Short answer. A health and safety policy is a written statement of intent: what you commit to and who is responsible for what. A safety management system is the operational machinery that turns that commitment into daily practice: risk assessments, training records, monitoring and review. A business needs both, and having only the first is a common gap.
What a health and safety policy is
Every employer with five or more employees must have a written health and safety policy. This is a legal requirement under section 2(3) of the Health and Safety at Work etc. Act 1974.
A health and safety policy has three parts. The statement of intent sets out the organisation's commitment to health and safety, usually signed by the most senior person in the organisation. The organisation section describes who is responsible for what: who manages day-to-day safety, who conducts risk assessments, who investigates incidents, who provides training. The arrangements section describes how health and safety is managed in practice: risk assessment procedures, training programmes, emergency arrangements, monitoring processes.
A good policy is a clear, concise document that sets the direction for health and safety in the organisation. It is the foundation, not the building.
What a safety management system is
A safety management system (SMS) is the complete framework of policies, procedures, processes, responsibilities, records and reviews that an organisation uses to manage health and safety on an ongoing basis. If the policy is the statement of intent, the SMS is the operational machinery that turns that intent into daily practice.
This is also where the law goes beyond the policy document. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires "arrangements for the effective planning, organisation, control, monitoring and review" of the preventive and protective measures identified by your risk assessments. That is, in plain terms, a legal requirement to have a system, not only a policy.
An effective SMS typically includes the policy itself, risk assessment processes and registers, safe systems of work and method statements, training needs analysis and delivery, competence frameworks, incident reporting and investigation, performance monitoring, audit programmes, management review, emergency procedures, contractor management and document control.
The most widely recognised framework for a safety management system is ISO 45001. HSE's own model, HSG65, Managing for Health and Safety, sets out a Plan-Do-Check-Act cycle that many UK businesses build their system around instead.
Why the difference matters
A policy without a system is a piece of paper. It might satisfy a basic legal check, but it will not on its own protect people, prevent incidents or stand up to scrutiny from the HSE, a court, a client audit or an insurance assessor.
Take a typical policy line: "all employees will receive appropriate health and safety training." Fine as a statement, but who decides what training is needed? How is it delivered? How do you check competence, record it, and know when refresher training falls due? Those questions are answered by the system, not the policy.
The policy sets the commitment. The management system provides the process, the accountability, the records and the review mechanism that makes it happen.
Where most businesses sit
In practice, most SMEs sit somewhere between a policy and a full management system. They have a policy, some risk assessments, some training records, maybe an incident book and a fire evacuation procedure. These elements often exist in isolation, in different folders, managed by different people, reviewed at different times or not at all, with no structure connecting them.
The step from having individual elements to having a system is less about creating new documents and more about connecting the existing ones into a coherent framework, with proper governance, review cycles and accountability.
What a system looks like in practice
For an SME, a safety management system does not need to be a lengthy manual. It needs to be proportionate to the organisation's size and risk profile. For a 20-person office, a well-structured document set, some clear procedures and a quarterly review cycle can be entirely adequate.
For a larger or higher-risk business, such as manufacturing, construction or care, the system needs to go further. The principles stay the same: clear responsibilities, documented processes, active monitoring, regular review and genuine commitment from the top.
The key sign of a working SMS is evidence of the "system" part: not just documents existing, but documents being used, reviewed, updated and acted on. Risk assessments that reflect current activities. Training records that are up to date. Incidents that have been investigated and have led to changes. Management reviews that happen and produce decisions.
Why it is worth doing properly
Beyond the legal duty, there are practical reasons to move from a policy to a system. Clients increasingly ask for evidence of structured safety management as part of supply chain checks, tenders and contractor pre-qualification, and insurers often ask about your management arrangements, not just your policy, when assessing risk. Businesses that move from reacting to incidents after they happen towards planned, monitored safety management tend to catch problems earlier, before they become incidents. If you want a system built around your business rather than bolted onto it, York Green's safety management systems service starts from what you already have and builds the missing connections.