Health and Safety Management Systems: 11 Things an Office Actually Needs
Almost everything written about health and safety management systems is written for organisations with plant, process and a significant workforce doing hazardous work.
Applied to a 120-person professional firm in a leased office, it produces something unrecognisable: a manual nobody reads, a documentation set out of all proportion to the risk, and a safety function spending its time maintaining the system rather than managing anything.
The duty is real and the answer is smaller than the guidance suggests. Eleven things an office-based organisation actually needs.
1. What a management system actually is
Strip away the terminology and it is the answer to one question: how does this organisation make sure the right things happen, keep happening, and get noticed when they stop?
Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make and give effect to appropriate arrangements for the effective planning, organisation, control, monitoring and review of preventive and protective measures.
Note "appropriate" and "give effect to". The arrangements must suit the organisation, and they must actually operate. Neither word suggests a manual.
2. You already have one; it is just undocumented
A useful reframing for anybody facing this from scratch.
Your organisation already does things. Somebody books the fire alarm test. Somebody orders a chair when a workstation assessment asks for one. Somebody notices when a first aid certificate lapses, usually late.
That is a management system operating informally. The work is rarely to build something new; it is to write down what exists, find the parts that depend on one person remembering, and fix those.
3. The structure that fits is plan, do, check, act
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
HSE's framework for managing health and safety uses plan, do, check, act, and its guidance HSG65 sets it out in full.
It fits an office well because it is small. Plan: what you are trying to achieve and who is responsible. Do: profile the risks, organise, implement. Check: measure and investigate. Act: review and improve.
Four stages, not a hierarchy of documents.
4. What the whole thing looks like at office scale
Concretely, for a single-site organisation of fifty to a few hundred people.
A policy with the three statutory parts. A risk assessment set covering the premises, display screen work, fire, and anything unusual you do. Named people: the competent person appointment, fire wardens, first aiders. A statutory check schedule for the building, with who holds each line. An action list with owners and dates. An incident and near miss route that people use. A training record. And a review cycle that is triggered by change as well as by the calendar.
That is the system. It fits in one folder and a spreadsheet, or in a single platform, and for most organisations it is sufficient.
5. What you can safely leave out
Equally important, and rarely said.
Separate procedures for activities you do not carry out. A documented objective-setting process with annual targets cascaded through the organisation. A management review meeting with a formal agenda where three people discuss a document. A document control system with revision tables on items that change once every five years. Internal audit programmes modelled on certification requirements you have not sought.
None of these is wrong in a large industrial organisation. In a professional firm they consume the capacity that should be spent closing actions.
6. ISO 45001 is a choice, not a requirement
Worth separating clearly, because the two get conflated.
ISO 45001 is an international standard against which an organisation can be certified. Nothing in British law requires it. It becomes worth considering when customers or tenders ask for it, when the organisation operates in sectors where it is expected, or when a group wants a common framework across countries.
The practical sequence is to build arrangements that work first, then decide whether certifying them adds commercial value. Doing it in the opposite order produces a system designed for an auditor rather than for the organisation.
7. Documentation proportionate to the risk
The principle that keeps the system usable.
The test for any document is whether somebody would act differently without it. A one-page arrangement describing who does what for contractors is worth having. A twelve-page procedure covering scenarios that never arise is not, and its length makes the useful part harder to find.
Where the law requires a specific record, that settles the question: the policy at five or more employees, the fire risk assessment and fire safety arrangements recorded in full since October 2023, and incident records retained for defined periods.
8. The three things that always matter
If an organisation gets only three things right, these are the three.
Assessments current. Describing the building, the headcount and the activities as they are now, not as they were at the last office.
Actions closed. The number open and the age of the oldest tells you more about a safety function than any other measure.
People appointed and capable. The competent person, wardens and first aiders exist, are known, and their training is in date.
Nearly every finding in an office audit reduces to one of those three.
9. Where office systems actually fail
Four failure modes, all of them organisational rather than technical.
One person holds it informally. It works until they are on leave, and stops when they resign.
Actions have no owner outside the safety function. Safety raises them, safety chases them, and operational managers treat them as somebody else's list.
The system reflects the last office. Moves, subletting and attendance changes invalidate assessments and nobody revisits them.
Checking does not happen. Plan and do are complete, check is absent, and the organisation cannot tell the difference between working arrangements and good luck.
10. What software does and does not solve
A clear-eyed view, since this is where organisations often start.
Software is good at holding records, prompting on dates, routing actions and showing a position across sites. For an organisation with more than one building, that is genuinely valuable and difficult to replicate in spreadsheets.
What it cannot do is decide whether an assessment is suitable and sufficient, whether a control is reasonably practicable, or whether the dashboard reflects reality. Those are judgements, which is why health and safety consultants and software are worth more together than either alone.
The sequence matters: decide what you are managing, then choose the tool. Buying first produces a configured system around an absence.
11. When to formalise further
Five triggers worth watching, because the proportionate answer changes as the organisation does.
A second site, which breaks informal arrangements immediately. Headcount growth past the point where one person knows everybody. An overseas entity, which brings a different legal framework. A customer or tender requiring certification. And an acquisition, which imports somebody else's arrangements.
Until one of those applies, resist adding structure. After one applies, add only what the change requires.
The 11, in short
| Point | Position |
|---|---|
| What it is | How the right things keep happening |
| Starting point | You have one already; write it down |
| Structure | Plan, do, check, act |
| The whole thing | Policy, assessments, named people, checks, actions, incidents, training, review |
| Leave out | Documentation modelled on industrial operations |
| ISO 45001 | A commercial choice, not a legal requirement |
| Documentation | Would somebody act differently without it |
| Always matters | Assessments current, actions closed, people appointed |
| Failure modes | One person, no owners, old premises, no checking |
| Software | Holds the position; cannot supply judgement |
| Formalise when | Second site, growth, abroad, certification, acquisition |
Rows four and five together are the answer most organisations are looking for: a short list of what to build, and permission not to build the rest.
For international groups
Two considerations, and the second is where the proportionality argument stops.
A group framework plus local annexes is the workable structure. One set of principles and one way of working, with each entity holding its own appointments, statutory documents and records.
Several jurisdictions prescribe the system itself, which removes the discretion. This series has documented examples: Thailand's safety management system regulation, Indonesia's SMK3 obligation audited by a licensed body against defined criteria with a grading outcome, Colombia's annual self-evaluation scored against minimum standards, and Peru's formal system under its safety law.
In those countries, a proportionate British-style arrangement is not an option, however sensible it looks. Regulation 7 requires a competent person here; several of those frameworks require a prescribed appointment with prescribed qualifications.
Periodic health and safety audits are how a group establishes whether each entity meets its own national test rather than the group's.
Where Arinite fits
Arinite builds arrangements sized to the organisation, which for most of our clients means considerably less documentation and considerably more attention to whether things are actually happening. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years.
Our health and safety consultants work extensively with legal, insurance, education and IT and software organisations, where the significant risks are organisational and the documentation set should be short.
Where entities sit in several countries, our global health and safety consultants establish which jurisdictions prescribe a formal system, and our international health and safety consultants keep that current as you add markets.
If your safety function spends more time maintaining documents than closing actions, a free gap analysis is the right place to start.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
