A Simple Safety Management System for Small Businesses

Published 22 October 2026 · gribit

Staff member testing a fire alarm call point

A simple safety management system is a routine you actually follow: decide what needs checking, do the checks, record the results, and fix what fails. For a shop, pub, salon, office or village hall, that usually means one organised logbook and a handful of habits, not a certified formal system. Below we set out what the law expects, how to build the routine around the HSE’s Plan, Do, Check, Act cycle, and how to keep your safety certificates somewhere you can find them on the day an inspector asks.

Gribit

Keep Safety Checks and Records Together

Gribit helps small businesses record recurring safety checks, manage follow-ups, and store certificates and documents in one digital logbook.

Explore the digital logbook

TL;DR

You are not legally required to run a formal management system if your business is small or low risk. You still have to manage risks and be able to show it.
Build the routine around Plan, Do, Check, Act: a policy and risk assessment, controls in place, regular checks, and a record of what you fixed.
The weak spot in most records is the “Act” stage. A logbook full of passes and no recorded faults or fixes looks unconvincing.
Keep certificates and check records together, with a named person responsible for each task and reminders so nothing lapses.
Gribit is a digital logbook for exactly this job, at £49 per site per year.

What a safety management system means for a small business

The phrase sounds heavy. In large organisations it describes a documented framework of policies, procedures, audits and training, often certified to a standard such as ISO 45001. In a small business it means something far more modest: the way you organise yourself so that risks are found, controlled and kept under control.

The HSE is clear that you’re not required by law to implement a formal management system, though one can give structure. If your business is small or low risk, you can usually meet your duties with a practical, proportionate approach. Its wider guidance adds that health and safety management is an ongoing process, not a one-off task: it isn’t enough to control risks once, you have to make sure they stay controlled.

So the useful question is not “do we have a system?” but “could we show, today, that our fire alarm is tested, our first-aid kit is stocked, our equipment is maintained, and that when something failed we put it right?” A simple system is whatever lets you answer yes without a scramble.

What a safety management system means for a small business — overview diagram

The four stages: Plan, Do, Check, Act

The HSE’s Plan, Do, Check, Act guidance encourages a common-sense, proportionate approach, and it maps neatly onto a small site. Here is how each stage looks in practice.

Plan: decide what matters

Write a short health and safety policy and carry out your risk assessments. For most small premises that means a general risk assessment and a fire risk assessment. Then turn them into a list of recurring tasks: what gets checked, how often, and by whom.

A typical list for a pub, salon or village hall might include:

weekly fire alarm test
emergency lighting and fire extinguisher checks
first-aid kit contents and expiry dates
fire exits and escape routes kept clear
electrical and gas appliance servicing
equipment maintenance and inspection

Do: put the controls in place

Controls are the real work: extinguishers fitted, exits unobstructed, equipment suitable and maintained, staff shown what to do. The HSE’s guidance on providing and using work equipment safely is a good reminder that equipment must be suitable for its purpose and kept in a condition that is safe to use.

Protective equipment belongs here too. If your risk assessment calls for hi-vis, gloves or other PPE, a supplier such as workwear and PPE specialists in Birmingham can kit out a team, and the fact that you issued it and when is worth a line in your records.

Check: test that controls still work

This is where recurring checks live. The HSE explains that the purpose of an inspection of work equipment is to find whether it can be operated, adjusted and maintained safely, with any deterioration detected and remedied before it causes a risk. Not all equipment needs a formal inspection, so your risk assessment should decide which does.

Checks only count if they happen on schedule and leave a trace: date, what was checked, result, who did it.

Act: fix it and write down that you did

When a check fails, you need to correct the fault, and just as importantly, record that you did. A broken call point, an expired first-aid item or a blocked exit should produce an entry that says what was wrong, who was told, what was done and when it was resolved.

This is the stage most often missed. A log that shows nothing but passes can raise more questions than it answers, because real premises have faults. Evidence that you found one and fixed it is what shows the system working.

What the law expects you to record

No single law says “keep a logbook”. Instead, several duties imply records, and a logbook is the easiest way to meet them together.

Fire safety

If you are the responsible person for non-domestic premises in England and Wales, you must carry out and regularly review a fire risk assessment and, where there are five or more people or a licence applies, keep a written record of it. The government’s fire safety responsibilities guidance also covers keeping a record of your fire safety arrangements and of the maintenance of equipment such as alarms and emergency lighting. Scotland and Northern Ireland have their own fire safety legislation, so check the rules for your nation.

Fire services publish templates too. Avon Fire and Rescue’s fire safety log book for commercial premises says that keeping a record of checks, tests and maintenance can show due diligence and compliance with the Fire Safety Order 2005.

One detail catches people out: false alarms. The government guidance points to the duty to identify the cause of unwanted fire signals, so they belong in your record along with the cause and what you did about them.

Gas

If you let property, gas safety records have their own rules. The HSE says a gas safety check record must include details such as the appliance and its location, the date of the check, the engineer’s name and registration number, and any defect found and remedial action taken. Landlords must keep these records for at least two years. That is a good example of why certificates and the follow-up actions should sit together.

Staff names and personal data

Check records often name the person who did the test. That is personal data about your staff. The government’s guidance on keeping staff records says to keep them secure, whether that means locked filing cabinets or passwords on computer records, and to hold them only as long as you have a clear business need. In practice: limit who can see the log and decide how long you keep old entries.

Where paper logbooks and spreadsheets break down

A paper logbook is a perfectly legitimate record. The trouble is what happens around it.

Nobody is reminded. The weekly test depends on someone remembering. When the person who always does it is off, the gap appears in the book weeks later.
Certificates scatter. The fire alarm service report is in a drawer, the gas certificate is in an email, the electrical report is with the previous manager.
Handover loses knowledge. A new manager inherits a ring binder and no idea what is due next.
Faults vanish. A failed check is scribbled in a margin, and nobody knows whether it was ever resolved.
Access is all or nothing. Either everyone can see everything, or only whoever holds the folder.

Spreadsheets solve some of this but add their own problems: versions multiply, nobody owns them, and they don’t nudge anyone when a task is overdue.

Storing safety certificates so you can find them

Many owners search for ways to organise compliance certificates because the real pain is retrieval, not creation. A few rules make any storage method work, paper or digital.

One home. Pick a single place for every certificate and service report: fire alarm, emergency lighting, extinguisher service, gas safety, electrical, and anything else your risk assessments rely on.
Name them consistently. Item, site, date. “Fire alarm service, High Street, March” beats “scan0042”.
Link the certificate to the check. The service report is evidence for a line in your log. Store them side by side.
Note the next due date. A certificate with no renewal date is a future lapse.
Keep the remedial work with it. If a certificate listed defects, record how and when each was fixed.
Control access. Staff who run the checks need to see the tasks. They don’t all need to see everything.
Keep a copy outside the building. Paper in a damp back office is a risk of its own.

If your premises are multi-occupied, note that the government’s guidance on fire safety includes duties for responsible persons to share information and cooperate with each other, so a record you can export or share quickly is useful.

Setting up a simple system in one week

You can do this in a few short sessions rather than a project.

Day 1: list your sites and your duties. For each site, write down the checks your fire and general risk assessments call for. If you don’t have current assessments, that is the first job.
Day 2: set frequencies. Weekly, monthly, quarterly, annual. Follow the manufacturer’s and your assessor’s advice rather than guessing.
Day 3: name an owner for each task. Most routine checks can be done by a trained, experienced employee, not an external consultant. HSE guidance on who counts as competent stresses having the knowledge and experience to spot a fault and know what to do about it. The pitfall is not writing down their training and responsibilities, so do.
Day 4: gather the certificates. Collect every current certificate and report, note expiry or next-service dates, and store them in your one home.
Day 5: run the first round of checks and record them. Include anything that fails, with the action and the date it was closed.
Then, once a month: ten minutes to look at what is overdue, what is open, and what is due soon.

Involve the people doing the checks. The HSE stresses consulting workers throughout the cycle, because people who understand why a check matters report problems more honestly. Wider workplace culture matters too: this guide to psychological safety exercises for managers is useful if you want staff to feel comfortable raising concerns.

Common mistakes to avoid

Treating paperwork as the goal. The HSE’s view is that paperwork on its own is not a good performance measure. What matters is that controls are in place and maintained.
Logging only passes. Real checks find real faults. Record them and their resolution.
Overbuilding. A system so elaborate that nobody uses it is worse than a simple one that is followed.
Ignoring handover. When a manager leaves, the knowledge of what is due and why should stay in the system, not in their head.
Forgetting the review. Plan, Do, Check, Act is a loop. Revisit your assessments after an incident, a refit or a change of layout.

Our view: keep it small enough to survive a busy Friday

We built Gribit around one observation: small businesses rarely fail at safety because they don’t care. They fail because the checks depend on one person’s memory and a binder in the back office. When that person is off sick or the pub is flat out on a Friday night, the record has a hole in it.

Our view: keep it small enough to survive a busy Friday — overview diagram

So our view of a simple safety management system is deliberately plain. Know what needs checking. Make each task someone’s job. Remind them. Record the result on the spot. When something fails, keep the follow-up in the same place until it is closed. Keep the certificates next to the checks they support. If a new manager can open the record and understand what is due within ten minutes, the system works.

We would rather you spent your time fixing a faulty call point than hunting for the paperwork that proves you tested it last month.

— Jon

Where Gribit fits

Gribit is a digital logbook for small sites such as shops, pubs, offices, salons and village halls. You schedule recurring checks like fire alarm tests and first-aid kit inspections, record results, track follow-up actions, and store certificates and supporting documents in the same place. You can assign staff access, set automated reminders, manage checks by site, item or location, and export your records when someone asks to see them.

The site logbook annual plan costs £49 per year per site. You can start a logbook for your site at Gribit and move your current checks and certificates across in an afternoon.

FAQ

Do I legally need a safety management system?

No formal system is required by law for a small or low-risk business, according to the HSE. You do still have legal duties to assess and control risks, and in most workplaces to keep fire safety records. A simple, documented routine is the proportionate way to meet them.

What are the main parts of a simple safety management system?

Four stages in a loop: plan (policy and risk assessments), do (put controls in place), check (regular inspections and tests) and act (fix faults and review). For a small site, the logbook that records the checks and the follow-up is the working core of it.

How should I store gas, fire and other safety certificates?

Keep them in one place, named consistently by item, site and date, with the next due date noted and any remedial work attached. For landlords, the HSE says gas safety records must be kept for at least two years. Digital storage with limited access also helps you keep staff data secure.

Who can carry out routine safety checks?

For most routine checks, a trained employee with enough experience to recognise a fault and know what to do next can do the job, rather than an external consultant. Record their training and exactly which checks they are responsible for. Specialist work, such as gas appliances, needs a suitably registered engineer.