Management of Health and Safety at Work Regulations 1999

The Management of Health and Safety at Work Regulations 1999 (often called the “Management Regulations”) are the central operational regulations under the Health and Safety at Work etc. Act 1974. They turn the Act’s broad general duties into specific, practical requirements that apply to almost every workplace in Great Britain. If HSWA 1974 says what you must achieve, the Management Regulations say how — above all, through risk assessment.

This page is not legal advice. For specific compliance questions, consult a qualified health and safety advisor or lawyer.

What the Management Regulations cover

The Management Regulations are broad. The main areas relevant to most small and medium businesses are:

Risk assessment (regulation 3)

Every employer must carry out a suitable and sufficient assessment of the risks to the health and safety of:

its employees while they are at work, and
other people (contractors, visitors, members of the public) affected by the work.

A risk assessment is “suitable and sufficient” when it identifies the significant hazards, evaluates the risk from each, and shows you have considered everyone who might be harmed and what controls are needed. Employers with five or more employees must record the significant findings of the assessment. The assessment must be reviewed if it is no longer valid — for example after an incident, when work changes, or when there is reason to believe it is out of date.

SteadyOn support: The Hazard Register directly maps to this duty. Each hazard record captures the identified hazard, who might be harmed, a risk assessment (likelihood × consequence), the control measures in place, and a review date. The BRAG status flags when a review is overdue — which is exactly the “keep it valid” obligation in regulation 3.

The principles of prevention (regulation 4)

Where risks cannot simply be eliminated, the employer must apply the general principles of prevention set out in Schedule 1. In summary, you should, in order of preference:

Avoid the risk altogether
Evaluate risks that cannot be avoided
Combat risks at source
Adapt the work to the individual
Adapt to technical progress
Replace the dangerous with the non-dangerous or less dangerous
Develop a coherent overall prevention policy
Give collective protective measures priority over individual (personal) measures
Give appropriate instructions to workers

This is the legal expression of the familiar hierarchy of controls — eliminate first, fall back to personal protective equipment only as a last resort.

SteadyOn support: When you record control measures against a hazard, work through the hierarchy from the top. The risk matrix lets you record the residual risk after controls, so you can see whether the controls you have chosen have done enough.

Health surveillance (regulation 6)

Where the risk assessment shows that workers are exposed to identifiable health risks for which there are valid monitoring techniques (for example, hearing tests for noise exposure, lung-function testing for certain dusts), the employer must provide appropriate health surveillance.

SteadyOn support: Health surveillance regimes themselves run outside SteadyOn (through an occupational-health provider), but you can record the need for surveillance against the relevant hazard, store the programme details in the Documents module, and use the Inspections module to schedule recurring review points.

Competent persons (regulation 7)

Every employer must appoint one or more competent persons to help it comply with its health and safety duties. A person is competent where they have sufficient training, experience, knowledge, or other qualities to do the job. Where in-house competence exists, it must be preferred to external help.

SteadyOn support: Track the competence of your appointed person(s) using the Roles, People, and Training modules — define a Role, attach the relevant qualifications as a course Requirement, and enrol the person so their certification is monitored and its expiry flagged by the enrollment BRAG.

Emergency procedures (regulations 8 and 9)

Employers must establish procedures to be followed in the event of serious and imminent danger (such as fire), nominate enough competent persons to implement evacuation, and ensure necessary contacts with external emergency services are arranged — particularly for first aid, emergency medical care, and rescue work.

SteadyOn support: Store your emergency procedures in the Documents module, track the people nominated to act through Roles + People + Training, and schedule and record drills in Inspections. See UK Fire Safety for the related fire-specific duties.

Other duties

The Management Regulations also require employers to provide employees with comprehensible information on the risks and the preventive measures (regulation 10), to cooperate and coordinate where workplaces are shared (regulation 11), and to give particular consideration to new and expectant mothers and young workers in the risk assessment (regulations 16–19).

SteadyOn support: Record any group-specific risks (for example, risks to new or expectant mothers) as their own hazard entries with tailored controls, and store information and briefings in the Documents module.

Documentation requirements

The most important record under these Regulations is the significant findings of your risk assessment (required if you employ five or more people). Documented records are your evidence of compliance more generally. Key things to record in SteadyOn:

Requirement	Where to record in SteadyOn
Identified hazards and risk assessments	Hazards
Control measures for each hazard	Hazards — Control measures field
Review and revalidation of assessments	Hazards — Review date + Log tab
Emergency procedures (the document itself)	Documents
Competent-person appointments and competence	Roles + People + Training
Health surveillance arrangements	Documents + Inspections (review schedule)

Relationship to HSWA 1974

The Management Regulations are made under HSWA 1974 and must be read alongside it. The Act sets the duty; these Regulations specify how to discharge it — chiefly by requiring the risk-assessment process that underpins everything else. Where the Regulations are silent, the Act’s general duty (“so far as is reasonably practicable”) still applies, and the relevant Approved Codes of Practice and HSE guidance show how to comply.

See Health and Safety at Work etc. Act 1974 and the UK Regulatory Framework for the broader picture.