If you run a small business in the UK, health and safety can feel like a mountain of paperwork designed for factories and building sites rather than for a team of six in a converted barn. The reality is much friendlier than the reputation. The duties that apply to you are usually straightforward: think about what could realistically hurt someone, do something sensible about it, and make sure your people know what to do. Regulators are not looking for perfection — they are looking for proportionate, sensible management.

What the law actually asks of you

The Health and Safety at Work etc. Act 1974 places a duty on every employer to protect employees and anyone else affected by the business — customers, visitors, contractors, delivery drivers and members of the public. Under the Management of Health and Safety at Work Regulations 1999 you must assess risks, and you must have access to competent advice. Once you employ five or more people, your significant findings must be recorded in writing, along with a written health and safety policy.

In practice, for most small firms this comes down to four things:

• Risk assessment: identify what could cause harm, decide who could be affected and how, and note what you are doing about it.
• Practical arrangements: first aid, fire safety, accident reporting, and a named person responsible for day-to-day matters.
• Training and information: everyone needs to understand the risks in their role and how to work safely.
• Insurance: if you employ anyone, you almost certainly need employers' liability insurance, and the certificate should be easy to find.

None of this requires a glossy binder. It requires thought, a few written records, and consistency.

Risk assessments that actually fit your business

A risk assessment for a three-person design studio should not run to forty pages. The Health and Safety Executive expects you to focus on significant hazards, not every trivial one. Start with a walk around your premises and ask simple questions: what equipment could injure someone, what substances are used, where could people slip or trip, who works alone, who works from home, and are there young workers, new starters or pregnant employees to consider?

Then, for each hazard, write down four short points: who is at risk, what you already do to control it, what else is reasonably needed, and who will do it by when. That is a risk assessment. Generic templates are a fine starting point, but adapt them — a template that talks about forklifts in an office will undermine the whole exercise.

Review your assessments when something changes: new equipment, new premises, a new process, an accident, or a member of staff returning after a long absence. A quick annual check keeps them current without becoming a project.

Training that people remember

Training does not have to mean a day in a classroom. For most small firms it is a mix of induction, on-the-job instruction and short refreshers. What matters is that it is relevant, understood and recorded.

• Induction: fire exits, first aid arrangements, who to report problems to, and the specific risks of their role.
• Job-specific instruction: manual handling, safe use of tools or machinery, control of substances hazardous to health, and display screen equipment for regular users.
• Refreshers: at sensible intervals, and always after a change in process or following an incident.
• Records: a simple log of who was trained, on what, when and by whom. A signature or an email confirmation is enough.

Explain the why, not just the what. People follow rules they understand and quietly ignore rules that feel arbitrary.

Keeping the paperwork under control

The trick is to keep one system — ideally digital — rather than scattered folders. A straightforward structure works well: policy, risk assessments, training records, accident book, equipment inspection logs, insurance certificate and first aid details. Give each document a review date and set a reminder.

Avoid the common trap of writing a separate assessment for every individual. Assess the activity or the task, then note any additional needs for particular people. Report accidents properly, too: certain injuries, absences of more than seven days, dangerous occurrences and some work-related diseases must be reported under RIDDOR. If you are unsure whether something is reportable, report it — the process is quick.

Knowing when to bring in help

You can act as your own competent person if you understand your business and its risks. Bring in outside support for hazards you genuinely do not know: asbestos in older buildings, complex machinery, significant chemical use, or construction work. Good advice leaves you more capable, not more dependent.

Choose someone who explains their reasoning, gives you documents you can maintain yourself, and charges transparently. A one-off audit or a short retainer is often enough for a small firm, and it is far cheaper than reacting to an incident or an improvement notice.

Health and safety at its best is simply good management: know your risks, train your people, write down what matters, and review when things change. Do that, and you will be compliant without drowning in paper.