PCBU Checklist For Small Business Owners

Being told your business is a PCBU can sound more complicated than it really is. If you run a small business in New Zealand, it usually means you have practical workplace health and safety responsibilities under the Health and Safety at Work Act 2015.

Dated note: This article is written for the Health and Safety at Work Act 2015 as amended from 1 November 2026. If you're reading this before then, the current overlapping duty wording still applies until the new co-operation framework starts on 1 November 2026.

The good news is that PCBU compliance doesn't have to mean a folder full of policies nobody reads. What matters is that you identify the real risks in your business, focus first on critical risks, put sensible controls in place, involve your workers, manage contractors properly and keep clear records when something goes wrong.

Let's turn the PCBU meaning into a checklist you can actually use in your business.

What Does PCBU Mean In New Zealand?

A PCBU means a person conducting a business or undertaking, and it usually includes your company, partnership, sole trader business or organisation.

The PCBU concept is broad on purpose. Under the Health and Safety at Work Act 2015, health and safety duties sit with the business or undertaking that has influence or control over the work being done.

For example, you may be a PCBU if you:

• run a company registered with the Companies Office and keep company records up to date
• operate as a sole trader with an NZBN
• run a partnership or professional services business, with clear responsibilities in your partnership agreement
• hire employees, contractors, labour hire workers or volunteers
• operate from a shop, workshop, office, warehouse, home studio or client sites

From 1 November 2026, the Act also recognises the concept of a small PCBU. Broadly, this means a PCBU that falls within the small business category set by the Act and regulations. In practical terms, this will usually be relevant for businesses with a small number of workers that aren't carrying out excluded higher risk work or operating in a prescribed higher risk setting.

This matters because the amended Act gives small PCBUs a more focused risk management framework. You still need to take health and safety seriously, but your practical system should put the most time and effort into critical risks. A critical risk is a risk that could cause death, serious injury or serious illness, or another risk treated as critical under the Act or regulations.

If you're a director, owner or senior manager, you may also have officer duties. That means you need to take reasonable steps to make sure the PCBU is meeting its health and safety obligations. This isn't about doing every task yourself, but you do need to stay informed, resource the business properly and check that systems are actually working.

Workers also have duties to take reasonable care for their own health and safety and not put others at risk. However, you can't simply shift the PCBU's primary duty onto your workers or contractors.

What Are Your PCBU Duties Under The Health And Safety At Work Act?

Your main PCBU duty is to make sure, so far as is reasonably practicable, that workers and other people aren't put at risk by your work.

That phrase, reasonably practicable, is the key test. It means you need to consider:

• how likely the risk is to happen
• how serious the harm could be
• what you know, or should reasonably know, about the risk
• what controls are available and suitable
• the cost of the control, and whether that cost is grossly disproportionate to the risk

In plain English, WorkSafe New Zealand won't expect a two person design studio to run the same safety system as a large construction company. But it will expect you to deal with obvious risks in a sensible way, especially risks that could kill or seriously harm someone.

For small PCBUs, the 1 November 2026 changes make the critical risk focus especially important. If an activity, workplace, plant, substance, work arrangement or contractor task could create a critical risk, you need to identify that risk, choose controls, tell people what to do, and review whether the controls are working. Lower level hazards shouldn't be ignored, but they can often be managed through simple day to day processes.

Your workplace safety obligations in New Zealand usually include:

• providing and maintaining a safe work environment
• providing safe plant, equipment, tools and systems of work
• making sure hazardous substances are stored, labelled and used safely
• giving workers the information, training, instruction and supervision they need
• providing adequate facilities, such as toilets, drinking water and first aid
• monitoring workplace conditions and worker health where needed
• engaging with workers on health and safety matters and supporting worker participation where required

These duties can apply even if your business feels low risk. An online agency might still need safe home working processes, screen set up guidance, mental health risk management and clear procedures for client site visits.

What Should Be On Your Small Business Health And Safety Checklist?

Your checklist should cover the practical steps you take to find risks, control them, train your team and review what is working.

A useful small business health and safety checklist, or wider legal health check, can be simple. The aim is to create a system your team can follow, not a document that sits untouched after week one.

1. Identify Your Main Risks

Walk through your work activities and list what could harm people. Then mark which risks are critical. This could include slips that could cause serious injury, manual handling, vehicles, machinery, chemicals, fatigue, customer aggression, remote work, stress, lone work or poorly maintained equipment.

Say Mia runs a cafe in Wellington with 8 staff and 2 regular contractors who service equipment and clean after hours. Her main risks might include burns from the coffee machine, slips near the dish area, cuts from food prep, early morning deliveries and contractors working alone after closing. Her critical risks are the ones that could realistically cause death, serious injury or serious illness, such as serious burns, serious slips, electrical work, vehicle movements during deliveries and violence or aggression.

2. Choose Controls That Match The Risk

Start with controls that remove or reduce the risk at the source. Personal protective equipment can help, but it usually shouldn't be your first or only control.

• For burns, Mia might train staff, keep steam wands maintained and use clear cleaning procedures.
• For slips, she might install non slip mats, fix drainage issues and require spills to be cleaned straight away.
• For after hours contractors, she might use a sign in process, alarm instructions and a check out text.

3. Train Your Team And Check It Sticks

Training doesn't have to be formal classroom training every time. It might be induction, toolbox talks, written instructions, short videos or supervised practice.

Keep a record of who was trained, when it happened and what was covered. If someone is injured later, those records help show what you did to manage the risk.

4. Review Your Controls

Review your controls when something changes, such as new equipment, a new site, a new product line, a near miss or a worker raising a concern. For many small businesses, a monthly or quarterly check is a practical starting point, with faster reviews for critical risks.

What Policies And Records Should You Keep?

You should keep the policies and records that show how your business manages real risks, not just generic paperwork.

Templates can be a helpful starting point, but they often miss the details that matter most in your industry, team and worksite. Your documents work best when they're tailored to how your business actually operates.

A practical health and safety policy outline might include:

1. Purpose And Scope: Explain who the policy applies to, including employees, contractors, visitors and anyone working at your direction.
2. Roles And Responsibilities: Set out what owners, managers, workers and contractors are expected to do.
3. Hazard And Risk Management: Explain how risks are identified, assessed, controlled and reviewed, including how critical risks are prioritised.
4. Worker Engagement: Describe how your team can raise safety issues and be involved in decisions.
5. Training And Induction: List what training is required for new starters, role changes and critical risk tasks.
6. Incident And Near Miss Reporting: Explain what must be reported, who receives reports and how follow up actions are tracked.
7. Emergency Procedures: Cover evacuation, first aid, emergency contacts and business specific emergency steps.
8. Contractor Management: Explain how contractors are approved, briefed, supervised and reviewed.
9. Record Keeping: State what records you keep and who is responsible for maintaining them.
10. Review Date: Set a date or trigger for reviewing the policy.

You should also consider keeping:

• a risk register or hazard register that clearly marks critical risks
• staff induction records
• training records
• equipment maintenance records
• contractor insurance and licence checks, where relevant
• incident and near miss reports
• minutes or notes from health and safety discussions
• first aid kit and emergency equipment checks

If you collect health information as part of incident reporting or worker monitoring, remember the Privacy Act 2020 may apply. Only collect what you need, store it securely and limit who can access it.

How Do You Manage Contractors And Other PCBUs?

You need to manage contractors by checking they're suitable for the work, agreeing how safety risks will be controlled, sometimes in a safety responsibility schedule, and co-operating with any other PCBUs that have duties in relation to the same matter.

Contractors can be a common gap for small businesses. You might assume that because someone is independent, health and safety is entirely their problem. That's not how the Health and Safety at Work Act works.

If your business has influence or control over the work, workplace or systems, you may still owe PCBU duties. The contractor may also be a PCBU. From 1 November 2026, where more than one PCBU has a duty in relation to the same matter, each PCBU must, so far as reasonably practicable, co-operate with every other PCBU that has that duty.

In practice, co-operation means sharing the information each business needs to manage the risk, agreeing who will do what, and following through on the controls each business can influence or control. A small PCBU doesn't need to manage risks it has no real ability to control, but it does need to act on critical risks connected with its workplace, systems, workers or work arrangements.

For example, if Mia's cafe brings in an electrician after hours, Mia doesn't need to tell the electrician how to do electrical work. But she should still tell them about site hazards, alarm procedures, asbestos information if relevant, wet floor risks and who to contact in an emergency. The electrician should manage electrical risks and tell Mia if their work creates risks for staff the next morning.

A contractor management checklist can include:

• confirming the contractor has the skills, training and licences needed for the work
• checking insurance where appropriate
• giving them a site induction before work starts
• agreeing who supplies equipment and personal protective equipment
• agreeing how incidents and hazards will be reported
• keeping copies of key documents and communications
• reviewing performance if the work is ongoing

Employment status is a separate issue. The Employment Relations Act 2000, including the Employment Relations Amendment Act 2026 contractor gateway test, affects when a worker may be treated as a contractor rather than an employee for employment law purposes. Even where someone is genuinely a contractor, your PCBU duties can still apply to the work they do for your business.

What Should You Do If There's A Workplace Incident?

If there's a workplace incident, your first steps are to make people safe, get medical help if needed, preserve the scene if it's notifiable and record what happened.

Not every incident needs to be reported to WorkSafe. Under the Health and Safety at Work Act, you must notify WorkSafe as soon as possible after becoming aware of a notifiable event. This includes a death, a notifiable illness or injury, or a notifiable incident.

A notifiable injury or illness can include serious injuries such as an amputation, serious head injury, serious eye injury, serious burn, spinal injury, loss of bodily function, or an injury or illness requiring immediate hospital treatment. Some dangerous incidents are notifiable even if nobody is injured, such as an uncontrolled release of a substance or a serious risk from plant, structures or electric shock.

If an event is notifiable, you generally need to preserve the incident site until an inspector authorises access, unless you need to help an injured person, make the site safe, prevent further harm or follow police directions.

You also need to keep records of each notifiable event for at least 5 years from the date you notify WorkSafe.

For a practical incident process, use this order:

1. Make The Area Safe: Stop work if needed and remove people from immediate danger.
2. Get Medical Help: Call emergency services or arrange first aid and medical treatment.
3. Decide If It Is Notifiable: Check whether the injury, illness or incident meets WorkSafe's notifiable event criteria.
4. Notify WorkSafe If Required: Do this as soon as possible after you become aware of the notifiable event.
5. Preserve The Site: Keep the scene undisturbed unless an exception applies.
6. Record The Details: Note the date, time, people involved, what happened, photos, witness accounts and immediate actions.
7. Fix The Cause: Identify what failed and assign clear corrective actions with due dates.

Back to Mia's cafe. If a staff member slips, has a minor bruise and returns to work after first aid, Mia should still record it and review the wet floor controls. If another worker suffers a serious burn and needs immediate hospital treatment, Mia should treat it as potentially notifiable, contact WorkSafe promptly, preserve the relevant area if safe to do so and keep the record for at least 5 years.

Key Takeaways

• PCBU meaning in New Zealand is broad, and it usually covers your company, sole trader business, partnership or organisation.
• From 1 November 2026, small PCBUs have a clearer critical risk focus. Prioritise risks that could cause death, serious injury or serious illness.
• Your core duty is to manage health and safety risks so far as is reasonably practicable under the Health and Safety at Work Act 2015.
• A useful checklist covers critical risks, controls, training, worker engagement, contractor management and regular reviews.
• Where PCBU duties overlap, the new framework requires PCBUs to co-operate with each other so far as reasonably practicable in relation to the same matter.
• If an incident is notifiable, contact WorkSafe as soon as possible, preserve the site where required and keep records for at least 5 years.

If you'd like help with your health and safety policies, contractor arrangements, incident records and small PCBU risk checklist, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.