Safety Norms: Human Resource Management and Talent Development

1Purpose, Scope, and Safety Principles

These norms set out how HR and talent development staff protect people, information, and the organization while carrying out their work. In this document, safety means preventing physical harm in workplaces and training venues, psychological harm from mistreatment or unfair processes, information harm from privacy breaches, and organizational harm from unlawful or inconsistent decisions.

The scope covers recruitment, onboarding, performance management, learning and development delivery, employee relations, compensation administration, workforce planning, and offboarding. It applies whether activities take place in person, online, or through third-party providers.

• Mandatory: Every HR activity that involves people, personal data, or physical spaces must have a documented owner and a risk assessment.
• Principle one: people come before process. No timetable or target justifies unsafe training conditions or unfair treatment.
• Principle two: least access. Staff see only the personal data they need for their task.
• Principle three: escalate early. Uncertainty about a risk is a reason to ask for guidance before proceeding.

2Roles, Competence, and Accountability

The most senior HR leader owns this norm set and approves local procedures. HR business partners, recruiters, learning designers, facilitators, and payroll administrators own the controls within their own activities. Line managers share responsibility for safe workplaces and fair people decisions within their teams. Occupational health and safety colleagues advise on physical hazards, while information security and data protection officers advise on information controls.

Competence must be demonstrated, not assumed. Staff who run investigations, handle medical or disability information, or facilitate physical activities must hold documented training and written authorization. General facilitation skill does not automatically qualify a person to lead activities with physical risk.

• Mandatory: Each investigation must be assigned in writing to a trained investigator with no conflict of interest.
• Mandatory: Only authorized staff may access health, disability, or medical records, and only for a documented lawful purpose.
• Recommendation: Maintain a competence matrix listing each role, required training, verification method, and renewal review interval.

3Course-Specific Hazards and Risk Assessment

Hazards in HR and talent development are mainly human, informational, and environmental. Risk level combines the likelihood of harm with its severity. Use a three-level scale of low, medium, and high, and record the rating and reasoning for every activity that involves personal data, sensitive decisions, or spaces used by people.

Each risk assessment must name the hazard, the people exposed, existing controls, residual risk, and the owner of any further action. Review assessments when a process, tool, venue, or vendor changes, after any incident, and at a periodic interval set by the organization.

• Physical hazards at training venues, such as slips on wet floors, trip hazards from cables, overcrowded rooms, and unsafe stairs. Usually medium risk.
• Ergonomic strain from long assessment sessions, heavy training materials, or poorly set workstations. Usually low to medium risk.
• Psychological harm from bullying, harassment, intimidating coaching, or poorly handled disciplinary meetings. High risk.
• Distress for staff handling grievances, redundancies, or serious injury cases. High risk, requiring support and rotation options.
• Data exposure through misdirected emails, unsecured files, personal devices, or oversharing in meetings. High risk.
• Discriminatory or unlawful decisions in hiring, promotion, pay, or dismissal caused by inconsistent procedures. High risk; legal duties vary by jurisdiction.
• Emergencies during large events, including fire, medical incidents, or threats. Medium risk, requiring venue-specific plans.

4Preventive Controls and Safe Working Practices

Apply controls in order of effectiveness: remove the hazard where possible, redesign the process to be safer, use training and supervision, and rely on personal safeguards last. In HR work, removing hazards often means not collecting data that is not needed, avoiding unsafe rooms, and not using untested tools or activities.

Example: a recruiter preparing offer letters containing salary information should send them only from the approved system, confirm the recipient using a known address, and mark the file as confidential. Example: a learning designer proposing a team activity using balance equipment must obtain a qualified provider's risk review before scheduling. HR must not improvise physical activities.

• Mandatory: Before any training event, confirm the venue layout, clear exits, unobstructed fire doors, and first aid arrangements, and record the check.
• Mandatory: Do not conduct disciplinary, grievance, or dismissal meetings without a second trained person present and a notes taker, unless local policy sets a different arrangement.
• Mandatory: Give participants a clear statement of purpose before any assessment, including whether results affect employment decisions.
• Mandatory: Do not request medical, genetic, pregnancy, or family information unless a lawful purpose is documented. Verify applicable rules with counsel.
• Mandatory: Store personal files only in approved systems. Never keep them on personal email, messaging apps, or unencrypted removable drives.
• Mandatory: Physical activities require a documented risk assessment, a qualified facilitator, voluntary participation, and an alternative for anyone who declines.
• Mandatory: Stop any session where a participant appears distressed, injured, or unsafe. Provide a break, offer support, and record the event.
• Recommendation: Use a two-person check before sending confidential documents externally, including verifying addresses and attachments.
• Recommendation: Hold sensitive conversations in private rooms away from open areas, and close doors and screens before discussing confidential matters.
• Recommendation: Use structured interview guides and standard scoring criteria to reduce unfair decisions and support defensible outcomes.

5Equipment, Environment, Information, and Protective Safeguards

Tools include learning management systems, applicant tracking systems, payroll platforms, video conferencing, assessment software, and presentation equipment. Each tool needs an owner, access controls, and a documented setup check. Equipment used in training, such as projectors, extension leads, and simulation props, must be inspected before use and kept out of walkways. Electrical equipment should be maintained under the local program; verify current electrical standards with a qualified electrician or facilities professional.

Personal protective equipment is normally not required for desk-based HR work. Where a training activity involves physical risk, provide the protective items specified in the risk assessment, such as suitable footwear or helmets, and follow manufacturer instructions. Hygiene controls apply to shared spaces: clean shared items such as headsets and handled props between sessions, and provide hand hygiene facilities. Follow local public health guidance during outbreaks.

• Mandatory: Use multi-factor authentication for HR systems where available, and lock screens when leaving workstations.
• Mandatory: Restrict personnel and health files to named roles, and review access when people change roles or leave.
• Mandatory: Mark printed personal data as confidential, collect it promptly from shared printers, and destroy it using approved methods.
• Recommendation: Set workstation ergonomic standards and schedule breaks during long assessments, following local occupational health guidance.

6Incident Reporting, Emergency Response, and Escalation

An incident is any event that causes or could cause harm, including injury, distress, a data breach, a discriminatory act, a threat, or a fire. A near miss is an event that could have caused harm but did not. Report incidents and near misses within the timeframe set by local policy and, where it is safe, as soon as possible. Do not wait for a formal investigation to conclude before reporting.

Escalation runs from the first person aware of the event to the HR lead, and then to senior leadership, legal counsel, or regulators where required. Serious matters, including death, serious injury, violence, criminal allegations, or major data breaches, must be escalated immediately. Offer affected people support, including access to employee assistance services where available.

• Mandatory: In a medical emergency or immediate danger, call local emergency services first, then notify the site lead and HR.
• Mandatory: Report suspected personal data breaches to the data protection lead immediately. Legal notification deadlines vary by jurisdiction; verify them with counsel.
• Mandatory: Report threats, harassment, or violence to security and the responsible manager. Do not confront the person alone.
• Mandatory: Preserve evidence such as emails, messages, and records. Do not alter or delete them.
• Recommendation: Keep a contact card for each training venue listing emergency numbers, first aid location, and assembly point.
• Recommendation: Run tabletop exercises for data breach and workplace violence scenarios at an interval set locally.

7Records, Training, Inspection, and Review

Records show that controls exist and work. Keep training records, risk assessments, incident reports, access reviews, and investigation files in approved systems. Retention periods depend on law and internal policy; verify them with legal counsel before setting schedules.

All HR staff complete induction on these norms, data protection, and incident reporting. Specialist training, such as first aid, mental health awareness, or facilitation of physical activities, must come from qualified providers, and certificates must be verified rather than assumed.

• Mandatory: Maintain a register of training sessions showing venue, facilitator qualification, attendance, and any incidents.
• Mandatory: Record every investigation outcome, including the decision rationale and any appeal.
• Recommendation: Review system access rights periodically and review these norms at a set interval or after any significant incident.
• Recommendation: Use audit findings and staff feedback to update local procedures and this document.

Implementation checklist

• Confirm your role has documented training and authorized access before handling sensitive data or investigations.
• Complete a risk assessment before running any training event or physical activity.
• Check venue exits, fire doors, and first aid arrangements before each event and record the check.
• Use a second trained person and a notes taker for disciplinary or dismissal meetings.
• Send personal data only through approved systems and verify recipient addresses before sending.
• Lock screens, clear shared printers, and store confidential files in approved locations.
• Stop any session that appears unsafe and offer support to the person affected.
• Report incidents and near misses within policy timelines, and report suspected data breaches immediately.
• Preserve evidence and do not alter records during an investigation.
• Verify jurisdiction-specific laws, notification duties, and retention rules with qualified professionals.
• Record outcomes, review access rights periodically, and update procedures after incidents.