How to Write a Workplace Health and Safety Policy (October 2026)

A workplace health and safety policy is a written document that sets out how an employer manages the safety and welfare of its people. It states the employer’s commitment, names who is responsible for what, and documents the day-to-day arrangements: risk assessment, training, protective equipment, incident reporting and emergency procedures. Writing one properly takes a hazard assessment, a legal check against the rules that apply to your site, and real employee input — a day or two of focused work for most small employers.

The policy is not the safety system. It is the document that says the safety system exists, who owns it, and how anyone can see it. If your policy contradicts what happens on the floor, you have two problems, not one.

A few words on scope before the steps. This guide is written for US employers, with OSHA as the reference point. If you operate in the UK, the same seven steps apply, anchored instead on the Health and Safety at Work Act 1974 and the Health and Safety Executive’s three-part structure: statement of intent, responsibilities, and arrangements.

Table of Contents

What You Need
Step-by-Step: How to Write a Workplace Health and Safety Policy
Frequently Asked Questions
Conclusion

What You Need

Assemble these before you write a single sentence. A policy drafted without them is guesswork with a signature on it.

A current hazard and risk assessment. Every task, machine, substance and routine in your operation, with the controls already in place and the gaps still open. If your assessment is two years old, refresh it first — it is the raw material for the arrangements section.
The OSHA standards that apply to you. Check your industry and whether your state operates an OSHA-approved state plan, since state rules can be stricter. Hazard-specific written program standards cover bloodborne pathogens, respiratory protection, hazardous chemicals (HazCom), and fall protection.
Your existing procedures. Emergency action plan, fire evacuation, accident reporting, first aid, contractor and visitor control, vehicle and driving rules, lone working. Most employers already have these scattered across binders; step four is mostly a consolidation job.
Twelve months of incident data. The accident log, near-miss reports and any regulator correspondence. Repeat causes are the strongest evidence you have for what the policy needs to say.
Employee safety committee input, or a documented consultation. Whoever does the work knows where the policy is wrong. If you have no committee, run structured conversations and write down who you spoke to and what they said.
Legal references to hand. The OSH Act general duty clause, 29 CFR 1904 recordkeeping, your state plan requirements, and the nonretaliation protection in OSH Act Section 11(c). Where you employ ten or more people at any time, keep the OSHA 300 log, the 300A annual summary and the 301 incident forms — your policy should name who maintains them.

Step-by-Step: How to Write a Workplace Health and Safety Policy

Seven steps, in this order. The sequence matters because each step feeds the next: you cannot assign responsibilities you have not understood, and you cannot check a draft against law that depends on hazards you have not identified.

How to Write a Workplace Health and Safety Policy People Can Follow

Start with the hazard assessment and write only what it supports. A policy people can follow names a role, an action, a frequency and a record for every commitment, and none of those four things can come from a generic template.

Write in the language of the workplace, not the language of the manual. “Wear cut-resistant gloves when handling glass or sharp tooling” survives contact with a worker. “Employees shall utilise appropriate personal protective equipment” gets read once and ignored. Where you must reference a regulation, put it in parentheses after the plain instruction.

Define responsibilities by role rather than by name, so the document survives someone leaving. Typical entries: the owner or general manager holds final responsibility and signs the policy; the safety coordinator runs risk assessments, training records and inspections; supervisors enforce the arrangements in their area; every employee reports hazards and incidents promptly and uses the equipment provided.

Give each arrangement a measurable expectation. “Safety glasses are worn in the fabrication area” can be checked. “A strong safety culture is promoted” cannot. For a small employer, two to four pages is the useful length — long enough to cover real hazards, short enough that people read it once.

Consult Employees and Safety Committees

Consult the people doing the work before final approval, and document what you heard. Consultation does not transfer your legal responsibility; the employer still owns the duty to provide a safe workplace, but a policy built without input is far harder to implement and easier to challenge.

Ask role-specific questions rather than “any concerns.” On the shop floor: which task is the most dangerous, and what breaks first. In the office: what happens when someone works alone late. On the road: what is not covered by the vehicle policy. Remote and hybrid staff: what ergonomics and home-working issues come up. For each group, ask what would make them slow down or stop work, and what would make reporting easier.

Write feedback into a log with a response column. Where a suggestion is not adopted, say why. Close the loop by telling people what changed — an eight-line summary in the next toolbox talk does more for belief in the policy than the policy itself.

Check the Policy Against OSHA and State Requirements

Compare your draft against every written program obligation that applies to your hazards, plus state plan requirements if you are in one of them. Most gaps come from the hazard-specific standards rather than the general duty clause, because those carry a defined written-program requirement.

Hazard communication (HazCom). A written program with a chemical inventory, labels and SDS access, and employee training on hazards.
Bloodborne pathogens. A written exposure control plan with sharp-injury prevention, hepatitis B vaccination and post-exposure steps.
Respiratory protection. A written program with required medical evaluation, fit testing, selection and training — and voluntary use rules where no program exists.
Fall protection. Written fall protection and rescue procedures where employees work at height.
Emergency action plan. Required where the general duty clause is not met by a written program; it must state what to do in an emergency and who does it.
LOTO and machine safety. Documented energy-control procedures, periodic inspection, and authorized-employee training.
Recordkeeping. If you are an employer covered by 29 CFR 1904, name in your policy who maintains the 300 log, the 300A summary and the 301 forms.

Note explicitly that the policy does not override a more specific standard. Where a hazard-specific program governs, the policy points to it; the program holds the detail.

Set Clear Roles, Procedures, and Enforcement

Your policy must say how a hazard gets reported, what happens next, and what protects the person who reports it. Those three elements are where weak policies collapse during an audit or a claim.

Set out the reporting route in practical terms: who to tell, when, and by which channel — verbal to a supervisor, a written form, an app, a posted number, or an anonymous channel where the concern involves a supervisor or owner. State the response time you commit to, for example investigating a reported hazard within five working days and telling the reporter the outcome.

Then write down the follow-through: what an investigation consists of, who owns the corrective action, and how completion is recorded. Reference the nonretaliation protection in Section 11(c) of the OSH Act, which protects employees who report injuries, illnesses or hazards, and pair it with a plain statement that reporting will not cost anyone their job, hours or standing.

Keep one thing out of the policy: a promise that the workplace will never have an injury or that every accident can be prevented. Say you will eliminate risks where reasonably practicable, reduce risks where not, and review everything after change. Realistic commitments survive inspection; impossible ones get quoted back at you.

Get Formal Approval and Assign a Review Date

Approval turns a draft into a commitment. The most senior person at the site signs and dates the policy, states their role, and puts their name to it.

Build a small control block at the top or bottom of the document: version number, effective date, document owner, next review date, and the date of the last change. Version control sounds like bureaucracy until a client, insurer or investigator asks which version your floor supervisors were actually trained on.

Set the first review for twelve months out and add event triggers, each with a date and a name against it: new equipment or a new process, a change in headcount or site, an incident or near miss, a regulatory change, a move, and any new contractor working on site. Review at least annually even when nothing changed, because the hazards around your business move even when your document does not.

Communicate, Train, and Put the Policy Into Practice

A policy nobody has read is a document, not a control. Distribution has to reach people who may not have regular access to a computer, which usually means shop-floor terminals, a noticeboard, printed copies in break rooms and handover folders.

Cover it in induction before a new starter’s first week ends, and in refresher training on a fixed cycle. Train on what happens in that person’s work, not the whole policy — an operator needs the machine isolation procedure and the near-miss process, not the procurement section. Keep a sign-in sheet or completion record for every session; that record is often the evidence an auditor asks for first.

Post what must be posted: emergency numbers, evacuation routes, assembly points, warning signs, and the reporting contact. Give people a short acknowledgement form to sign so you can prove the policy was communicated, and keep those forms with the training records.

Check the psychology, because this is where policies quietly fail. Ask someone on the floor how comfortable they would feel reporting a missing guard or a blocked exit. If the honest answer is “it would get awkward,” fix the reporting route before you fix the wording.

Test Effectiveness and Update the Policy

Test the policy against evidence rather than opinion. Pull twelve months of incident and near-miss data and compare it to the period before the policy took effect, then look at the training completion rate and the findings from your last few inspections.

Ask three questions at review: which arrangements produced a measurable change in the numbers, which were never followed at all, and which hazards have no arrangement at all. Use the answers to write the revision. If slips and trips lead the log and your arrangements section says nothing about floor condition or housekeeping, that gap is your next edit.

Record each revision with the date, who approved it, and the evidence behind it. A policy with three documented versions over three years tells an auditor more about the safety culture than a perfect document drafted once and filed away.

Common Mistakes

These are the failures that recur, with the correction for each.

Copying a generic template. Vendors sell fill-in-the-blanks policies that contain no site-specific hazard, machine or substance. The fix: keep the template as scaffolding, then replace every general line with something drawn from your own assessment.
Vague commitments. “Continuous improvement in health and safety” tells a worker nothing. The fix: add an owner, a frequency and a record to every arrangement.
Skipping employee consultation. Drafting entirely in a back office produces a document your own crews will not follow. The fix: hold documented consultations and log the feedback and your responses.
Ignoring small sites and contractors. A policy written only for the main warehouse ignores the depot, the shop unit and the subcontractor on site. The fix: state the scope, and apply it to everyone who works for you or on your site, including temporary and visiting staff.
Promising zero incidents. It is not achievable and it is read as unserious. The fix: commit to reducing risk, investigating every event, and reviewing after change.
Confusing the policy with a risk assessment or a safety plan. The risk assessment identifies and scores hazards; the policy states who manages them and how. The fix: keep the two documents separate, cross-referenced, both dated.
Never communicating or never updating it. The most common and most damaging of all. The fix: induction, refresher cycles, a named owner and a scheduled review with event triggers.

Frequently Asked Questions

Do I legally need a workplace health and safety policy?

In the US there is no single rule that says every employer must have a written policy on a particular date. The obligation attaches to the hazard: if a workplace risk exists that could cause death or serious harm, the general duty clause requires a written program describing what you do about it, even at two employees. UK employers with five or more employees must hold a written policy under the Health and Safety at Work Act 1974. Insurers and clients will ask for one regardless.

What written safety programs does OSHA require?

OSHA sets written program requirements for hazard-specific standards, including bloodborne pathogens, respiratory protection, hazard communication, fall protection, lockout/tagout and powered industrial trucks. Where an emergency action plan is required and the general duty clause is not satisfied by another written program, that plan must state what to do in an emergency and who does it. Employers covered by 29 CFR 1904 must also maintain the OSHA 300 log, the 300A summary and 301 incident forms.

Do OSHA rules apply to small businesses?

Yes, with the smallest staffing threshold. OSHA’s small-business exemption in its penalties policy protects small employers from citations for the first violation in a category, and separate staffing thresholds of 10, 11, 12, 15 or 20 employees apply to which specific standards are enforced, depending on industry. None of that removes the general duty clause. A three-person workshop with a dangerous machine has the same underlying duty as a factory with 300 staff.

How long should a health and safety policy be?

For a small employer, two to four pages is the useful range: long enough to cover your real hazards, procedures and responsibilities, short enough that people read it once. Longer documents are fine for multi-site or high-risk operations provided they have a clear contents page and summary. Length is not the measure — whether a frontline worker can find the answer to one question about their own task is the measure.

How often should a health and safety policy be reviewed?

At least annually, and immediately after anything changes the risk picture: new equipment or processes, a move, a change in headcount, an incident or near miss, a new contractor, or a regulatory change. Some sectors are inspected more often than others, but an annual cycle is the baseline most auditors and insurers expect to see. Record each review with its date, findings and approver.

Who should sign a workplace health and safety policy?

The most senior person at the site, with their name and role written next to the signature and date. That is typically the owner, managing director or executive director. In a larger group the group-level director may sign a group policy with site managers signing local appendices. Whoever signs, the document should state plainly that the signer accepts ultimate responsibility for health and safety on that site.

Conclusion

Six actions, in order: run a current hazard assessment, write the policy from what it shows, put it in front of the people who do the work, check it against the standards that apply to your hazards and state, sign it at the highest level with a named owner and a review date, then communicate and train on it. Repeat that loop annually and whenever the work changes.

If you only do one thing this week, gather your last twelve months of incident and near-miss reports. They will tell you which parts of your policy need to be real, and which parts can stay short.