Lone working policy

The rule: the risk is assessed before anyone works alone

Lone working is governed by general health and safety law rather than a lone-working statute. The Health and Safety at Work etc. Act 1974 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees, and a duty towards other people affected by its work. The Management of Health and Safety at Work Regulations 1999 turn that into a process: regulation 3 requires "a suitable and sufficient assessment of" the risks to the health and safety of employees "to which they are exposed whilst they are at work", and of the risks to other people arising from the work, and where the employer employs five or more people it must record "the significant findings of the assessment" and "any group of his employees identified by it as being especially at risk".

The Health and Safety Executive's guidance applies that directly to working alone. It defines lone workers as "those who work by themselves without close or direct supervision", and it is plain about timing: "As an employer, you must manage any health and safety risks before people can work alone. This applies to anyone contracted to work for you, including self-employed people", which in a charity includes sessional counsellors, tutors and freelance youth workers. It adds that "There will always be greater risks for lone workers without direct supervision or anyone to help them if things go wrong", and that employers must "train, supervise and monitor lone workers" and "keep in touch with them and respond to any incident".

Three points matter particularly in this sector:

• Volunteers are included. HSE says that if an organisation has at least one employee it "must protect your employees but also others, including volunteers", must include volunteers in the risk assessment, and "should provide the same level of protection to volunteers where they carry out similar activities and are exposed to the same level of risk as employees". A group with no employees at all is not normally covered by health and safety law, but HSE notes that volunteers and voluntary organisations still owe each other a common-law duty of care.
• In care, HSE or the local authority owns the worker's safety. CQC regulates the safety of people using a registered service. Under the memorandum of understanding between the two regulators, HSE and local authorities are "the lead inspection and enforcement bodies for health and safety matters involving workers, visitors and contractors, irrespective of registration". A care provider's lone working arrangements are a matter for HSE or the local authority, even though CQC will expect a safe service to have them.
• A policy is not the legal requirement; the assessment is. No law says "lone working policy". The risk assessment is mandatory, and an employer with five or more employees must have a written health and safety policy, which is where lone working arrangements usually sit. A separate lone working policy is the practical way to set out the procedures, and it is what staff, volunteers, insurers and inspectors will ask for.

This guide covers England, Wales and Scotland, where HSE is the regulator. Northern Ireland has its own equivalent legislation and regulator, HSENI.

Who is a lone worker in a charity or care service

HSE's examples include health workers and people working at home. In charities, care and community services, the list is longer than most boards assume:

• home care and domiciliary care workers visiting people in their own homes;
• supported living staff on night shifts or sleep-ins, alone in a shared house;
• outreach, befriending and advocacy workers, and social workers or family support staff making home visits;
• counsellors and support workers seeing clients one to one, especially at the end of the day;
• youth and community workers opening or locking up a building after a session;
• charity shop staff and volunteers opening, closing or cashing up alone, often dealing with members of the public with no colleague on the floor, and caretakers of community halls;
• drivers and volunteers delivering food parcels, prescriptions or community transport;
• door-to-door and street fundraisers, where the charity runs its own team;
• staff working from home, for whom HSE says employers have "the same health and safety responsibilities" as for any other worker.

Lone working need not be all day. A worker who is part of a busy team for most of a shift but locks up alone at ten at night is a lone worker for those twenty minutes, and that is often when the risk is highest.

The lone working risk assessment

The risk assessment process for lone working follows the usual steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on control measures, record the findings and review them. HSE lists the risks that particularly affect lone workers:

• Violence and aggression. HSE defines work-related violence as "any incident in which a person is abused, threatened or assaulted in circumstances relating to their work", which includes verbal threats. It notes that lone working "does not always mean a higher risk of violence, but it does make workers more vulnerable". Late evening and early morning work, people affected by alcohol or drugs, and carrying money or valuable equipment all raise the risk.
• Stress, mental health and wellbeing. Isolation from colleagues and managers makes it harder to get support, and HSE asks employers to put procedures in place for direct contact so that signs of stress are recognised early.
• Medical suitability. Whether a person's health condition makes it safe for them to work alone, thinking about both routine work and emergencies.
• The workplace itself, for example a rural or isolated location, a building with poor lighting or a single exit, and the travel between visits, since many lone workers face work-related road risks.

In care and community work, add the risks of the setting: a visit to someone's home, where the worker does not control who else is present, whether there are pets, or whether the person's behaviour has changed since the last visit; manual handling that the care plan says needs two people; and handling cash for shopping. Where a lone worker will be at someone else's workplace, HSE says "you must ask that employer about any risks and control measures".

The outcome of the assessment is a set of control measures and, where needed, restrictions on lone working: tasks that must not be done alone, visits that must be made in pairs, clients who are seen only in the office, and new or inexperienced workers who are accompanied until they are competent. HSE notes that some high-risk work always requires at least one other person, and that you "should set limits on what can be done while working alone". Record the significant findings, including any group of workers who are especially at risk, and review the assessment after an incident, a near miss, a change in a client's circumstances or a change in the service.

What a lone working policy should contain

The policy's job is to turn the risk assessment into safe systems of work: clear procedures that every person who may work alone knows before their first shift. A lone working policy for a charity or care service is short if it is specific. It should cover:

1. Policy statement and scope. What the organisation commits to, and whom it covers: employees, bank and agency workers, volunteers and trustees who work alone.
2. Roles and responsibilities. The trustees' or directors' accountability, the manager who owns the risk assessments, the line manager or on-call manager who receives check-ins, and the lone worker's own duties to follow the procedure and report concerns.
3. Risk assessment. When a lone working risk assessment is done, reviewed and shared with the worker, including dynamic risk assessment on arrival at a visit.
4. Restrictions on lone working. The activities, locations and people that require two workers or none.
5. Keeping in touch. The check-in procedure: how the worker's whereabouts are known, the pre-agreed intervals, and how the end of the working day is confirmed.
6. Escalation. Exactly what happens when a check-in is missed: who tries to make contact, after how long, who is told next, and when the police are called.
7. Equipment. Charged work phones, personal alarms or lone worker devices where the risk assessment calls for them, first aid kits, torches.
8. Training. Personal safety, conflict resolution and using any safety equipment, with refreshers and extra supervision for new workers.
9. The right to leave. A clear statement that a worker who feels unsafe may end a visit or leave a building without penalty, and must tell the manager when they have.
10. Reporting incidents and near misses. How to report violence, threats, accidents and near misses, including those that may need reporting to HSE under RIDDOR, and the support available following an incident. HSE says to "Put measures in place to support any worker who's experienced violence".
11. Review. When the policy and the procedures are tested and reviewed.

Lone worker devices and safety apps can be valuable where the risk is high, but they are not a legal requirement in themselves. HSE lists "other devices for raising the alarm, operated manually or automatically" as one option among several; the risk assessment decides whether you need one.

Check-ins and escalation: the procedure that has to work

HSE's guidance describes the arrangements employers may use to stay in touch: supervisors visiting, "knowing where lone workers are, with pre-agreed intervals of regular contact, using phones, radios, email etc", alarm devices, and "a reliable system to ensure a lone worker has returned to their base once they have completed their task". In practice a sound procedure has five parts:

1. An itinerary. The worker's visits or tasks, in order, known to a named person before the shift starts, and updated when it changes.
2. Contact at set points. At arrival and departure for higher-risk visits, and at agreed intervals for longer tasks.
3. Confirmation of the end of the working day. The step most often skipped, and the one that decides whether anyone notices a worker who never got home.
4. A defined response to a missed check-in. A set time before the named person acts, a set sequence of calls, and the point at which the manager goes to the address or calls the police. A procedure that says "the manager will follow up" is not a procedure.
5. Someone always receiving. An on-call rota that covers evenings, nights and weekends, so that check-ins do not land on the phone of a manager who is asleep or on leave.

HSE also says to "Regularly test these systems and all emergency procedures to ensure lone workers can be contacted if a problem or emergency is identified." A test is simple: choose a shift, have a worker deliberately miss a check-in, and see what happens, how long it takes and who knew.

Finally, keep the record. The check-in log shows the system was operated; the missed check-in log shows what was done each time; the incident and near-miss reports feed the next review of the risk assessment. Without them, the organisation can describe its procedure but cannot show that anyone followed it.

The check-in that lives on the manager's phone

In most small charities and care services, the check-in system is a text. "At Mr Okafor's flat on Elm Road." "All fine, walking back to the car." "Centre locked, home." Sometimes more: "Bit uneasy, his neighbour was on the landing again, shouting about the noise." The messages go to the coordinator's or on-call manager's personal phone, or to a staff group chat, and they are the whole of the log. They work, day to day, because a manager who cares reads them.

They fail in two ways. When something does happen, the questions are when the worker last checked in, who received it, when they noticed the next check-in had not arrived and what they did; the answers are on a personal phone, in the order a manager remembers them. And the near misses, the uneasy visits and the shouting neighbour, rarely travel from the text into the risk assessment, so the next worker climbs the same stairs knowing nothing. HSE's requirement is to keep in touch and respond; the record of whether the organisation did both is the part it does not hold.

ComplyChat gives an organisation channels it owns for those conversations. Everyone added is told the channel is on the record and can object or leave, a mobile number verified by SMS is the identity so bank staff and volunteers without a work account can take part, and messages are recorded on the server as they are sent, so a check-in, a missed one and the response are in one place with their times. On paid plans, once the organisation's Microsoft 365 tenant is connected, the lasting record files there under its own retention rules. It is not a lone worker alarm or safety device: it does not raise the alarm when a check-in is missed, it does not replace the escalation procedure or the person who operates it, and where the risk assessment calls for a dedicated device, use one. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive, so it is not a way to keep a lasting record.

A question for the next leadership or trustees' meeting: if one of our lone workers did not check in tonight, who would notice, how long would it take, and could we show afterwards exactly what happened?

Official guidance and your next step

HSE's guide Lone working: protect those working alone is the authority, with its leaflet Protecting lone workers (INDG73) and its guidance on work-related violence. Charities should read HSE's guidance on protecting volunteers. The legal text is the Management of Health and Safety at Work Regulations 1999, regulation 3. Care providers should also read the CQC and HSE memorandum of understanding on who regulates what. Quotations are from those pages as published on 25 September 2026.

This guide is a practical summary, not legal advice. Where a risk assessment involves violence, a client with a history of aggression or high-risk work, take competent health and safety advice.

Then do one thing: test the escalation procedure this month. Pick one lone worker's shift, agree in advance that they will miss the final check-in, and time what happens. Whatever you learn goes straight into the policy.