Lone working policy

The rule: the risk is assessed before anyone works alone

Lone working is governed by general health and safety law rather than a lone-working statute. The Health and Safety at Work etc. Act 1974 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees, and a duty towards other people affected by its work. The Management of Health and Safety at Work Regulations 1999 turn that into a process: regulation 3 requires "a suitable and sufficient assessment of" the risks to the health and safety of employees "to which they are exposed whilst they are at work", and of the risks to other people arising from the work, and where the employer employs five or more employees it must record "the significant findings of the assessment" and "any group of his employees identified by it as being especially at risk".

The Health and Safety Executive's guidance applies that directly to working alone. It defines lone workers as "those who work by themselves without close or direct supervision", and it is plain about timing: "As an employer, you must manage any health and safety risks before people can work alone. This applies to anyone contracted to work for you, including self-employed people", which in a charity includes sessional counsellors, tutors and freelance youth workers. It adds that "There will always be greater risks for lone workers without direct supervision or anyone to help them if things go wrong", and that employers must "train, supervise and monitor lone workers" and "keep in touch with them and respond to any incident".

Three points matter particularly in this sector:

• Volunteers are included. HSE says that if an organisation has at least one employee it "must protect your employees but also others, including volunteers", must include volunteers in the risk assessment, and "should provide the same level of protection to volunteers where they carry out similar activities and are exposed to the same level of risk as employees". A group with no employees at all is not normally covered by health and safety law (exceptions include a volunteer in control of non-domestic premises, such as a village or community hall, or one who procures or controls construction work), but HSE notes that voluntary organisations and individual volunteers still owe a common-law duty of care to each other and to others who may be affected by their activities.
• In care, HSE or the local authority regulates the worker's safety. In England, CQC regulates the safety of people using a registered service, and where one of them is injured the responsible authority "will normally be the CQC unless the police have primacy". Under the memorandum of understanding between the two regulators, which applies to health and adult social care in England and not to Wales or Scotland, HSE and local authorities are "the lead inspection and enforcement bodies for health and safety matters involving workers, visitors and contractors, irrespective of registration". A care provider's lone working arrangements, so far as they protect workers, are a matter for HSE or the local authority (for example, HSE for care homes with nursing and local authorities for residential care homes), and providers registered with CQC have duties of their own under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: regulation 17(2)(b) requires systems to "assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk", and regulation 18(2)(a) requires staff to receive the support, training and supervision they need to do their work.
• A policy is not the legal requirement; the assessment is. No law says "lone working policy". The risk assessment is mandatory, and an employer with five or more employees must have a written health and safety policy, which is where lone working arrangements usually sit. A separate lone working policy is the practical way to set out the procedures, and it is what staff, volunteers, insurers and inspectors will ask for.

This guide covers England, Wales and Scotland, where HSE and local authorities enforce health and safety law; which of them enforces at a given site usually depends on the main activity carried on there. Northern Ireland has its own equivalent legislation and regulator, HSENI.

Who is a lone worker in a charity or care service

HSE's examples include health workers and people working at home. In charities, care and community services, the list is longer than most boards assume:

• home care and domiciliary care workers visiting people in their own homes (personal assistants employed directly by the person receiving care can be a different case: section 51 of the Health and Safety at Work etc. Act 1974 excludes domestic servants in a private household, although HSE says this depends on the circumstances and that duties may arise where the work goes beyond ordinary domestic service, such as hoisting);
• supported living staff on night shifts or sleep-ins, alone in a shared house;
• outreach, befriending and advocacy workers, and social workers or family support staff making home visits;
• counsellors and support workers seeing clients one to one, especially at the end of the day;
• youth and community workers opening or locking up a building after a session;
• charity shop staff and volunteers opening, closing or cashing up alone, often dealing with members of the public with no colleague on the floor, and caretakers of community halls;
• drivers and volunteers delivering food parcels, prescriptions or community transport;
• door-to-door and street fundraisers, where the charity runs its own team;
• staff working from home, for whom HSE says employers have "the same health and safety responsibilities" as for any other worker.

Lone working need not be all day. A worker who is part of a busy team for most of a shift but locks up alone at ten at night is a lone worker for those twenty minutes, and that is often when the risk is highest.

The lone working risk assessment

The risk assessment process for lone working follows the usual steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on control measures, record the findings and review them. HSE says there is "no legal requirement to conduct a specific, separate risk assessment for lone workers", but you have "a duty to include risks to lone workers in your general risk assessment", and that includes involving workers when considering the risks and the measures to control them. HSE lists the risks that particularly affect lone workers:

• Violence and aggression. HSE defines work-related violence as "any incident in which a person is abused, threatened or assaulted in circumstances relating to their work", which includes verbal threats. It notes that lone working "does not automatically imply a higher risk of violence, but it does make workers more vulnerable". Late evening and early morning work, people affected by alcohol or drugs, and carrying money or valuable equipment all raise the risk.
• Stress, mental health and wellbeing. Isolation from colleagues and managers makes it harder to get support, and HSE says procedures that allow direct contact between the lone worker and their manager can help, because managing work-related stress relies on recognising abnormal behaviour or symptoms early. It also says work-related mental health issues "must be assessed to measure the levels of risk to staff" and, where a risk is identified, you must remove or reduce it as far as reasonably practicable; a worker with a pre-existing condition may need reasonable adjustments.
• Medical suitability. Whether a person's health condition makes it safe for them to work alone, thinking about both routine work and emergencies.
• The workplace itself, for example a rural or isolated location, a building with poor lighting or a single exit, and the travel between visits, since many lone workers face work-related road risks.

In care and community work, add the risks of the setting: a visit to someone's home, where the worker does not control who else is present, whether there are pets, or whether the person's behaviour has changed since the last visit; manual handling that the care plan says needs two people, or that uses the person's own lifting equipment, where HSE says the duty to ensure the worker's safety, so far as is reasonably practicable, rests with the employer; and handling cash for shopping. HSE's health and social care guidance says "the potential risk of violence should be assessed before any home visit", using information such as that passed on at referral, information from other agencies and any past history of violence. Where a lone worker will be at someone else's workplace, HSE says "you must ask that employer about any risks and control measures".

The outcome of the assessment is a set of control measures and, where needed, restrictions on lone working: tasks that must not be done alone, visits that must be made in pairs, clients who are seen only in the office, and new or inexperienced workers who are accompanied until they are competent. HSE notes that some high-risk work always requires at least one other person, and that you "should set limits on what can be done while working alone". Record the significant findings, including any group of workers who are especially at risk, and review the assessment after an incident, a near miss, a change in a client's circumstances or a change in the service.

What a lone working policy should contain

The policy's job is to turn the risk assessment into safe systems of work: clear procedures that every person who may work alone knows before their first shift. A lone working policy for a charity or care service is short if it is specific. It should cover:

1. Policy statement and scope. What the organisation commits to, and whom it covers: employees, bank and agency workers, self-employed and sessional contractors, volunteers and trustees who work alone.
2. Roles and responsibilities. The trustees' or directors' accountability, the competent person or persons the employer must appoint to help it meet its health and safety duties (regulation 7 of the 1999 Regulations), the manager who owns the risk assessments, the line manager or on-call manager who receives check-ins, and the lone worker's own duties to follow the procedure and report concerns. HSE says the employer's responsibilities "cannot be transferred to any other person, including to those people who work alone".
3. Risk assessment. When a lone working risk assessment is done, reviewed and shared with the worker, including dynamic risk assessment on arrival at a visit. HSE says dynamic risk assessment "is not a substitute for a comprehensive risk assessment", and that a worker who may have to make one must be trained to do it, consider the possible control measures and what action to take, and get support for their decisions.
4. Restrictions on lone working. The activities, locations and people that require two workers or none.
5. Keeping in touch. The check-in procedure: how the worker's whereabouts are known, the pre-agreed intervals, and how the end of the working day is confirmed.
6. Escalation. Exactly what happens when a check-in is missed: who tries to make contact, after how long, who is told next, and when the police are called.
7. Equipment. Charged work phones, personal alarms or lone worker devices where the risk assessment calls for them, first aid kits, torches.
8. Training. Personal safety, conflict resolution and using any safety equipment, with refreshers and extra supervision for new workers. For employees, regulation 13 of the 1999 Regulations requires adequate health and safety training on recruitment and on exposure to new or increased risks, during working hours.
9. The right to leave. Regulation 8 of the 1999 Regulations requires procedures that enable people "to stop work and immediately proceed to a place of safety" if they are exposed to serious, imminent and unavoidable danger. A clear statement that a worker who feels unsafe may end a visit or leave a building without penalty, and must tell the manager when they have.
10. Reporting incidents and near misses. How to report violence, threats, accidents and near misses, including those that may need reporting to HSE under RIDDOR, any notification a registered care provider must make to CQC, and the support available following an incident. HSE says "Employers should have measures in place to support any worker who has been subject to an abusive or violent incident".
11. Review. When the policy and the procedures are tested and reviewed.

Lone worker devices and safety apps can be valuable where the risk is high, but they are not a legal requirement in themselves. HSE lists "other devices for raising the alarm, operated manually or automatically" as one option among several; the risk assessment decides whether you need one.

Check-ins and escalation: the procedure that has to work

HSE says "You must monitor your lone workers and keep in touch with them", and that workers must understand any monitoring system used. Its guidance describes the arrangements employers may use to do that: supervisors visiting, "knowing where lone workers are, with pre-agreed intervals of regular contact, using phones, radios, email etc", alarm devices, and "a reliable system to ensure a lone worker has returned to their base once they have completed their task". In practice a sound procedure has five parts:

1. An itinerary. The worker's visits or tasks, in order, known to a named person before the shift starts, and updated when it changes.
2. Contact at set points. At arrival and departure for higher-risk visits, and at agreed intervals for longer tasks.
3. Confirmation of the end of the working day. The step most often skipped, and the one that decides whether anyone notices a worker who never got home.
4. A defined response to a missed check-in. A set time before the named person acts, a set sequence of calls, and the point at which the manager goes to the address or calls the police. A procedure that says "the manager will follow up" is not a procedure.
5. Someone always receiving. An on-call rota that covers evenings, nights and weekends, so that check-ins do not land on the phone of a manager who is asleep or on leave.

HSE also says to "Regularly test these systems and all emergency procedures to ensure lone workers can be contacted if a problem or emergency is identified." A test is simple: choose a shift, have a worker deliberately miss a check-in, and see what happens, how long it takes and who knew.

Finally, keep the record. The check-in log shows the system was operated; the missed check-in log shows what was done each time; the incident and near-miss reports feed the next review of the risk assessment. Without them, the organisation can describe its procedure but cannot show that anyone followed it. Some records are a legal requirement: under RIDDOR the responsible person must keep a record of any reportable incident and of any work injury that keeps someone from routine work for more than three consecutive days, for at least three years.

The check-in that lives on the manager's phone

In most small charities and care services, the check-in system is a text. "At Mr Okafor's flat on Elm Road." "All fine, walking back to the car." "Centre locked, home." Sometimes more: "Bit uneasy, his neighbour was on the landing again, shouting about the noise." The messages go to the coordinator's or on-call manager's personal phone, or to a staff group chat, and they are the whole of the log. They work, day to day, because a manager who cares reads them.

They fail in two ways. When something does happen, the questions are when the worker last checked in, who received it, when they noticed the next check-in had not arrived and what they did; the answers are on a personal phone, in the order a manager remembers them. And the near misses, the uneasy visits and the shouting neighbour, rarely travel from the text into the risk assessment, so the next worker climbs the same stairs knowing nothing. HSE's requirement is to keep in touch and respond; the record of whether the organisation did both is the part it does not hold.

ComplyChat gives an organisation channels it owns for those conversations. Everyone added is told the channel is on the record and can object or leave, a mobile number verified by SMS is the identity so bank staff and volunteers without a work account can take part, and messages are recorded on the server as they are sent, so a check-in, a missed one and the response are in one place with their times. On paid plans, once the organisation's Microsoft 365 tenant is connected, conversations are kept there, under the retention schedules it already runs. It is not a lone worker alarm or safety device: it does not raise the alarm when a check-in is missed, it does not replace the escalation procedure or the person who operates it, and where the risk assessment calls for a dedicated device, use one. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive, so it is not a way to keep a lasting record.

A question for the next leadership or trustees' meeting: if one of our lone workers did not check in tonight, who would notice, how long would it take, and could we show afterwards exactly what happened?

Questions people ask

When can an employer allow you to work alone?

An employer can let you work alone once it has assessed and managed the risks: the Health and Safety Executive says “you must manage any health and safety risks before people can work alone”. Some high-risk work always needs at least one other person, including work in a confined space, near exposed live electricity conductors, in diving operations, in vehicles carrying explosives and with fumigation, according to HSE’s guidance to manage the risks of working alone.

What should you have by law if you’re working alone?

By law, a lone worker’s risks must be assessed, and HSE says the employer must “train, supervise and monitor lone workers” and “keep in touch with them and respond to any incident”. No law requires a particular device: HSE’s guidance on training, supervision and monitoring lists “other devices for raising the alarm” as one option alongside pre-agreed contact and a reliable system to confirm the worker has returned to base.

Is it legal to work alone in a shop?

Working alone in a shop is legal, provided the employer has assessed and dealt with the risks first: the Health and Safety Executive’s leaflet Protecting lone workers (INDG73) says “It will often be safe to work alone. However, the law requires you to think about and deal with any health and safety risks before people are allowed to do so.” HSE adds that the employer’s responsibility covers volunteers too, so in a charity shop the moments to assess are the ones a volunteer spends alone: opening up, locking up and taking the money to the bank.

Official guidance and your next step

HSE's guide Lone working: protect those working alone is the authority, with its leaflet Protecting lone workers (INDG73) and its guidance on work-related violence. Charities should read HSE's guidance on protecting volunteers. The legal text is the Management of Health and Safety at Work Regulations 1999, regulation 3. Care providers in England should also read the CQC and HSE memorandum of understanding on who regulates what. Quotations are from those pages as published on 25 September 2026.

This guide is a practical summary, not legal advice. Where a risk assessment involves violence, a client with a history of aggression or high-risk work, take competent health and safety advice.

Then do one thing: test the escalation procedure this month. Pick one lone worker's shift, agree in advance that they will miss the final check-in, and time what happens. Whatever you learn goes straight into the policy.