Tōtika Knowledge Centre

How to Write a Health and Safety Policy That Actually Works

Tōtika Category 1 | SB1 Health and Safety Policy

For many New Zealand businesses, the Health and Safety Policy is one of the first documents created when establishing a health and safety system.

It is also one of the documents we most commonly see causing avoidable problems during prequalification.

The issue is rarely that a business does not care about health and safety. More often, the policy is old, generic, copied from a template, missing an important commitment, or simply does not describe how the business actually operates.

A good Health and Safety Policy does not need to be complicated.

For many small and medium sized businesses, one page may be enough.

What matters is whether the policy clearly explains what the organisation commits to doing, who is responsible and whether those commitments can be demonstrated in practice.

What is a Health and Safety Policy actually for?

Think of your policy as three things.

A promise.

It sets out the commitment your organisation and its leaders make to protecting workers and anyone else who could be affected by your work.

A map.

It identifies where responsibility for health and safety sits and the respective roles of leadership, management and workers.

A signal.

It tells workers, contractors, clients and other organisations what they should expect from your business.

The policy sits at the top of the health and safety management system.

Underneath it sit the processes for managing risk, training, incidents, emergencies and other health and safety activities.

Beneath those are the registers, forms, records and tools that demonstrate what is happening in practice.

Ultimately, the policy should connect to what people actually do at work.

What does Tōtika Category 1 SB1 look for?

SB1 addresses the organisation's Health and Safety Policy or Statement of Intent.

For Tōtika Category 1, suppliers need to demonstrate a current policy that has been signed and dated by top management and establishes the organisation's health and safety commitments and high level responsibilities.

The policy needs to address several fundamental areas.

These include leadership, legal compliance, recognised good practice, worker consultation and appropriate high level responsibilities and accountabilities.

The policy also needs to be current.

Most importantly, the assessor can only assess what the evidence actually demonstrates.

A statement in your supplier response cannot repair something that is missing from the policy itself.

The eight building blocks of a strong Health and Safety Policy

Before submitting a Health and Safety Policy for Tōtika Category 1 SB1, check it against these eight building blocks.

1. Your business name

Make it clear which organisation the policy belongs to.

This sounds obvious, but copied templates and older documents can contain incorrect business names, outdated terminology or references to another organisation.

2. Leadership commitment

Top management should accept responsibility for health and safety and demonstrate leadership through meaningful commitments.

Avoid relying solely on generic statements such as:

“Management is committed to health and safety.”

Explain what that commitment actually means within your business.

3. Legal compliance

The organisation should commit to meeting applicable New Zealand health and safety legislation and regulatory requirements.

4. Good practice

Legal compliance should not be the organisation's only commitment.

The policy should also demonstrate a commitment to appropriate recognised good practice relevant to the organisation and its work.

5. Worker consultation

Workers should not simply be instructed to work safely.

The policy should commit the organisation to engaging with workers, listening to their input and providing appropriate opportunities to participate in health and safety matters.

6. Responsibilities and accountabilities

The policy should make high level health and safety responsibilities clear.

Who provides leadership?

What are managers responsible for?

What responsibilities do workers have?

The level of detail should be appropriate to the size and complexity of the organisation.

7. Review

The policy needs to remain current and relevant to the organisation.

For SB1, suppliers should ensure the policy has been reviewed within the required period and still accurately reflects the business.

A review should also be considered following significant organisational change, operational change or a serious event.

8. Top management approval

The current policy should be signed and dated by top management.

The evidence should make the authority of the person approving the policy clear.

Before uploading the document, check that the signature, role and date are actually visible in the final file.

The problem with generic Health and Safety Policies

Consider a policy that says:

“Management is committed to safety.”

It sounds appropriate.

But what does it actually demonstrate?

Who is management?

What have they committed to doing?

Who approves resources?

Who reviews health and safety performance?

Who makes sure actions are completed?

The objective is not to make the policy longer.

It is to make it real.

Instead of saying:

“Workers will be consulted.”

A business could explain the actual commitment it makes to worker participation.

For example, workers may be consulted about changes through prestart meetings and regular safety meetings, with resulting actions recorded and followed through.

Instead of saying:

“Management supports safety.”

The policy can identify the leadership responsibilities that actually exist within the organisation.

Clear language makes the policy easier for workers to understand and easier for the organisation to demonstrate.

Write the truth

This is one of the most important principles when developing a Health and Safety Policy.

Write the truth.

A policy should describe the organisation you actually operate, rather than an imaginary perfect business.

If your policy states that workers are regularly consulted, there should be a mechanism through which that occurs.

If it says management reviews health and safety performance, that should happen.

If it says training and supervision will be provided, your systems should support that commitment.

If it says risks will be identified and controlled, this should be reflected in how work is actually planned and undertaken.

A policy is a promise.

The rest of your health and safety system should demonstrate how that promise is put into practice.

Common Health and Safety Policy mistakes seen during assessment

There are several recurring issues that can weaken otherwise good evidence.

The old policy

The policy may be well written and signed, but the review date is several years old.

The problem is currency.

The document may no longer accurately describe the organisation, its work or its health and safety arrangements.

The copied template

A business uploads a polished template containing generic commitments or roles that do not actually exist within the organisation.

The problem is credibility.

A template can be an excellent starting point, but the finished policy should describe the real business.

The invisible leader

The policy promises to keep people safe but never establishes who is accountable.

The problem is that leadership and high level responsibility cannot be clearly determined.

The silent worker

The policy covers legal compliance and risk management but never commits to consulting workers.

Requiring workers to follow rules is not consultation.

Worker engagement and participation need to be addressed.

The missing signature

The supplier response says the policy is signed, but the uploaded document contains no visible signature or date.

The assessor can only assess the evidence that has actually been supplied.

The framed policy

The business has a beautifully presented policy displayed in the workplace, but nobody can explain what it means.

A policy becomes useful when workers understand the commitments it contains and those commitments influence what happens in the business.

Can I use a Health and Safety Policy template for Tōtika?

Yes.

But use a template as a starting point, not as the finished product.

Before adopting any template, ask:

What work do we actually do?

What could seriously hurt or harm someone?

Who makes health and safety decisions here?

How do workers really speak up and participate?

What responsibilities actually exist within our business?

Then change the policy so it reflects those answers.

A simple policy that accurately describes your organisation is more useful than an impressive document containing commitments, terminology and management structures that do not exist.

How long should a Health and Safety Policy be?

There is no benefit in making a policy complicated simply to make it appear comprehensive.

For many small businesses, one page may be enough.

Two pages may be appropriate where responsibilities or commitments require additional explanation.

The test should not be the number of pages.

The test should be whether someone reading the policy can understand:

What the business promises.

Who is responsible.

How workers participate.

What standards the organisation commits to.

How the policy connects to the way the organisation actually works.

Plain language generally beats impressive language.

A policy should not live in a folder

Having the right words on the page is only the beginning.

A useful policy moves through the organisation.

Sign it

Top management approves the policy.

Share it

Workers are introduced to the policy and understand what it means.

Use it

The commitments influence planning, risk management, training, resources and decisions.

Check it

The organisation looks for evidence that the commitments are actually being implemented.

Improve it

The policy is reviewed and updated as the organisation changes and learns.

Evidence that the policy is alive within the business might include induction records, worker acknowledgements, meeting records, consultation evidence, risk management decisions, training decisions, resource decisions and policy review records.

What is the difference between having a policy and implementing it?

This distinction is important in a Tōtika assessment.

The policy establishes the organisation's commitment.

Implementation demonstrates what the organisation actually does.

For example, a policy may commit to consulting workers.

The policy demonstrates the promise.

Meeting records, toolbox discussions, worker feedback, health and safety meetings or other consultation records may demonstrate that the promise is being implemented.

Likewise, a commitment to provide training is different from the training records and competency evidence demonstrating that it occurs.

Good health and safety systems connect the two.

What should I upload for Tōtika SB1?

Upload the complete current Health and Safety Policy relevant to your organisation.

Before submitting it, open the actual uploaded document and check that:

The correct organisation name is shown.

The complete policy has uploaded.

Every page is readable.

Leadership commitments are evident.

Legal compliance is addressed.

Good practice is addressed.

Worker consultation is addressed.

High level responsibilities and accountabilities are clear.

The policy is current.

Top management approval is visible.

The signature and date are visible.

If something cannot be seen in the evidence, do not assume the assessor will infer it.

How should I answer the SB1 assessment question?

Your supplier response should help the assessor understand and navigate your evidence.

It should not attempt to replace the evidence.

A useful response identifies the Health and Safety Policy, explains who approved it, states when it was reviewed and briefly identifies the relevant commitments contained within it.

Keep the response factual.

Most importantly, do not make claims that cannot be demonstrated by the document you have attached.

Final Tōtika SB1 Health and Safety Policy check

Before submitting your evidence, ask yourself:

Does the policy contain the correct business name?

Is there a clear leadership commitment?

Does it address legal compliance?

Does it commit to appropriate good practice?

Does it include worker consultation?

Are high level responsibilities and accountabilities clear?

Is the policy current?

Has it been signed and dated by top management?

Is the final uploaded document complete and readable?

Can we demonstrate implementation if the assessment level requires it?

If one of the required elements is missing, address it before submitting.

A polished supplier response cannot repair a missing commitment, an old review date or an incomplete attachment.

The Qualify365 approach

The purpose of the Tōtika Knowledge Centre is to make health and safety prequalification easier to understand.

Each guide takes an assessment requirement and breaks it down into practical language.

What does the requirement mean?

Why does it matter?

What does good evidence look like?

What commonly goes wrong?

How can a business improve?

The objective is not simply to help suppliers complete another prequalification.

It is to help businesses understand what good health and safety management looks like and turn assessment requirements into practical improvements in the workplace.

For SB1, that principle can be reduced to three simple ideas.

Write it. Use it. Prove it.

Write a Health and Safety Policy that genuinely reflects your organisation.

Use those commitments to guide what happens within the business.

Prove those commitments through credible evidence.

That is what turns a Health and Safety Policy from a document into part of a working health and safety system.

Qualify365 Tōtika Knowledge Centre

Practical guidance for better assurance.

‍