Health and Safety Policy Template for NZ Businesses: What the Law Requires and What to Include

Search for a health and safety policy template and you will find hundreds of documents for sale, most of them written for other countries and many far longer than a small business needs. Before you download or buy anything, two things are worth knowing. First, what New Zealand law actually requires, because it is probably not what the template sellers imply. Second, what a useful policy really contains, because a good one for a ten-person business can be short, plain and written in your own words.

This guide works through both. It explains the duties under the Health and Safety at Work Act 2015 (HSWA) that a policy is meant to support, sets out the sections a sound policy covers, gives an original template structure you can adapt, and covers how detailed the document needs to be and how to keep it current.

Does NZ law require a written health and safety policy?

No. HSWA does not require a business to have a written health and safety policy document. The Act places duties on a business to manage risk in practice: identify hazards, eliminate risks where that is reasonably practicable, minimise the ones that cannot be eliminated, train and supervise people, and involve workers in decisions that affect them. None of those duties is satisfied by owning a document, and none names a policy as the way to comply.

Business.govt.nz, MBIE’s small business site, makes the same point in plain terms. Its health and safety guidance says a business does not necessarily need a formal process or policy in writing, and the most effective approach is the one that is practical for the owner and the team. What the law cares about is whether risks are actually being managed day to day.

So why write one at all? WorkSafe treats written health and safety documents as good practice and as part of how a business organises its system. It publishes guidance on writing health and safety documents, including policies, procedures, forms and records, with a short example policy included. The reasons to have one are practical rather than legalistic:

• It records who is responsible for what, so nothing depends on one person’s memory.
• It shows workers, in writing, how the business expects work to be done safely and what they can expect in return.
• It is evidence of a working system if WorkSafe asks questions after an incident, and clients, head contractors and insurers commonly ask for one before work starts.

Treat the policy as the cover page of your health and safety system, not the system itself. The procedures and records behind it are what make it true.

The duties a policy has to support

A policy is only worth writing if it reflects the real duties in HSWA, summarised here.

The PCBU and its primary duty of care

HSWA duties fall mainly on the PCBU, short for a person conducting a business or undertaking: a company, a partnership, a sole trader or another organisation. Section 36 gives the PCBU its primary duty of care: to ensure, so far as is reasonably practicable, the health and safety of its workers, and to make sure other people are not put at risk by the work.

WorkSafe’s introduction to HSWA explains what sits inside that broad duty: a work environment without risks to health and safety, safe plant and structures, safe systems of work, safe use, handling and storage of plant, structures and substances, adequate welfare facilities, and the information, training, instruction and supervision people need. It must also monitor workers’ health and workplace conditions.

“So far as is reasonably practicable” is the standard running through the Act (section 22). It means weighing how likely a risk is, how serious the harm could be, what is known about the risk and its controls, what measures are available and suitable, and whether their cost is grossly disproportionate to the risk. Section 30 applies the same logic to risk itself: eliminate risks so far as is reasonably practicable, and minimise the ones that cannot be eliminated. Your policy should be written around that sequence, because it is the logic WorkSafe will apply to your business.

Officers and due diligence

Directors, partners and others who exercise significant influence over the management of a business are officers under HSWA. Section 44 gives each officer a personal duty to exercise due diligence so the PCBU complies with its duties. In a small business the owner is usually an officer too, so this duty lands on the same desk.

WorkSafe describes due diligence as taking reasonable steps to keep health and safety knowledge up to date, understand the business’s operations and its hazards and risks, and ensure the business has appropriate resources and processes for eliminating or minimising risk and uses them. Officers also need processes for receiving and responding promptly to information about incidents, hazards and risks, and ways of verifying that compliance processes and resources are in place and working. A policy that names an owner, sets review dates and requires reporting up the line is one small part of evidencing that diligence.

Workers and other people

Workers have their own duties under section 45: take reasonable care for their own health and safety, take reasonable care that what they do or fail to do does not adversely affect others, cooperate with any reasonable health and safety policy or procedure notified to them, and comply, so far as reasonably able, with reasonable instructions from the PCBU. That cooperation duty matters: a policy only binds in practice if workers have been told about it, which is why induction and sign-off count. Visitors and customers have a similar duty of reasonable care under section 46.

Working with other businesses

Where more than one PCBU has duties for the same matter, section 34 requires them to consult, cooperate and coordinate with each other, so far as is reasonably practicable. This is the everyday situation for contractors on a client’s site, trades working alongside each other, and businesses sharing a building. Nobody can contract out of their HSWA duties, and a contractor management section is how small businesses record how they handle this one.

Worker engagement, representatives and committees

HSWA does not treat safety as something management does to workers. Part 3 requires every PCBU to engage with workers on health and safety matters that may directly affect them, so far as is reasonably practicable (section 58), and to have worker participation practices giving workers reasonable opportunities to participate effectively in improving health and safety on an ongoing basis (section 61). Engagement is expected at set points, including when hazards are identified, risks assessed, and control decisions made.

Two formal mechanisms sit inside that framework:

Health and safety representatives (HSRs). Any worker can ask the business for one or more HSRs to be elected for their work group. WorkSafe’s guidance is that the business must then initiate an election, started within two months of the request. Elections are informal: any agreed method works unless a secret ballot is requested, and candidates cannot run the election themselves. An HSR’s term is a maximum of three years, and they can be re-elected. The current law applies these rules to businesses of every size; there is no small-business exemption from an election request.

Health and safety committees (HSCs). If an HSR, or five or more workers, ask for a health and safety committee, the business must establish one. WorkSafe describes a committee’s job as helping the business and workers cooperate on health and safety, assisting with developing standards, rules, policies and procedures, and making recommendations. A committee must meet regularly and at least once every three months. If it recommends something, the business must either adopt it or give the committee written reasons for not doing so.

Smaller businesses often meet the engagement duties directly: regular toolbox talks, a standing item in team meetings, a simple way for anyone to raise a hazard. That is legitimate, provided it genuinely happens and people are told about decisions affecting them. Record the model in the policy, and keep HSR names and contact details where workers can find them, as WorkSafe expects.

What a good policy contains, section by section

WorkSafe’s guidance for small to medium business owners sets out the components a health and safety plan should have, and its example policy shows how short the top-level document can be. A complete policy usually covers the following ground. Some businesses keep all of it in one document; others keep the policy brief and hold detail in separate procedures the policy points to. Either structure works.

Commitment statement. A short opening, signed by the owner or chief executive, committing the business to keeping workers and others safe, to complying with HSWA and its regulations, and to improving over time. WorkSafe’s example policy rests on a simple shared commitment: everyone looks after their own safety and everyone else’s.

Responsibilities. Named responsibilities for the PCBU, for officers, for managers and supervisors, and for workers. WorkSafe’s example policy splits this into what everyone will do (follow safe ways of working, wear required protective equipment, report pain or discomfort, report accidents and near misses, work with the business on returning after injury) and what managers do for the PCBU (engage with workers, investigate incidents, keep records, maintain the system, check contractors have safe ways of working).

Hazard and risk management. How hazards are identified (walk-throughs, worker reports, past incidents, industry guidance), how risks are assessed, and the commitment to eliminate risks first and minimise what cannot be eliminated. This section usually points to a risk register, where the business’s actual hazards and controls are recorded.

Incident reporting and investigation. A requirement that all injuries, illnesses, near misses and hazards are reported promptly and recorded, in an accident register or equivalent. It covers investigating to find causes and prevent a repeat, and the legal steps for a notifiable event: notify WorkSafe as soon as possible, preserve the site until an inspector authorises otherwise (except to help an injured person, remove a deceased person or make the site safe), and keep records of the event for at least five years from the date the regulator was notified (sections 55 to 57). HSWA does not expressly require a PCBU to investigate a notifiable event, but WorkSafe describes investigation as good practice.

Worker engagement. How the business consults workers, the participation practices in place, and how HSR and committee requests are handled.

Training, supervision and induction. Inductions for every new worker, training records showing who has been trained for which tasks and risks, supervision for inexperienced workers, and any competency requirements for higher-risk work.

Emergency procedures. What to do in the emergencies that could realistically affect the workplace, including fires, medical events and natural disasters, plus first aid, evacuation procedures and regular drills.

Contractor management. How contractors are selected and checked, how overlapping duties are handled through consultation and coordination, site induction, and monitoring while work is under way.

Health monitoring and wellbeing. Where workers are exposed to hazards such as noise, dust, chemicals or vibration, how their health and exposure are monitored, and what the business does about work-related health risks such as fatigue and stress. Some businesses keep this in the policy; the Workplace Policy Builder discussed below covers health and wellbeing in a companion policy.

Monitoring, review and sign-off. How the business checks the system is working: regular reporting on injuries, incidents and new hazards, measurable goals, a scheduled review, and the signature and date block showing the policy is current and owned at the top.

A template structure you can adapt

The structure below is an original starting framework built to match the official guidance described above. It is not a legal document and is not copied from any published template. Replace the square-bracket placeholders, delete sections that do not apply to your work, and add the specific procedures your risks require. The example sentences show the tone and scope to aim for; rewrite them in your own words for your workplace.

1. Our commitment
Example: “[Business name] is committed to the health and safety of everyone who works for us and everyone affected by our work. We will comply with the Health and Safety at Work Act 2015 and keep improving how we manage risk.”

2. Who this policy covers
Example: “This policy applies to all our workers, including contractors and volunteers, at every site where we work, and to visitors and the public affected by our work.”

3. Responsibilities
Example: “The directors of [business name] will make sure we have the people, equipment and processes needed to work safely. Every worker will follow safe work procedures, use the protective equipment provided, and report hazards, injuries and near misses straight away.”

4. Identifying and managing risk
Example: “We identify hazards by inspecting our workplaces, listening to our workers and reviewing our incidents. We will eliminate risks where we reasonably can, and minimise the rest, recording our main hazards and controls in our risk register.”

5. Reporting and investigating incidents
Example: “All injuries, illnesses, near misses and hazards must be reported to [role] the day they happen and recorded in our accident register. We investigate to find causes and fix them. If an event is notifiable, we will notify WorkSafe as soon as possible, preserve the site, and keep the records for at least five years.”

6. Worker engagement and participation
Example: “We talk with our workers about health and safety through [toolbox meetings / team meetings] and act on what they raise. If a worker asks for a health and safety representative to be elected, we will start the election within two months. If a representative or five or more workers ask for a committee, we will establish one.”

7. Training, supervision and induction
Example: “No one starts a task until inducted, trained and, where needed, supervised by someone competent. We keep training records for every worker.”

8. Emergencies and first aid
Example: “Our emergency procedures are displayed at [location] and practised at least [frequency]. Trained first aiders and first aid kits are at every site.”

9. Working with contractors and other businesses
Example: “Before a contractor starts work for us, we check how they manage health and safety, agree responsibilities, and monitor the work. We consult, cooperate and coordinate with businesses whose work overlaps with ours.”

10. Health monitoring
Example: “Where our work exposes people to noise, dust, chemicals or similar risks, we monitor exposure and workers’ health, and act on the results.”

11. Review
Example: “We review this policy and our health and safety system at least once a year, and sooner after a serious incident or a significant change in our work. Signed: [name, role]. Date: [date]. Next review: [date].”

Free official help: the Workplace Policy Builder

You do not have to start from a blank page, or pay a template seller to start. Business.govt.nz offers a Workplace Policy Builder with pre-built workplace policies you pick from and customise. Its fair workplace guidance lists health, safety and wellbeing among the key policy areas a business is likely to need, and the builder’s health and wellbeing policy covers topics such as mental health, smoking and alcohol, and returning to work after illness or injury.

Understand the boundary, though. A wellbeing policy is a companion to a health and safety policy, not a substitute: it does not write your risk register, your contractor checks or your notifiable event process. Many small businesses use the builder for wellbeing and a short policy of their own, along the lines of the structure above, for the safety system itself. Business.govt.nz also points small businesses to its Compliance Matters tool for the rules applying to their industry and structure.

How detailed should it be? Matching the document to your risk

Proportionality is built into both the Act and the guidance. Business.govt.nz advises businesses to manage health and safety in proportion to the level of risk, and notes that plans and tools may be very simple or more complex depending on the risks involved.

A small, low-risk business, such as a professional services office or a small retailer with no hazardous plant, can usually run a policy of a few pages, a short risk register covering its real hazards (slips and trips, manual handling, fatigue and stress, emergency evacuation), and simple habits: an induction checklist, an accident register, regular team conversations about safety. What it cannot do is nothing. The duties apply in full; the paperwork scales.

Businesses doing higher-risk work need more, and their policies should say so. In construction, agriculture, manufacturing, forestry and similar sectors, risks can kill or seriously injure, and much of the work is covered by specific regulations under HSWA. WorkSafe publishes sector-specific guidance and approved codes of practice for this work, and a policy in these sectors normally sits on top of detailed procedures: safe work method statements, permit-to-work systems for tasks such as confined spaces or hot work, machinery guarding and lockout procedures, hazardous substances inventories and safety data sheets, and formal health monitoring. If your work involves asbestos, cranes, excavations, work at height or hazardous substances, your policy should name the procedures governing them rather than trying to contain them.

One sense check from WorkSafe’s writing guidance: test the document with the people who have to use it. If workers cannot understand it, or it does not match how work is actually done, rewrite it.

Keeping it alive: review, records and the 2027 changes

A policy with no review date is already drifting out of date. WorkSafe’s guide for small to medium business owners recommends reviewing the health and safety plan at least once a year, or sooner if a major safety-related event happens. Add the obvious triggers: a serious incident or near miss, new work, new plant or new premises, key people changing, the law changing. Keep version control simple: a version number, an approval signature, a date updated and a next review date on the document itself, the format WorkSafe’s own example documents use.

Keep the records the system depends on: the risk register, the accident register, investigation findings, training and induction records, health and exposure monitoring results, engagement meeting notes, and notifiable event records kept for at least five years. These records turn a policy from a statement of intent into evidence of a functioning system, and in a small business they are what due diligence is largely made of.

One change is already on the calendar. The Health and Safety at Work Amendment Act has passed and its changes come into force on 1 April 2027. WorkSafe’s guidance on the changes introduces critical risks: risks likely to result in death, a notifiable injury, illness or incident, a specified occupational disease, or risks managed by regulations under HSWA. From 1 April 2027, small PCBUs’ main HSWA duties are limited to managing their critical risks, while large PCBUs must manage all risks and prioritise the critical ones. Basic welfare duties, such as drinking water, toilets, hand washing, first aid and emergency planning, apply to every business regardless. At your next review, check your risk register against WorkSafe’s critical risk guidance.

Frequently asked questions

Is a written health and safety policy a legal requirement in New Zealand?

No. HSWA does not require a written policy; it requires the PCBU to manage risk in practice, and business.govt.nz says the same. A short written policy is still good practice: WorkSafe publishes an example policy in its writing guidance, and clients, head contractors and insurers often ask for one.

What is the difference between a health and safety policy and a health and safety plan?

The terms overlap and are used loosely. In WorkSafe’s guidance for small to medium businesses, the plan is the working system: risk procedures, monitoring, training records, engagement processes, emergency information and review. A policy is the short statement of commitment and responsibilities at the front of that system. The statement without the working parts achieves little.

Who is responsible for health and safety in a small business?

The PCBU holds the primary duty of care, and in a small company that is the company itself, directed by its officers. Officers, including owner-directors, have a personal due diligence duty to make sure the PCBU complies. Workers have duties too: take reasonable care, cooperate with notified policies, and follow reasonable instructions. Responsibility is shared, but it cannot be delegated or contracted away.

Does my business need a health and safety representative or a committee?

Only if the trigger occurs. If any worker asks for a health and safety representative, the business must initiate an election within two months. If a representative, or five or more workers, ask for a committee, the business must establish one, and it must meet at least once every three months. Informal arrangements are fine until a request is made; the request creates the obligation.

How often should we review our policy?

At least once a year, following WorkSafe’s guidance for small to medium businesses, and sooner after a major safety-related event, a serious incident, a change in the work you do, or a change in the law. Put the review date on the document and treat a missed date as a gap in the system.

What records do we have to keep?

Keep the records your system runs on: risk register, accident register, incident investigations, training and induction records, and health and exposure monitoring results. One figure is fixed in law: records of notifiable events must be kept for at least five years from the date the regulator was notified.

Should we buy a template or pay a consultant instead?

That is a business decision, not a legal one. The free official starting points are WorkSafe’s guidance and example policy material and business.govt.nz’s Workplace Policy Builder for health and wellbeing. Higher-risk businesses often get real value from a qualified health and safety professional reviewing their system. Note WorkSafe’s warning in its small business guidance: you can get help and advice, but you cannot contract out of your duties under HSWA. Whatever you buy, the document has to describe your workplace and be understood by your workers, or it will not protect anyone.

What changes on 1 April 2027?

Changes under the Health and Safety at Work Amendment Act come into force, built around critical risks. Small PCBUs’ main duties focus on identifying and managing critical risks; large PCBUs must manage all risks while prioritising critical ones; basic welfare duties continue for everyone. Businesses should test their policy and risk register against WorkSafe’s critical risk guidance at their next review.

Sources

• WorkSafe New Zealand, worksafe.govt.nz: Introduction to the Health and Safety at Work Act 2015, special guide (duties of PCBUs, officers, workers and other persons; reasonably practicable; managing risk; overlapping duties; notifiable events and five-year records; worker engagement and participation)
• WorkSafe New Zealand, worksafe.govt.nz: HSR election process (election on request, two-month initiation, three-year maximum term)
• WorkSafe New Zealand, worksafe.govt.nz: Health and Safety Committees (establishment on request by an HSR or five or more workers, functions, meeting at least every three months)
• WorkSafe New Zealand, worksafe.govt.nz: A guide for small to medium business owners and company directors (health and safety plan components, review at least annually or after a major event, due diligence steps, records)
• WorkSafe New Zealand, worksafe.govt.nz: Writing for health and safety, guidance for workplace health and safety writers (policies as good practice documents, example health and safety policy, document review dates, checking worker understanding)
• WorkSafe New Zealand, worksafe.govt.nz: What is a critical risk? (changes applying from 1 April 2027, critical risk definition, small and large PCBU duties, regulated high-risk work)
• Business.govt.nz (MBIE), business.govt.nz: Health and safety (team involvement, risk identification, proportionate planning, written policy not necessarily required, SafePlus, Compliance Matters)
• Business.govt.nz (MBIE), business.govt.nz: Having a fair workplace (policies and procedures, health safety and wellbeing as a key policy area, Workplace Policy Builder described)

This article is general information about health and safety obligations for New Zealand businesses. It is not legal advice, and it does not replace the Health and Safety at Work Act 2015, its regulations, or WorkSafe guidance for your industry. Health and safety duties depend on the work you do and the risks involved. If you are unsure whether your arrangements meet your obligations, check the current guidance on worksafe.govt.nz and business.govt.nz, or get advice from a qualified health and safety professional or lawyer.