics 365 are designed to bridge that gap, as reflected in HSE guidance and related compliance discussion.

What automation should actually do

Automation isn't about replacing judgement. It's about removing avoidable admin and making evidence reliable.

In a properly designed Microsoft environment, you can connect:

Why Microsoft-native matters

For organisations already invested in Microsoft 365, the advantage of a Dynamics 365 and Power Platform approach is practical. Dataverse gives you a central data layer. Power Automate handles reminders and workflows. Power BI supports audit visibility. Teams and Outlook help managers act without jumping between disconnected tools.

That matters because health and safety compliance is cross-functional. HR, operations, facilities, compliance, and line managers all touch it. A platform that sits inside the Microsoft stack removes friction that point solutions often create.

A strong example of that broader HR and operations foundation is outlined in this overview of Dynamics 365 HR alternatives and capabilities, especially where organisations need more flexibility across the full employee lifecycle.

Product thinking beats document thinking

Many businesses need a mindset shift. Stop asking, “Where is the policy document?” Start asking, “What process ensures this duty happens every time?”

For example:

• A new starter joins a field role. The system should trigger induction, site-specific safety briefings, equipment issue records, and manager confirmation.
• A worker changes location during a heatwave period. The system should prompt the relevant assessment and review task.
• A certificate approaches expiry. The manager should be alerted before the employee is assigned to restricted work.
• An incident is logged. The system should route investigation tasks, capture findings, and link resulting actions back to the relevant assessment or policy.

This is the practical value of integrated digital transformation. It reduces delay, tightens accountability, and gives leadership evidence they can trust.

We are DynamicsHub.co.uk. Experience HR transformation built around your business. Hubdrive's HR Management for Microsoft Dynamics 365 is the premier hire‑to‑retire solution, more powerful, more flexible, and more future‑ready than Microsoft Dynamics 365 HR. Hubdrive product capabilities make this especially effective for UK organisations that want training records, policy acknowledgements, incident workflows, employee lifecycle changes, Right to Work controls, and broader HR operations managed in one Microsoft-native environment.

If your current compliance process depends on spreadsheets, inboxes, and memory, it isn't adequate enough. Modern health and safety compliance needs one source of truth, clear workflow ownership, and evidence captured by design rather than chased after the event.

DynamicsHub helps UK organisations modernise compliance and HR operations on Microsoft Dynamics 365 and the Power Platform. If you want a practical route to better health and safety process control, call DynamicsHub on 01522 508096 today, or send us a message.

Chris Pickles Director / Dynamics 365 and Power Platform Architect & Consultant

Chris Pickles is a Dynamics 365 specialist and digital transformation leader with a passion for turning complex business challenges into practical, high-impact solutions. As Founder of F1Group and DynamicsHub, he works with organisations across the UK and internationally to unlock the full potential of Dynamics 365 Customer Engagement, HR solutions, and the Microsoft Power Platform. With decades of experience in Microsoft technologies, Chris combines strategic thinking with hands-on delivery. He designs and implements systems that don’t just function well technically — they empower people, streamline processes, and drive measurable performance improvements. Known for his straightforward, people-first approach, Chris challenges conventional thinking and focuses on outcomes over features. Whether modernising customer engagement, transforming HR operations, or automating processes with Power Platform, his goal is simple: build solutions that create clarity, capability, and competitive advantage.

See Full Bio

Dynamics 365 Customer Engagement (CE) Dynamics 365 Sales Dynamics 365 Customer Service Digital Transformation Microsoft Power Platform Power Apps Power Automate Power BI Dynamics 365 HR / HR Systems Hubdrive HR Business Process Automation