Quick answer: Setting up a WHS management system for a small business means putting a policy in place, identifying your hazards, documenting key procedures, creating a small set of registers, training your workers, and reviewing the system regularly. It does not need to be large — it needs to work.
Last reviewed: June 2026 by the BlueSafe Technical Team. Reflects current Australian WHS laws and regulations.
A WHS management system for a small business is not a shelf of binders. It is a practical set of documents, records, and processes that help you manage safety consistently — whether you have two workers or twenty. If you have been wondering where to start, this guide walks through each step in plain language.
If you are not yet sure whether your business needs a WHS management system at all, read Does a small business need a WHS management system? first. For an overview of the WHS documents that typically apply to small businesses, see WHS documents for small business.
Step 1: Write your WHS policy
The WHS policy is the foundation of your system. It is a short, signed statement that tells workers, contractors, and visitors how your business approaches health and safety. It does not need to be long — one page is usually enough.
Your WHS policy should cover:
- the business's commitment to providing a healthy and safe workplace;
- who is responsible for WHS at each level of the business;
- how the business will consult with workers;
- the expectation that everyone follows safe procedures.
Once written, the policy should be signed by the most senior person in the business (the PCBU or an officer), dated, and displayed somewhere workers can see it. It should also be reviewed whenever the business changes significantly.
A policy that sits in a drawer and is never discussed does not add much. A policy that is introduced at induction, referred to at toolbox talks, and updated when responsibilities change tells a very different story.
Step 2: Identify your hazards and complete risk assessments
Hazard identification is the practical core of a WHS management system. You cannot control what you have not found.
Start by walking through your workplace and listing the hazards associated with each type of work. Think about physical hazards (machinery, heights, electricity, chemicals), environmental hazards (noise, heat, dust), and people hazards (manual handling, fatigue, working alone).
Once you have identified hazards, assess the risk of each one using a simple risk matrix:
- How likely is it that harm will occur?
- How serious would that harm be?
Then apply controls using the hierarchy of controls — eliminate the hazard if you can, substitute it, isolate it, engineer it out, use administrative controls, and use personal protective equipment as a last resort.
Record this process in a hazard register. Your hazard register does not need to be elaborate. A spreadsheet or table with columns for hazard, risk rating, controls applied, and the person responsible to review it is enough for most small businesses.
For higher-risk tasks — especially work at heights, electrical work, or work involving moving plant — a more detailed risk assessment or a Safe Work Method Statement (SWMS) is appropriate. SWMS are a legal requirement for high-risk construction work.
Step 3: Set up your core procedures
Three procedures form the operational backbone of most small business safety systems.
Consultation procedure
WHS law requires PCBUs to consult workers on matters that affect their health and safety. For a small business, this does not mean formal committee meetings. It means involving workers when you:
- introduce new equipment or tasks;
- make changes to the workplace;
- review risk assessments or procedures;
- investigate incidents.
Keep a record of consultation. This can be as simple as a dated toolbox talk record with signatures.
Incident and near-miss reporting procedure
Your incident procedure tells workers how to report injuries, near-misses, dangerous incidents, and property damage. It should cover:
- how to report (who to tell, what form to use);
- first aid response and who to contact;
- when to notify the regulator (serious injuries and dangerous incidents must be notified immediately);
- how investigations are carried out;
- how corrective actions are tracked and closed out.
Emergency response procedure
Every workplace needs an emergency response plan. At minimum, yours should cover:
- emergency contact numbers (ambulance, fire, regulator);
- the location of first aid kits, fire extinguishers, and emergency exits;
- evacuation routes and the assembly point;
- who takes charge during an emergency;
- how workers with a disability or mobility limitation will be assisted.
Test your emergency procedure at least once a year. Record the drill and note anything that needs improving.
Step 4: Set up your registers
Registers are the record-keeping layer of your system. They demonstrate that your safety obligations are being met in an ongoing way, not just at setup.
A small business should maintain at least the following registers:
| Register | What it records |
|---|---|
| Hazard register | All identified hazards, risk ratings, and controls |
| Incident register | All injuries, near-misses, and dangerous incidents |
| Chemical register (if relevant) | All hazardous chemicals used or stored on site |
| Training and induction register | Who has been inducted and trained, and when |
If your business uses chemicals, you are also required to maintain Safety Data Sheets (SDS) for each hazardous chemical and make them accessible to workers. The SDS list and your chemical register work together.
If you have plant and equipment, a plant register that records inspection and maintenance dates is good practice and required for prescribed high-risk plant.
Step 5: Develop SWMS and safe work procedures
Safe Work Method Statements (SWMS) are required by law for high-risk construction work. Even where they are not legally required, they are a highly practical tool for communicating how high-risk tasks should be done safely.
A SWMS for a small business does not need to run to ten pages. It needs to:
- describe the work activity;
- identify the hazards;
- list the controls;
- be reviewed before work starts;
- be signed by the workers who will do the job.
For tasks that are not high-risk construction but still carry meaningful risk — chemical handling, working at heights, using power tools, manual handling of heavy loads — a shorter safe work procedure (SWP) serves the same purpose. This can be a one-page document that explains how the task is done safely, what PPE is required, and what to do if something goes wrong.
Keep your SWMS and SWPs together and make sure workers can find them quickly before starting work.
Step 6: Induct and train your workers
A WHS management system is only as good as the people using it. Workers need to be inducted into your system and trained in the procedures and controls that apply to their work.
Your induction should cover:
- the WHS policy and who is responsible for safety;
- the major hazards in your workplace and the controls in place;
- the emergency response procedure and assembly point;
- how to report hazards, near-misses, and incidents;
- any PPE requirements;
- the worker's right to stop unsafe work.
Record each induction in your training register with the worker's name, date, and what was covered. Keep this record for as long as the person works for you — and beyond if required by your industry.
Ongoing training matters too. When you introduce new equipment, update a procedure, or identify a gap through an incident investigation, arrange the relevant training and record it. A training needs matrix — a simple table showing what training each role requires and when each worker is due for refreshers — helps keep this organised.
Step 7: Review and continuously improve
A WHS management system that is built and then ignored will quickly become out of date and legally vulnerable. Regular review keeps it current and useful.
Build review into your calendar:
- After every incident or near-miss: review the relevant procedure and risk assessment. Did a control fail? Does the hazard register need updating?
- When work changes: new tasks, new equipment, new chemicals, a new site, or new workers all require review of the relevant documents.
- At least annually: review the whole system. Check that registers are up to date, training is current, procedures still match the work being done, and the policy is still accurate.
Record your reviews and the actions they generate. An action log — a simple list of what needs to change, who is responsible, and the due date — is enough. Close out actions and keep a record that they were completed.
Continuous improvement does not require a new document every time. It requires that when the system identifies a problem, something is done about it and that action is recorded.
Keeping it proportionate
A WHS management system for a three-person trade business will look different from one for a thirty-person manufacturer. The steps are the same; the depth is different.
For most small businesses, proportionate means:
- a one-page policy instead of a twenty-page manual;
- a single hazard register rather than separate registers by work area;
- a toolbox talk record rather than a formal consultation committee;
- a handful of SWPs for the highest-risk tasks rather than a procedure for every activity.
The test is not size. The test is whether the system actually helps workers do their jobs safely and whether it would give a regulator, a client, or a court reasonable confidence that safety is being managed.
Related guides
Frequently asked questions
Does a small business need a WHS management system?
Any PCBU with workers has the same core WHS duties as a large employer. A proportionate system — policy, hazard register, key procedures, registers, and training records — is the most practical way to meet those duties consistently.
What documents does a small business WHS management system need?
At minimum: a WHS policy, a hazard register, a risk assessment for your highest-risk work, a consultation record, an incident register, an emergency plan, and an induction and training register. Add SWMS for high-risk construction work.
How long does it take to set up a WHS management system for a small business?
A basic system can be operational in a few working days using pre-built templates. The effort is mainly in adapting documents to your actual work and completing risk assessments for your specific tasks and site.
Do I need a consultant to set up a WHS management system?
No. Many small businesses build their own system using quality templates and regulator guidance. A consultant adds value for high-risk industries or complex sites but is not required for most small businesses.
Get the right documents for your business
Building your system is faster when the templates, registers, and procedures are ready to adapt rather than built from scratch. BlueSafe's WHS document products are designed for small businesses that need practical, compliant documents without the enterprise overhead.
Browse WHS documents for small business
This article provides general information only and does not constitute legal advice. WHS laws vary between states and territories. Always check the requirements that apply in your jurisdiction and, where necessary, seek advice from a qualified WHS professional or your state or territory regulator.