A health and safety management system is simply the organised way a business manages the risks its work creates: who is responsible for what, how risks are identified and controlled, how people are trained and consulted, how performance is checked, and how the whole thing is reviewed and improved. Every employer already has one, whether it is written down or lives in the owner's head. The question is how formal it should be, and whether it should follow a recognised model such as HSE's HSG65 or the international standard ISO 45001.
Why every employer already has one, in law
The Management of Health and Safety at Work Regulations 1999 require every employer to have arrangements for the effective planning, organisation, control, monitoring and review of its health and safety measures, in proportion to the nature of its activities and the size of the undertaking. Where there are five or more employees, those arrangements must be recorded. That list of five words is a management system in miniature. A sole trader with a notebook and a larger company with a certified system are both meeting the same duty at different scales.
The parts of any management system
- Policy and leadership. A statement of what the business intends, signed by the person at the top, and visible commitment to it.
- Organisation. Who is responsible for what, who is competent to do it, and how people are consulted and informed.
- Planning. Identifying hazards, assessing risks, deciding controls, setting objectives and planning for emergencies.
- Implementation. Putting the controls in place: procedures, training, equipment, supervision, contractor management.
- Measuring performance. Active monitoring such as inspections and audits, and reactive monitoring such as accident and near miss investigation.
- Review and improvement. Looking at the results periodically, deciding what to change, and feeding that back into planning.
The loop is the important part. A set of documents that is written once and never revisited is not a management system, however thick the folder.
HSG65: HSE's Plan, Do, Check, Act model
HSG65, Managing for health and safety, is HSE's free guidance on how to manage health and safety. Since 2013 it has used the Plan, Do, Check, Act cycle that is familiar from quality management.
- Plan. Decide what you want to achieve, who is responsible, how you will measure success, and put your policy in writing.
- Do. Identify your risk profile, organise the work, implement the controls, train and consult people.
- Check. Measure performance, investigate accidents and near misses, inspect and audit.
- Act. Review performance, learn lessons and act on them.
HSG65 is guidance rather than a standard. There is no certificate, no auditor and no fee. For most small and medium businesses it is the right model, because it is proportionate, free and written for exactly that audience. An inspector who asks how you manage health and safety is, in effect, asking how you do the four steps.
ISO 45001: the certifiable standard
ISO 45001:2018, with its 2024 amendment, is the international standard for occupational health and safety management systems. It uses the same high-level structure as ISO 9001 for quality and ISO 14001 for environment, so the three can be run as one integrated system. In outline its requirements cover understanding the context of the organisation and the needs of workers and other interested parties, leadership and worker participation, planning that addresses hazards, risks, opportunities and legal requirements, the resources, competence, awareness, communication and documented information needed to support the system, operational controls and emergency preparedness, performance evaluation including internal audit and management review, and continual improvement.
The cycle is the same Plan, Do, Check, Act. What ISO 45001 adds is formality and independent verification. An organisation can have its system audited by an accredited certification body and, if it conforms, receive a certificate that clients, tenders and frameworks recognise. Certification is decided by the certification body, not by any consultant, and Featherstone Safety is not a certification body. See ISO consultant vs certification body.
HSG65 or ISO 45001?
Both will give you a working system if you actually run them. The differences that matter are:
- Recognition. Only ISO 45001 produces a certificate. If clients, tenders or frameworks ask for certification, HSG65 will not satisfy them, however good your system is. See ISO certification for tenders and frameworks.
- Formality. ISO 45001 expects documented information, internal audits, management reviews and records of worker participation. HSG65 asks for the same things in substance but lets you decide the form.
- Cost. HSG65 costs your time. ISO 45001 costs your time plus certification body fees and, usually, some consultancy. See what ISO 45001 implementation costs.
- Integration. If you already hold ISO 9001 or ISO 14001, adding ISO 45001 is a natural step because the structure is shared. See adding ISO 45001 to an ISO 9001 system.
A sensible path for many businesses is to build the system on HSG65 principles first, run it for a while, and move to ISO 45001 when a commercial reason appears. A system built properly on Plan, Do, Check, Act is most of the way to the standard already. The ISO 45001 readiness checklist shows how far you are from it.
What it looks like in a small business
Stripped of jargon, a working system in a business of ten to fifty people usually consists of a short policy and arrangements document, a register of risk assessments and COSHH assessments that is reviewed on a schedule, a training matrix showing who is competent for what and when refreshers fall due, a routine of workplace inspections with actions tracked to closure, an accident and near miss log that is actually used, a way of consulting staff, and a review meeting at least once a year where the directors look at the results and decide what to improve. That is the whole thing. The difficulty is not designing it but keeping it alive, which is why the record-keeping tools matter. Featherstone Safety Hub was built to hold exactly these elements in one place, with overdue actions and training visible on a dashboard rather than buried in folders.
How to build one
- Establish where you are with a gap assessment or compliance review.
- Write the policy and assign responsibilities, with the most senior person signing.
- Profile your risks and complete or update the risk assessments, prioritising the activities that could cause serious harm.
- Put the controls, training and consultation in place and record them.
- Set up the checks: inspections, incident investigation and, for ISO 45001, internal audit.
- Hold a review, act on it, and repeat.
For a business that wants help with that, a compliance pack establishes the documented system, retained support keeps it running, and for certification the ISO 45001 implementation service takes it to the standard, with fees from £1,250 for a gap assessment confirmed in writing before work begins.
Frequently asked questions
Is a health and safety management system a legal requirement in the UK?
A formal, certified system is not. Having arrangements for planning, organising, controlling, monitoring and reviewing health and safety is a legal requirement for every employer under the Management Regulations, and those arrangements must be recorded where there are five or more employees. That is a management system in all but name.
What is the difference between HSG65 and ISO 45001?
HSG65 is free HSE guidance built on Plan, Do, Check, Act, with no certificate or audit. ISO 45001 is an international standard with the same cycle but more formal requirements, which can be independently audited by a certification body to produce a certificate that clients and tenders recognise.
Does a small business need ISO 45001?
Usually only where clients, tenders or frameworks require it, or where the business wants the discipline and recognition of certification. Many small businesses run a perfectly good system on HSG65 principles and move to ISO 45001 when a commercial reason appears.
Can a management system be run in software?
Yes, and it is usually easier to keep alive that way. Risk assessment registers, training matrices, inspection records, incident logs and action tracking are exactly the elements that go stale in folders. Software such as Featherstone Safety Hub keeps them current and visible, although the thinking and the decisions still have to be done by people.
How long does it take to set up a health and safety management system?
For a small business starting with reasonable arrangements, the documented system can usually be established in a few weeks of focused work. ISO 45001 certification takes longer because the system must be operated and audited before the certification audit. See the guide on how long ISO 45001 certification takes.