How to Set Up a Workplace Health and Safety Programme

Why do workplace safety programmes fail?

Most small and mid-size companies have a safety policy somewhere. Fewer have a programme: habits that find hazards, fix them and prove it. The International Labour Organization estimated in its November 2023 report, A Call for Safer and Healthier Working Environments, that nearly three million workers die each year from work-related accidents and diseases, about 330,000 of them from accidents, and that around 395 million suffer non-fatal work injuries.

Three failures account for most of the gap. Paper: risk assessments written once to satisfy a customer or an auditor, filed and never read. Blame: the first question after an incident is who did it, so people stop reporting and management believes things are fine until they are not. Invisibility: leaders say safety matters and never go to the floor, never ask about it in the weekly meeting and never fund the fix.

A programme that works starts with a leader who is seen, runs as a loop every week, keeps one list of actions, and treats a rising number of near-miss reports as success. This guide walks through the eight steps in the order you build them.

What are the eight steps of a safety programme?

Regulators and standards describe the same shape in different words. ISO 45001, the international standard for occupational health and safety management systems published in 2018, is built on the plan-do-check-act cycle. OSHA's Recommended Practices for Safety and Health Programs in the United States list seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, programme evaluation and improvement, and coordination with contractors and staffing agencies. The UK Health and Safety Executive gives a five-step method for managing risk: identify hazards, assess the risks, control the risks, record your findings and review the controls.

In plain words, the job breaks into eight steps that you can run as a loop.

How do you get leadership commitment for safety?

Ask for three things that cost nothing. First, the most senior person reads and signs a one-page policy in plain words, so it is theirs and not a consultant's. Second, they walk the floor with you for thirty minutes every fortnight and ask people what worries them. Third, safety is the first item on the weekly management meeting, every week, even when there is nothing to report.

Then name the roles: a safety lead, a deputy, first aiders and fire wardens by shift, area owners who do the weekly inspections, and a committee. In a company of 10 to 50 people the committee may be three people meeting for half an hour a month. In a company of 120 it might be six, including two elected floor representatives. Publish the minutes on a notice board within three days. Many countries require worker representatives or a committee above a certain headcount, so check your regulator.

How do you identify hazards in a workplace?

Walk, do not imagine. Take at least three people, including one who does the work, and cover every area and every shift, including the yard, the roof access and the chemical store. Use category prompts so whole families of risk are not missed: moving vehicles and pedestrians; manual handling and ergonomics; slips, trips and falls; work at height; machinery and guarding; electricity; chemicals and dust; noise and vibration; fire and exits; heat and cold; lone working; violence; fatigue; housekeeping; and whatever your business adds, such as sharps in a clinic or allergens in a kitchen.

Give every hazard a reference number and a photo, and do not fix anything during the walk or you will lose the list. Type everything into a hazard register the same day: area, activity, hazard, who could be harmed and how, existing controls, planned controls, and a rating before and after.

• At least three people walk, one of whom does the work
• Every area and shift is covered
• Each hazard gets a reference and a photo
• Nothing is fixed on the walk; it is listed
• The register is updated the same day

How do you do a risk assessment with a matrix?

For each hazard, judge two things: how likely harm is, and how serious it would be, each on a scale of 1 to 5. Write what each number means in your own words with examples from your site, so two supervisors scoring the same hazard get the same answer. Multiply the two numbers and group the result into bands: for example Low up to 4, Medium 5 to 9, High 10 to 15 and Extreme 16 to 25, with action timelines of 90, 30, 7 and 1 day. Set the bands once and leave them alone; a matrix that moves is worthless.

A forklift and pedestrian hazard in a shared dock doorway might score likelihood 4 and severity 5, rating 20, Extreme, act within a day. The one-day action can be temporary (a supervisor at the door) while the permanent controls (a separate pedestrian door, a painted walkway, barriers, a mirror) take three weeks and bring the residual rating to 10.

Write review triggers on every assessment: the annual cycle, plus any new machine, substance or shift pattern, any incident involving the task, a change in the law, or a worker telling you the procedure does not work. The HSE notes that UK employers with five or more employees must record their significant findings; most regulators expect something similar.

What is the hierarchy of controls?

The hierarchy of controls, described by NIOSH in the United States and used worldwide, ranks controls from most to least effective: eliminate the hazard; substitute something less hazardous; engineer the hazard away from people with guards, barriers, ventilation and interlocks; use administrative controls such as procedures, permits, training and rotation; and finally personal protective equipment. The further down the list, the more the control depends on a person doing the right thing every time, and people are tired, distracted and new.

Weak programmes live at the bottom of the hierarchy because signs, training and PPE are cheap and quick. Strong programmes push every High and Extreme hazard as far up as the budget allows and treat PPE as what is left over. Record the level you chose for every action, and walk the control with the operators before you sign it off, because a guard that makes a machine awkward to clear will be removed.

How do you train and induct people so it sticks?

Induct every new starter before work begins, not at the end of the first week: the policy in five minutes, site rules, the emergency plan and assembly point, how to report a hazard or near miss and the promise that reporting is welcomed, the hazards of their area and the controls, their PPE with a fitting, and a walk to the first-aid box, exits and eye-wash station. Contractors get a shorter induction with a different emphasis: your rules on their site, the permit system, where they may go and what they must hand over before they start. Visitors get five minutes and an escort.

Then keep a training matrix: people down the side, required training across the top, dates in the cells, a refresher cycle in months and a flag for anything expired or due. It shows at a glance who was never inducted and which role has no one qualified, such as a night shift with no trained first aider. Ten-minute toolbox talks on one topic, with a signed record, count as refreshers and keep the programme visible.

How should you inspect, and what do you do with the findings?

Inspect in layers. Daily, two to five minutes by the operator: pre-use checks of vehicles and machines, exits clear, housekeeping. Weekly, twenty minutes by the area owner against a checklist of the controls in the risk assessments. Monthly, an hour by the safety lead with a committee member, covering the whole site and the records. Quarterly or annually, the specialist checks the law or the manufacturer requires, such as electrical testing, lifting equipment and racking.

Every finding that needs more than a two-minute fix becomes a row on one action tracker, the same list that holds the controls from risk assessments, the actions from incidents and the decisions of the committee. Each action has an owner, a due date from the band, a status, an overdue flag and a verifier who is not the owner. If the tracker is up to date, the programme is alive.

How do you handle incidents and near misses without blame?

Make reporting easy and safe: a near-miss card and a box where people pass, a form on a phone, a supervisor who says thank you, a written rule that honest reporting is never punished, and a board that shows what was reported and what was done. When reports go up after a launch, that is the programme working.

Investigate anything with lost time, medical treatment, a dangerous occurrence or a near miss that could have been serious. Care for the person and secure the scene. Write the timeline before you think about causes, interviewing people separately and soon. Then immediate causes, then root causes by asking why five times or drawing a fishbone diagram, credited to Kaoru Ishikawa, with branches for people, equipment, materials, methods, environment and management. Root causes are nearly always about design, maintenance, procedures, training, supervision or pressure. Write one action per root cause, pushed up the hierarchy, and share the lesson without a name.

Most countries require certain incidents to be reported to a regulator within a fixed time, from hours to days, and the thresholds differ. Decide on the day of the incident, from the current rules for your country and, if in doubt, a call to the regulator or a qualified safety professional.

Which safety KPIs should a small company track?

Lagging indicators count harm that has already happened: injuries, days lost and the lost time injury frequency rate, which is lost-time injuries per million hours worked (or per 200,000 hours in the US convention). Report them, with their limits stated: in a 120-person company one injury can double the rate, and a target that punishes reporting drives injuries underground. Never attach bonuses to a falling injury rate.

Manage with leading indicators you control: inspections completed, actions closed on time, near-miss reports, training current, drills and toolbox talks on schedule, leadership walks done. Put six numbers on one page every month. Twice a year, ask people anonymously whether they would report a near miss, whether actions get closed and whether they could stop a job; the answers are a culture measure the committee can act on. Once a year, have someone who did not build the programme audit it against the loop, and hold a management review that sets next year's targets and budget.

AI assistants now help with drafting checklists, talks and first-pass procedures, with spotting patterns in anonymised incident descriptions and with rehearsing an investigation interview. They do not rate a risk, close an action, decide what is reportable or sign a permit; a named person does, and can explain why. To measure where you and your supervisors start, the AssessAll Frontline Safety Leadership Judgment assessment is a sensible first week, and a Jobulary development plan turns the gaps it finds into a year of training. If you want every step above as a ready file, the Workplace Safety Programme Kit from Bodhih Training packs the workbook, forms, policy, procedures, message library and calendar into one download.