Health & Safety at Work Act 1974 – PPM Duties for Property Managers

How HSWA 1974 Really Shapes Your PPM Duties

If you plan or oversee maintenance in residential or mixed‑use buildings, HSWA 1974 almost certainly touches your day‑to‑day decisions. The key question is not job title, but how your PPM choices affect real risks for residents, staff, visitors and contractors.

Once you see PPM as a safety‑critical control system, not just a schedule, your duties under sections 2, 3 and 4 become much clearer. This article shows how to map control, design a defensible maintenance regime and record decisions in a way you can explain if something goes wrong.

• Clarify when you become an HSWA dutyholder through PPM decisions
• Translate sections 2, 3 and 4 into concrete maintenance tasks
• Build records and logs that stand up to regulatory scrutiny

Does HSWA 1974 apply to your PPM work (and why it’s more than “keeping up the schedule”)?

If your maintenance decisions can change anyone’s safety in a building, HSWA almost certainly applies to you.

Under the Health & Safety at Work etc. Act 1974 (HSWA), the real test is not “am I the owner?” but “does my undertaking create or control risk?”. If you plan, instruct or oversee maintenance, you are part of that undertaking. That is why a simple job calendar is not enough. You are expected to run a system that spots foreseeable harm and controls it in a planned way.

Planned preventive maintenance (PPM) is one of the main ways you reduce those foreseeable harms. Poorly maintained stairs, lighting, doors, water systems or electrical plant can lead to slips, trips, falls, fires, shocks and exposure to hazardous substances. Those outcomes are well known and avoidable, so regulators expect you to act before something fails, not only after it breaks.

To make this work day to day, you need a shared definition of PPM across your team. PPM should mean a controlled process that sets scope, frequency, method and evidence for each task, not just “things in the calendar”. That process must support the HSWA duty to protect both employees and non‑employees who may be affected by your activities.

HSWA uses the test “so far as is reasonably practicable”. That does not mean “as far as the budget will stretch”. It means you weigh the risk reduction benefit of a control against the time, cost and effort involved, and you can explain that reasoning later if you are challenged. A defensible PPM regime gives you that explanation trail. You are far stronger when you treat your PPM calendar as a safety‑critical control system, not just an admin tool.

Before you change anything, ask yourself this: if an inspector walked the site after an incident, would they see an organised maintenance system that controls the main harm pathways in your common parts, or a string of ad‑hoc jobs?

When you become the HSWA dutyholder: a practical “control test” for property managers

You become relevant under HSWA when you have real control over how risks are managed, not only when your job title says “responsible person”.

Start by mapping what you actually control day to day. Do you decide which contractors are used? Do you approve scopes and quotes? Do you control access to plant rooms, risers or roofs? Do you sign off completion, or decide whether to defer work? Every one of those control points pulls you into the dutyholder picture.

If a client tells you “you’re just the agent”, look at the appointment and how work actually flows. If you instruct contractors in your own name, coordinate their attendance, or accept work as “complete”, you are actively managing risk, not just passing messages. That creates an expectation that you will do so competently and systematically.

Paperwork can also mislead. Leases and contracts may assign responsibilities in one way, but if the on‑site workflow is different, regulators tend to look at reality, not theory. If, in practice, your team handles all repairs in common parts, you should assume you share responsibility for how those repairs are planned and controlled.

A simple scenario makes this real. If you choose to defer replacing a failed emergency light on a stair to “next budget year”, you have effectively accepted the increased evacuation risk for everyone who uses that stair. An investigator will look at that decision at least as closely as any contract wording.

In mixed‑use or multi‑occupied buildings, the position is more complex. Control is often split by zone: the landlord or managing agent may control common parts, while individual tenants control their demised areas. Your PPM plan should therefore be explicit about which systems and areas you own, which you support, and which you only monitor at the interfaces.

Access is a good test of this. Where you cannot get into flats or risers, “reasonable steps” usually means you can show repeated attempts, use of agreed access windows, escalation to the client or board, and interim controls where risk is believed to be higher. Doing nothing and letting jobs age silently is very hard to defend.

HSWA sections 2, 3 and 4 → your PPM micro‑obligations

The general duties in HSWA translate quite cleanly into maintenance obligations once you read the wording with plant and premises in mind.

• Section 2 covers your duties to employees. It includes the duty to provide and maintain safe plant and systems of work, and to maintain workplaces under your control in a safe condition. Your PPM regime is one of the main ways you show that plant, equipment and the fabric of the workplace are kept safe over time.

• Section 3 extends duties to people who are not your employees but may be affected by your undertaking. For you, that means residents, visitors, contractors, commercial occupiers and anyone else who can be harmed if your maintenance is weak. A schedule that only considers staff exposure is rarely enough in residential or mixed‑use estates.

• Section 4 addresses those who have control of non‑domestic premises. If you control common parts, plant rooms, escape routes or shared systems, you must ensure they, and the means of access to them, are safe. That is broader than “keep the plant running”; it is about safe condition and safe access for those who use or maintain the premises.

To avoid what many regulators call “maintenance theatre”, you should link each PPM activity back to a clear “safe condition” outcome. For a fire door that might be correct gaps, closing action and seals; for emergency lighting, it may be luminaires that operate for the required duration and are free from damage. Completing a visit is not the same as proving the asset is safe.

When work slips, you then need to apply the “reasonably practicable” test. What is the risk if the task is delayed, what options do you have to reduce it, what do they cost, and is it grossly disproportionate to do more now? Recording that reasoning in a simple decision log is often the difference between an understandable constraint and an unjustified omission.

A useful sense‑check is this: could you explain, in plain language, how your PPM system gives effect to sections 2, 3 and 4 for your portfolio? If you can, and your records back it up, you are in a much stronger position.

Build a defensible PPM system: register → criticality → task design → verification → exceptions

Once you are clear on duties and control, you can design a PPM system that will stand up to scrutiny and still work operationally.

Build the right asset register

You need a live register of the assets and systems you are actually responsible for, not just what appears on historic plans. That should cover obvious plant (boilers, electrical distribution, lifts, smoke control, pumps) and the less obvious elements that affect safety (fire doors, guardrails, glazing, drainage, water systems, roofs and gutters, play equipment where relevant).

Each record should include a clear identifier, location, what the asset does, the main hazards if it fails, and who owns the maintenance decision (you, the client, a specialist). Without this, you cannot sensibly plan PPM or prove coverage.

Set frequencies using criticality, not habit

When your team asks “how often?”, you should be thinking “how critical?”. For each asset, consider the likely harm if it fails, how often that might happen, how many people are exposed, and how quickly you would notice. Combine that with any statutory minimums and manufacturer instructions to set intervals that are fair and defensible.

Life‑safety systems, gas, electrical distribution and water hygiene controls will usually warrant more frequent checks than low‑risk decorative items. Where you deviate from common patterns, record why, so you can explain it in audits, tenders or post‑incident reviews.

Design tasks that clearly control a hazard

For each PPM task, be clear what hazard it controls and what “good” looks like. Separate:

• statutory inspections (for example, thorough examination of lifts or pressure systems, gas safety checks, electrical inspection and testing)
• manufacturer‑recommended servicing and adjustments
• additional risk‑based checks you have chosen because of building layout, history or occupancy

If you cannot say which risk each task controls, it will be hard to justify it, defend a deferral, or retire the task later.

Add verification, not just completion

A common failure mode is a system that shows “complete” in the CAFM, but nobody can show that the asset is actually safe. You reduce that risk by requiring simple verification, such as measured values, pass/fail readings, photographs, commissioning sheets or independent certificates where appropriate.

You do not need to drown your teams in paperwork, but you do need enough evidence to show that checks were done competently and that obvious defects were identified and addressed.

Manage exceptions visibly

Deferrals, access failures and scope changes are where many regimes fall down. You should treat these as exceptions that need conscious approval. At a minimum, record what is being deferred, why, what interim controls are in place, who approved the decision, and when it must be reviewed.

Repeat defects are another warning sign. If the same item keeps failing or generating call‑outs, ask what failure mode you are not controlling. You may need to change the task, upgrade the asset or adjust the design, rather than logging yet another reactive job. If you keep seeing the same lift, pump or fire door in your reports, it is a signal that your PPM needs to change, not simply push harder.

Accreditations & Certifications

PPM touchpoints with other UK regimes (so your HSWA system does not miss “the what”)

HSWA sets the overall duty; other regulations often define specific expectations for particular risks. Your PPM system needs to join these up so that you are not strong in one regime and weak in another.

Construction work, including some major maintenance and refurbishment, can trigger construction design and management duties. In that case, you or your client may take on roles such as “client” or “principal designer” and must ensure that work is planned and carried out safely. Your PPM programme should flag when work crosses that threshold so duties are not missed.

Asbestos management is another example. If there are asbestos‑containing materials, your maintenance plan should reflect the survey and register: controlling disturbance, planning re‑inspection and ensuring contractors see the information before they work. Keeping the asbestos report in a separate folder without linking it to work orders is a common and risky gap.

Water systems require control of legionella risks. That usually means risk assessment, temperature monitoring, flushing, cleaning and remedials that are coordinated with your PPM. Again, the key is linking findings to tasks and actions, rather than treating the report as a one‑off exercise.

Workplace health, safety and welfare regulations set baseline conditions for floors, traffic routes, lighting, cleanliness and sanitary conveniences. Many of those are maintained through routine tasks rather than one‑off projects, so your PPM plan needs to cover them alongside plant and equipment.

Fire safety and, for some buildings, newer building‑safety requirements add further layers. Your maintenance of alarms, emergency lighting, fire doors, smoke control and structural fire protection should align with the fire risk assessment and any building‑safety case. Defects and actions should be closed out through the same system, not on an isolated spreadsheet.

Thinking this way helps you avoid a situation where you can show effort in one regime but cannot show a joined‑up control of risk across them. If you want external eyes on how well your current PPM joins these regimes up, you can arrange a focused review and benchmark it against a more defensible standard.

What “good evidence” looks like: PPM register, completion proofs, remedials, audit trail and retention

Evidence is what turns a well‑intentioned maintenance plan into something that can withstand scrutiny.

Build a minimum evidence pack per safety‑critical asset

For safety‑critical items, you should be able to pull, quickly and in an organised way:

• the asset record
• the planned task schedule
• recent inspection or service reports
• any test results or readings
• defect lists and remedial records
• proof of completion and, where needed, re‑testing

If that bundle takes days to assemble from emails and shared drives, your system is not yet robust, even if the work has been done.

Plan retention, do not hoard everything forever

Record retention needs to balance defensibility with data protection and practicality. You should set clear retention periods for different classes of record, guided by legal limitation periods, regulatory expectations, insurance requirements and your own policy.

Many organisations keep key safety records for a number of years that matches or exceeds typical claim periods, but you still need to document the logic and apply it consistently. Holding everything indefinitely, especially where personal data is involved, can create its own risks.

Make retrieval straightforward

From an investigator’s or auditor’s perspective, “we have it somewhere” is not enough. Your naming conventions, folder structure and system fields should allow someone unfamiliar with your team to locate records by asset, date, building, risk type and contractor. Version control should be clear so that superseded documents are not mistaken for current ones.

Protect integrity

You also need basic controls over how records are edited and by whom. Unexplained gaps, overwritten reports or casual alterations can undermine confidence in your whole system. Simple access controls, change logs and review points go a long way to avoiding that.

Fire‑safety‑related records, and records for security and other life‑safety systems, will often attract greater scrutiny. For those, make sure it is obvious what was checked, against what standard, by whom, what defects were found and how they were closed. Independent certification where applicable strengthens the position further.

Responsibility split you can actually run: landlord vs tenant vs managing agent

In real portfolios, duties are rarely held by one party alone. You need a picture you can operate, not just clauses in a lease.

A good starting point is a simple matrix that lists building systems and areas down one side and maps who is responsible for each of: paying, instructing, overseeing and evidencing. That matrix should reflect leases, appointments and what actually happens on site.

Where you manage contractors on a client’s behalf, ask what you must control even though the client is the primary dutyholder. Often that includes contractor selection, competence checks, permit requirements, method approvals and site supervision standards. Those expectations should be written into scopes of service and authorisation routes.

Procurement then becomes part of your risk control. You should be clear whether you are buying a safe outcome or a set number of visits. Evaluation criteria should cover technical capability, supervision, record‑keeping and willingness to work with your evidence standards, not just day rates.

Certificates and badges are useful, but they are not the whole storey. For higher‑risk work, you should know how competence is maintained, how equipment used for testing is calibrated, and how non‑conformities are handled. A contractor who can explain this calmly in a meeting is usually a safer choice than one who only waves an accreditation logo.

For resident‑occupied buildings, responsibility also includes access, communication and interim controls. Someone has to own the process when works are blocked by no‑access, vulnerability or other constraints. That process should be clear enough that residents know what to expect and you can still show you have taken reasonable steps to manage risk.

Finally, think about how your responsibility split will look if something goes wrong. Backlog age, deferral reasons, and how quickly high‑risk issues were escalated to the board or client are often key parts of that storey. A visible, risk‑ranked view of outstanding work helps here and makes it easier to defend decisions later.

Reliable Property Maintenance You Can Trust

From routine upkeep to urgent repairs, our certified team delivers dependable property maintenance services 24/7 across the UK. Fast response, skilled professionals, and fully insured support to keep your property running smoothly.

Book Your Service Now

Book your free consultation with All Services 4U today

If you already have backlogs, deferrals and access issues, the hardest question is often which risks you can safely live with for now. A short conversation can help you apply “reasonably practicable” logic to those decisions, with clear interim controls and review dates you can stand behind.

In a focused triage, you can map who really controls what in one of your buildings, where your PPM chain is weakest, and how your current evidence would look if it was tested. That gives you a baseline without disrupting day‑to‑day operations, and lets you decide where to focus first.

From there, you can turn findings into an action plan that ranks work by risk, assigns named owners, and sets timescales that reflect both safety and access realities, rather than leaving everything in the same queue. If you manage a portfolio, you can pilot this in a single high‑signal site to prove the approach before rolling it out.

Ahead of the call, it helps if you can pull together a simple pack: a current asset list, the last twelve months of PPM completion data, an overdue or deferral log with reasons, and a list of your main maintenance contractors and their scopes. With that information in one place, we can review your HSWA‑driven PPM duties clearly. You then see exactly where they are well controlled, and where they need focused attention next.

Frequently Asked Questions

Explore our FAQs to find answers to planned preventative maintenance questions you may have.