Short answer. The same handful of gaps trip up almost every new employer: assuming size exempts you, using a generic risk assessment, skipping proper induction training, ignoring fire safety, and treating health and safety as a one-off task rather than an ongoing one. Add employers' liability insurance, first aid provision and accident recording to that list and you have covered the areas the HSE actually checks first.
Mistake 1: Thinking H&S Doesn't Apply to Small Businesses
There's a persistent myth that health and safety is only for big companies with factories and hard hats. The reality is that the Health and Safety at Work etc. Act 1974 applies to every employer, regardless of size. If you employ one person, you have legal duties.
Those duties include providing a safe working environment (HSWA 1974), carrying out and recording suitable risk assessments (Management of Health and Safety at Work Regulations 1999, regulation 3), providing information, instruction and training, consulting employees on health and safety matters (Health and Safety (Consultation with Employees) Regulations 1996), and, if you have five or more employees, having a written health and safety policy.
Sole traders with no employees have a narrower duty: since the Deregulation Act 2015, HSWA 1974 no longer applies to genuinely self-employed people whose work carries no risk to others. If your activity could put anyone else, clients, visitors, members of the public, at risk, or falls on the list of higher-risk activities the exemption doesn't cover, the duty still applies to you.
Mistake 2: Downloading a Generic Risk Assessment from the Internet
A business needs risk assessments, so someone downloads a template, changes the company name at the top and files it away. Except a risk assessment is supposed to be specific to your workplace, your activities, your equipment and your people.
A generic risk assessment for "office work" doesn't cover the layout of your office, the equipment your employees actually use, or the hazards specific to your building. It's a starting point at best, but most businesses treat it as the finished article and never look at it again.
Risk assessments need to reflect what actually happens in your workplace. They need to be carried out by someone competent, reviewed regularly and updated when things change. A template with your logo on it won't satisfy an HSE inspector.
Mistake 3: Not Providing Any Training
"They'll pick it up as they go along" is a common assumption and a risky one. Employers have a legal duty to provide adequate health and safety training, starting on day one. New starters need induction training covering emergency procedures, fire safety, first aid arrangements, reporting procedures and any hazards specific to their role.
Beyond induction, employees need training for the tasks they actually do. If they're using work equipment, they need PUWER training. If they're handling hazardous substances, they need COSHH training. If they're working at height, they need training under the Work at Height Regulations 2005. All of it needs to be documented.
Mistake 4: Missing the Basics: Insurance, First Aid and Records
Three requirements catch new employers out because they don't feel like "health and safety" until something goes wrong. Employers' Liability (Compulsory Insurance) Act 1969 requires almost every employer to hold employers' liability insurance, with a daily fine for every day a business operates without it. A first aid needs assessment under the Health and Safety (First-Aid) Regulations 1981 is required from your first employee, covering the size of your workforce, the hazards present and how quickly help can reach an injured person. An accident book is the simplest way to meet this and to support any RIDDOR report you may later need to make to the HSE.
None of these are optional extras. They are usually the first things an inspector or an insurer asks to see.
Mistake 5: Ignoring Fire Safety
New businesses often focus on getting the space looking right, furniture, signage, decoration, without giving a thought to fire safety. The Regulatory Reform (Fire Safety) Order 2005 applies to virtually all non-domestic premises, and the responsible person, usually the employer or whoever controls the premises, must carry out a fire risk assessment and, since 1 October 2023, keep a written record of it regardless of the number of employees.
This means identifying fire hazards, identifying people at risk, evaluating existing fire safety measures and setting out an action plan. The Order requires suitable fire safety procedures and staff training (articles 15 and 21); regular fire drills are the accepted way of demonstrating that training works, though the law doesn't fix a set frequency. If you've moved into premises and haven't had a fire risk assessment, you're already non-compliant.
Mistake 6: Treating H&S as a One-Off Exercise
Perhaps the most damaging mistake of all is treating health and safety as something you set up once and forget about. Risk assessments are completed when the business starts but never reviewed. Training is provided at induction but never refreshed. The health and safety policy gathers dust in a drawer.
Health and safety is a continuous process. Your workplace changes, your activities evolve, new equipment arrives, new people join, legislation is updated. Set review dates, put them in the diary, and treat health and safety reviews with the same seriousness as a financial review or a client audit.
A short health and safety consultancy engagement at the start can put proportionate risk assessments, a fire risk assessment, a health and safety policy and a review schedule in place before any of these gaps become a problem. For the legal detail, see HSE's guidance for small businesses.