Health and Safety Policy | Sprintlaw Australia

If you own or run a business, health and safety can feel deceptively simple until something goes wrong. A common mistake is assuming the HR manager, site supervisor or office manager is “in charge” of work health and safety, so the directors do not need to stay involved. Another is copying a generic policy, filing it away and treating the document itself as compliance. A third is forgetting that contractors, remote staff, shared workspaces and visiting clients can all create safety duties too.

The legal position in Australia is more direct than many founders expect. Responsibility for a business’s health and safety policy does not sit with one person alone, and you cannot sign it away just by appointing a manager. The business itself has primary duties, while directors, officers, managers, workers and others may each have their own obligations. This guide explains who is legally responsible for your business's health and safety policy, how those responsibilities work in practice, when the issue usually comes up, and what small businesses should fix before a regulator, customer or employee forces the issue.

Overview

In Australia, your business usually carries the primary legal duty to manage work health and safety, but directors and other officers also have personal due diligence obligations. A health and safety policy helps show how your business plans to manage risks, yet the legal responsibility goes beyond drafting a document and includes real systems, consultation, training and review.

The business entity, often called the PCBU, usually has the main WHS duty.
Directors and officers cannot step back completely, even if a manager handles day to day safety.
Workers also have duties to take reasonable care and follow lawful safety instructions.
Your policy should match the actual risks in your workplace, not just a template.
Responsibility often becomes urgent before you hire staff, sign a lease, engage contractors, open a worksite or investigate an incident.

What Who Is Legally Responsible for Your Business S Health and Safety Policy Means For Australian Businesses

The short answer is that your business is legally responsible for putting effective work health and safety measures in place, and the people who run the business may also have personal obligations to make sure that happens.

Across most of Australia, work health and safety laws place the main duty on the person conducting a business or undertaking, often shortened to PCBU. A PCBU can be a company, sole trader, partnership or other business structure. This means the legal responsibility starts with the business itself, not just the person who physically writes the policy.

A health and safety policy is usually one part of a broader WHS system. It sets out your commitment, roles, reporting lines and how risks will be managed. On its own, though, it does not satisfy your legal duties if the business does not actually identify hazards, train workers, maintain safe systems of work and respond to incidents.

What Is The PCBU Responsible For?

The PCBU must, so far as is reasonably practicable, ensure the health and safety of workers and others affected by the work. That can include employees, contractors, labour hire workers, volunteers, customers, visitors and members of the public, depending on the business.

In practical terms, the business usually needs to address matters such as:

safe premises and work environment
safe plant, equipment and systems of work
training, supervision and information for workers
incident reporting and response procedures
consultation with workers about safety matters
monitoring conditions and reviewing controls where needed

Your health and safety policy should support those steps. It should not be the only safety document you have.

What About Directors And Officers?

Directors and officers are not expected to do every safety task personally, but they do have due diligence obligations. That means they must take reasonable steps to understand the business’s WHS risks, make sure resources are available, and verify that safety processes actually work.

This is where founders often get caught. A director may say, “I left that to operations,” but the law generally expects more than delegation. If your business has warehouses, vehicles, heavy equipment, client visits, work from home arrangements or contractor teams, officers should be asking real questions and checking that the answers are documented.

Reasonable due diligence often includes:

keeping up to date with WHS issues relevant to the business
understanding the key operational hazards
ensuring there are processes for identifying and controlling risks
making sure incidents, complaints and near misses are reported upwards
checking that workers receive training and supervision
reviewing whether the policy and procedures still fit the business as it grows

Can You Make One Manager Solely Responsible?

No, not in the sense of removing everyone else’s duties. You can appoint a manager, safety officer or HR lead to administer the policy and coordinate compliance, and for many SMEs that is sensible. But the appointment does not eliminate the primary duty of the business or the due diligence duties of directors and officers.

The better approach is to allocate day to day responsibilities clearly while keeping governance responsibility at the right level. Your policy should name who handles reporting, training, consultation and record keeping, but it should also show how senior decision-makers oversee the system.

Do Workers Have Responsibilities Too?

Yes. Workers generally must take reasonable care for their own health and safety and avoid adversely affecting others. They also need to comply with reasonable instructions and cooperate with workplace policies and procedures.

That matters because a health and safety policy is not just a management document. It should be introduced properly, acknowledged by staff where appropriate, and backed by training, inductions and practical reporting channels.

Does Location Matter Across Australia?

Yes, but the core answer stays similar. Most jurisdictions follow harmonised WHS laws, while Victoria and Western Australia have some differences in legislation and terminology. The overall position remains that the business has primary responsibilities and officers or equivalent decision-makers may have additional personal duties.

If you operate in more than one state, use one national policy only if it genuinely fits each site and legal setting. A single generic document can miss local consultation rules, incident processes or site-specific hazards.

When This Issue Comes Up

The question of who is legally responsible for your business's health and safety policy usually comes up when the business is changing, growing or under pressure.

For many startups, safety obligations get attention only once they hire their first employee or move into a commercial space. That is often too late. WHS issues should be considered before you sign a commercial lease, before you engage regular contractors and before you spend money on setup that may create safety risks later.

Hiring Staff For The First Time

Once you bring on employees, your safety obligations become more visible. You need more than an employment contract and workplace policies dealing with conduct or leave. You should also think about whether the work environment is safe, whether the role involves manual handling, driving, client visits, equipment use or remote work, and how incidents will be reported.

Founders often assume a small team means low risk. But common office and service business issues include:

ergonomic injuries from poor workstation setup
psychosocial risks such as workload, bullying or unclear reporting lines
vehicle use for deliveries or client meetings
slips, trips and electrical hazards in shared premises
work from home arrangements with no documented expectations

Signing A Commercial Lease

A new premises can shift safety responsibility in ways that business owners miss. The lease may allocate repair, maintenance, access or fitout obligations between landlord and tenant, but those arrangements do not automatically remove WHS duties owed by the business to workers and visitors.

Before you sign, check how the site will actually be used. A cheap warehouse, studio or shopfront can create hidden safety costs if ventilation, storage, emergency exits or access controls are not suitable.

Using Contractors, Labour Hire Or Shared Workspaces

Responsibility becomes more complicated when multiple businesses share control over the same site or task. You may need to consult, cooperate and coordinate activities with others who also owe duties.

This comes up in situations such as:

a startup engaging IT installers, cleaners or tradespeople at its office
a retail business operating in a shopping centre
a company using labour hire staff on site
a business with staff working from a co-working space
a founder using subcontractors for deliveries, field work or events

The main risk is assuming someone else’s policy covers your business entirely. Shared responsibility does not mean no responsibility.

Expanding Online Or Into New Services

Even businesses that mainly sell online can have WHS exposure. Packing orders, handling returns, storing stock, using home garages as dispatch points and sending staff to events all create practical safety questions. If your business model changes, your policy and procedures should change too.

This is also where legal issues overlap. A growing business may be reviewing contracts, privacy processes, staff onboarding, trade mark protection and business structure at the same time. WHS should not be treated as an afterthought while everything else is being formalised.

After An Incident, Complaint Or Near Miss

If someone is injured, raises a concern or reports a near miss, responsibility becomes a live issue very quickly. Regulators and insurers often look beyond the policy document and ask what actually happened in practice. They may want to see records of training, risk assessments, maintenance, consultation and supervision.

A common problem is scrambling to create paperwork after the event. That rarely helps. The better position is to have clear processes in place before an incident occurs, then review and update them when something goes wrong.

Practical Steps And Common Mistakes

The best way to manage legal responsibility is to match your health and safety policy to the reality of your business, assign responsibilities clearly, and keep evidence that the system works.

1. Identify Who Holds Which Role

Start with your business structure. Is the PCBU a company, sole trader or partnership? Who are the directors or officers? Who manages daily operations? Which workers supervise others?

Write down the internal allocation of responsibilities, including:

who approves the policy
who conducts inductions and training
who receives incident reports
who investigates hazards and complaints
who updates the policy and when
who reports safety issues to directors or leadership

This avoids the classic SME problem where everyone assumes someone else is handling safety.

2. Make The Policy Specific To Your Workplace

A policy should reflect your actual operations. A design agency with hybrid staff will need a different approach from a café, logistics business or manufacturing startup. Regulators can tell when a policy has been copied from another industry and never adapted.

Your policy might address matters such as:

the nature of your work and sites
key physical and psychosocial risks
consultation processes with workers
contractor management
remote and flexible work arrangements
incident, hazard and near miss reporting
emergency contacts and escalation pathways

3. Support The Policy With Other Documents

A standalone policy is rarely enough. Depending on your business, you may also need induction materials, risk assessments, safe work procedures, training records, contractor terms, incident forms and internal reporting processes.

For SMEs, the point is not to create unnecessary paperwork. The point is to have documents that support how the business actually operates.

4. Train People And Keep Records

A policy no one has read is weak evidence of compliance. Staff should know where the policy sits, what it means for their role, and who to speak to when something goes wrong. Managers should understand what they are expected to do with reports or concerns.

Keep records of:

staff inductions and refresher training
policy acknowledgements where appropriate
hazard reports and corrective actions
consultation meetings or communications
maintenance and safety checks
reviews after incidents or operational changes

Good records also help if you are selling the business, seeking investment or responding to insurer questions during due diligence.

5. Review The Policy When The Business Changes

A health and safety policy should not stay frozen while the business grows. New premises, new equipment, interstate expansion, changed staff numbers or a shift to online fulfilment can all make an old policy inaccurate.

Review points commonly include:

hiring your first employee
moving into or out of premises
using vehicles or delivery services differently
starting to use contractors regularly
launching a warehouse, workshop or retail site
experiencing an incident, complaint or regulator enquiry

Common Mistakes Businesses Make

The most common mistakes are delegation without oversight, generic policies, poor record keeping and forgetting that health and safety includes psychosocial as well as physical risks.

Other mistakes include:

assuming the landlord is responsible for everything at the premises
treating contractors as outside the safety system
ignoring work from home hazards because staff are offsite
failing to consult workers on issues that affect them
not aligning employment contracts and contractor agreements with actual safety processes
waiting until after an incident to decide who is in charge

For growing businesses, this area also connects with broader legal housekeeping. Employment contracts, contractor agreements, workplace policies, commercial leases and service agreements should all fit the way the business manages operational risk. If they conflict, confusion follows quickly when an incident is reported.

FAQs

Is the business owner always personally liable for health and safety?

Not always in the same way, but owners who are also directors or officers may have personal due diligence obligations. The business entity usually carries the primary duty, and the people who control it may also need to show they took reasonable steps to ensure compliance.

Can I appoint a health and safety officer and transfer the legal responsibility?

No. You can appoint someone to manage the process, but that does not remove the business’s primary duty or the oversight duties of directors and officers. Delegation helps with administration, not legal escape.

Do small office businesses need a health and safety policy?

Often yes. Even low-risk workplaces can face ergonomic issues, psychosocial hazards, electrical risks, visitor safety concerns and work from home problems. The policy can be proportionate to the business, but it should still reflect real risks.

Does a work from home team change who is responsible?

No, the core responsibility still sits with the business as far as reasonably practicable. Remote work changes the type of risks you need to manage, such as workstation setup, reporting channels, mental health pressures and equipment use.

Is a template policy enough for compliance?

Usually not on its own. A template can be a starting point, but it needs to be tailored to your operations and supported by actual training, consultation, reporting and risk controls.

Key Takeaways

In Australia, the business itself usually has the primary legal duty for work health and safety, including putting effective safety systems in place.
Directors and officers may have personal due diligence obligations and cannot rely on delegation alone.
A health and safety policy is important, but it must reflect the real risks of the business and be backed by action, training and records.
Workers also have duties to take reasonable care and follow lawful safety instructions.
Responsibility often becomes critical before you sign a lease, hire staff, engage contractors, expand operations or respond to an incident.
Generic policies, unclear internal responsibility and poor record keeping are some of the most common compliance gaps for SMEs.

If your business is dealing with who is legally responsible for your business s health and safety policy and wants help with workplace policies, employment contracts, contractor agreements, commercial lease reviews, you can reach us on 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.

Official Sources to Check

Rules and regulator guidance can change. Check the current official material most relevant to this issue before relying on the article:

Who Is Legally Responsible for Your Business's Health and Safety Policy?