£2.2m Fine: What HSE Prosecutions Say About Oversight

£2.2 million. That is what Huws Gray Limited was fined at Chelmsford Magistrates Court on 26 March 2026 after Paul Coulson, a 56-year-old labourer, was crushed to death by a three-tonne pack of timber at Herringswell Sawmills in Suffolk. The company had identified the risk. It had put up signage. It had placed stickers on the conveyor. And still, CCTV showed operatives entering the danger zone on 19 separate occasions between 14 April and 23 May 2024.

If you run schools or campuses, the details of the machinery change but the oversight failure does not. You have the risk assessment. You have the policy. The question an HSE inspector asks is whether your team followed it, and whether you can prove that today.

The duty is yours, and the evidence is not in the policy folder

Under the Health and Safety at Work etc Act 1974, the employer holds the duty to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. In a school or campus, that duty sits with the trust, the local authority or the governing body as the employer. You, as head of property, sign the paperwork that says the arrangements are in place.

The Huws Gray case turned on a single point: the company chose to control a serious risk through instruction alone. HSE inspector Joanne Williams said exactly that. "Had Huws Gray Ltd taken robust action when they became aware of the problem, Paul Coulson would be alive today." The fine reflects the gravity, but the oversight failure is the part that should worry you. The company knew. It documented the knowledge. It did not act on it.

In a school, the equivalent pattern looks like this. A caretaker reports that the fire door on the science block corridor is not closing fully. The report goes into the helpdesk system. The job is logged. Three weeks later, the door is still not closing, because the part is on order and the site team is down to two people covering five buildings. The log shows the report. It does not show the fix. An inspector sees the gap between the two.

What falls due, and who owns it

The HSE Enforcement Management Model gives inspectors a guide for deciding whether to issue an improvement notice, a prohibition notice or a prosecution. It is not a strict set of rules, but it tells you what they look at: whether the duty holder knew about the risk, whether they had a system to manage it, and whether that system worked in practice. For a school or campus portfolio, the obligations that most often surface in enforcement fall into a predictable rhythm.

Monthly

• Fire door inspections. The responsible person under the Regulatory Reform (Fire Safety) Order 2005 must ensure fire doors are maintained. In a school, that means the estates team or the site manager checks self-closers, gaps and intumescent seals on every door on a rolling schedule. The record is the check sheet, dated and signed. If you cannot produce last month's sheet for every building, you have a gap.
• Legionella flushing and temperature checks. The ACOP L8 approved code of practice requires regular monitoring of water systems. In schools, the risk sits with the duty holder, but the task usually falls to the site team. They record temperatures at sentinel taps and flush little-used outlets. The record is the logbook. If the logbook is blank for a week, the system was not monitored.

Quarterly

• Emergency lighting and fire alarm tests. The responsible person must test emergency lighting monthly and the fire alarm weekly, but the quarterly review of the records is where oversight shows. Who signs off that the tests happened? If the answer is "the site manager does it and tells me if there is a problem," you have delegated the oversight, not the task.
• Asbestos management reviews. The duty to manage asbestos in non-domestic premises under the Control of Asbestos Regulations 2012 requires a review of the management plan. In a campus with buildings from different decades, the review checks whether the register is still accurate and whether anyone has disturbed the fabric. The owner is the duty holder. The evidence is the updated register and the review meeting note.

Annually

• Fixed electrical installation testing. The EICR, or Electrical Installation Condition Report, is the record that the fixed wiring is safe. In schools, the frequency depends on the building's use, but the five-year cycle is common. The owner is the duty holder. The evidence is the certificate and the schedule of remedials. If the remedials are outstanding, the certificate tells the inspector that you knew.
• Gas safety checks. Where there is gas in a school kitchen or boiler house, the annual check is a legal requirement. The record is the Gas Safety Certificate. The owner is the employer. The evidence is the certificate, not the invoice for the visit.
• Playground and sports equipment inspections. The frequency depends on the equipment and the manufacturer's guidance, but the annual review of the inspection regime is where oversight sits. Who checks that the weekly visual inspections happened? Who signs off the annual independent inspection? If the answer is the same person who does the inspections, you have a control gap.

The oversight question an inspector actually asks

When HSE investigates a school or campus incident, the inspector does not start with the accident. They start with the system. They ask for the risk assessment, then they ask for the evidence that the controls in it were in place on the day. The gap between the two is where enforcement action lives.

The Huws Gray case is a £2.2 million example of that gap. The company had a system: signage, stickers, instruction. It did not have the control that mattered: guarding. The inspector's words were that the company "chose to control a serious risk through instruction alone." In a school, the equivalent is controlling a risk through a policy document alone, without the check sheet, the logbook or the sign-off that proves the policy was followed.

You can read the full HSE press release on the Huws Gray prosecution to see how the inspector built the case. The pattern is consistent: the company knew, the company documented the knowledge, the company did not act. The fine reflects the consequence, but the oversight failure is the part you can control.

The HSE's Enforcement Management Model is the guide inspectors use to decide between an improvement notice, a prohibition notice and a prosecution. It is not a strict set of rules, but it tells you what they weigh: the seriousness of the risk, the duty holder's knowledge, and the quality of the response. If your response is a policy that nobody checks, the model points towards enforcement.

For schools and campuses, the allocation of enforcement between HSE and local authorities is set out in the Health and Safety (Enforcing Authority) Regulations 1998. The general rule is that HSE enforces in educational establishments, but the allocation can turn on the main activity of the premises. If you run a campus with residential accommodation, the enforcement authority for the residential parts may differ from the teaching blocks. That is not a reason to relax. It is a reason to know which regulator would arrive, and what they would ask for.

If you want to see how this pattern plays out in another compliance area, the £900k Legionella fine shows HSE acting on exposure risk alone, before anyone became ill. The oversight failure was the same: the system existed, the evidence did not.

Your 60-second self-check

• Could you produce last month's fire door inspection sheet, signed and dated, for every building in your portfolio?
• Could you show the last quarterly review of your asbestos management plan, with the date and the name of the person who signed it off?
• Could you name the person who checks that the site team's legionella logbook is complete, and show the record of that check?

If you cannot answer all three with confidence, the gap is not in your policy. It is in the evidence that the policy was followed. The free 5-minute Director's Risk Check gives you a control score for your portfolio, the breach exposure with official sources attached, and a board-ready briefing. Send it to the colleague who holds the records, and the briefing comes back to you. You can run it at hermanwa.com/risk-check.

Herman's verdict

The fine is the headline, but the oversight failure is the lesson. A policy that nobody checks is not a control. It is a document that tells an inspector you knew the risk and did not manage it.

— Herman