An employee has raised a safeguarding concern: when does an HR issue become a regulatory issue?

When an employee raises a safeguarding concern, the first question should not be “Is this a grievance or a disciplinary issue?” It should be more basic: what is the nature of the concern, and is anybody at immediate risk?

That might involve a child or an adult at risk. It could be an allegation of abuse, injury, theft or neglect. It might also involve unsafe working, such as failing to use the correct equipment or repeatedly carrying out a task in a way that puts somebody else at risk.

Not every unsafe act is technically a safeguarding matter. The issue may fall within safeguarding, health and safety, regulatory compliance or more than one regime at the same time. The important thing is to identify what you are actually dealing with rather than assuming that, because the concern came through HR, HR is where it begins and ends.

If there is an immediate risk, stop the potentially harmful activity while the facts are established.

Remove the risk first

If the risk is ongoing, the employee should at minimum be removed from the duties creating it while the matter is investigated.

That does not always mean sending them home. A field-based employee who has repeatedly failed to use required equipment might be brought back into the office, taken off certain jobs or prevented from working directly with service users until the issue has been investigated and any necessary refresher training completed.

The response should match the risk. If changing duties, restricting access or removing somebody from direct contact with the affected person is enough, that may be the better option. Where the risk cannot sensibly be controlled in another way, suspension may need to be considered.

Not every safeguarding or safety concern involves deliberate abuse or serious misconduct. Sometimes the problem is poor training, complacency or bad supervision. Sometimes it is considerably more serious. The first job is to make the situation safe enough to establish which one you are dealing with.

Know when the issue has moved beyond HR

Once the concern extends beyond the employment relationship, the organisation needs to consider whether external obligations have been triggered.

If a service user, patient, child, adult at risk or member of the public may have been harmed or placed at risk, there may be reporting, referral or escalation requirements. Depending on the circumstances, that could involve the local authority, police, a regulator or another public body.

In some regulated or safety-critical environments, an incident can be reportable even where nobody has actually been injured. Equally, not every near miss or unsafe act is automatically reportable. The threshold depends on the particular legal or regulatory regime.

Organisations working with children or adults at risk may also have specific safeguarding referral routes. There can also be separate obligations relating to the employee. For example, where somebody working in regulated activity is removed, dismissed or redeployed because they have harmed or pose a risk of harm, a referral to the Disclosure and Barring Service may need to be considered.

Serious cases need clear ownership

Who takes responsibility will depend on the organisation. In a small business it may be the founder, proprietor or managing director. Elsewhere it may sit with HR, a safeguarding or compliance lead, the employee’s manager or another nominated person.

Where there has been a serious breach, I would usually want the response owned by the most senior appropriate person. They do not need to conduct every interview or personally make every referral, but they should know what has happened, make sure the right people are involved and remain accountable for seeing the response through.

The obvious exception is where that person is involved or conflicted. In that situation, responsibility needs to move elsewhere and independent input may be necessary.

Record the material facts, decisions and actions

From the moment the concern is raised, the organisation should be able to reconstruct what happened without relying on memory.

Record who raised the concern, what was reported, when and where it happened, who may have been affected, what evidence exists, what immediate action was taken, who made each significant decision and why, who was notified and what happens next.

In simple terms: who, what, when, where, why and next steps.

That does not mean recording every rumour or piece of speculation. Records should be relevant, accurate and focused on what is necessary. They may later be needed by a regulator, local authority, police, insurer, court or tribunal, and may be the clearest evidence that the organisation recognised the risk and responded appropriately.

Depending on the regime and facts, failures can expose the organisation, and in some circumstances individuals within it, to regulatory enforcement or criminal liability.

Support the person affected as well as managing the employee

What support is appropriate will depend on the concern.

If, for example, there is an allegation of abuse of an adult at risk, it may be necessary to involve safeguarding authorities, social care, the police and any relevant regulator, as well as considering whether the organisation’s insurer needs to be notified.

The person affected should be offered appropriate support. That may include medical assistance, access to other services or practical help. Businesses should not become so frightened of liability that they fail to help somebody who may have been harmed. An apology, offer of treatment or other redress does not of itself amount to an admission of negligence or breach of statutory duty, although wording and insurer requirements still need care.

The employee should be dealt with according to what the evidence shows. If the issue is poor practice or a training failure, refresher training may be appropriate. If it continues, closer supervision, retraining or redeployment may need to be considered. Where somebody seriously or repeatedly disregards important health and safety or safeguarding requirements, formal disciplinary action, potentially including dismissal, may follow.

Be careful once outside agencies are involved

If the local authority, police, regulator or another external body becomes involved, the internal process needs to be handled carefully.

Responsibilities should be clear, evidence preserved and decisions documented. The organisation should avoid taking steps that could interfere with an external investigation. Sometimes the internal employment process can continue alongside the external one; in other cases the employer may need guidance before progressing further.

One of the easiest ways to make a safeguarding problem worse is to talk too much and record too little. Speculation spreads, different versions of events develop and people start discussing what they think happened before anybody has properly documented what actually happened.

At the same time, HR cannot become so focused on protecting the company’s employment position that the person at risk becomes secondary. There has to be a balance between protecting the organisation and making sure the service user, patient, child, adult at risk or other person affected is actually safe.

That is not simply a regulatory consideration. In many cases it is the organisation’s basic moral responsibility as well.

A safeguarding concern may begin with an employee complaint, a manager’s concern or what initially appears to be an ordinary workplace incident. Once somebody outside the employment relationship may be at risk, however, the questions change.

It is no longer simply “How do we deal with this employee?”

It becomes: who may be at risk, what needs to stop now, which legal or regulatory regime applies, who needs to know, what needs to be recorded, and what happens next?

Aubrey International supports employers and regulated businesses where workplace issues overlap with safeguarding, regulatory risk and wider operational responsibilities.

Practical support. Real solutions.