What should actually be in your site folder?

Everyone who's run a site has had the moment someone turns up — a client, an inspector, an insurer's assessor after an incident — and asks to see the paperwork. What's actually in the folder at that point falls into two categories: things you're legally required to have, and things that just make life easier when someone starts asking questions.

Knowing which is which matters, because it tells you where the non-negotiables are.

The F10, where the job is notifiable

If your project meets the notification threshold under CDM 2015 Regulation 6 — scheduled to last longer than 30 working days and have more than 20 workers working simultaneously at any point, or to exceed 500 person days — the client has a legal duty to notify the HSE, and Regulation 6(3) requires the notice to be clearly displayed in the site office where workers can read it.

If your job meets neither limb, you don't need one. Keep a note of why not, because it's among the first things anyone from the HSE will ask about.

The construction phase plan

Where a Principal Contractor role exists, Regulation 12 requires a construction phase plan to be drawn up before construction starts and kept up to date throughout. This is a legal requirement, not a nice-to-have, and it should genuinely reflect the job rather than being a boilerplate cover sheet.

Even on a single-contractor job with no Principal Contractor, you still need your own risk assessments under Regulation 3 of the Management of Health and Safety at Work Regulations 1999. The label changes; the duty to think it through in writing doesn't.

Site rules and inductions

Site inductions are a legal requirement wherever a Principal Contractor exists — Regulation 13 requires every worker to receive a suitable site induction before starting work.

Written site rules beyond the legal minimum — parking, welfare, smoking areas, out-of-hours access — are good practice rather than a statutory requirement. They're also the single most effective thing at preventing the daily arguments that eat a site manager's time.

Toolbox talks

Toolbox talks aren't named as a specific document in any regulation, but they are the practical evidence that you're meeting your duty under the 1999 Regulations to give employees adequate health and safety information, instruction and training.

Record what was covered, when, and who attended. If something goes wrong later, a folder of dated toolbox talk records is worth considerably more than a claim that everyone was told verbally.

Permits to work

Some permits reflect a specific legal requirement for a specific activity — entry into a confined space needs a proper safe system of work under the Confined Spaces Regulations 1997. Others, such as a general hot works permit, aren't named in a single piece of legislation but are standard industry practice and very often an insurer's condition of cover.

Either way: if the activity is high-risk and irreversible when it goes wrong, a written permit signed off before work starts is the right call, legally required or not.

Plant and equipment records

This is one of the clearer legal areas. Lifting equipment needs thorough examination records under the Lifting Operations and Lifting Equipment Regulations 1998. Work equipment generally must be maintained in an efficient state under the Provision and Use of Work Equipment Regulations 1998.

If it lifts, cuts, or has moving parts that could injure someone, there should be a maintenance and inspection record for it in the folder.

First aid and the accident book

The Health and Safety (First-Aid) Regulations 1981 require an employer to provide adequate and appropriate first aid equipment, facilities and personnel, based on an assessment of what that workplace actually needs. What counts as adequate depends on the size and risk of the site.

An accident book is standard practice and feeds directly into your duty under RIDDOR 2013 to report certain injuries, occupational diseases and dangerous occurrences to the HSE. Check the current RIDDOR guidance for what is reportable and by when — the categories each have their own criteria and timescales, and this is not an area to work from memory or from something you were told on a previous job.

Fire plan

If the site counts as a workplace, the Regulatory Reform (Fire Safety) Order 2005 requires a fire risk assessment and emergency plan from whoever is the responsible person.

Many sites also follow the Joint Code of Practice on the Protection from Fire of Construction Sites. That is industry guidance and often an insurer requirement rather than a standalone statutory duty — but it is treated as the benchmark, and departing from it without good reason is hard to defend after a fire.

COSHH assessments

Where hazardous substances are used or created by the work — cutting concrete, using solvents, disturbing lead paint — Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 requires a suitable assessment of the health risk before the work starts.

This is a clear legal duty, and it needs to be specific to the substance and the task. "Wear a mask" is not a COSHH assessment.

RAMS for each trade

Every trade working on site should have their own risk assessment and method statement, reviewed by whoever holds the Principal Contractor role before that trade starts. It's usually the first thing asked for on day one of any inspection.

The honest summary

The short version: the F10 where notifiable, the construction phase plan, site inductions, COSHH assessments, plant maintenance records, first aid provision and RAMS are legal requirements with a specific regulation behind each one.

Site rules beyond the legal minimum, toolbox talk records and most permit systems are good practice — not because they don't matter, but because they save arguments and protect you in a dispute rather than being demanded by a named piece of legislation.

Both categories belong in the folder. Only one of them is optional, and it isn't the one most people assume.

This article is guidance, not legal advice. Thresholds and reporting timescales — particularly under RIDDOR 2013 and CDM 2015 — should be checked against the current regulations before you rely on them for a live site.