Multi-site health and safety management: what a partner does

Multi-site health and safety management means meeting one employer's duties at every site you run. Head office sets the policy, the standards and the checks once. Each site holds what depends on its own building and the work done there: risk assessments that fit it, a fire risk assessment, evacuation arrangements, first aid and its records. A health and safety partner adds a competent person who audits every site to the same standard and keeps the findings in one place. The legal duties stay with you as the employer.

Who is responsible for health and safety at each site?

The employer is, at every site. Section 2 of the Health and Safety at Work etc. Act 1974 requires every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all its employees, and section 2(2)(d) of the 1974 Act reaches any place of work under the employer's control. Where a group trades through one company, that company is the employer, so a branch, a depot and a store share one set of duties. The 1974 Act and the regulations made under it apply in England, Wales and Scotland.

Site managers carry the tasks your policy gives them. Section 2(3) of the 1974 Act requires a written statement of your policy and of "the organisation and arrangements for the time being in force for carrying out that policy". HSE's guidance asks the policy to list the names, positions and roles of the people with specific responsibility, which in a group means naming who holds each task at each site. Directors are exposed personally as well. Under section 37 of the 1974 Act, where an offence by the company is committed with a director's consent or connivance, or is attributable to their neglect, the director is guilty of it too.

The headcount thresholds count the employer's whole workforce. Regulation 2 of the Employers' Health and Safety Policy Statements (Exception) Regulations 1975 excuses an undertaking employing fewer than five employees from writing its policy down. Regulations 3(6) and 5(2) of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999) require your significant risk assessment findings and your arrangements to be recorded "where the employer employs five or more employees". So a three-person branch of a 200-person company has its findings recorded.

A site in Northern Ireland comes under the Health and Safety at Work (Northern Ireland) Order 1978 and the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, which set the same core duties and are enforced by HSENI and the district councils. A group policy can include that site, with its assessments made against that law.

What should multi-site health and safety management set centrally, and what stays local?

Set once whatever is the same everywhere. Hold at each site whatever changes with the building or the work done there. HSE's warning about example risk assessments applies to a group template as well: copying one and putting your company name on it "would not satisfy the law".

Duty	Set once for the group	Held at each site
Health and safety policy, section 2(3) of the 1974 Act	The statement of intent, signed by your most senior person, and the arrangements	The names and roles of the people responsible at that site
Risk assessment, regulation 3 of MHSWR 1999	Assessments for activities every site runs the same way	A check that each one fits the site's layout, people and equipment, and an assessment of anything only that site does
Fire risk assessment, article 9 of the Regulatory Reform (Fire Safety) Order 2005, in England and Wales	The format and the standard	An assessment of the premises
Emergency procedures, regulation 8 of MHSWR 1999	The group procedure	The site's own version, with enough competent people nominated to run an evacuation
First aid, regulation 3 of the Health and Safety (First-Aid) Regulations 1981	How each site's needs are assessed	Equipment and first-aiders adequate and appropriate for that site
Training, section 2(2)(c) of the 1974 Act	What each role needs	The record of who has had it
Competent person, regulation 7 of MHSWR 1999	The appointment, with enough time and means for every site	A route to them when the site needs advice
Monitoring and review, regulation 5 of MHSWR 1999	The audit standard and timetable	Routine checks of the workplace between audits

The fire row is the clearest site-level duty. In England and Wales, the government's guidance tells the responsible person, the employer for a workplace, to carry out a fire risk assessment of the premises and review it regularly, and Scotland's own fire safety legislation sets an equivalent duty for each workplace.

Some duties sit with the site whatever head office decides. HSE's guidance on first aid says what counts as adequate and appropriate "depends on the work you do and where you do it", and suggests considering how close your sites are to emergency medical services. Where a site is shared with another employer, such as a concession inside another business's store, regulation 11 of MHSWR 1999 requires each of you to co-operate and take all reasonable steps to co-ordinate your measures and share information about the risks.

One record can be central. Regulation 12 of the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR 2013) lets you keep its record of reportable incidents, diseases and over-three-day injuries at the place where the work is done or at your usual place of business, so a single group record can meet it.

How do you know every site is compliant?

Regulation 5 of MHSWR 1999 requires arrangements for the "effective planning, organisation, control, monitoring and review" of your preventive and protective measures. Across several sites, the evidence comes from three places:

• checks made at each site by the people who run it, between audits
• audits of every site against one standard, so the results sit side by side
• incident data: accidents, near misses, RIDDOR reports and sickness absence

HSE's Managing for health and safety (HSG65) notes that reactive monitoring, such as investigating accidents and tracking sickness absence, can also identify better practices that may be transferred to other parts of a business, which is the point of comparing sites. It suggests that someone independent, perhaps from another business area, could add value to a review. In a group, that could be one site manager auditing another's site, or an outside consultant. HSG65 warns that "'paperwork' on its own is not a good performance measure", so each audit includes walking the site.

When the same finding turns up at several branches, the fix belongs in the group procedure. When one site trails the others, the fix belongs at that site. HSE's leaflet for directors and boards, INDG417, asks the board to review health and safety performance at least once a year and to make sure periodic audits of the effectiveness of its management structures and risk controls are carried out. A health and safety audit of each site against the same standard, with every gap given a priority, an owner and a timeline, is where that review starts.

Compliance Cloud, Opus's compliance platform, can be bought on its own. Its site snapshot shows each site's open incidents, audit actions, overdue training and outstanding checks, and it benchmarks sites on time to assign and resolve actions.

What does a health and safety partner do for a multi-site operator?

A partner adds competence, and the time to use it at every site. Regulation 7 of MHSWR 1999 requires you to appoint one or more competent persons to assist you, and an outside consultancy can hold that appointment on its own or alongside your own staff. Regulation 7(3) of MHSWR 1999 then requires their number, time and means to be adequate having regard to the size of the business, the risks, and "the distribution of those risks throughout the undertaking". One manager covering two neighbouring sites may be stretched by ten across the country, and that spread is part of the legal test.

The partner reviews your group policy and shared risk assessments against the sites they cover, audits every site to the same standard, and writes specialist assessments when a site needs one, such as fire, COSHH or noise. They also support a site after an incident or during a visit from a regulator. With one consultant seeing every site, the differences between branches become visible.

On the Opus Safety Partnership, a named consultant works across your sites on the same Compliance Cloud platform you use, and the findings from each site audit become tracked tasks, so every site's actions sit in one place. The number of site visits is set in your contract. Opus was founded by former HSE and local authority regulators, the two bodies that enforce health and safety at shops, offices, warehouses and factories.

Appointing a partner moves the work, and the duties stay with you. Under regulation 21 of MHSWR 1999, the act or default of a competent person you appointed is no defence for you in criminal proceedings.

When do you not need a health and safety partner?

When someone inside the business has the competence and the time for every site. Regulation 7(8) of MHSWR 1999 requires a competent person in your own employment to be appointed in preference to one from outside. HSE's guidance says that managing health and safety is usually straightforward enough to do yourself with the help of your workers, and points to outside help where a business is large, complex or high risk, or lacks the competence in-house.

A group of four offices with a capable health and safety manager may need only a specialist assessment when one falls due. The case for a partner grows with the number of sites, the distance between them and the specialist risks they carry, which is the test in regulation 7(3) of MHSWR 1999 again. If you already employ a health and safety manager, outside support can extend what they cover without replacing them.

Frequently asked questions

What is multi-site health and safety management? Running one employer's health and safety duties across several premises: the policy, standards and audit programme set once for the group, and each site holding the assessments, emergency arrangements and records that depend on its own building and work.

Does each site need its own risk assessment? Each site's risks have to be assessed under regulation 3 of MHSWR 1999. A shared assessment can cover an activity that runs the same way at several sites, if each site checks it against its own layout and adds what only it does. The fire risk assessment is made for each premises.

Do the five-employee thresholds apply per site? They apply to the employer's whole workforce. A company with five or more employees records its significant findings and arrangements under regulations 3(6) and 5(2) of MHSWR 1999 and writes down its policy, covering a branch with two staff as much as head office.

Who enforces health and safety at each of our sites? It depends on the main activity at each premises. Shops, offices, catering and warehouses storing goods for retail or wholesale distribution are enforced by the local authority for the area, and factories and anything else off the local authority list by HSE. Fire safety is enforced by the fire and rescue service. A group of sites can deal with several of each.

Can one local authority advise on all our sites? Yes, through Primary Authority, for the law local regulators enforce. A business can form a legal partnership with one local authority, whose advice on environmental health, trading standards or fire safety regulation other local regulators must respect. It does not bind HSE, so health and safety at a site HSE enforces sits outside it. The Office for Product Safety and Standards runs the scheme.

Does a health and safety partner take on our legal responsibility? No. The duties under the Health and Safety at Work etc. Act 1974 stay with the employer, and under regulation 21 of MHSWR 1999 a competent person's act or default gives you no defence. The partner assesses, audits and advises, and you act on what they find.