Health and Safety Audits for Insurance Firms: 9 Yes/No Questions to Answer First
Your firm spends its working life pricing other people's risk. Underwriters model flood exposure, brokers stress-test client business continuity, and claims teams see exactly what happens when a duty holder cuts a corner. Then the auditor books a walkthrough of your own London floor, your Dublin branch and your Singapore desk, and the questions get uncomfortably close to home. Well-run health and safety audits are not a paperwork exercise for insurance businesses. They are the same discipline you apply to clients, turned inward.
The difficulty is that insurance is a distributed business. A broker with 300 staff may occupy six leased floors in five jurisdictions, none of which it owns, all of which carry different statutory duties. In the UK, section 2 of the Health and Safety at Work etc. Act 1974 makes the employer responsible for the health, safety and welfare of employees at work, and regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient risk assessment. Cross the Channel and the EU Framework Directive 89/391/EEC imposes a parallel but differently documented set of obligations. Nobody sends a single checklist to all five offices and gets a defensible answer.
These are the nine questions to answer honestly before anyone books an audit date. Each one is a yes or a no. There is no partial credit, because a regulator will not award any.
1. Can you produce a current written risk assessment for every office, in the format that country requires?
A yes means every location, not the headquarters plus a note that the others are similar. The format matters as much as the content. France requires a Document Unique, the DUERP, reviewed at least annually and after any significant change. Germany requires a documented Gefährdungsbeurteilung under the Arbeitsschutzgesetz, overseen within the DGUV framework. Ireland requires a written Safety Statement under the Safety, Health and Welfare at Work Act 2005. A UK-format assessment translated into French is not a DUERP, and an inspector will say so.
2. Does a named individual hold the health and safety duty at each site, and do they know it?
Distributed firms lose accountability at the seams. The office manager assumes the landlord handles it, the landlord's agent assumes the tenant does, and the risk sits unowned for three years until something happens. A yes means a named person per site, documented, who could describe their responsibilities without notice. Many firms appoint a competent person precisely because the internal candidate does not have the technical grounding to say yes to this one.
3. Have you assessed display screen equipment for every employee, including the hybrid ones?
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Insurance work is screen work. Underwriting, claims handling, actuarial modelling and broking are all sustained sedentary tasks, frequently across dual or triple monitors, often for eight hours. The UK's DSE Regulations 1992 require an assessment for every user, and the HSE's guidance on musculoskeletal disorders is explicit that the duty follows the worker to their home when they work there habitually. A DSE assessment covering only the people who happen to be in on a Tuesday is a no.
4. Is workplace stress treated as a health and safety risk with controls, rather than an HR wellbeing initiative?
This is the question that catches financial services firms most often. Renewal season, claims surges after a catastrophe event and quarter-end reporting create predictable, foreseeable workload peaks. Under UK law, stress is a hazard like any other and must be assessed. The HSE Management Standards set out six areas that should be covered: demands, control, support, relationships, role and change. A yoga app is not a control measure. A documented assessment with named interventions is.
5. Do you know what your lease actually makes you responsible for?
Serviced and leased offices produce a reliable gap. The landlord maintains the fabric, the fire alarm and the lifts. You remain responsible for your own arrangements: your fire evacuation procedure, your first aid provision, your equipment, your people. Under Article 9 of the Regulatory Reform (Fire Safety) Order 2005 the responsible person must carry out a fire risk assessment, and being a tenant does not remove you from that definition. A yes means somebody has read the lease against the statutory duties and written down where the line falls.
6. Are incidents recorded consistently across every jurisdiction, and do you know which are legally reportable?
Reporting thresholds are national, not global. UK incidents may be reportable under RIDDOR within tightly defined timeframes. US operations sit under OSHA recordkeeping rules and the General Duty Clause. Singapore applies the Workplace Safety and Health Act. If each office keeps its own spreadsheet in its own format, you cannot see a trend, cannot evidence a system, and will not be able to answer an auditor's first request, which is almost always for the incident log. This is where health and safety consultants and software earn their keep: one register, one taxonomy, jurisdiction-specific reporting rules applied automatically.
7. Can you evidence that training was delivered, understood and refreshed?
An attendance list from 2022 is not evidence of a competent workforce. A yes means induction training for every starter, role-specific training where the risk warrants it, fire warden and first aider cover proportionate to headcount at every site, and a refresh cycle you can show. Firms that have grown by acquisition are particularly exposed here, because the acquired offices usually arrived with their own arrangements and nobody reconciled them.
8. Does your governance actually review health and safety, or only receive it?
Boards in regulated financial businesses are used to demonstrating oversight. Health and safety is frequently the exception: a paper goes to the operations committee, is noted, and nothing changes. ISO 45001 formalises the difference through clause 9.3, which requires management review with documented outputs and decisions. Even if you never certify, the distinction between receiving information and acting on it is the one an auditor will probe.
9. If your largest client asked for your health and safety documentation tomorrow, could you send it the same day?
Increasingly they do ask. Insurance firms bidding for corporate and public sector accounts face supply chain due diligence questionnaires that request policies, risk assessments, accident statistics and audit history. So do professional indemnity underwriters assessing your own risk. A no here has a direct commercial cost that has nothing to do with regulators.
The scorecard
Count your yes answers.
| Score | What it means | What to do next |
|---|---|---|
| 8 to 9 | Audit-ready. Your system is defensible and evidenced. | Move to continual improvement and consider certification. |
| 5 to 7 | Partially controlled. Documentation exists but is uneven across sites. | Prioritise the weakest jurisdictions and standardise the record. |
| 2 to 4 | Significant exposure. The system is informal and person-dependent. | Independent gap analysis, then a phased programme. |
| 0 to 1 | Unmanaged. A single incident would find you without a defence. | Treat as urgent. Start with risk assessment and named duty holders. |
Most insurance firms score in the middle band, and almost always for the same reason. The headquarters is in good order because someone senior took an interest, and the overseas offices were left to their own devices because nobody knew which local rules applied.
Where Arinite fits
Arinite has spent 15+ years helping office-based businesses run one coherent system across many countries. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. For a broker or underwriter, that means our global health and safety consultants coordinate locally qualified practitioners in each jurisdiction while you keep a single point of contact and a single view of compliance. Our health and safety consultants work across the insurance, finance and banking and legal sectors, so the advice you get reflects how professional firms actually operate rather than a generic template.
If your offices span more than one country, our international health and safety consultants can tell you exactly which national rules bite where. Answer the nine questions above, then book a free gap analysis and we will tell you, in one call, how far the answers would hold up under scrutiny.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
