Health and safety is the policy trustees most often assume must be more complicated than it is. If your charity runs a food bank, a village hall, a youth club or an office of three people, you do not need a fifty-page manual, a consultant or a laminated poster culture. You need a short, honest document that says who is responsible for what and how you actually keep people safe — and for many small charities, even the writing down is optional.
Here is the direct answer. A written health and safety policy is legally required once your charity has five or more employees — section 2(3) of the Health and Safety at Work etc. Act 1974. Volunteers, however many you have, do not count towards that five. But the underlying duties are not optional at any size: they apply to every employer from the first employee, and volunteers are owed a legal duty of care under section 3 of the same Act even though they never trigger the writing-down requirement.
A charity health and safety policy is a written statement of the charity's commitment to keeping staff, volunteers, beneficiaries and visitors safe, naming who is responsible for health and safety at each level and setting out the practical arrangements — risk assessments, training, first aid, fire precautions and accident reporting — by which that commitment is delivered. This guide covers exactly when the law requires one, what a good policy for a small England and Wales charity contains section by section, and how to adopt it properly at board level. If you are still assembling your wider policy set, start with our pillar guide to what policies your charity needs.
Is a health and safety policy legally required for a charity?
Unusually among charity policies, this one is driven by statute rather than by Charity Commission expectation. Health and safety does not even appear among the thirteen policies the Annual Return asks charities about — because Parliament got there first, in 1974, and the requirement attaches to you as an employer, not as a charity.
The precise legal position:
- Every employer, from the first employee, has duties under the Health and Safety at Work etc. Act 1974 — including section 2 (protect the health, safety and welfare of employees so far as is reasonably practicable) and section 3 (protect people who are not your employees but are affected by what you do: volunteers, beneficiaries, visitors, the public).
- Section 2(3) requires every employer to prepare a written statement of its general health and safety policy, together with the organisation and arrangements for carrying it out, to bring it to employees' attention, and to revise it as often as appropriate. An exception made under the Act (the Employers' Health and Safety Policy Statements (Exception) Regulations 1975) relieves employers with fewer than five employees of the duty to put it in writing — the policy must still exist in substance, it just needn't be a document.
- Risk assessment is a separate legal duty under the Management of Health and Safety at Work Regulations 1999, again applying from the first employee. HSE's guidance is plain: if you employ five or more people, "you must record your significant findings" — the hazards, who might be harmed and how, and what you are doing to control the risks. Two duties, two documents: the policy says how you manage safety; the risk assessments show you doing it.
The Health and Safety Executive publishes a free policy template and worked example under the Open Government Licence. It is deliberately short and it is the authoritative starting point — its only drawbacks for charities are that it is PDF-only and written for businesses, so trustees, volunteers and events do not appear. Our Word template below follows HSE's structure and fills those gaps.
What if the charity has volunteers but no employees?
Be honest with yourself here, because the position is genuinely different. HSE's guidance for organisations that involve volunteers confirms that if your charity has no employees at all, the statutory duties under the 1974 Act generally do not apply to it. There is no legal requirement to have a health and safety policy, written or otherwise.
That is not the end of the matter, though. A volunteer-only charity still owes a civil duty of care to its volunteers and to anyone affected by its activities — if someone is hurt through the charity's negligence, the charity (and in an unincorporated charity, potentially the trustees personally) can be sued. Public liability insurers commonly expect to see risk assessments and a basic safety policy, and many funders and venues ask for one before they will let you operate. So the practical advice for volunteer-run charities is: adopt a short policy anyway, treat it as evidence of the care you already take, and do not pretend a statutory duty exists where it does not. The moment you take on your first employee, the statutory duties switch on; at the fifth, the writing-down requirement does too.
Do volunteers count towards the five employees?
No — and this is the single most-asked question, so it deserves its own answer. The section 2(3) written-policy threshold counts employees only. A charity with three paid staff and eighty volunteers is below the threshold and has no statutory duty to write its policy down (though with a workforce of that size, only writing it down makes sense).
What volunteers lose in the counting, they gain in protection. Once a charity has at least one employee, HSE is explicit that its duties extend to volunteers: you should provide the same level of protection to volunteers as to employees where they carry out similar activities and face the same risks, and your risk assessments must include volunteers as well as staff. In other words, volunteers never trigger the paperwork, but they are always owed the care. A policy that mentions volunteers nowhere is a policy written for a different organisation.
What your charity health and safety policy should include
HSE's template uses a three-part structure — statement of intent, responsibilities, arrangements — and there is no reason for a charity to depart from it. Here is the anatomy, tuned for a small charity in England and Wales.
1. Statement of general policy (signed and dated)
Three or four sentences committing the charity to preventing accidents and ill health, providing safe premises, equipment and activities, giving people the information and training they need, and consulting staff and volunteers on matters affecting their safety. It should be signed and dated by the chair or chief executive — a signature turns a document into a commitment, and HSE's template provides for one; the most senior person should own it.
2. Organisation and responsibilities
Say plainly that the trustee board holds ultimate responsibility for health and safety — because it does, and policies that bury this fact serve no one. Then name the person with day-to-day responsibility (a chief officer, centre manager or nominated trustee), and list specific duties held by others: who does risk assessments, who checks the first aid kit, who acts as fire warden, who inducts new volunteers. Use role titles with the current holder's name alongside, so the policy survives personnel changes. Finally, note what everyone is responsible for: taking reasonable care of themselves and others, cooperating with the arrangements, and reporting hazards.
3. Arrangements
The longest part, and the part that makes the policy yours rather than a downloaded ornament. Cover each of these in a few sentences apiece, deleting anything that genuinely doesn't apply:
- Risk assessments — who carries them out, when (before new activities and events, and reviewed annually), and where they are kept. If you have five or more employees, state that significant findings are recorded in writing, as the Management of Health and Safety at Work Regulations 1999 require. This dovetails with your wider risk management policy, which covers strategic as well as physical risks.
- Induction and training — every new employee and volunteer gets a safety induction before they start: the hazards of their role, emergency procedures, who to report concerns to. Record that it happened.
- First aid — the Health and Safety (First-Aid) Regulations 1981 require employers to provide adequate and appropriate equipment, facilities and people so employees can get immediate attention, based on a first-aid needs assessment. The Regulations technically cover employees only, but HSE strongly recommends providing for volunteers and the public too — for a charity it would be hard to justify ignoring. Name where kits are kept and who your first aiders are.
- Fire safety — for any premises the charity controls, the Regulatory Reform (Fire Safety) Order 2005 makes a "responsible person" (usually the employer or whoever controls the premises) carry out a fire risk assessment, keep a written record of it, maintain escape routes and alarms, plan for emergencies and train staff. If you hire a hall, say who checks exits and tells attendees the evacuation procedure at each session.
- Accidents, incidents and RIDDOR — all accidents and near misses go in an accident book and are reviewed for lessons. Certain events must be reported to HSE under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR): deaths, specified injuries to workers, injuries keeping a worker off normal duties for more than seven days, certain occupational diseases and dangerous occurrences — and injuries to non-workers, including volunteers, that result in them being taken directly to hospital for treatment. Serious harm to people connected with the charity may also be a serious incident to report to the Charity Commission — one event can require both reports.
- Lone working — if anyone works or volunteers alone (home visits, sole shop cover, locking up), say how they check in and what happens if they don't.
- Volunteers and events — state that volunteers receive the same protection as employees in comparable roles, that risk assessments cover them, and that one-off events (fetes, collections, sponsored walks) each get their own short risk assessment. Cross-refer to your volunteer policy for recruitment and supervision.
- Premises and equipment — who inspects the building, tests portable electrical equipment, and maintains anything with moving parts. Hiring charities should note what the hire agreement makes the landlord responsible for.
- Driving on charity business — licence, insurance (business use or volunteer extension) and roadworthiness checks for anyone driving for the charity, including in their own car.
Close the policy with a review clause: reviewed at least annually by the board, and sooner on any significant change.
Download our free charity health and safety policy template (Word) — openly licensed, written for small charities in England and Wales, and yours to adapt with no sign-up.
Adopting the policy properly
A health and safety policy adopted by email thread is a liability waiting for its moment. Do it in four visible steps. First, tailor the template: delete arrangements that don't apply, insert real names and real locations, and read it once asking "do we actually do this?" — a policy describing imaginary practice is worse than none, because it proves you knew what good looked like. Second, put it to the board for a decision recorded in the minutes, with the date and the version adopted. Third, have the chair or CEO sign and date the statement of intent. Fourth, give it an owner and a review date, and bring it to the attention of every employee — that last step is itself part of the section 2(3) duty — and every volunteer. Trustee Meetings keeps policies, owners and review dates alongside your agendas and minutes and resurfaces each one when it falls due, so adoption and review leave a clean paper trail — free to try, no card needed.
Common mistakes charities make
- Counting volunteers towards the five — and concluding a written policy is required when it isn't, or (worse, in reverse) assuming volunteers are outside health and safety law entirely. They don't count for the threshold; they absolutely count for the duty of care.
- Confusing the policy with risk assessments. Trustees sometimes file one glossy policy and believe the job done. The 1999 Regulations impose a separate, ongoing duty to assess risks — the policy without the assessments is a promise without the performance.
- Borrowing a business policy wholesale. A policy that never mentions trustees, volunteers or events, and names a "Managing Director," tells an inspector or insurer that nobody read it.
- Naming people who left. If your fire warden resigned in 2023, your policy is out of date in the way most visible to a tribunal. Use roles, and keep the name list current.
- No signature and no date. An unsigned, undated policy cannot show it was in force when an incident happened — which is precisely when you need it to.
- Treating hired premises as someone else's problem. The hall's owner has duties, but so does the charity running the session. Know which side of the line each precaution sits on.
If your current policy trips over more than one of these, the quickest fix is to start afresh from our free health and safety policy template and tailor it in time for the next board meeting.
Review cadence — and what triggers an early one
Review the policy annually at board level, even if the outcome is "no change" minuted in a single line. Trigger an early review whenever the facts shift: taking on your first employee (statutory duties begin), reaching five employees (the written policy and written risk-assessment findings both become mandatory), new premises or activities, an accident, near miss or RIDDOR report, a change in the people named, or new HSE guidance affecting your work. Pair each review with a glance at your risk assessments — they age faster than the policy does. A standing item on the annual planner, with the policy's owner and review date tracked in Trustee Meetings, means the review happens because the system remembers, not because someone happens to.
Health and safety rarely stands alone in a charity's governance. If you are building out the full set, our guides to the charity risk management policy and charity safeguarding policy cover the policies that share borders with this one, our guide to how often trustees should meet will help you find room for the annual review in the board calendar, and our guide to the charity trustee action log will help you make sure the actions each review generates actually get done.