Health and safety management for restaurants, hotels and shops: plan, do, check, act, with a free year plan

Short answer: Health and safety management is how you plan, organise, control, monitor and review the way you keep people safe at work. In the UK that’s the law, not a nice-to-have: regulation 5 of the Management of Health and Safety at Work Regulations 1999 asks every employer for those arrangements, and with five or more employees you have to record them and write down your health and safety policy. HSE’s guidance frames it as plan, do, check, act. A year plan is the simplest way to make sure the checking actually happens.

It’s a Tuesday in November. Priya runs operations for six pubs and gets an email from the insurer: when did you last review your health and safety arrangements? The policy in the shared drive is from two summers ago. Four of the six sites did a safety walk this year, the near misses live in a group chat, and Christmas bookings open next week. None of it’s wrong. It just doesn’t add up to a system.

This guide is for GMs in restaurants, hotels and shops, and the ops and area managers who look after several sites. It covers UK law and isn’t legal advice. Keep the free health and safety year plan (PDF) open while you read.

What is health and safety management?

It’s the routine that keeps safety from depending on who’s on shift. You decide what good looks like, give each job to a named person, check it’s happening, fix what isn’t and look back once in a while to see if the whole thing works. HSE’s guidance Managing for health and safety (HSG65) explains it as plan, do, check, act.

What’s a health and safety management system?

The same thing, written down: your policy, who does what, your risk assessments, your procedures, your training and your records, and how they connect. For a group of restaurants that can be ten pages and a calendar. It doesn’t have to be software or a certificate, and nothing in UK law asks you to buy either.

What does UK law ask for?

Three rules do most of the work for a hospitality or retail employer:

• Arrangements. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 says every employer “shall make and give effect to such arrangements as are appropriate” for the effective planning, organisation, control, monitoring and review of the measures that keep people safe. With five or more employees, you record them.
• A policy. “If you have five or more employees, you must write your policy down,” says HSE. It “should clearly say who does what, when and how.”
• Risk assessment. Regulation 3 asks every employer to assess the risks, and to record the significant findings with five or more employees. Our risk assessment guide covers how.

Around those sit duties you’ll know from the HSE’s basics for small businesses: get competent help (regulation 7), train people when they join and when their risks change (regulation 13), consult your workers, provide first aid, and report certain incidents under RIDDOR. In HSE’s words: “You must report certain injuries, near-misses and work-related illnesses to HSE.”

Is an annual review a legal requirement?

Not as such. Regulation 5 asks for monitoring and review, but no rule we found says how often. Once a year is a sensible minimum, and you should look again after a serious incident, a new site or a big change to how you work.

Plan, do, check, act on a shift

Plan, do, check, act sounds like a boardroom diagram. On a busy site it’s four plain questions.

Plan: what does good look like, and who owns it?

Write down what you’re aiming for and who does what. On each site, name who runs the safety walk, who handles near misses and who keeps the action plan moving. Write down who covers in August too, because it’s rarely the same person who covers in March.

Do: is it happening on every shift?

Do the risk assessments, turn the controls into procedures people can follow and put them in the handbook. Train new starters before they work alone. Regulation 13 asks for training when people are recruited, and seasonal staff count.

Check: are you finding out what’s going wrong?

Walk the site with a safety inspection checklist, look at near misses and accidents, and ask the people who close what nearly went wrong. A near miss nobody reports is a check you didn’t get. Our guide to reducing workplace incidents covers the culture that gets them reported.

Act: did the fix work?

Every fix gets an owner and a date, and someone checks it worked. Then the review asks the bigger question: is the system itself working, or are you just filling in forms?

Health and safety year plan template

The year plan is a free two-page PDF: download the health and safety year plan (PDF). Page one is the year, month by month, with the examples below filled in and a column to tick off. Page two is the annual review, with the questions below, and a table for who does what.

No law asks for a year plan, and the template doesn’t do the work for you. The months are our suggestion, and the last column says which duty each line helps with, not that the rule names that month.

How to use the template

• Fill in the site, the year and who owns the plan.
• Cross out what doesn’t fit and add what’s yours, like a refit or a new opening.
• Put a person against every month, not a job title.
• Make the month’s item a standing point at your team meeting, so every shift hears what’s done.
• Do the annual review on page two with someone who works the shifts.
• Put whatever needs to improve into the action plan, with an owner and a date.

A year of health and safety for restaurants, hotels and shops

Month	What you do	Who	Why
January	Review your arrangements and policy for the year ahead	Ops manager	Reg 5 and your policy
February	Check who does what for health and safety on every site	Ops manager	Your policy
March	Safety walk on every site before summer	GM	Reg 5 monitoring
April	Review risk assessments for summer: outdoor seating, heat, new shifts, seasonal staff	GM	Reg 3
May	Induction for seasonal staff: hazards, procedures and who to ask	GM	Reg 13
June	Safety walk in full summer trading, and check the spring fixes worked	GM	Reg 5 monitoring
July	Agree who’s in charge over the holidays, and make sure they know	Ops manager	Your policy
August	Staff survey on workload, hours and wellbeing	Ops or HR	Good practice
September	Safety walk on every site before autumn	GM	Reg 5 monitoring
October	Risk assessment for Christmas trading or parties: hours, staffing, lone working	GM	Reg 3
November	Go through the year’s accidents, near misses and RIDDOR reports	Ops manager	Reg 5 review
December	Safety walk in the Christmas rush, and carry open actions into January	Ops manager and GM	Reg 5 review

Every month: near misses and open actions as a standing point at the team meeting, and nobody works alone before their induction.

The safety walk comes round every quarter, as our safety inspection guide suggests. Walk the kitchen or stockroom more often if that’s where most happens.

Questions for the annual review

• Is the policy up to date, and do your managers know what it says?
• Does it still say who does what, when and how, on every site?
• Do your risk assessments cover this year’s changes, with the significant findings recorded?
• Did everyone, seasonal staff included, get training when they joined?
• Were accidents and near misses looked into, and the reportable ones reported?
• Were the fixes from walks and assessments done and checked?
• Have you consulted your staff on health and safety this year?
• Do you have competent help, inside the business or outside it?

One system for every site

Write the shared parts once and do the local parts where they happen. That’s our suggestion: the law doesn’t say how to split the work between head office and sites.

• The policy and procedures are written once, centrally, and apply everywhere. Change a procedure and every site gets it the same day.
• Walks, assessments and inductions happen on site, with the GM and the people who work there. The cellar steps and the night desk only exist at one address.
• The year plan is the same everywhere, so in January you can put the sites side by side. Ask about the lines that haven’t moved, not whether the folder exists.
• Who does what is written per site, so it’s clear who’s in charge when a GM leaves or goes on holiday.

Health and safety on the shift with Todolo

The review happens in a meeting room in January. Health and safety happens on the shift: at the fryer in the dinner rush, at the till when someone closes alone, on the night desk. That’s where your team is, and that’s where the system needs to live.

Todolo is one app for the whole shift, an employee app that needs no computer or company email address. In Todolo Operations, the plan becomes work someone owns:

• Safety walks become checklists. One per area or site, with a QR code on each spot so whoever does the walk opens the right checklist where they stand. See facility inspections with QR codes.
• The person on shift raises it. A hazard gets reported from the checklist or a form, on their phone, with a photo.
• Every action has an owner. Each one becomes an incident with a named person, a due date and a severity on your own scale.
• Every shift hears it. Procedures and changes go out as posts to the right sites and roles, and read confirmation shows who read them.

TOD, Todolo’s AI teammate, answers questions from your own handbooks. ESS Group reports accidents and near misses through Todolo workflows, separately from fault reporting.

Todolo has no health and safety management module and doesn’t make you compliant. The policy, the judgement and the duty stay yours.

Common questions about health and safety management

Who is responsible for health and safety management?

The employer. You can hand tasks to GMs, shift leads and competent advisers, but the duty stays with the business. In a group of restaurants that usually means the GM does the work on their site and the business makes sure they have the time, authority and training to do it.

Do I need a written policy with fewer than five employees?

No, the duty to write it down starts at five. You still need the arrangements, and writing them down anyway costs a page and saves arguments later.

Do I need ISO 45001?

No UK law asks for it. ISO 45001 is a voluntary standard some larger businesses certify against, often because a client asks. Plenty of well-run groups never do.

Does a year plan replace risk assessments?

No. The year plan schedules them. The risk assessment is still the document that says what could hurt people and what you’re doing about it.

Start with January

You don’t need to do everything at once. Book the annual review for January with someone who works the shifts, and bring what you already have: walk records, near misses and the action plan. Answer the questions on page two, fill in the year on page one and put a name against every month.

In thirty minutes we’ll show you how your year plan would work in Todolo, site by site. There’s no long contract to sign, and there’s a 30-day money-back guarantee.

Book a 30-minute demo