Compliance guide
Health and Safety Policies and Procedures
A single policy states your commitment; your policies and procedures are how you actually run safety day to day. Together they make up your health and safety management system (sometimes called a WHSMS or, under ISO 45001, an OH&S management system). This guide lists the documents to include, with examples, or you can have a tailored set done for you.
Last updated
Key takeaways
- A policy says what you're committed to; a procedure sets out the steps for doing a task safely. You need both.
- Your full set of policies, procedures and records is your health and safety management system (WHSMS, or an ISO 45001 OH&S management system).
- WHS and OHS policies and procedures are the same thing under different names.
- Prequalification systems like CM3 and Avetta often ask for several procedures, not just a policy, especially for higher-risk work.
- Scale the set to your risk: a low-risk office needs far less than a construction or aged care business.
- Use the examples below to build your own, or have a tailored set prepared for you.
Policies vs procedures: what's the difference?
- A policy is a short, high-level statement of intent and responsibility, for example your health and safety policy.
- A procedure is a step-by-step method for carrying out a specific task safely, for example how to report an incident or isolate equipment.
- Records are the evidence that you follow your procedures, such as completed inductions, risk assessments and incident reports.
Reviewers look for all three. A policy with no procedures behind it, or procedures with no records, is a common reason prequalification submissions are sent back.
What to include in your health and safety management system
Most small to medium businesses build their system from this core set. Include the policies and the procedures relevant to your work, you don't need every item if it doesn't apply.
Core policies
- Health and safety policy (your overarching commitment)
- Consultation, cooperation and coordination
- Drug and alcohol policy
- Return to work / injury management
Core procedures
- Hazard identification and risk management
- Incident, injury and near-miss reporting and investigation
- Emergency response and evacuation
- First aid
- Personal protective equipment (PPE)
- Contractor and visitor management
- Training, induction and competency
- Safe Work Method Statements (SWMS) for high-risk work
Procedure example: incident reporting
A good procedure is short and tells a worker exactly what to do. For example:
- Make the area safe and attend to anyone injured; call emergency services if needed.
- Report the incident to your supervisor as soon as practicable.
- Record the details in the incident register (what, when, where, who).
- Investigate to identify the cause and what control will prevent a recurrence.
- Notify the regulator if it's a notifiable incident, and keep records as required.
Download the policies and procedures template pack
Add your email and we'll send an editable pack of health and safety policies and procedures (Word and PDF) you can trim down to the documents your work actually needs.
How to build your health and safety policies and procedures
A practical path from a single policy to a working management system.
- 1
Start with your policy
Put your overarching health and safety policy in place first; everything else hangs off it.
- 2
Identify your real risks
List the hazards in your work. Your highest risks tell you which procedures you actually need.
- 3
Write procedures for those risks
Create short, step-by-step procedures for your key risks rather than copying a generic library you won't follow.
- 4
Consult your workers
Involve workers in writing and reviewing procedures, it's a legal duty in many places and it makes them workable.
- 5
Train, induct and record
Roll the procedures out through induction and training, and keep the records that prove it.
- 6
Review and improve
Review after incidents and at least annually, and update procedures as your work changes.
Build it yourself vs done-for-you
Building the set yourself is realistic if you have a few days and know your risks. A done-for-you set is matched to those risks, written to clear prequalification, and ready to upload.
| Free template pack | Done-for-you set | |
|---|---|---|
| Price | £0 | Fixed fee |
| Effort from you | Days of editing | A short intake form |
| Matched to your risks | You decide and write | Done for you |
| Procedures included | Generic set to adapt | Tailored to your work |
| Portal-ready PDF | Format it yourself | Yes, upload-ready |
| If a portal sends it back | You fix it | We revise it free |
Prefer your policies and procedures done for you?
Tell us about your work and its risks, and we'll prepare a tailored set of health and safety policies and procedures written to clear prequalification for portals like CM3, Avetta and Felix.
Requests for the health and safety documents are reviewed and prepared manually, we'll follow up by email.