What health and safety do we actually have to do?

England and Wales: This page sets out the position in full, including the offences, who commits them and the penalty. Scotland: covered — the same Act and regulations, prosecuted by a different body, and with a lower maximum penalty in the magistrates’ or sheriff court than England and Wales. Northern Ireland: covered, and separate law — its own Order and its own regulator, with the same duties and thresholds; the fine is capped as in Scotland, not unlimited as in England and Wales, though the summary prison term is shorter than Scotland’s; the exact wording of its personal-liability provision and its version of the injury-reporting rules are not set out here.

Health and safety offences: imprisonment, not just a fine

Breaching charity health and safety duties can lead to prison, not just a fine. The duties are often described as “backed by criminal law”. Most trustees read that as meaning a fine. It means more. HSE enforces them in Great Britain, and HSENI in Northern Ireland, with local authorities for some premises.

This step applies to every charity with staff, volunteers or visitors, whether or not you have just taken on premises.

In England and Wales, and in Scotland, the duties come from the Health and Safety at Work etc. Act 1974 (HSWA). They also come from the Management of Health and Safety at Work Regulations 1999. Failing in them is an offence:

Provision	What it makes an offence	Who commits it
HSWA s.33(1)(a)	Failing to carry out the duty to employees (s.2) or to people who are not employees (s.3)	The employer — the charity, or in an unincorporated charity the trustees themselves
HSWA s.33(1)(c)	Breaching regulation 3 of the 1999 Regulations — the risk assessment duty	The employer
HSWA s.37(1)	The charity’s offence, where it was committed with an officer’s consent or connivance, or was down to their neglect	That officer personally, as well as the charity
HSWA s.37(2)	The same, where the body’s affairs are managed by its members	The member personally

In England and Wales and in Scotland, both offences under section 33 can be tried in either the lower or the higher court. The penalty table in Schedule 3A to HSWA sets the limbs:

• Summarily, England and Wales: Sch 3A para 1, row for s.33(1)(a) (duties under ss.2-6) and s.33(1)(c): 'Imprisonment for a term not exceeding the general limit in a magistrates' court, or a fine, or both.' (E.W. wording)
• Summarily, Scotland: The un-amended Sch 3A wording, which still applies in Scotland: 'Imprisonment for a term not exceeding 12 months, or a fine not exceeding £20,000, or both.'
• On indictment: 'Imprisonment for a term not exceeding two years, or a fine, or both.' (all three nations)

The penalty is not the same in all three nations. SI 2015/664 made the lower-court fine unlimited. It extends to England and Wales only:

	Lower court (summary)	Higher court (indictment)
England and Wales	Prison up to the magistrates’ general limit, an unlimited fine (since 12 March 2015), or both	Prison up to 2 years, a fine, or both
Scotland	Prison up to 12 months, a fine up to £20,000, or both	Prison up to 2 years, a fine, or both
Northern Ireland	Prison up to 6 months, a fine up to £20,000, or both	Prison up to 2 years, an unlimited fine, or both

In Northern Ireland the offences are under the Northern Ireland Order, not HSWA. The section on Scotland and Northern Ireland sets this out.

Neglect is enough to make it personal

Section 37 does not need a trustee to have agreed to anything dangerous. Neglect is enough. Section 37(1) of HSWA applies in England and Wales and in Scotland. It says:

Where an offence under any of the relevant statutory provisions committed by a body corporate is proved to have been committed with the consent or connivance of, or to have been attributable to any neglect on the part of, any director, manager, secretary or other similar officer of the body corporate or a person who was purporting to act in any such capacity, he as well as the body corporate shall be guilty of that offence and shall be liable to be proceeded against and punished accordingly.

Section 37(2) applies the same rule to members, where a body’s affairs are managed by its members.

Section 37 reaches neglect as well as consent or connivance. Whether a particular trustee’s conduct amounts to any of them is a question for a solicitor, not for this page. How this fits the wider picture of a trustee’s own exposure is set out in Am I personally liable as a charity trustee?

In England and Wales and in Scotland, section 37 applies to a body corporate — a charitable company or a CIO. It does not apply to an unincorporated charity, because there is no body corporate.

But that does not help. In an unincorporated charity that employs people, the trustees are the employer themselves. The HSWA duties in sections 2 and 3 are theirs directly.

Either way, the exposure is personal.

Once you employ anyone, you must assess the risks — at any size

In England and Wales and in Scotland, the duty to assess risk is in regulation 3(1) of the 1999 Regulations. It has no size threshold:

Every employer shall make a suitable and sufficient assessment of— (a) the risks to the health and safety of his employees …; and (b) the risks to the health and safety of persons not in his employment …

Two things follow.

A risk assessment is the employer’s review of the risks its work creates for employees and for anyone else affected. Regulation 3(1) requires it to be “suitable and sufficient”.

It binds every employer, however small. One employee is enough. The assessment covers staff. It also covers people who are not employees, including volunteers and the public.

It binds only an employer. A charity with no employees at all has no regulation 3(1) duty. HSE’s own guidance says that if you have volunteers and no employees, “health and safety law will not normally apply to you. However, you may still have duties under civil law”.

HSE names one exception: control of premises. Section 4 of HSWA puts a duty on each person who has, to any extent, control of non-domestic premises. The premises must be made available to people who are not their employees, as a place of work or as a place where they may use equipment or substances provided there. HSE’s guidance on village and community halls says: “Anyone with control of non-domestic premises (such as a village or community hall) has legal responsibilities under health and safety law.” That applies with or without employees.

Those civil-law duties are the common-law duty of care. A negligence claim enforces that duty, not a regulator. For a small group, a negligence claim is not obviously less serious than a prosecution. A written risk assessment is still the best evidence that the charity took reasonable care.

Two thresholds, both about writing things down

The law sets two employee-count thresholds at the same number. Charities often merge them into one rule. They then conclude that below it they need not assess risk at all. That is wrong: neither threshold is about the underlying duty.

1. The written policy statement. Once you have 5 or more employees, you must have a written health and safety policy. In England and Wales and in Scotland, section 2(3) of HSWA contains the duty but not the number. The number comes from regulation 2 of the Employers’ Health and Safety Policy Statements (Exception) Regulations 1975. It says:

Any employer who carries on an undertaking in which for the time being he employs less than five employees is hereby excepted as respects that undertaking from the provisions of subsection (3) of section 2 …

The duty is to share the policy, not just to hold it. Section 2(3) requires the employer “to bring the statement and any revision of it to the notice of all of his employees”. A policy on file that nobody has seen does not meet the duty.

2. The recorded assessment. Once you have 5 or more employees, you must record the significant findings of the risk assessment. You must also record any group of employees it identifies as especially at risk. This is regulation 3(6) of the 1999 Regulations, in England and Wales and in Scotland.

Below that number you must still do the assessment. You do not yet have to write it down. A written assessment is still the best evidence of reasonable care.

Volunteers: owed a duty, not counted — and reported differently

Volunteers do not count towards either threshold. Both count employees.

But once you have one employee, you owe volunteers a duty. Section 3(1) of HSWA applies in England and Wales and in Scotland. It sets the duty “to conduct his undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in his employment who may be affected thereby are not thereby exposed to risks to their health or safety”.

A volunteer is such a person. HSE’s guidance goes further. It says you should give volunteers the same protection as employees who do similar work and face the same risks.

Accident reporting treats them differently. RIDDOR is the set of injury-reporting rules. HSE’s guidance on RIDDOR says an incident involving a volunteer is reportable only where it arose from a work-related activity. The incident also has to have done one of these:

• caused a death
• led to the person being taken directly from the scene to hospital for treatment

The category for injuries that keep someone off for a longer period applies to employees only.

HSE’s own examples:

Not reportable	Reportable
A charity shop volunteer hurts their back and is not taken to hospital, however long they are then off	A volunteer at a fundraising event breaks a foot, where the charity has employees
A litter-picking volunteer with a group that has no employees	A farm volunteer loses a finger in machinery

The Northern Ireland injury-reporting rules were not read for this page. Do not assume they match.

For insuring volunteers, and what else you owe them, see Are volunteers insured, and what do I owe them on health and safety?.

Scotland and Northern Ireland: the reverse of what people expect

People expect Scotland to have its own law and Northern Ireland to follow Great Britain. In health and safety it is the other way round.

Scotland uses the same HSWA and the same 1999 Regulations. HSE works there too. HSE reports cases to the Health and Safety Investigation Unit, part of the Crown Office and Procurator Fiscal Service. The unit decides whether to prosecute.

But “same law, only the prosecutor differs” is not accurate at the penalty level. SI 2015/664 does not extend to Scotland. So the lower-court cap and term in the first section’s penalty table still apply there.

Northern Ireland has its own primary law, the Health and Safety at Work (Northern Ireland) Order 1978. It also has its own regulator, HSENI. The duties run parallel:

• Written policy — Article 4(3) of the 1978 Order, once an employer has 5 employees. HSENI’s guidance confirms the number. The Northern Ireland exception regulations (S.R. 1980/269) are published only as a scanned PDF. They were not read directly.
• Recorded assessment — regulation 3(6) of the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, at 5 employees. Its wording matches Great Britain’s. The duty to assess has no threshold and binds an employer, as in Great Britain.
• Penalty — Schedule 3A to the 1978 Order keeps the lower-court cap shown in the first section’s penalty table. The unlimited fine never reached Northern Ireland.
• Personal liability — individuals can also be prosecuted for a body’s offence. HSENI’s enforcement guidelines say inspectors should consider this where the offence was committed with a person’s “consent, knowledge or connivance” or was attributable to their “lack of reasonable diligence”. The statutory wording was not read for this page. So this page does not say the rule is the same as section 37 of the Great Britain Act.

What to write down, and when

1. Count your employees, not your volunteers.
2. With at least one employee, assess the risks to staff, volunteers and anyone else your work affects.
3. At the threshold, record the significant findings, and adopt a written policy and give it to every employee.
4. With no employees, check whether the charity controls premises (section 4). A written assessment is evidence of reasonable care either way.
5. Put health and safety on the board’s agenda and minute it. Neglect is the route to personal liability.
6. Brief whoever handles accidents on the different reporting rules for volunteers.

Next: buy the insurance you need. The first employee brings compulsory employers’ liability cover as well as these duties.

Common mistake: reading “criminal-law-backed” as meaning “a fine”

No penalty is usually stated. So trustees assume the worst is money. In England and Wales and in Scotland, failing the section 2 or 3 duty is an offence under section 33(1)(a) of HSWA. It can be tried in either court, with prison on either route.

In England and Wales the lower-court fine has been unlimited since 12 March 2015. Breaching the risk assessment regulation is an offence under section 33(1)(c), with the same penalties.

Common mistake: assuming only “the charity” can be prosecuted, never a trustee

Health and safety is delegated to a manager. The board assumes incorporation shields it.

HSWA section 37(1) applies in England and Wales and in Scotland. It makes an officer guilty of the body’s offence if it was committed with their consent or connivance. The same applies if the offence was down to their neglect. Section 37(2) extends this to members who manage the body.

In an unincorporated charity, the trustees are the employer and are directly liable. Either way the exposure is personal.

Common mistake: concluding that below the threshold you need not assess risk at all

People merge two thresholds at the same number into one rule about small employers. Both are about writing things down.

The duty to assess has no threshold and covers people who are not employees. The duty binds every employer. A charity with no employees has no regulation 3(1) duty. It may still have a section 4 duty if it controls premises such as a hall, and it still owes the common-law duty of care.

Common mistake: counting volunteers towards the threshold — or assuming no duty is owed to them

The thresholds count employees only. But with at least one employee, HSWA section 3 covers volunteers in England, Wales and Scotland. HSE says to protect them as you would employees doing similar work. With no employees, the common-law duty of care still applies.

Common mistake: holding the policy statement on file without giving it to anyone

In England and Wales and in Scotland, HSWA section 2(3) sets the rule. The employer must bring the statement, and any revision, to the notice of all employees. The duty is to communicate it.

Common mistake: applying the employee injury-reporting rules to volunteers

A volunteer incident is reportable only if it arose from a work-related activity. It also has to have caused a death or a direct trip from the scene to hospital. The longer-absence category is for employees only.

Common mistake: assuming Scotland has its own law and Northern Ireland follows Great Britain

It is the reverse. Scotland uses the same Act, with a different prosecutor. But its lower court has a lower maximum penalty. Northern Ireland has its own Order and its own regulator, HSENI.

Worked example

Two charities ask what they have to write down.

Wrenfield Village Hall is an unincorporated association run entirely by volunteers, in England. It has no employees, so the 1999 Regulations do not apply to it. But the committee controls the hall. HSE’s guidance on halls says that whoever has control should take reasonable measures to make the hall, access to it and any equipment provided safe for the people using it, so far as is reasonably practicable.

But the hall still owes everyone who uses it the common-law duty of care. The committee writes a short risk assessment of the hall and its events anyway. If someone is hurt, the assessment is the evidence that the charity took reasonable care.

If Wrenfield ever takes on a caretaker, the trustees become the employer themselves. The employer’s duties then become theirs as well.

Tollgate Youth CIO has one employee and a rota of volunteers. HSWA now applies, and in England section 3 covers the volunteers and the young people. It must assess the risks.

Its headcount is below both writing-down thresholds. So recording the assessment and having a written policy are not yet legal duties.

It writes the assessment down anyway. It also diarises a written policy for when it reaches 5 employees.

Tollgate is a CIO, which is a body corporate. So its trustees can be personally liable under HSWA section 37 in England if an offence is down to their neglect. That is why health and safety goes on the board’s agenda, and the minute records it.

If Tollgate were in Northern Ireland, the same thresholds would apply under the 1978 Order and the 2000 Regulations. HSENI would be the regulator.