Safety Document Management for Small UK Businesses

Good safety document management means three things: you know which records the law expects you to keep, you can find them in under a minute, and the recurring checks behind them actually happen on time. For a shop, pub, salon, office or village hall, that usually comes down to a fire risk assessment, a log of routine checks, certificates from contractors, and a short list of who is allowed to see what.

This guide covers what to keep, how long to keep it, and a simple system that works without a safety department.

TL;DR

• Keep a written fire risk assessment, risk assessments for your other hazards, and a dated record of the routine checks that show those controls are working.
• Since 1 October 2023, every Responsible Person must record their full fire risk assessment findings, whatever the size of the business.
• Retention differs by record type: health surveillance records can need 40 years under COSHH, while most check logs need a sensible, written rule rather than “forever”.
• The HSE warns against paperwork for its own sake. Short, current, findable records beat a big folder nobody opens.
• A single digital logbook per site, with reminders and shared access, replaces scattered paper, spreadsheets and email attachments.

Table of Contents

• What counts as a safety document?
• What the law expects you to write down
• Paperwork is not safety
• Where small businesses usually go wrong
• A simple system that works
• Retention: how long should you keep things?
• Access and personal data
• Making sure the right person is on shift
• Our view: the record should chase you, not the other way round
• Paper, spreadsheet or digital logbook?
• Where Gribit fits
• FAQ
• Sources

What counts as a safety document?

People use “safety documents” to mean several different things. Separating them makes the whole job easier, because each type has its own rhythm.

Most small businesses are fine on the first row and weak on the second and fifth. The assessment sits in a drawer, but nobody can show that the alarm was tested every week for the past year, or that the broken fire door closer was fixed.

What the law expects you to write down

Fire safety

If you are the Responsible Person for premises, GOV.UK says you must carry out and regularly review a fire risk assessment, and that you must keep a written record of it.

The bar has risen. Following the Building Safety Act 2022, all Responsible Persons must record their full fire risk assessment, including all findings, and document their fire safety arrangements. The change took effect on 1 October 2023 and no longer depends on having five or more employees.

There is also a handover duty. When a Responsible Person leaves, they must pass on the relevant fire safety information to whoever takes over, so the record continues across the life of the building. That matters for a pub changing manager or a village hall committee changing treasurer every few years. If your records live in one person’s inbox or one person’s head, the handover fails.

General risk assessment

The Management of Health and Safety at Work Regulations require every employer to make a suitable and sufficient assessment of the risks to employees and others. Employers with five or more people must record the significant findings. Even below that threshold, a written assessment is the evidence you reach for after an incident or during an inspection, as a local authority policy on risk assessment also notes.

Health records

Where health surveillance applies, for example to workers exposed to certain substances, the HSE explains that employers must keep health records for the period set by regulation. For COSHH that period is 40 years. If no period is set, keep them at least for the duration of the person’s employment. Most shops, offices and salons will rarely meet this, but a salon handling chemicals should check whether it applies.

If you are unsure which of these apply to your premises, ask a competent fire risk assessor or your local fire and rescue service, or check the HSE guidance for your type of workplace.

Paperwork is not safety

It is easy to read the above and conclude that you need a mountain of documents. The HSE says the opposite. Its guidance, Managing for health and safety (HSG65), frames safety management as Plan, Do, Check, Act, and stresses leadership, behaviour and communication over a heavy documented system.

The practical reading for a small business:

• Write down what you need to control risks and prove you did it, and no more.
• Keep documents short and current. An out-of-date 40-page policy is worse than a clear one-pager.
• Treat the record as the proof of the check, not a substitute for it. A signed sheet means nothing if nobody walked the building.

Where small businesses usually go wrong

Records scattered across places. The fire alarm certificate is in an email, the extinguisher service sticker is on the wall, the test log is a clipboard by the back door and the risk assessment is on someone’s old laptop.

No due dates. Checks happen when someone remembers. Weekly alarm tests slip in busy periods, and the gap shows up only when you look for the record.

Faults found but not closed. A log that says “emergency light in the cellar not working” is only useful if the next entry says who fixed it and when. Follow-up is where most paper logbooks fail.

One person knows everything. When the manager leaves, the knowledge leaves too. This is exactly the handover problem the fire safety guidance describes.

Keeping everything for ever. This feels safe but is not. The ICO is clear that data protection is not about keeping records forever; it is about a defensible reason to keep each record and secure deletion once that reason has ended.

A simple system that works

You do not need specialist software to get this right, but you do need a routine. Here is a setup that fits most small sites.

1. List what you actually have. Walk the site and write down the fire alarm, emergency lighting, extinguishers, first-aid kits, fire doors, electrical equipment and any machinery. Each item with a recurring check is a line in your system.
2. Set a frequency for each check. Base it on your risk assessment and the servicing advice for the equipment, and write it down. Weekly alarm tests and monthly first-aid kit checks are common examples, but your own assessment decides.
3. Name an owner and a deputy. Every check needs one person responsible and one cover. This is what stops the system collapsing on holiday weeks.
4. Record the result on the day. Date, who did it, pass or fail, and a note. Not at the end of the month from memory.
5. Raise an action for every failure. Give it an owner and a due date, and close it with a note when fixed.
6. File the paperwork where the check lives. Attach the certificate or contractor report to the item it relates to, not to a general folder.
7. Set a retention rule. Decide how long each record type stays, write it in one page, and review it once a year.
8. Review access. Give people the access they need, and remove it when they change role or leave.

Retention: how long should you keep things?

There is no single answer, and anyone who offers one number for all records is guessing. What you can do is separate the categories:

• Fire risk assessment: keep the current version and your review history. The handover duty means the information should travel with the premises.
• Risk assessments: a local authority policy suggests keeping them at the site of origin for at least three years, though that is one organisation’s rule and requirements vary by regulation. Check your own sector guidance and insurer.
• Health surveillance records: set by regulation, 40 years for COSHH.
• Routine check logs: no universal statutory figure. Pick a period that lets you show a sustained pattern of checking, agree it with your insurer if you can, and write it down.
• Anything containing personal data: the ICO notes that data protection law sets no fixed time limits; you must be able to justify how long you keep it.

Insurers sometimes ask for longer than the law, so check your policy wording before deleting anything.

Access and personal data

Safety records often include names: who did the check, who was injured, who was trained. Under UK GDPR, that makes access control part of document management. The ICO’s records management guidance points to limiting access to authorised staff and reviewing those rights, especially when people change roles or leave.

In practice: a team member who ticks off the daily checks does not need to see the accident report. The manager and owner do. Shared passwords and a spreadsheet emailed around fail on both counts.

Making sure the right person is on shift

A check only happens if someone competent is there to do it. Rotas matter more than people expect: first-aid cover, a trained fire marshal at closing, a named opener who tests the alarm. Planning shifts and responsibilities together, as in this piece on staff scheduling and safer shifts, helps ensure the person assigned to a safety task is actually working that day.

Our view: the record should chase you, not the other way round

We built Gribit around one observation. Small business owners rarely lack the will to keep safety records. They lack the time, and a paper logbook does nothing when a check is overdue. It just sits there, blank.

So our approach is to make the recurring part automatic. You set up each check once, by site, item and location. Reminders go to the right person. The result is recorded in a few taps, any failure becomes a follow-up action, and the certificate or contractor report is attached to the same item. When the manager changes, the whole history is already there for the next person.

We also think the HSE has it right about paperwork. The point is not a bigger archive. It is spending your effort on fixing the faulty door closer instead of hunting for last March’s test sheet. A good record is a by-product of doing the checks, not a separate job.

If you take one thing from this guide, make it this: choose one place for safety records per site, and make sure every check in it has an owner and a date.

— Jon

Paper, spreadsheet or digital logbook?

Paper is fine for a tiny site with one diligent person. The trouble starts with more than one location, more than one person, or a change of manager.

Where Gribit fits

Gribit is a digital logbook for recurring safety checks such as fire alarm tests and first-aid kit inspections. You record results, manage follow-ups, store certificates and documents, assign staff access, automate reminders, export records and organise checks by site, item or location.

The plan is simple: the Site Logbook Annual Plan costs £49 per year per site. It suits shops, pubs, offices, salons and village halls, where the person responsible is also busy doing something else.

FAQ

Is a health and safety file a legal requirement?

There is no legal requirement for a single “H&S file” as such. There are duties to record specific things, such as your fire risk assessment and, for employers with five or more people, the significant findings of risk assessments. How you organise those records is up to you, as long as you can produce them.

How long should I keep fire alarm test records?

There is no universal statutory figure that we can point to. Keep them long enough to show a sustained pattern of testing, check what your insurer requires, and write your retention period down so it is a decision rather than an accident.

Do I need document management software for a small business?

No, but you do need a reliable routine. Paper or spreadsheets can work for one person at one site. Software starts to earn its place when several people share checks, you run more than one location, or you need reminders and a clean handover.

Who is the Responsible Person?

Under fire safety law it is generally the employer or the person in control of the premises, such as the owner, manager or, for a hall, the committee. If you are unsure who it is for your building, the GOV.UK fire risk assessment guidance is the place to start.

Sources

• Fire safety in the workplace: Fire risk assessments, GOV.UK
• Fire safety responsibilities under Section 156 of the Building Safety Act 2022, GOV.UK
• The Management of Health and Safety at Work Regulations 1992, regulation 3
• Risk assessment policy and procedures, Bromsgrove
• Health surveillance record keeping, HSE
• Managing for health and safety (HSG65), HSE
• Records management and security, ICO
• Data storage advice, ICO
• Event staff scheduling: safer shifts