Safety Culture and Behavioural Safety: What the HSE and HSA Actually Say

Safety culture is one of the most heavily marketed ideas in health and safety and one of the least precisely defined. It is worth knowing what the two regulators on these islands actually publish on the subject, because both are more cautious than the consultancies selling programmes in their name — and the HSE in particular publishes warnings that rarely make it into a sales deck.

The definition the HSE uses

The HSE’s human factors guidance adopts the definition produced by the Advisory Committee on the Safety of Nuclear Installations human factors study group in 1993: safety culture is the product of individual and group values, attitudes, perceptions, competencies and behaviour patterns, and is a subset of overall organisational culture.

The HSE adds a claim worth quoting in any business case: an organisation’s culture can influence safety outcomes as much as its safety management system. And it adds a warning — many companies wrongly equate safety culture with employees’ compliance with rules, when management style matters more.

The HSE’s stated key aspects of an effective culture are management commitment, visible management, good two-way communication and active employee participation. Its stated symptoms of a poor culture are routine procedural violations, failure to follow the organisation’s own safety management system, and management decisions that consistently favour production or cost over safety.

The HSE’s warnings about behavioural safety

Behavioural safety programmes define safe and unsafe behaviour, observe it, then feed back to reinforce or re-educate. The HSE recognises real benefits: workforce participation, manager visibility, leading indicators, better safety conversations.

Its cautions are more interesting, and an employer about to commission a programme should read them first. The HSE states that behavioural approaches have limited benefits for the control of major hazards and must be combined with engineering and systems work. It says evidence is needed that behaviour change, rather than better procedures or equipment, is what improved safety. It observes that programmes tend to focus on easy issues, and gives that tendency a memorable name: "boots not leaks". It warns that they can shift responsibility onto individuals and ignore management behaviour, that off-the-peg or consultant-led programmes fit local culture poorly, and that a blame culture or a sense of surveillance undermines them.

Two further points. The HSE warns that a failed programme can leave a workplace worse off than before it started. And it cautions against assuming that the accident triangle applies equally to occupational ill-health, minor injuries and major accidents — which is to say, reducing minor incidents does not reliably reduce catastrophic ones.

The named HSE guidance

Three documents carry most of the weight:

• HSG48, "Reducing error and influencing behaviour" — the human factors guidance on human error and behaviour, aimed at managers, safety professionals and employee representatives.
• HSG65, "Managing for health and safety" — the 2013 revised edition, which sets out the Plan, Do, Check, Act cycle and explicitly aims to balance the systems and behavioural aspects of management. It treats health and safety as part of good management rather than a standalone system.
• INDG417(rev1), "Leading health and safety at work" — issued by the HSE jointly with the Institute of Directors, first published in 2007 and revised in June 2013.

INDG417 is the one to put in front of a board. It sets three essential principles: strong and active leadership from the top, worker involvement, and assessment and review. The worker involvement principle expressly includes providing high-quality training, and the guidance notes that providing health and safety training to some or all of the board can promote understanding. Its checklist asks how the organisation is ensuring that all staff — including the board — are sufficiently trained and competent in their health and safety responsibilities.

Its four-part agenda is worth knowing because it maps onto what inspectors ask. Under Plan, the board must know the organisation’s significant risks before agreeing a policy. Under Do, it must resource the arrangements, obtain competent health and safety advice, ensure risk assessments are carried out, and involve employees or their representatives in decisions affecting their health and safety. Under Check, it must give appropriate weight to preventive information as well as incident data, audit management structures and risk controls periodically, and maintain procedures for new or changed legal requirements. Under Act, it must review health and safety performance at least once a year.

Measuring it: the Safety Climate Tool and the maturity models

The HSE sells a Safety Climate Tool, an online survey of 40 questions with anonymous responses, producing a report benchmarked against the HSE’s own industry dataset. The HSE is careful about what it claims: the tool measures an element of safety culture, not the whole of it. Its eight factors are organisational commitment, health and safety oriented behaviours, health and safety trust, usability of procedures, engagement in health and safety, peer group attitude, resources for health and safety, and accident and near miss reporting.

Two other published frameworks are widely cited. HSE research produced a safety culture inspection toolkit for railway inspection built on five indicators: leadership, two-way communication, employee involvement, learning culture, and attitude towards blame. That last indicator — attitude towards blame — is the one organisations most often leave out of their own measures.

The best-known maturity model is Fleming’s, published by the HSE as an Offshore Technology Report, with five levels running from poor to excellent: pathological, reactive, bureaucratic, proactive and generative. One caveat that honest use requires: Fleming’s own later retrospective notes the levels are conceptual rather than empirical — there is no evidence that organisations move through them sequentially. Treat the model as a conversation structure, not a measurement instrument.

A separate HSE literature review on leadership behaviours for safety reached a conclusion worth holding onto: leadership is a key component of a safe organisation, but there is no agreement on how leadership should deliver safety, what actions are needed, or who should take them, and very little leadership literature addresses safety at all, particularly major hazards.

What the Health and Safety Authority publishes

Ireland’s Health and Safety Authority takes a more enthusiastic line on behavioural safety than the HSE, and its guidance is more practical.

Its Behaviour Based Safety Guide, "Doing what we do: Better, smarter, safer", published in 2013, frames behaviour based safety as bottom-up with top-down support and builds it on the antecedent, behaviour, consequence model. The claim in it that matters most for anyone buying training is this: consequences shape behaviour more strongly than antecedents such as training or signs. The guide prefers positive reinforcement to negative, which it says tends to produce mere compliance, and it identifies goal setting paired with specific, frequent feedback as the most effective combination. It also criticises assessing competence when someone leaves the training room, on the basis that learning alone does not sustain safe practice, and recommends training all employees in observation and feedback technique and training leaders to analyse behaviour.

The HSA’s stated aim is a "total safety culture", in which people hold safety as a value rather than a priority, take responsibility for colleagues as well as themselves, and are willing to go beyond the call of duty. It recommends assessing long-term culture and recent climate before and after an intervention, which is the discipline most programmes skip.

The HSA’s earlier management guidance, "Workplace Safety and Health Management", published in January 2006, sets out five elements — policy and commitment, planning, implementation and operation, measuring performance, and auditing and reviewing performance. Its introduction states that organisations which manage safety and health successfully invariably have a positive safety culture, and its implementation section states that the visible and active leadership of senior managers fosters one. Its section on training, awareness and competence requires systems and resources for information, instruction, training and supporting communications, with training records maintained, and notes that proper supervision helps ensure competence is developed and maintained. Its performance standards section contains the line to pin above a competence matrix: nobody should be made responsible for a task unless they meet suitable competence criteria.

For the statutory baseline that sits underneath all of this in Ireland, see our guide to HSA mandatory training requirements.

Frequently asked questions

Is there a legal requirement to have a positive safety culture?

No. Culture is not a statutory duty. The statutory duties are risk assessment, competence, supervision, consultation and reporting — and both regulators treat culture as what determines whether those are done well.

Does the HSE recommend behavioural safety programmes?

It recognises benefits and publishes substantial cautions, including that such programmes have limited benefits for major hazard control and that a failed programme can leave a workplace worse off than before.

Can safety culture be measured?

Climate can be surveyed. The HSE’s own tool is careful to claim it measures an element of culture. Maturity models give structure but, on the author’s own account, lack evidence that organisations progress through the levels in sequence.

What should a board actually do?

Follow INDG417: strong and active leadership, worker involvement including high-quality training, and assessment and review — with performance reviewed at least annually.

How does this relate to ISO 45001?

ISO 45001 does not use the word culture as a requirement, but its clause 5.4 on consultation and participation of workers covers much of the same ground, including requiring the removal of barriers such as language, shift patterns, literacy and fear of reprisal.

Doing this honestly

The regulators’ own material suggests a short test for any culture programme: does it address management behaviour as well as frontline behaviour, does it measure before and after, does it include attitude towards blame, and is it combined with engineering and systems improvement rather than offered instead of them?

Training is part of that, not the whole of it — and the HSA is explicit that training alone does not sustain behaviour. Where training does belong is competence: the qualifications your managers and practitioners hold, such as IOSH Managing Safely and the NEBOSH National General Certificate, and the reporting and investigation discipline covered in our guides to RIDDOR and incident investigation documentation. To see our catalogue, explore our CPD courses or see pricing for teams.