Policy and procedure template, filled in for incident reporting
A policy states the organisation's rule on a matter and why it exists; a procedure states how the rule is carried out, step by step, by whom, with what record. They are two documents with the same number, because they have different readers: the policy is read by managers, auditors and lawyers; the procedure is read by the person doing the task. The template is written out below for incident and near-miss reporting, because it is the one every site needs and the one with real legal timescales attached.
What is in the template
Each section below says what goes in it, why it is there, and then shows the section filled in. The example: Written for a 120-person manufacturing site. The OSHA and RIDDOR timescales are real; change the names and the forms.
- Policy: control
- Policy: purpose
- Policy: scope
- Policy: statements
- Policy: definitions, responsibilities, non-compliance
- Procedure: control and trigger
- Procedure: steps
- Procedure: exceptions, escalation and records
1. Policy: control
What goes here. Number, title, owner (a role), approved by, effective date, review date, and the procedure(s) that implement it.
Why it is there. The owner is accountable for the policy being true; the review date is what stops it being eight years old.
Filled in:
| Field | Entry |
|---|---|
| Number | HS-POL-004 |
| Title | Incident, injury and near-miss reporting |
| Owner | Health and safety manager |
| Approved by | Site director |
| Effective | 1 March 2026 |
| Review | March 2027, or on any change in reporting law |
| Implemented by | HS-PROC-004 Reporting and investigating an incident |
2. Policy: purpose
What goes here. One or two sentences: what the policy is for and what harm it prevents.
Why it is there. A reader who knows why a rule exists applies it to the case the writer did not think of.
Filled in
This policy exists so that every injury, illness, dangerous occurrence and near miss on this site is reported, recorded and investigated, so that the person gets the right care, the cause is fixed before it hurts someone else, and the company meets its legal duty to record and report.
3. Policy: scope
What goes here. Who and what it covers: employees, agency staff, contractors, visitors; all sites and vehicles; work-related travel. What it does not cover.
Why it is there. The incidents that go unreported are the ones involving a contractor on a Saturday. Scope is where that is settled.
Filled in
Applies to everyone on site or working for the company anywhere (employees, agency workers, contractors, visitors and drivers) and to work-related travel. Covers injuries, work-related ill health, dangerous occurrences (a collapse, an explosion, a release) and near misses (an event that could have caused injury but did not). Does not cover commuting to and from work, or security incidents (see SEC-POL-001).
4. Policy: statements
What goes here. The rules, numbered, each one sentence. This is the part that is quoted back in an investigation or a tribunal.
Why it is there. Numbered rules can be referenced from the procedure, from training and from a disciplinary letter. Paragraphs cannot.
Filled in
4.1 Every injury, however minor, every work-related illness and every near miss is reported to the supervisor before the end of the shift in which it happened or was noticed.
4.2 No one will be disciplined or treated less favourably for reporting an incident or near miss in good faith, including one they caused.
4.3 Every injury and dangerous occurrence is investigated to find the cause, starting within 24 hours; near misses are reviewed weekly.
4.4 Recordable injuries and illnesses are entered on the OSHA 300 log within 7 calendar days [US, 1904.29] / the accident book entry is made the same day [UK].
4.5 The regulator is notified within the legal time. US: a fatality within 8 hours; an in-patient hospitalisation, amputation or loss of an eye within 24 hours (1904.39). UK: a death or specified injury reported to HSE without delay (by phone for a death); an over-7-day injury within 15 days; dangerous occurrences without delay (RIDDOR 2013). Only the health and safety manager or the site director makes the report.
4.6 The scene of a serious incident is left undisturbed, except to help the injured or make it safe, until the health and safety manager releases it.
4.7 Incident records are kept for at least 5 years [US: 1904.33; UK: 3 years for the accident book, longer for RIDDOR and any claim].
5. Policy: definitions, responsibilities, non-compliance
What goes here. The words that must mean one thing (recordable, near miss, specified injury, dangerous occurrence); who does what by role; what happens if the policy is not followed; related documents.
Why it is there. "Near miss" means five different things on a site until it is defined. Responsibilities by role survive staff changes. The non-compliance line is what makes the policy a rule and not advice.
Filled in
Near miss: an unplanned event that did not result in injury or damage but could have. Recordable (US): an injury or illness resulting in death, days away, restricted work, transfer, loss of consciousness, or medical treatment beyond first aid. Specified injury (UK): the list in RIDDOR regulation 4.
Everyone: report. Supervisors: make safe, get first aid, start the form, begin the investigation. First-aiders: treat and record. Health and safety manager: investigate, record, report to the regulator, track actions. Site director: approve the policy, review serious incidents, resource the actions.
Not reporting an injury or near miss, or discouraging someone else from reporting, is a disciplinary matter. Related: HS-PROC-004; HS-POL-001 Health and safety policy; first-aid procedure HS-PROC-002; OSHA 1904 / RIDDOR 2013.
6. Procedure: control and trigger
What goes here. The same number as the policy with PROC in it; the owner; and the trigger, the exact moment the procedure starts.
Why it is there. A procedure that does not say when it starts is started late.
Filled in:
| Field | Entry |
|---|---|
| Number | HS-PROC-004 |
| Title | Reporting and investigating an incident |
| Implements | HS-POL-004 |
| Owner | Health and safety manager |
| Trigger | Any injury, illness, dangerous occurrence or near miss is noticed by anyone |
| Version | 2.0 · March 2026 |
7. Procedure: steps
What goes here. A table: step, who, what, by when, record. One action per row. The timescales from the policy appear here as deadlines on specific rows.
Why it is there. The person using the procedure is a supervisor at 2 am with an injured worker. They need the next action and the time limit, not the policy's reasoning.
Filled in:
| # | Who | Action | By when | Record |
|---|---|---|---|---|
| 1 | Anyone | Make the area safe if you can do so without risk; get first aid or call emergency services (911 / 999); tell the supervisor. | At once | |
| 2 | Supervisor | Check the injured person is being treated; stop the machine or process involved; do not move anything else at the scene of a serious injury. | At once | |
| 3 | Supervisor | Phone the health and safety manager (24-hour: 555-0160) for any injury needing more than first aid, any dangerous occurrence, or anything you are unsure about. | Within 30 minutes | Call logged |
| 4 | Supervisor with the person | Complete the incident report form (IR-1): who, what, where, when, witnesses, injury, first aid given. Near misses: the yellow card is enough. | Before the end of the shift | IR-1 / yellow card |
| 5 | Health and safety manager | Decide if the incident is reportable to the regulator and report it: US fatality 8 hours, hospitalisation/amputation/eye loss 24 hours; UK death or specified injury without delay, over-7-day within 15 days. | Within the legal time | Report reference on IR-1 |
| 6 | Health and safety manager | Enter recordable injuries on the OSHA 300 log and complete the 301 [US]; accident book and RIDDOR copy [UK]. | Within 7 days / same day | 300 log / accident book |
| 7 | Supervisor + HS manager | Investigate: visit the scene, interview the person and witnesses separately, review the procedure in force, find the immediate cause and the underlying cause (why the condition existed). | Start within 24 hours; complete within 5 working days | Investigation report IR-2 |
| 8 | HS manager | Agree corrective actions with an owner and a date; add to the action tracker; brief the team at the next toolbox talk without naming the person. | Within 5 working days | Action tracker |
| 9 | Site director | Review every lost-time or reportable incident and sign off the investigation and the actions. | Within 10 working days | Signature on IR-2 |
| 10 | HS manager | Review near-miss cards weekly; trend incidents monthly by area, type and shift; report to the site meeting. | Weekly / monthly | Monthly H&S report |
8. Procedure: exceptions, escalation and records
What goes here. What to do when a step cannot be followed (the HS manager is unreachable; the person refuses first aid; the incident involves a contractor), who to escalate to, and the records list with retention.
Why it is there. Procedures fail at the exception. Writing the three most likely ones down is cheaper than finding out at 2 am.
Filled in
HS manager unreachable: the site director, then the duty manager, takes the role for the regulator notification; the time limit does not wait. Contractor injured: the same procedure applies; the contractor's company is informed and provides its own report as well. Person refuses first aid or hospital: record the refusal on IR-1 with a witness; the incident is still reported and investigated.
Records: IR-1 and IR-2 kept 5 years [US]; accident book 3 years and RIDDOR reports 3 years [UK], or longer if there is a claim; action tracker kept current; monthly reports 5 years. Filed by the health and safety manager; access limited to those with a need, because they contain medical information.
Where policy and procedures go wrong
One document trying to be both
A "policy and procedure" merged into one is read by nobody in full: the supervisor cannot find the steps between the paragraphs of purpose and scope, and the auditor cannot find the rule between the steps. Two pages, one number.
The policy has no owner
A policy approved by "management" is reviewed by nobody. The owner is a role; when the person changes, the policy is reassigned the same week.
The procedure is prose
"Supervisors should ensure that the incident is reported appropriately and in a timely manner" is a sentence, not a step. Who, what, by when, record, in a table.
The policy says one thing and the floor does another
A policy that says every near miss is reported, on a site where the near-miss cards are empty and everyone knows why, is evidence against the company, not for it. Write the rule you will enforce, then enforce it.
The legal timescales are missing or wrong
The 8-hour and 24-hour OSHA clocks and the RIDDOR "without delay" are the parts the regulator checks first. Put them in the policy, repeat them in the procedure step, and put the phone numbers next to them.
No consequence is stated
A policy with no non-compliance line is a recommendation. One sentence is enough.
It is written in legal language for a floor audience
The policy page can be formal; the procedure page is read by a supervisor under stress. Short sentences, the next action, the time limit, the phone number.
Make it a video
The procedure stays as the controlled document. The part staff must know by heart (report before the end of the shift, never punished for reporting, who to call) is a 60-second video shown at induction and once a year, in every language on site.
Questions
What is the difference between a policy and a procedure?
A policy is the rule and the reason: what the organisation requires and why. A procedure is the method: the steps by which the rule is carried out, who does each one, by when, and what record it leaves. Policies change rarely and are approved at the top; procedures change whenever the method improves and are owned closer to the work.
Do they have to be separate documents?
They have to be separate sections with separate readers in mind. Many organisations keep them as one file with a policy page followed by the procedure page, sharing a number, which is what this template does. The mistake is blending them into one text.
Which policies does a small site legally need?
It depends on the country and the industry, but the common set is: health and safety (UK: a written policy at 5 or more employees; US: specific written programmes such as hazard communication, lockout and emergency action), incident reporting, equal opportunity and harassment, data protection, and discipline and grievance. Food, pharma and finance add their own.
How often should policies be reviewed?
Annually for anything with a legal basis, and immediately when the law changes. Procedures are reviewed when the method changes and at least every two years. Put both dates on the control table.
Can the procedure be a video?
The procedure stays as a document because it is the controlled record. But the part that staff must know by heart (report before the end of the shift, never be punished for reporting, who to call) is a 60-second video shown at induction and once a year, in every language on site.
Sources
- OSHA 29 CFR 1904: Recording and reporting occupational injuries and illnesses (1904.29, 1904.33, 1904.39)
- HSE: RIDDOR, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (UK)
- HSE: Investigating accidents and incidents, HSG245
- India: Factories Act 1948, section 88 (notice of accidents)
Turn your policy and procedure into a video
Send one procedure. We send back a 60-second branded video with a quiz, in your crew's languages. Free, no obligation.