You evidence your duty of care with dated records: a risk assessment that includes psychosocial risk, a log of actions taken and closed, a note of what was communicated to staff, and measurement repeated over time. Good intentions, a caring culture, a manager who "would always notice", none of it counts until it is written down with a date on it.
Two audiences can put these records under scrutiny, and they ask the same question in different accents.
An HSE inspector asks whether you carried out a suitable and sufficient risk assessment, which is the requirement in regulation 3 of the Management of Health and Safety at Work Regulations 1999, and whether health was inside its scope. HSE's position on that scope is not ambiguous: "Employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it. This is the same duty you have to protect people from other health and safety risks."
A court asks something narrower and, for most employers, more likely to arise. Following Hatton v Sutherland [2002] EWCA Civ 76, largely upheld in Barber v Somerset CC [2004] UKHL 13, liability for psychiatric injury caused by work turns on whether harm to that particular employee was reasonably foreseeable, judged on what the employer knew or ought reasonably to have known. The threshold question, as reproduced in Easton v B&Q plc [2015] EWHC 880 (QB) at [50], is "whether this kind of harm to this particular employee was reasonably foreseeable". Foreseeability attaches to knowledge, and knowledge is a thing you can only demonstrate with a record.
Notice what neither of them asks for. Nobody asks how much you care. They ask to see records, because a record is the only form in which "we acted when we knew" can be tested later. Both questions come out of the same body of law, and it is set out in full, with the statutory text and the cases behind it, in the employer duty of care guide.
The underlying risk is not speculative. HSE estimates 964,000 workers in Great Britain with work-related stress, depression or anxiety in 2024/25, and 22.1 million working days lost to it, an average of 22.9 days per case (HSE, Work-related stress, depression or anxiety statistics in Great Britain, 2025, published 20 November 2025). Those are self-reported figures: they capture what workers themselves attribute to their work, not diagnoses.
Across the statutory duty, the case law and the HSE Management Standards, a defensible record keeps coming back to five things.
First, a dated risk assessment covering psychosocial hazards as well as physical ones. If you employ five or more people, the significant findings must be recorded in writing, along with any group of employees identified as being especially at risk (MHSWR 1999, reg. 3(6)). Below that threshold the assessment duty still applies in full; only the written-record requirement falls away.
Second, something systematic underneath it. A single anecdote, or a single survey, tells you where things stood on one day. What regulation 3(3) expects is an assessment kept current: reviewed when there is reason to suspect it is no longer valid, or after a significant change. Repeated measurement is one way to satisfy that. So are structured, recorded conversations. HSE is explicit that a survey "is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways", so nobody should be selling you one on the basis that the law demands it.
Third, actions taken and closed. An assessment that identifies a risk and then goes quiet is worse than unhelpful, because it proves knowledge without proving response. Each action wants an owner, a date, and a closure note.
Fourth, communication records. What did staff hear about the findings, the changes made, and the support available? On support specifically, keep both halves of the law in view. Hatton proposition (11) says an employer offering a confidential advice service "is unlikely to be found in breach of duty", but the Court of Appeal has since held that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases" (Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45]). Having an employee assistance programme is a factor. It is not a shield, and it is not a substitute for the rest of the record.
Fifth, oversight. Someone senior saw the aggregate findings and had the authority to act on them. This is what manages the "ought to have known" limb: risk information that never reached a decision-maker still counts as knowledge the organisation ought to have acted on.
One reassurance about all of this. Regulation 3(6) specifies only what has to be recorded, not how. It prescribes no format, no standalone document, no template and no retention period, and there is no Approved Code of Practice for these Regulations that could add one. HSE's own equivalence checklist asks employers to "provide documentation to show what you have done at each stage of the process". That is the whole test. A shared folder with dates in the filenames passes it.
The checklist version of the above, laid out as something you can work through, is at the duty of care checklist.
The commonest is the annual survey with no actions log. The survey proves you knew; the missing log means nothing shows what followed. Since foreseeability attaches to knowledge, that is a record which establishes what you knew without establishing what you did.
The second is the policy suite with no review dates. Documents written years ago and never revisited, which read as shelf-ware the moment anyone checks the file properties.
The third is simpler and more common than most owners expect: nothing written down at all, with the whole duty resting on the memory of whoever was in the room.
A fourth is subtler. Measurement that cannot show change, because the questions, the scale or the supplier changed each year and no two results are comparable. Regulation 3(3) is about currency, and currency needs a series, not a snapshot. Whether an annual instrument or something continuous is the better way to get that series, and what each of them is worse at, is worked through in annual survey or continuous evidence.
The reason those gaps recur is that assembling evidence retrospectively is a standalone project, and it gets deferred.
The alternative is to run measurement continuously: a short anonymous pulse at regular intervals, reported in aggregate, with each round timestamped. Done that way, every cycle deposits its own evidence as it goes. The measurement is the psychosocial layer of the assessment; the date stamp is the review record; the movement between rounds is the monitoring; and the actions you log against each round complete the trail. When the request eventually comes, the record already exists as a by-product of running the thing, rather than a scramble to reconstruct it.
That record documents that a real risk domain was measured and that action followed knowledge, which is what the foreseeability test examines. It diagnoses nobody and promises no outcome.
This is how Alltoogether approaches it. The IWE pulse gives employers free, anonymous measurement, funded by our work as a benefits broker, with results shown as averages of five or more people. The free Strategy Audit will tell you where your current records stand against the checklist.
The free strategy audit takes twenty minutes and gives you your gaps in writing. No card, no call booked at the end of it unless you ask for one.
Start the free audit →