What recent cases tell us about regulator priorities

Recent Health and Safety Executive prosecution summaries continue to show a familiar pattern. Serious injuries and fatalities are still being linked to failures in basic safety controls rather than complex or unforeseeable events.

For businesses, these cases are a reminder that enforcement is not focused on rare edge cases, but on everyday risks that were known, manageable and left unaddressed.

What enforcement data is showing

Across sectors, prosecutions frequently follow incidents involving falls from height, workplace transport, machinery and unsafe systems of work. Investigations reveal that where risk assessments existed, they were often outdated, generic or not followed in practice.

Fines remain substantial and are increasingly accompanied by detailed judicial commentary on management failings, training gaps and poor supervision.

Why regulators care

Regulators are less interested in paperwork and more focused on whether controls were embedded and understood. Many prosecutions cite a lack of supervision, insufficient training or informal workarounds that became normalised over time.

Where a serious injury or fatality occurs, the question is not simply what went wrong, but who knew the risk and what did they do about it.

Why this matters to SMEs

Smaller and mid-sized businesses often assume enforcement is aimed at large organisations. In reality, SMEs feature heavily in prosecution data, particularly where cost, time pressure or informal practices have replaced structured controls.

Directors and managers in smaller organisations are closer to the day to day operations, which can increase personal exposure where risks are obvious and longstanding.

Common questions 

We’ve never had an incident, does that help?
A good history helps, but it does not reduce expectations once an incident occurs. It can just as equally lead to further enquiries regarding record keeping and how the organisation responds to dangerous occurrences.

Are written risk assessments enough?
Only if they are accurate, current and actually followed.

Does training need to be refreshed?
Yes. Many cases involve training that was provided once and never revisited.

A practical monthly sense-check

Organisations can use enforcement summaries to ask:

These questions often reveal gaps long before an inspector does.

Useful guidance 
Final thought

Most enforcement action is not about isolated breaches. It is about basic failures that accumulated quietly until something went wrong.

Regularly reviewing enforcement trends can be one of the simplest ways to spot weaknesses before they turn into investigations.

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

This field is for validation purposes and should be left unchanged.
Name(Required)