Lone working policy: what the law asks for, and what to put in it

01

What the law requires, and where a lone working policy fits

The definition to start from is the Health and Safety Executive's (HSE): a lone worker is "someone who works by themselves without close or direct supervision". Its leaflet Protecting lone workers: How to manage the risks of working alone (INDG73, revision 4, March 2020) is the starting point for any policy, and it is plain about the legal position: "It will often be safe to work alone. However, the law requires you to think about and deal with any health and safety risks before people are allowed to do so."

The duties come from general health and safety law, not from a lone working statute. In Great Britain the main ones are:

• Section 2 of the Health and Safety at Work etc. Act 1974: every employer must ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees, including the information, instruction, training and supervision that requires. Section 2(3) requires a written statement of the employer's health and safety policy and "the organisation and arrangements for the time being in force for carrying out that policy", brought to the notice of every employee. The Employers' Health and Safety Policy Statements (Exception) Regulations 1975 exempt an employer with fewer than five employees from the written statement, though not from managing the risk.
• Section 3 of the 1974 Act: an employer must also protect people not in its employment, such as agency staff, contractors and the public, so far as is reasonably practicable.
• Regulation 3 of the Management of Health and Safety at Work Regulations 1999: every employer must make "a suitable and sufficient assessment" of the risks to its employees and, where it employs five or more, record the significant findings and any group identified as especially at risk.

INDG73 says there is "no legal requirement to conduct a specific, separate risk assessment for lone workers", but the employer must include their risks in its general risk assessment. In practice a lone working policy is the part of the section 2(3) arrangements that deals with people on their own, with the risk assessment behind it. A large employer may write a stand-alone policy and procedure; a small business may cover it in a page of its general policy.

The responsibility stays with the employer: HSE says it "cannot be transferred to any other person, including to those people who work alone". Workers have their own responsibilities too: under section 7 of the 1974 Act an employee must take reasonable care for the health and safety of themselves and of others who may be affected by what they do or fail to do at work, and co-operate with the employer so far as is necessary for it to meet its duties. In Northern Ireland the same structure comes from the Health and Safety at Work (Northern Ireland) Order 1978 and the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, as HSENI's page on lone working sets out.

02

Who counts as a lone worker in a building

HSE's list includes people who "work separately from other people on the same premises or outside normal working hours, for example security staff, cleaners, maintenance and repair staff". In the buildings that facilities managers, cleaning and security providers and managing agents look after, the lone workers are usually:

• Out-of-hours cleaners in an office, school or surgery after it has emptied, or before it opens.
• Security officers on a static site at night or at weekends, and mobile patrol officers visiting several sites alone, including alarm response and key holding visits.
• Caretakers and site managers opening up early, locking up after an evening letting, or checking the building in the holidays.
• Maintenance engineers and contractors in plant rooms, roof spaces, risers and car parks that nobody else visits.
• Receptionists, concierges and porters covering a desk alone at the start or end of the day.

A person can be a lone worker for part of a shift. The cleaner who finishes the top floor alone, or the officer left on site after colleagues go home at 22:00, is alone when help is furthest away. Define lone working by the situation, not only by the job title.

Contracted work needs care, because both employers have duties. INDG73 says that when the lone worker is at another employer's workplace, their employer should consult that employer to identify the risks and the control measures. The client knows the building, its alarms and who else may be there; the contractor knows its own people. The site's assignment instructions or method statement should carry what they agree.

03

The lone working risk assessment

The risk assessment decides what the policy says. INDG73 asks employers to consider:

• The worker: how experienced they are in the role and in working alone, whether they have had relevant training, and whether they may be more vulnerable, for example because they are young, pregnant, disabled or a trainee. Where a medical condition is relevant, seek medical advice if necessary.
• The environment and equipment: operating equipment alone or lifting objects too large for one person; an isolated site; safe access to and exit from the workplace for one person outside normal hours; and "adequate and reliable means of communication and a way to call for help".
• The work itself: a security role with authority over other people, or handling cash, asking for payment or removing goods or property.
• Foreseeable emergencies: fire, equipment failure, illness and accidents.

Some work should not be done alone at all. INDG73 gives as examples work in a confined space, where a supervisor may need to be present along with someone dedicated to the rescue role, work near exposed live electrical conductors, diving, vehicles carrying explosives and fumigation. In an ordinary building the assessment may add ladder work above a set height, heavy lifting, or going into a building where the intruder alarm has activated.

HSE's test is to think about what might cause harm and decide whether you are doing enough to prevent it. With five or more employees the significant findings must be written down; HSE says the record should include the hazards, how they may harm people and what is already being done to control them. Review it when anything changes: new staff, a new site, new hours, or an incident. INDG73 also says to involve workers when considering risks and controls.

Some employers also use dynamic risk assessments, in which lone workers make decisions on the spot about risks that cannot necessarily be foreseen. INDG73 says this "is not a substitute for a comprehensive risk assessment", and that a worker expected to make one must be trained to do it, consider the range of possible control measures and what action to take, and get support for their decisions.

04

Lone working procedures: keeping in touch and raising the alarm

A procedure has to work at 02:00 with nobody to ask. HSE's page on training, supervision and monitoring of lone workers says "You must monitor your lone workers and keep in touch with them", and lists the means: supervisors visiting and observing; knowing where lone workers are, with pre-agreed intervals of regular contact by phone, radio or email; devices that raise the alarm manually or automatically; and a reliable system to make sure a lone worker has returned to base once their task is done. Turn that into steps:

1. Signing in. The worker tells a named person, or the system, when they start, where they are and when they expect to finish.
2. Check-in intervals. Set by the risk assessment and written down: for example, a call every hour for an officer on a quiet site at night, and a shorter interval for higher-risk work.
3. A missed check-in. Say exactly what happens and how quickly: call the worker, call again, then send someone or call the emergency services.
4. Signing out. Someone confirms the worker has left safely once the work is complete; an unclosed shift is followed up.
5. Code words. If a worker can raise concern discreetly on a call, everyone involved must know the word.

Lone worker devices and apps add a panic button, fall or no-movement alerts and a link to a monitoring centre. The British Standard for these services is a code of practice, BS 8484:2022 Provision of lone worker services, covering devices and apps, monitoring, training, management information and response. A device still needs someone to respond, and HSE says to test these systems and all emergency procedures regularly.

Regulation 8 of the 1999 Regulations requires procedures for serious and imminent danger, and regulation 3 of the Health and Safety (First-Aid) Regulations 1981 requires first-aid equipment and facilities adequate and appropriate in the circumstances. INDG73 says some lone workers may need to carry first-aid equipment or be trained, including in first aid to themselves.

Violence needs its own paragraph in a policy for security and out-of-hours staff. HSE says lone working "does not automatically imply a higher risk of violence, but it does make workers more vulnerable", and names late evening or early morning work, positions of authority, alcohol and drugs, and carrying money or valuable equipment. Personal safety training, support after an incident and a rule that nobody tackles an intruder all belong here.

05

Writing the policy: an outline to adapt

A lone working policy template is useful only as a list of headings; the answers about lone worker safety come from your own risk assessment. A workable policy covers:

1. Purpose and scope: who it applies to, including contractors, agency staff and volunteers.
2. Responsibilities: the senior owner, the managers and supervisors who apply it, and the lone workers themselves.
3. Risk assessment: how lone working is assessed, where the assessments are kept, and when they are reviewed.
4. Work that must not be done alone.
5. Keeping in touch: signing in and out, intervals, devices, and the escalation for a missed check-in, with names and times.
6. Emergencies: illness, injury, fire, intruders and violence, and first aid.
7. Training and supervision: induction, personal safety, the equipment provided, and how new staff are accompanied at first.
8. Wellbeing: regular contact, team updates and support after incidents.
9. Reporting: how to report incidents, near misses and concerns, and who will follow each one up.
10. Review: tests of the procedures, the review date and the version in force.

Regulation 13 of the 1999 Regulations requires employers to take account of employees' capabilities when giving them tasks, and to train them on recruitment and on exposure to new or increased risks. INDG73 says the level of supervision is "a management decision", that "the higher the risk, the greater the level of supervision required", and that lone workers may need to be accompanied at first when new to a job, in training, doing a job with specific risks or facing new situations. It also asks for clear arrangements where a lone worker's first language is not English, and warns that with poor contact workers may feel "disconnected, isolated or abandoned".

Monitoring lone workers involves personal information. The Information Commissioner's Office guidance Employment practices and data protection: monitoring workers says workers must be told how and what personal information is collected, and that a data protection impact assessment is needed before processing likely to cause a high risk. The policy should say what a tracking device or app records, who sees it and how long it is kept.

06

Where the record fails, and what SiteClara does about it

Most lone working policies are sound on paper. The weak point is the record of the night itself: a check-in that lives in a supervisor's call log, a signing-in sheet nobody reads, a patrol walked with nothing to show for it. After an incident, or when a client asks whether the building was checked, the employer often cannot say where the worker was last seen, or when.

SiteClara is a record of visits and checks, not a lone worker system. A printed QR poster, with an optional NFC tag behind it, sits at each place where work is checked: an entrance, a plant room, a toilet block, a fire exit, a patrol point. The cleaner, officer or caretaker scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, and marks each one done or explains what stopped them, with a photo when one is asked for. Each confirmation is recorded with the named person and the time, at the location. A problem reported there goes onto the team's list of jobs until someone closes it.

The supervisor sees what is due, done and missed, records the reason a check was missed, and approves a daily report for the client or manager the next morning. For a lone working policy, that is a timed trail of where each person confirmed work during the shift, useful when reviewing an incident or the risk assessment.

07

Questions people ask

Is it legal to work alone in the UK?

Yes. HSE's leaflet Protecting lone workers: How to manage the risks of working alone (INDG73) says "It will often be safe to work alone", but that the law requires the employer to think about and deal with the risks before anyone is allowed to do so. Some high-risk work may need at least one other person present, such as work in a confined space, near exposed live electricity conductors, or in diving operations.

What are the two key pieces of legislation that apply to lone workers?

In Great Britain, HSE's leaflet Protecting lone workers: How to manage the risks of working alone (INDG73) names the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. Section 2 of the Health and Safety at Work etc. Act 1974 sets the employer's general duty to its employees; regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires the risk assessment that lone working arrangements are built on.

What must an employer with five or more employees have in writing?

A written statement of its health and safety policy and "the organisation and arrangements for the time being in force for carrying out that policy", under section 2(3) of the Health and Safety at Work etc. Act 1974, and "the significant findings of the assessment", under regulation 3(6) of the Management of Health and Safety at Work Regulations 1999. The Employers' Health and Safety Policy Statements (Exception) Regulations 1975 exempt an employer with fewer than five employees from the written statement, and regulation 3(6) applies only from five; neither exempts anyone from assessing and controlling the risks.

Can you provide an example of a risk assessment for lone working?

HSE's page Risk assessment: template and examples has a template and six worked examples, none of them for lone working, and warns: "Do not just copy an example and put your company name to it as that would not satisfy the law and would not protect your employees." Build a lone working assessment from the questions in Protecting lone workers: How to manage the risks of working alone (INDG73): the worker, the environment, the work and foreseeable emergencies, recording the hazards, how they may harm people and what you are already doing to control the risks.

08

Further reading, and a list to take away

HSE publishes Protecting lone workers (INDG73) and its web guidance Lone working: Protect those working alone, with further guidance on work-related violence, stress and first aid. HSENI publishes its own lone working guidance for Northern Ireland, BSI publishes BS 8484:2022, and the Information Commissioner's Office publishes guidance on monitoring workers.

Before you sign off a lone working policy, check that:

• lone working is in the risk assessment, by situation as well as job title, and the significant findings are recorded;
• the tasks that must never be done alone are listed;
• every lone worker knows how to check in, how often, and what happens if they do not;
• the escalation for a missed check-in names a person and a time, and has been tested;
• contractors and clients have agreed who does what at each site;
• new staff are trained and accompanied at first;
• any monitoring has been explained to workers;
• the policy has an owner, a version and a review date.