Incident Reporting for Hospitality Venues: What You Must Record, What You Must Report, and What Most Venues Get Wrong

A customer slips on a wet floor in the bar area. A kitchen porter burns their forearm on a pan. A member of the public trips on a loose paving slab outside your front entrance and is taken to hospital by their partner. A drunk customer pushes a member of your staff. A ceiling tile falls and narrowly misses a server during the lunch rush.

Every one of these incidents needs to be recorded. Some of them need to be reported to an external authority within a specific timeframe. At least one of them, depending on the detail, could result in a criminal prosecution if you do not report it. And from April 2027, a suspicious individual surveilling your venue or an unattended bag that triggers an evacuation will also need documenting as part of your Martyn's Law procedures.

If you are confident you know which of those incidents needs a RIDDOR report, which just needs an accident book entry, and which is a near-miss that should be recorded but does not need reporting externally, you are ahead of most venue operators.

If you are not confident, this article will fix that.

The Reporting Problem Nobody Talks About

An HSE study using the Merseyside Accident Information Model found that only 30% of reportable workplace injuries were actually reported under RIDDOR. The hospitality sector had one of the lowest reporting levels of any industry.

This is not because hospitality operators are reckless. It is because the system is confusing, the thresholds are unclear, and the pace of a busy venue makes it easy to deal with the immediate situation and never circle back to the paperwork. The customer who slipped gets helped up, given a free drink, and the floor gets mopped. Everyone moves on. Nobody writes anything down.

The problem surfaces later. When the customer's solicitor sends a letter. When the HSE investigates a pattern of injuries at your premises. When your insurer asks to see your incident records and finds nothing. Or when, under Martyn's Law, the SIA wants to understand how you handle security incidents and you have no documented history.

The gap is not in how you respond to incidents. Hospitality people are generally good at responding. The gap is in how you record them.

Source: CHAS — RIDDOR reporting levels study; HSE — Merseyside Accident Information Model

The Three Levels of Incident Recording

Not every incident is the same, and not every incident needs the same response. The problem most venues have is that they treat everything identically, either recording nothing at all, or not knowing when they need to escalate to an external report. Here are the three levels you need to understand.

Level 1: Internal Record Only

These are incidents that do not meet the threshold for external reporting but must still be recorded in your accident book or incident log. Every workplace accident, however minor, should be recorded internally. This is not optional generosity on your part, it is a legal requirement under the Social Security (Claims and Payments) Regulations 1979 for businesses with employees.

Examples in a hospitality setting:

• A member of staff cuts their finger while prepping food and receives first aid on site
• A customer trips but is not injured and does not go to hospital
• A minor burn in the kitchen that does not require hospital treatment
• A staff member strains their back lifting a keg but returns to work the same day
• A verbal altercation between a customer and staff that does not result in physical injury

What to record: Date, time, location within the venue, name of injured person (and whether staff or customer), what happened, what injuries were sustained, what first aid was given, who witnessed it, and what action was taken.

Why it matters: Internal records create the pattern. If you have three slip incidents in the same area over two months, that is a risk assessment trigger. If a staff member later claims an injury happened at work and you have no record, you have no defence. If an inspector asks about your incident history and you have nothing, their confidence in your management drops immediately.

Level 2: RIDDOR Reportable

RIDDOR — the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 — requires you to report specific types of incidents to the HSE or your local authority. Failure to report is a criminal offence. These are not suggestions.

For hospitality venues, the most common RIDDOR triggers are:

Specified injuries to workers:

• Fractures (other than to fingers, thumbs, and toes)
• Amputations
• Serious burns covering more than 10% of the body or damaging sight, the respiratory system, or other organs
• Loss of consciousness caused by head injury or asphyxia
• Any injury requiring admittance to hospital for more than 24 hours

Over-seven-day injuries: If a member of staff is injured at work and cannot do their normal duties for more than seven consecutive days (not counting the day of the accident), this must be reported within 15 days.

Injuries to non-workers (customers and members of the public): If a member of the public is injured as a result of your work activities and is taken directly from your premises to hospital for treatment, this must be reported. This is the one that catches most hospitality venues out. It does not need to be a major injury — but the injury must arise from a work-related activity. A customer slipping on a floor you failed to clean is work-related. A customer tripping over their own bag is not. A fight between two customers is not. The "work-related" qualifier is critical and is the part most venues either overlook or misunderstand.

Critical distinction: If a customer slips, says they are fine, goes home, and later visits their GP who refers them to hospital, that is not reportable. The person must be taken to hospital directly from your premises. But if a customer falls, hurts their knee, and their partner drives them to A&E from your car park, that is reportable.

Dangerous occurrences (near-misses with serious potential):

• An electrical short circuit that causes a fire or explosion
• The collapse or failure of load-bearing equipment
• An uncontrolled release of a substance that could cause harm (such as a gas leak or chemical spill)

How to report: Most RIDDOR reports should be made online at www.hse.gov.uk/riddor. For hospitality venues specifically, reports go to your local authority rather than the HSE. Deaths and specified injuries must be reported without delay (the HSE interprets this as within 10 days). Over-seven-day injuries must be reported within 15 days.

Records must be kept for at least three years.

Source: RIDDOR 2013; HSE — Reportable incidents; HSE — Examples of reportable incidents,

Level 3: Security and Terrorism-Related Incidents (from April 2027)

Martyn's Law does not create a formal "incident reporting" requirement in the way RIDDOR does. There is no equivalent of an online report form to submit to the SIA after a security incident. But the Act does require venues to have public protection procedures in place and to be able to demonstrate that those procedures work.

In practice, this means that security-related incidents, and how you handled them, needs to be documented. Not because the Act says "you must file a report" but because if the SIA ever reviews your compliance, they will want to see evidence that your procedures have been tested and applied.

Examples of security incidents worth documenting:

• An unattended bag that triggered a search or partial evacuation
• Suspicious behaviour observed by staff (someone photographing access points, asking unusual questions about capacity or security)
• A threat made to the venue or staff, whether in person, by phone, or online
• An evacuation, invacuation, or lockdown activated for any reason (including false alarms)
• A request from police or counter-terrorism officers for information about your venue
• Any incident where staff used the procedures you have trained them on

What to record: Date, time, what happened, who was involved (staff roles, not necessarily customer names unless appropriate), what procedures were followed, how the situation was resolved, and any follow-up actions.

Why it matters: This is about building an evidence trail that shows your procedures are not just documents gathering dust. If you activated a lockdown procedure because of a disturbance outside and you recorded how it went, what worked, what did not, what you would change, that is exactly the kind of evidence that demonstrates genuine compliance. If you have no record of ever having used your procedures, a regulator will reasonably question whether they exist in practice.

Source: Terrorism (Protection of Premises) Act 2025; ProtectUK — Martyn's Law

The RIDDOR Scenarios That Catch Hospitality Venues Out

The regulations are not intuitive. Here are the specific situations in which hospitality venues most often make the wrong decision.

"They said they were fine"

A customer falls in your venue, insists they are fine, refuses first aid, and leaves. Two hours later, they are in A&E. Is this reportable?

Answer: No, if they left your premises and went to hospital later. RIDDOR requires that the person is taken to the hospital directly from the site of the accident. But you should absolutely record this internally, because if they make a claim, your contemporaneous record of what happened is your best evidence.

"It was their own fault"

A customer who has had too much to drink falls down your stairs and breaks their wrist. Is this reportable?

Answer: Yes. RIDDOR does not care about fault. If a member of the public is injured and taken to hospital from your premises, it is reportable. The question of whether it was their fault is a matter for liability, the reporting obligation is separate.

"The staff member came back after a week"

A kitchen worker slips and injures their back on Monday. They take the rest of the week off but come back the following Monday. Is this reportable?

Answer: Count the days. The day of the accident does not count. If they were unable to work (or unable to do their normal duties) for more than seven consecutive days after the accident, it is reportable. In this example, Tuesday through Sunday is a six-day period. If they returned to normal duties on Monday, it is not reportable under the seven-day rule, but it should still be recorded internally, and you should monitor whether it progresses.

"It was just a fight between customers"

Two customers get into a physical altercation. One is injured and taken to the hospital. Is this reportable?

Answer: No, unless the injured person was a worker. Acts of non-consensual violence against non-workers (customers) are not reportable under RIDDOR unless they arise from a work-related activity. A fight between customers is not a work-related accident. But if a member of staff was assaulted and taken to hospital, that would be reportable.

"The shelf nearly fell, but nobody was hurt"

A loaded shelving unit in the cellar partially collapses. Nobody is in the cellar at the time. Is this reportable?

Answer: Potentially. If the collapse could have caused death or serious injury, it may qualify as a dangerous occurrence. These are near-misses with serious potential consequences, and they are reportable even though nobody was injured. The key question is whether the incident could have caused serious harm if someone had been present.

Source: HSE — Examples of reportable incidents

Why Near-Misses Matter More Than Accidents

Here is the counterintuitive truth about incident management: the most valuable records are not the ones about injuries that happened. They are the ones about injuries that nearly happened.

A near-miss is a free warning. The wet floor that someone walked around. The kitchen hazard was identified and resolved before anyone was injured. The frayed cable was noticed during a check. These incidents tell you where your next accident is likely to come from, without anyone actually being harmed.

Most hospitality venues record zero near-misses. Not because they do not happen; they happen constantly, but because nobody considers them incidents worth recording. The culture is to fix the problem and move on, which is the right immediate response but the wrong long-term approach.

If your incident log only contains injuries, it means one of two things: either nothing ever nearly goes wrong in your venue (unlikely), or you are only recording outcomes rather than risks. An inspector looking at that log sees a venue that is reactive rather than proactive. An insurance assessor observes a venue that fails to learn from warning signs.

Recording near-misses does not need to be complicated. A simple form, or even a section in your daily shift log, that captures "what happened, where, and what we did about it" is sufficient. What matters is that it exists and that you use it to inform your risk assessments.

The Accident Book Is Not Enough

Many hospitality venues rely on a physical accident book, the BI 510 format, or a similar system. It meets the basic legal requirement, but it has significant limitations.

The problems with a paper accident book:

• It lives in one location. If an incident occurs in the kitchen and the book is in the office, the record may be delayed or forgotten.
• It contains personal data. Under UK GDPR, accident records containing names and injury details must be stored securely. A book sitting on a shelf in the back office, accessible to any staff member, is a data protection issue. The HSE acknowledged this by recommending that employers use forms where each entry can be detached and stored separately.
• It only captures what someone writes down. The quality of the record depends entirely on who fills it in, when they fill it in, and how much detail they include. A record that says "customer fell, seemed OK" is almost useless.
• It does not prompt the right questions. A good incident record captures the five Ws: who, what, when, where, and why. A blank page in an accident book does not guide the person filling it in toward the information that actually matters.
• There is no follow-up mechanism. An entry in an accident book is a static record. It does not trigger a review, prompt a RIDDOR assessment, or generate a reminder to check whether the injured worker has been off for seven days.

A digital system solves all of these problems, but even if you are not ready for that, you can improve your paper system significantly by creating a standard incident form that prompts for the right information and includes a RIDDOR decision checklist.

Building a System That Actually Works

The goal is not to create more paperwork for its own sake. The goal is to build a system that captures the right information, triggers the right actions, and creates a defensible record. Here is what that looks like for a hospitality venue.

One Incident Form, All Incident Types

Create a single incident report form that covers workplace injuries, customer injuries, near-misses, and security incidents. The form should prompt for:

• Date, time, and exact location within the venue
• Type of incident (injury to staff, injury to customer, near-miss, security incident, dangerous occurrence)
• Description of what happened, in enough detail that someone who was not there could understand it
• Injuries sustained (if any), first aid given, and whether the person was taken to the hospital
• Witnesses (names and contact details)
• Immediate actions taken (floor cleaned, area cordoned off, equipment taken out of service, procedure activated)
• RIDDOR assessment — a simple checklist: Was this a specified injury? Was the person taken to the hospital from the premises? Is the worker likely to be off for more than seven days? If yes to any, flag for external reporting.
• Root cause — not just what happened, but why. Was it a hazard that should have been identified in a risk assessment? Was a procedure not followed? Is training needed?
• Follow-up actions — what needs to change to prevent this from happening again, who is responsible, and by when

Clear Escalation Triggers

Staff need to know when to escalate. The simplest approach is a decision tree:

Did someone go to the hospital from the premises? → If staff member: likely RIDDOR reportable, escalate to manager immediately → If customer/public: RIDDOR reportable, escalate to manager immediately

Was the injury to a staff member serious? (fracture, burn, loss of consciousness) → RIDDOR reportable, escalate immediately

Has a staff member been off work for more than three days? → Monitor. If they are unable to perform normal duties for seven consecutive days, it becomes RIDDOR reportable. Report within 15 days of the accident.

Was it a near-miss that could have caused serious injury or death? → Record as a dangerous occurrence. Assess whether RIDDOR reporting is required.

Was it a security concern? → Record under your Martyn's Law procedures. Consider whether it should be reported to the police.

Review Cycle

Incidents are not just records; they are data. Review your incident log monthly. Look for patterns: are slips happening in the same area? Are injuries clustering around the same time of day or the same shift? Are near-misses being recorded, or does the log only show actual injuries?

Use the data to update your risk assessments. This is not extra work, it is how risk assessment is supposed to work. Your risk assessment should be a living document informed by what actually happens in your venue, not a static file created once and forgotten.

How This Connects to Everything Else

If you have read our previous articles, you will see the pattern forming. Training records prove your staff know what to do. Incident records prove what happens when they have to do it. Risk assessments prove that you learned from what happened and took action to prevent it from happening again.

These are not separate systems. There are three parts of the same evidence chain:

Risk assessment → identifies the hazards Training → ensures staff know how to manage the hazards Incident records → capture what happens when hazards materialise Review → feeds back into the risk assessment

An inspector, whether fire, food hygiene, HSE, or the SIA, is looking for evidence that this cycle operates in your venue. Training without incident records suggests you have a theory, but no evidence that it works in practice. Incident records without training suggest you are reacting to problems rather than preventing them. The system demonstrates compliance only when all parts are connected.

This is the principle behind VenueLinQ's approach: a single platform where your risk assessments, training records, policy acknowledgements, and incident reports all live together, connected and cross-referenced. Not because compliance should be complicated, but because the evidence chain should not have gaps.

Where to Start This Week

Day one: Check whether you have an accident book. If it is the old BI 510 format without detachable pages, replace it with a UK GDPR-compliant version. Better still, create a digital incident form.

Day two: Create your RIDDOR decision checklist. Print it, laminate it, and put it where incidents actually get dealt with — behind the bar, in the kitchen, in the manager's office. Make sure every duty manager knows the thresholds.

Day three: Brief your team. Five minutes at the start of the next shift: "If something happens, someone gets hurt, something nearly goes wrong, anything that concerns you, tell the duty manager, and we will record it. We are not looking to blame anyone. We need the information so we can prevent itfrom happening again."

Ongoing: Review your incident log monthly. If it is empty, that is not a sign of safety; it is a sign of underreporting. If it only contains injuries, start encouraging near-miss recording. If it is full, you have a problem to investigate. All three scenarios require action.

VenueLinQ

If you want to manage your incident reporting, training records, and compliance evidence in one place, join the VenueLinQ waiting list or download our free Martyn's Law compliance checklist to start today.

Sources and Further Reading

1. Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 — legislation.gov.uk
2. HSE — Reportable incidents — hse.gov.uk
3. HSE — Examples of reportable incidents — hse.gov.uk
4. HSE — How to make a RIDDOR report — hse.gov.uk
5. CHAS — RIDDOR reporting levels (Merseyside Accident Information Model) — chas.co.uk
6. HSE Statistics 2024/25 — Accommodation and food services highest non-fatal injury rate — SafeWorkforce
7. Catering Insight — Hospitality injuries rose 13% in two years, 4,233 RIDDOR reports in 2023/24 — cateringinsight.com
8. The Drinks Business — Average injury case costs £11,700; hospitality highest non-fatal injury rate — thedrinksbusiness.com
9. Terrorism (Protection of Premises) Act 2025 — legislation.gov.uk
10. ProtectUK — Martyn's Law — protectuk.police.uk
11. Home Office — Martyn's Law Factsheet, April 2025 — gov.uk
12. SIA — Martyn's Law regulatory role — gov.uk

Chris Brown is the founder of VenueLinQ, a compliance platform built to help hospitality venues manage their full regulatory obligations — including incident reporting, training records, and inspection evidence — in one place.