The duty of care checklist

Run the list twice: first check that each item exists, then check that you could actually produce it tomorrow if someone asked.

Before you start: what the law prescribes about format

Nothing.

Regulation 3(6) of the Management of Health and Safety at Work Regulations 1999 names two things that must be recorded: the significant findings of the assessment, and any group of employees identified as being especially at risk. It prescribes no template, no standalone document, no file format and no retention period. There is no Approved Code of Practice for these Regulations, and none anywhere on stress, so nothing else fills the gap.

HSE's own equivalence checklist asks employers to "provide documentation to show what you have done at each stage of the process". That is the standard. A dated shared folder passes it. Where those requirements come from, and what the courts have made of them, is in the employer duty of care guide.

The assessment itself

1. A risk assessment exists that covers psychosocial risk, not only physical hazards. Legal requirement (MHSWR 1999, reg. 3(1)), and it applies from your first employee with no headcount threshold. HSE's position on scope: "You should assess the risk of stress, and its impact on mental and physical ill-health, in the same way as you assess other work-related health and safety risks."
2. The significant findings are recorded in writing, along with any group of employees identified as especially at risk. Legal requirement at five or more employees (reg. 3(6)). Below five, HSE's words: "If you have fewer than five workers, you don't have to write anything down." The duty in item 1 still applies.
3. The assessment carries a date, a named assessor and a stated next-review point. Good practice. Regulation 3(3) requires review when there is reason to suspect the assessment is no longer valid, or after a significant change, and names no interval. A stated review point is how you demonstrate that reviews actually happen.
4. It names the psychosocial hazards specifically, rather than gesturing at wellbeing. Good practice. HSE's Management Standards give you the six areas to work through: demands, control, support, relationships, role and change. You do not have to use them, and HSE publishes an equivalence checklist headed "Is my risk assessment approach suitable and sufficient?" for organisations that use something else.
5. A written health and safety policy statement exists. Legal requirement at five or more employees (HSWA 1974, s. 2(3)). Employers of fewer than five are excepted by the Employers' Health and Safety Policy Statements (Exception) Regulations 1975. This is a separate five-person threshold from item 2 and the two are constantly conflated.

What is underneath it

6. Something systematic sits behind the findings, not one person's impression. Good practice, method entirely open. No survey is required. HSE, on its own instrument: "A survey is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways." Recorded, dated conversations count. HSE publishes a Talking Toolkit of six conversation templates for exactly this.
7. Whatever you use is repeated, so you have a series rather than a snapshot. Good practice, and the one that answers reg. 3(3) most directly. If the questions, the scale or the supplier change every cycle, you have snapshots.
8. Results are handled in aggregate, and nobody is identifiable. Good practice, and what makes the answers in item 6 worth having. HSE positions its own tool as giving "a broad indication to organisations of how well their workforce rate their performance". It measures working conditions across a workforce, and it does not measure anyone's health.

What happened next

9. An actions log exists, with each action linked to a finding, and an owner and a start date on it. Good practice, and the item that most often decides a case. An assessment that identifies a risk and then goes quiet proves knowledge without proving response.
10. Those actions have closure notes: what was done, and when it was marked complete. Good practice.
11. There is a record of what staff were told, and when. Good practice. Findings, changes made, support routes available.
12. Support routes are current and signposted. Good practice, and worth understanding precisely. Hatton proposition (11) says an employer offering a confidential advice service "is unlikely to be found in breach of duty". The Court of Appeal has since held that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases" (Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45]). So it is worth having and weighs in your favour, but it does not cover for items 9 and 10.
13. A note shows the aggregate findings reached someone senior enough to act on them. Good practice. This is what manages the "ought to have known" limb of the foreseeability test.
14. Prior cycles are kept, so the sequence of measure, act and review is visible over years. Good practice.

What nobody asks you for

Worth knowing, because each of these is sold somewhere as a duty.

There is no legal requirement to provide counselling or an employee assistance programme. There is no legal requirement to run a staff survey, including HSE's own. There is no requirement to follow the HSE Management Standards, and no score to hit against them: HSE "does not expect an employer to meet all the standards". There is no obligation to adopt ISO 45003, and no accredited certification to it exists. There is no requirement to appoint mental health first aiders. Work-related stress is not reportable under RIDDOR, whose regulation 8 lists six occupational diseases, none of them psychological. And nothing in any of this names a wellbeing app, platform or programme.

Skipping every one of those is compatible with the law, provided items 1, 2, 9 and 10 are actually happening.

If an inspector does call

Less likely than the coverage suggests. HSE publishes its own filter: it "will only consider investigating potential issues of work-related stress where it is evident that several employees are experiencing work-related stress or related ill health", it will not generally investigate individual cases reported by employees, and it expects the concern to have been raised with the employer first. HSE is also not the body for bullying and harassment, and refers those to Acas, the Equality and Human Rights Commission and the police.

For most employers the realistic exposure is civil, and the civil test reads items 9 and 10 before anything else.

Scoring yourself

If items 1, 2 and 5 are missing, start there; those are the ones with statutory language attached.

If items 1 to 8 are present and 9 to 11 are not, you are in the position this checklist exists to prevent: you have documented that you knew, and nothing documents what you did. That is a worse evidential position than having done neither.

If everything is present but nothing has a date on it, none of it does the work: an undated record cannot show when you knew or when you acted.

The explanation behind each item, with the statutory text and the case law, is in how to evidence your duty of care, and the full legal position is in the employer duty of care guide.

Alltoogether's free Strategy Audit walks your current records against this list and tells you which items are missing. Items 6, 7 and 8 are the ones the free IWE pulse covers, funded by our broking work, with results shown as averages of five or more people.