Health and Safety Management in NZ: How to Run a System That Protects People
The short answer
Health and safety management is the ongoing work of finding the risks in your business, controlling them, and checking the controls still work. In New Zealand it sits under the Health and Safety at Work Act 2015 (HSWA). The main duty holder is the PCBU, the person conducting a business or undertaking. WorkSafe’s model is a loop, not a filing exercise. You identify hazards with your workers, assess the risks, decide on control measures, put them in place, then monitor and review them. A written policy can describe that system, but the system itself is the daily practice: trained people, working controls, honest reporting and regular review. Businesses that run it as a loop cope when work changes. Businesses that treat it as a folder of documents usually find the gaps only after someone is hurt.
The duty holders your system has to serve
Four kinds of duty holder appear in HSWA, and a management system is how their duties get met in practice. The PCBU holds the primary duty of care. Officers, such as directors and chief executives, must exercise due diligence to make sure the PCBU complies. Workers have their own duty to take reasonable care. Other people at the workplace, such as visitors, must take care not to harm others. In management terms, the PCBU builds and runs the system, officers resource it and check it works, and workers operate it and feed information back into it. Two rules shape how the system is built. Duties cannot be contracted out to anyone else. Where two or more businesses have duties for the same matter, they must consult, cooperate and coordinate with each other.
| Duty holder | Who they are | Their part in the system |
|---|---|---|
| PCBU | A person conducting a business or undertaking, such as a company, partnership or sole trader | Holds the primary duty of care: ensure, so far as is reasonably practicable, the health and safety of workers, and that other people are not put at risk by the work |
| Officer | Directors, partners, chief executives and others who exercise significant influence over management | Exercise due diligence so the PCBU complies with its duties, including resourcing the system and verifying it is used |
| Worker | Employees, contractors, labour hire workers, apprentices, trainees and volunteer workers | Take reasonable care for their own health and safety, and that their actions do not harm others |
| Other persons | Visitors, customers and casual volunteers at the workplace | Take reasonable care for their own health and safety, and take care not to harm others |
What a working system includes
WorkSafe’s guide for small to medium business owners describes good systems in plain terms. They have good leaders, worker engagement, risk smarts, worker participation, a focus on health as well as safety, constant improvement, emergencies sorted, clear reporting processes, proper resources and training, and care for people who are hurt. Behind those features sits a recognisable set of working parts:
- Procedures for identifying workplace risks, and plans for eliminating or minimising them, with workers involved.
- Procedures for monitoring workers’ health and their exposure to risks that cannot be eliminated.
- Training records that show who knows which risks, and how to keep themselves safe.
- A process for engaging workers on matters that may affect them, and real opportunities to participate in decisions.
- Information on what to do in an emergency, including incidents and natural disasters.
- Procedures for recording and investigating injuries, near misses and work-related ill health.
- A process for reporting notifiable events to WorkSafe.
- Health and safety inductions for every new worker.
- A review of the whole plan at least once a year, or sooner after a major safety-related event.
None of these parts has to be complicated. A small business can cover most of them with a short risk register, an incident register, induction checklists and a standing item in team meetings. What matters is that each part exists, is used, and connects to the others.
Managing risk step by step
The engine of the system is the risk management process. WorkSafe sets it out as five steps, and frames the same cycle as Plan-Do-Check-Act. Workers must be involved at every step.
Step 1: Identify hazards. With your workers, work out what could harm the health or endanger the safety of workers or anyone else, such as visitors or bystanders. Walk the workplace, look at each task, and check past incidents and near misses. Include health hazards, not just injury hazards: dust, noise, hazardous substances, fatigue, stress and poor air quality are easier to miss than a faulty machine.
Step 2: Assess the risks. For each hazard, ask who might be exposed, what could happen, how severe the harm could be, and how likely it is. Risk has two parts, the consequences if it happens and the likelihood of it happening. Use the answers to decide which risks to deal with first. WorkSafe tells businesses to focus on their critical risks, the ones that could kill or seriously harm, before less serious risks.
Step 3: Decide how to manage each risk. First try to eliminate the risk. If that is not reasonably practicable, minimise it using the control measures described in the next section. More than one control may be needed for a single risk. Give preference to controls that protect many workers at once, such as safety barriers or guards, over controls protecting one person at a time.
Step 4: Put control measures in place. Do this as soon as possible after the decision. Then instruct and train workers, including new workers, in the control measures: why they matter and how to apply them. A control nobody understands is not yet a control.
Step 5: Monitor and review. Check regularly that controls remain effective, fit for purpose, suitable for the nature and duration of the work, and used correctly. Review your work activities on an ongoing basis to spot new risks. Record your main hazards, risks and controls in a risk register, and update it as steps 1 to 5 cycle around.
Choosing controls: the hierarchy in practice
When a risk cannot be eliminated, regulation 6 of the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 sets the order for minimising it. First, take one or more of these actions, choosing whichever is most appropriate and effective for the nature of the risk: substitute the hazard with something of lesser risk, isolate the hazard so no one comes into contact with it, or apply engineering controls, such as machine guarding or ventilation. These three sit at the same level. If a risk then remains, apply administrative controls: safe methods of work, procedures, rosters and training. If a risk still remains, provide suitable personal protective equipment (PPE) and make sure it is used. PPE is the last line of defence. WorkSafe is explicit that PPE should not be the first or only control considered, and that businesses should prefer controls that protect several workers at once.
Controls also have to be looked after. Under regulation 7, a control measure must stay effective: fit for purpose, suitable for the work, and installed, set up and used correctly, checked on an ongoing basis rather than only when first installed. Under regulation 8, controls must be reviewed, and revised if needed, when a control is not controlling the risk, before a change at the workplace that could create a new or different risk, when a new hazard or risk is identified, when health or exposure monitoring results require it, when engagement with workers shows a review is needed, or when a health and safety representative asks for one.
Worker engagement inside the system
Engagement is not a launch event. It is part of how the system runs every week. Businesses must engage with workers when identifying hazards and assessing risks, when making decisions about ways to eliminate or minimise risks, when proposing changes that may affect health and safety, and when developing procedures for engagement itself, for monitoring workers’ health and workplace conditions, and for providing information and training. Business.govt.nz describes the same duty as two-way communication: ask for, listen to and consider workers’ views, explain the outcome of decisions promptly, and keep clear ways open for workers to raise their own suggestions. Health and safety representatives and committees are established ways for workers to take part, and they sit inside this wider habit of involvement rather than replacing it. A system that only hears from workers after an incident is missing its best source of early warnings, because workers are the eyes and ears of the business.
Training, supervision and information
Controls fail quietly when people do not know them. The system therefore treats training as a control in its own right. Every new worker gets an induction before they start work unsupervised. Training is specific to the tasks and risks each person faces, and inexperienced workers are supervised until they are competent. Step 4 of the risk process applies the same rule to every new control: instruct and train the people who must use it, including why it matters. Keep training records current, because they are the evidence that the PCBU knows who is trained for what. Information must reach people in a form they will use. Business.govt.nz suggests displaying it where the work happens, such as a laminated guide at a machine, rather than relying on a manual nobody opens.
Monitoring, incidents and learning from them
A system that is not monitored drifts. WorkSafe’s guidance for owners and directors says leaders should receive regular reports on injuries, incidents and work-related ill health, newly identified hazards and their risks, sickness absence rates, work-related injury and ill health leave, and the results of exposure monitoring such as noise or chemical levels. Those reports are how officers verify the system is working, rather than assume it.
Incidents and near misses are the system’s other feedback channel. Business.govt.nz advises keeping an incident register that records near misses, incidents and signs of occupational illness, who was involved or affected, what happened, where and when it happened, and what happened afterwards. Staff should know where the register is and how to fill it in. Investigation then looks for root causes. WorkSafe directs businesses to look closely at systemic factors such as training, workload and performance stress, and to involve workers and line managers in finding them. The aim is to fix causes, not to assign blame.
One category of incident carries legal steps as well. If a notifiable event occurs, the workflow is to notify WorkSafe as soon as possible, preserve the site until an inspector releases it, and keep records of the event for at least five years. Build those steps into your incident procedure now.
If things go wrong: enforcement and penalties
WorkSafe is the regulator, with the principal responsibility for ensuring workplaces abide by the law. Its inspectors can enter workplaces, investigate incidents, and issue notices. An improvement notice requires action to fix a breach, or likely breach, of HSWA or its regulations by a set deadline. A prohibition notice requires an activity to stop until a serious health and safety problem is fixed. A non-disturbance notice requires an area to be left undisturbed while an inspector works. Failing to comply with an improvement notice can be fined up to $250,000 for an organisation, and failing to comply with a prohibition notice up to $500,000. Regulators can also issue infringement notices for specified offences.
Serious failures go to court. HSWA sets three tiers of duty offence. Section 49 covers failure to comply with a health and safety duty, with maximum fines of $50,000 for an individual worker or other person, $100,000 for an officer or individual PCBU, and $500,000 for an organisation. Section 48 covers a failure that exposes someone to a risk of death, serious injury or serious illness: maximum fines of $150,000, $300,000 and $1.5 million on the same scale. Section 47 covers reckless conduct that exposes someone to that risk: an organisation can be fined up to $3 million, and individuals can face up to five years in prison, a fine of up to $300,000, or $600,000 for an officer or individual PCBU, or both prison and a fine. Courts can also impose orders, including adverse publicity, restoration, training and health and safety project orders. These are maximums. The practical point is simpler: a working system is what keeps people safe, and it is also what a business shows if WorkSafe ever asks questions.
Where a small business starts
WorkSafe’s guide for small to medium business owners reduces the build to a three-step cycle. Assess: get your team together and identify the hazards and risks in the business, including the low-probability risks that would cause serious harm, and ask whether you record and investigate injuries and near misses well enough to learn from them. Commit: turn the findings into a plan that is easy to understand, decide how it will be monitored and measured, and share it with every new worker. Act: lead by example, set clear targets everyone understands, run regular activities such as training and practice emergency drills, keep accurate records, include health and safety in regular meetings, and review and update the plan regularly. Business.govt.nz adds the proportionality rule: manage health and safety in proportion to the level of risk, so the plan and tools can be simple where risks are low and more detailed where risks are high.
When you want a benchmark, use SafePlus. It is a voluntary performance improvement toolkit developed by WorkSafe, ACC and MBIE. It sets out ten performance requirements under three concepts: leadership, worker engagement and risk management. Businesses can rate themselves with a free online self-assessment, and are described at three maturity levels: Developing, Performing and Leading. If you need hands-on help, WorkSafe recommends a suitably qualified and experienced health and safety professional. Advice can be bought in. The duties cannot: they stay with the PCBU.
Guides on this site that sit alongside this one: the health and safety policy template guide covers the written policy and the duties in legal depth; the dairy health and safety guide shows the same system applied on farms; and the CPR course guide covers first aid training, one part of the training side. More business guides are in the Business & Industry section.
Frequently asked questions
Does NZ law require a formal health and safety management system?
HSWA does not name a system, a standard or a certificate that a business must hold. It sets duties: manage risks, engage workers, train and supervise, and monitor. WorkSafe’s guidance describes the practices that meet those duties, and business.govt.nz notes that you do not necessarily need a formal process in writing. What is required is that the work actually happens and keeps happening.
What is the difference between a hazard and a risk?
A hazard is anything that can cause harm: a source of harm, such as a machine, a substance or a workload. A risk arises when people are exposed to that hazard. WorkSafe explains that risk has two components: the consequences, meaning how much harm could result, and the likelihood of it occurring. You manage the risk by reducing the likelihood, the level of harm, or ideally both.
How often should we review our control measures?
Monitoring is ongoing, not an annual event. Controls must be checked regularly to confirm they still work and are used correctly. A formal review is required when a control is not controlling the risk, before a workplace change that could bring a new risk, when a new hazard is identified, when monitoring results raise a concern, or when workers or a health and safety representative ask for one. WorkSafe also recommends reviewing the whole health and safety plan at least once a year.
What is a risk register, and do we need one?
A risk register is the running record of your hazards, the risks they create, the control measures in place and who owns them. HSWA does not prescribe the document by that name, but WorkSafe’s guidance for owners lists risk registers among the accurate health and safety records a business should keep, alongside incident investigations, notifiable events and training records. In practice the register is how a business proves to itself that risks have been identified and are being managed.
Can we rely on PPE as our main control?
No. The hierarchy in regulation 6 puts PPE last. It is used only where a risk still remains after elimination has been tried and substitution, isolation, engineering and administrative controls have been applied as far as reasonably practicable. WorkSafe states that PPE should not be the first or only control considered, and expects businesses to prefer controls that protect many workers at once.
What should we do straight after a serious incident?
Look after injured people first and make the scene safe. Record what happened in your incident register, with who, what, where and when. If the event is notifiable, notify WorkSafe as soon as possible, preserve the site until an inspector releases it, and keep the records for at least five years. Then investigate with your workers to find the root causes, including systemic factors such as training or workload, and fix them.
What is SafePlus, and is it compulsory?
SafePlus is a voluntary health and safety performance improvement toolkit from WorkSafe, ACC and MBIE. It defines what good health and safety looks like beyond minimum legal compliance, using ten performance requirements grouped under leadership, worker engagement and risk management. Businesses can use its free online self-assessment, or commission an onsite assessment by an accredited assessor. Using it is a choice. Meeting HSWA duties is not.
The bottom line
Health and safety management is a loop any business can run: know your risks, control them in the right order, train the people who rely on the controls, watch the results, and review whenever work changes. Start with your most serious risks, involve your workers at every step, and keep the records that prove the loop is turning. The businesses that stay safe are rarely the ones with the biggest manuals. They are the ones where the loop never stops.
Sources
- WorkSafe New Zealand, “How to manage work risks” (Plan-Do-Check-Act, critical risks first, worker input, paperwork in its place): https://www.worksafe.govt.nz/managing-health-and-safety/managing-risks/how-to-manage-work-risks/
- WorkSafe New Zealand, “General risk and workplace management, part 2” (interpretive guidelines for the GRWM Regulations 2016: duty holders, engagement, the prescribed risk management process in regulations 5 to 8, the hierarchy of control measures, maintaining and reviewing controls): https://www.worksafe.govt.nz/managing-health-and-safety/businesses/general-requirements-for-workplaces/general-risk-and-workplace-management-part-2/
- WorkSafe New Zealand, “A guide for small to medium business owners and company directors” (health and safety leadership, the assess, commit and act cycle, plan components, monitoring and reporting, features of good systems): https://www.worksafe.govt.nz/dmsdocument/863-a-guide-for-small-to-medium-business-owners-and-company-directors
- WorkSafe New Zealand, “Safe stacking of sawn timber and board materials” (section 2.0 sets out WorkSafe’s five steps for identifying, assessing and managing work risks): https://www.worksafe.govt.nz/topic-and-industry/manufacturing/safe-stacking-of-sawn-timber-and-board-materials/
- WorkSafe New Zealand, “Offences and penalties under the Health and Safety at Work Act 2015” (offence tiers in sections 47 to 49, inspector notices and maximum penalties): https://www.worksafe.govt.nz/managing-health-and-safety/getting-started/understanding-the-law/offences-and-penalties-under-the-health-and-safety-at-work-act-2015/
- WorkSafe New Zealand, ACC and MBIE, “SafePlus performance requirements” (the ten performance requirements, leadership, worker engagement and risk management, and the Developing, Performing and Leading levels): https://www.worksafe.govt.nz/dmsdocument/20683-safeplus-performance-requirements/latest/
- Business.govt.nz (MBIE), “Health and safety” (team involvement, identifying and assessing risks, SafePlus, putting a plan in place, proportionate management): https://www.business.govt.nz/operations/health-and-safety
- Business.govt.nz (MBIE), “Assessing health and safety risks” (look for risks, assess, prioritise, study, consider options, act): https://www.business.govt.nz/operations/health-and-safety/assessing-health-and-safety-risks
- Business.govt.nz (MBIE), “Keeping your business healthy and safe” (plans and tools, learning from incidents, keeping an incident register): https://www.business.govt.nz/operations/health-and-safety/keeping-your-business-healthy-and-safe
- Business.govt.nz (MBIE), “Involving workers” (engagement as two-way communication, where to include workers): https://www.business.govt.nz/operations/health-and-safety/involving-workers
- Health and Safety at Work (General Risk and Workplace Management) Regulations 2016, regulations 5 to 8 (duty to identify hazards, hierarchy of control measures, duty to maintain effective control measures, duty to review control measures), legislation.govt.nz: https://www.legislation.govt.nz/secondary-legislation/pco-drafted/2016/13/en/2024-08-10.pdf
This article is general information about health and safety management for New Zealand businesses. It summarises guidance published by WorkSafe New Zealand and business.govt.nz, and it is not legal advice. Duties under the Health and Safety at Work Act 2015 depend on the work you do and the risks involved. Check the current guidance on worksafe.govt.nz for your situation, and take advice from a qualified health and safety professional or a lawyer where you are unsure.
