Legal duties

All organisations have management processes or arrangements to deal with payroll, personnel issues, finance and quality control - managing health and safety is no different.

The Management of Health and Safety at Work Regulations (MHSWR) 1999 require employers to put in place arrangements to control health and safety risks. As a minimum, you should have the processes and procedures required to meet the legal requirements, including:

• a written health and safety policy (if you employ five or more people)
• assessments of the risks to employees, contractors, customers, partners, and any other people who could be affected by your activities - and record the significant findings in writing (if you employ five or more people). Any risk assessment must be 'suitable and sufficient'
• arrangements for the effective planning, organisation, control, monitoring and review of the preventive and protective measures that come from risk assessment
• access to competent health and safety advice
• providing employees with information about the risks in your workplace and how they are protected
• instruction and training for employees in how to deal with the risks 
• ensuring there is adequate and appropriate supervision in place  
• consulting with employees about their risks at work and current preventive and protective measures

HSE provides advice and templates on these processes - see our Risk management site for more information.

Risk profiling

Effective leaders and line managers know the risks their organisations face, rank them in order of importance and take action to control them. The range of risks goes beyond health and safety risks to include quality, environmental and asset damage, but issues in one area could impact in another.

Although you may not use these precise terms, you will most likely have built a risk profile that covers:

• the nature and level of the risks faced by your organisation
• the likelihood of adverse effects occurring and the level of disruption
• the costs associated with each type of risk
• the effectiveness of the controls in place to manage those risks