5+ Staff: Health and Safety File Contents for UK Small Sites

Published 04 October 2026 · gribit

Manager filing small-site safety records

Your health and safety file should hold six core record types: fire risk findings, risk assessments, maintenance certificates, first-aid and incident logs, training records and your health and safety policy. You must keep written records once you have a sizeable workforce or hold a licensed premises or have an alterations notice in force, under Gov. A digital logbook keeps all of this centralised, with dates, owners and reminders attached to each record.

TL;DR:

Fire risk assessments, significant findings, and emergency plans should be up-to-date and stored with proof of tests and contractor details.

Risk assessments must be documented, reviewed regularly, and linked to actions taken, especially if employing five or more people or holding a license.

Digital logbooks should include metadata, tags, and a clear audit trail to enable quick retrieval and verification of records.

Service certificates and maintenance logs need to be filed against specific equipment and should be readily accessible for inspections or emergencies.

Recurring checks like fire alarm tests and extinguisher servicing must follow manufacturer guidance, with recorded evidence from competent professionals.

Gribit

Keep Safety Records In One Place

Gribit helps small businesses record recurring checks, manage follow-ups, and securely store certificates and documents in one digital logbook.

✓Fire alarm test records
✓First-aid kit inspection records
✓Follow-up actions
✓Certificates and safety documents

Visit Gribit

What to store for each record type

Building a usable file means being specific about what each category contains, not just naming it. Treat this as an audit checklist, whether you are tidying an existing file or starting from scratch.

Fire: the latest fire risk assessment, its significant findings, your emergency evacuation plan, alarm test logs, and extinguisher service certificates with contractor details.
Risk assessments: dated documents covering each significant hazard, the findings, the actions taken, who reviewed them and when the next review is due.
Maintenance and testing: PAT records, emergency lighting test results, and boiler or HVAC service certificates with dates and the engineer’s name.
First aid and incidents: first-aid box check logs, an incident record for each event (date, injury, treatment given, signature) and notes on anything reported under RIDDOR.
Training records: course name, provider, attendees, completion date and the date a refresher falls due.
Policies and contact lists: your signed health and safety policy where one is required, emergency contact numbers and contractor details.

Attachments tie the whole thing together: scanned certificates, manufacturer instructions and test reports sit against the record they support, rather than in a separate drawer nobody checks.

What UK law actually requires you to keep

Not every record carries the same legal weight, and knowing which ones are statutory helps you prioritise when time is short. The duty to write down the significant findings of your fire risk assessment applies specifically when you employ five or more people, when your premises are licensed, or when an alterations notice is in force, according to GOV.UK. Below that threshold it remains good practice, but it stops being a legal obligation.

RIDDOR sets out which injuries, diseases and dangerous occurrences must be reported, and your incident log should note when something has been reported this way, as described in HSE first-aid guidance. The same guidance recommends keeping a central accident book for anything a first-aider attends to, even when RIDDOR itself does not apply.

Employers must provide first-aid provision based on a needs assessment, and a central incident record is recommended practice rather than optional paperwork, per HSE.

A few points worth holding onto:

Service certificates for fire equipment and other competent-person work are your evidence that maintenance actually happened, not just that it was scheduled.
Records need to be accessible and held securely enough to produce on request, whether that request comes from an inspector or your insurer.
A written health and safety policy becomes a legal requirement once you have a certain number of employees, and remains useful practice below that line.

How to build a digital logbook: a practical schema

Moving a paper file into a digital system works best when you follow a consistent structure rather than scanning documents at random. A workable schema runs from site, to category, to item, to record, to certificate or attachment, so a search for “fire” or “PAT” surfaces everything relevant in one place.

Capture the right metadata on every entry: date performed, inspector or contractor name, next due date, evidence attachment, current status and the person responsible for any follow-up action.
Tag records for fast retrieval, using consistent terms such as “fire”, “PAT”, “training” or a year, so staff can find a certificate without knowing which folder it sits in.
Keep an audit trail: automated timestamps and user identification on every entry give an inspector confidence that records were not edited after the fact, a point HSE guidance on equipment inspection notes is not a format requirement but a practical advantage of digital records.
Migrate in batches: scan your key certificates first, note where the original paper copy is stored until everything is digitised, and work through the rest as time allows.

A digital logbook built around this structure removes the guesswork of which folder a certificate lives in.

Pro Tip: Start your migration with whichever certificates you’d need fastest in an emergency, fire and first-aid records first, then work backwards through the rest.

Scheduling recurring checks: realistic frequencies

Most small sites run a mix of daily, weekly and periodic checks, and the right interval depends on how hard the equipment works rather than a single rule for everyone. Useful starting points include a daily visual safety walk, a weekly first-aid box check, monthly visual PAT inspections, quarterly servicing where equipment demands it, and annual full-service certificates for fire alarms and extinguishers.

Set intervals using manufacturer guidance, how intensively equipment is used, and any pattern of past failures, since HSE guidance on PAT testing confirms there is no fixed legal interval and choices should be risk-based.
Group related checks into a single round so one person can work through fire, first aid and equipment in one pass rather than three separate visits.
Log every failed check as an action with a named owner and a due date, not just a note that something needs attention.
Extinguisher servicing and fire alarm maintenance typically require a contractor certificate as evidence, so flag these for attachment rather than a simple tick.

Who is responsible, and what to record about them

Three terms come up repeatedly in health and safety guidance, and your file should name who holds each role on your site. The responsible person carries overall duty for fire safety, the competent person carries out technical servicing or assessments, and the appointed person manages first aid or evacuation on the day. HSE guidance treats the competent person role as flexible: an owner or manager can fill it, provided they have the skills, time and authority to act.

Record training certificates, in-house briefing notes and manufacturer instructions as your evidence of competence.
Log toolbox talks and staff briefings with date, attendees and topic, so consultation is documented rather than assumed.
Restrict access to personnel records to those who need them, in line with basic data protection practice.

Contractor and visitor records within the file

A health and safety file that only covers your own staff misses a common source of incidents: contractors and visitors working on site. When a contractor services your fire alarm, tests your extinguishers or carries out electrical work, their certificate belongs in the same file as your own maintenance records, filed against the equipment it covers rather than kept separately.

Before a contractor starts work, it helps to record what they have been told about site hazards, evacuation routes and any permit-to-work arrangements, along with evidence of their own competence, such as a trade certification or public liability insurance reference. This matters most for higher-risk work like electrical testing or working at height, where your own risk assessment should note what the contractor is responsible for and what remains yours.

Visitor records matter less for routine footfall and more for anyone working unsupervised or during an evacuation. A simple sign-in log with date, time and purpose of visit is usually enough for a shop, pub or office, while sites with vulnerable occupants, such as a village hall hosting events, may need a fuller record of who was briefed on fire exits.

Keeping these records inside the same digital system as your own checks means an inspector sees one coherent file rather than having to ask where contractor paperwork is kept, and it means a lapsed contractor certificate shows up alongside your own overdue items rather than getting lost in an inbox.

Connected contractor visitor safety records

Records that make your site safer, not just inspection-ready

Records that make your site safer, not just inspection-ready — overview diagram

Health and safety records exist to stop harm, not to survive a visit. HSE’s own Plan, Do, Check, Act framework treats monitoring and follow-up as the active part of the job, not paperwork tacked on afterwards. The small businesses that struggle are usually the ones with a missed refresher date or an action logged but never closed.

Automating the reminders and the chasing frees you to spend the saved time on the fix itself, not the filing.

— Jon

A compact digital logbook built for this exact structure

We built our site logbook plan to match the structure in this guide: schedule your recurring checks, store certificates against the item they cover, track follow-up actions with an owner and due date, and keep an audit trail an inspector can review in minutes. The subscription details are available on the website.

Gribit

If you are ready to move your file off paper, you can set up your first site on the Gribit site logbook plan today.

FAQ

What records must a small business keep for health and safety?

You must keep a written record of significant fire risk assessment findings if you employ five or more people, hold licensed premises or have an alterations notice in force, under GOV.UK guidance. Below that threshold, keeping risk assessments, maintenance certificates and training records remains good practice rather than a strict legal duty.

Do I need a written health and safety policy?

A written policy becomes a legal requirement once you employ five or more people, and it should set out who does what, when and how, according to HSE guidance. Fewer than five employees still benefits from a written policy even though it is not mandatory.

How often should I test fire alarms and extinguishers?

There is no single fixed interval for every site: servicing frequency should follow manufacturer guidance and how the equipment is used, with annual certificates being typical for extinguishers and alarms. Each service should produce a certificate from a competent person that gets filed against that specific piece of equipment.

What counts as a reportable incident under RIDDOR?

RIDDOR covers specific categories of injury, occupational disease and dangerous occurrence, and your incident log should note when an event has been reported this way, per HSE first-aid guidance. Not every incident recorded in your accident book meets the RIDDOR threshold, so the two records serve different purposes.

Can I keep my health and safety file digitally instead of on paper?

Yes, there is no legal requirement for a particular format, only that records are secure and accessible when needed, as noted in HSE guidance on inspection. A digital system such as our site logbook adds an automated audit trail that a paper file cannot easily match.