Paperwork Doesn’t Save Anyone. Here’s What Actually Does.
Written by Stephanie Austin, Founder & Lead Trainer, Prima Cura Training | Last reviewed: September 2026 | Next review: September 2027
This gap between workplace training and what staff can actually do under pressure is not unique to events, first aid or security.
A few weeks ago I wrote about what went wrong at EddFest this summer: inconsistent security, marshals who didn’t know what to do, a member of the public helping someone collapse because no staff were nearby. I made one point in that piece worth repeating properly here, because it’s the one that actually matters for your business, not just a stadium show. The paperwork was never the problem.
EddFest almost certainly had a staff handbook covering most of what went wrong that night. I know it did; I watched people wading through discarded copies. What it didn’t have was people trained to apply it under pressure. That gap between what’s written down and what people can actually do isn’t unique to one event, or to first aid, or to security. It shows up anywhere a business assumes a document has done the job a trained person needs to do, from a risk assessment left in a drawer to a complaints policy nobody’s ever been taught to actually use. I see it in businesses of every size, and every part of it is closable.
| The short version: A document only protects people if the person holding it can act on it, under pressure, without hesitating. That’s as true of a risk assessment and a first aid certificate as it is of a complaints policy. Closing the gap takes four things: a refresher schedule that matches how fast the skill actually fades, practice that isn’t just sitting in a room, someone whose job it is to check competency between courses, and staff who are actually trained, not just handed a policy, to deal with things going wrong, including complaints. The law itself draws the same distinction between having information and providing training. |
What Does the Law Actually Say About This?
This isn’t just a training provider’s opinion. Section 2 of the Health and Safety at Work etc. Act 1974 requires employers to ensure, so far as is reasonably practicable, the health, safety and welfare of their employees, and it spells out what that includes. Section 2(2)(c) specifically requires “the provision of such information, instruction, training and supervision as is necessary.”
Notice that information and training are listed as two separate, distinct duties, not one. The law itself doesn’t treat a handbook as equivalent to training. It never has. A business that hands out a policy document and calls it done has met one part of that sentence and skipped the other.
What Should a Risk Assessment Actually Include?
A risk assessment is where most businesses start, and it should be. HSE’s own five-step framework is straightforward: identify the hazards, decide who might be harmed and how, evaluate the risk and decide on precautions, record the significant findings, and review it regularly as things change. Done properly, under the Management of Health and Safety at Work Regulations 1999, it’s a genuinely useful document.
Where it goes wrong is in treating step five, the review, as optional, and in treating the finished document as the end of the job rather than the start of it. A risk assessment can identify that a queue of thousands needs welfare provision, or that a fire exit needs to stay clear. It doesn’t put a trained person on the door, and it doesn’t teach anyone what a heat-related collapse looks like before it becomes one. That’s the layer most organisations underinvest in, because a finished risk assessment feels like the job is done. It’s the groundwork. The training built on top of it is what actually protects anyone.
The Proof Is Already in Our Own Numbers
This isn’t a theory. We’ve written before about the Chain of Survival for bystander CPR and AED use, and the gap between knowing and doing shows up starkly in the data. According to the Resuscitation Council UK 2025 guidelines, where a trained bystander acted promptly and correctly, return of spontaneous circulation occurred in 50 to 57 per cent of cases. The national average across all bystanders sits at 9 to 10 per cent.
Bystander CPR happens in 60 to 73 per cent of cases in England, which sounds reasonable, but bystander AED use sits under 10 per cent nationally, according to the same guidelines and figures from the British Heart Foundation.
Most people know CPR exists in principle. Far fewer have ever had their hands on a defibrillator, or been told clearly enough that it’s safe to use one. Knowing something exists and being trained to use it under pressure are two entirely different things, and the survival numbers only move when the second one happens.
There’s a psychological reason the gap opens up in the first place, too. I’ve written separately about the bystander effect: people don’t just need information sitting in their head; they need enough certainty to act on it in front of witnesses, under pressure, without waiting for someone else to go first. That certainty is exactly what training builds, and a document can’t.
What Effective Workplace Training Actually Means
A certificate confirms someone sat in a room. It doesn’t confirm they can do the thing the certificate is for, three months later, with their heart rate up and other people watching. That distinction sounds obvious written down. It’s routinely missed in practice, because a completed training record looks identical whether the learning stuck or not.
The businesses that get this right treat a course as the start of competency, not the end of it. The ones that get caught out treat the certificate as the finish line, then find out what their team actually retained during the one moment it mattered.
Three Things That Actually Close the Gap
A refresher schedule that matches how fast the skill actually fades
Skills fade faster than most people assume. Research on CPR specifically has found skill decay can begin within two weeks of training, with most studies showing meaningful decline within a few months, long before the standard one- or two-year recertification point most courses are built around. It’s why our Basic Life Support and AED course exists as the accepted annual refresher for EFAW and FAW certificate holders, rather than something people do once and file away. Annual is the industry standard for a reason, but it’s a compromise between what the research shows and what’s practical to deliver, not proof the skill is still sharp eleven months in.
That’s exactly why the next two things matter as much as the refresher date on the calendar.
Scenario practice, not just theory
Sitting through slides on what to do is not the same as doing it under mild pressure, with a scenario that doesn’t go exactly to plan. Tabletop exercises, walk-throughs, and practical drills surface the gaps a classroom session can’t: the fire exit that’s actually blocked, the AED nobody can locate quickly, the staff member who freezes the first time it’s not a drill. Spaced, shorter practice sessions between full refreshers are consistently linked to better retention than relying on one big annual session alone.
Checking competency between courses is the employer’s job, not just the trainer’s
This is the step most organisations skip entirely, and it’s worth being honest about whose job it actually is. It isn’t ours. A training provider’s responsibility ends, properly, at the point someone leaves a course having met the standard on the day. What happens to that competency over the following months, whether it’s practised, tested, or left to quietly fade, is down to the employer.
That doesn’t need to be complicated or expensive. Ask a few staff, without warning, where the nearest first aid kit or AED is. Run an unannounced fire drill instead of a scheduled one. Ask someone to talk you through what they’d do if a colleague collapsed, or if a visitor made a complaint at the front desk. If the answers are confident and specific, training has landed. If they’re vague, you’ve found the gap while it’s still just an awkward internal conversation, not a genuine incident.
Some sectors already treat this as a formal requirement rather than good practice. Providers regulated by the Care Quality Commission are expected to keep staff competent throughout their employment, not only at the point of qualification, and CQC inspections routinely test this by asking staff direct questions, not just by reviewing a training matrix.
Who’s Actually Trained to Handle a Complaint?
There’s one area of competency that gets less attention than first aid or fire safety, and it matters just as much to a business’s survival: what happens when a customer, client or member of the public complains. Most organisations have a complaints policy sitting somewhere. Far fewer have trained anyone to actually run it.
The international standard for this, ISO 10002, sets out what good practice looks like: acknowledge complaints quickly, keep the complainant informed, investigate properly, and close the loop, even when the answer is difficult. For anyone working in regulated social care, this isn’t just best practice. CQC Regulation 16 requires providers to operate an effective, accessible system for identifying, receiving, handling and responding to complaints, and CQC can request a full summary of complaints and responses within 28 days of asking for one.
I’m in the middle of watching what happens when none of that exists.
I submitted a formal written complaint to the company behind EddFest in July, covering the safety and welfare failures I’ve written about elsewhere on this site. Since then I’ve sent two follow-up emails, copying in the organisation’s directors directly. Every one of those emails has been opened. The read receipts confirm it. Not one has been acknowledged, let alone answered.
That’s not a paperwork failure. A business running an event at that scale almost certainly has a complaints process somewhere. What’s missing is anyone trained and empowered to actually run it: someone who knows to acknowledge a complaint within a reasonable timeframe, recognises when an issue needs escalating rather than sitting in an inbox, and understands that silence doesn’t make a complaint disappear; it just moves it somewhere more public. This is exactly how complaints turn into reputational damage. Not because the original issue was unanswerable, but because nobody was equipped to answer it, so the complainant is left with no option except to keep escalating, or to say it publicly instead.
This is precisely what our Complaints and Conflict Resolution course exists to prevent: giving staff, not just a policy document, the skill and the confidence to acknowledge a complaint properly, de-escalate a frustrated customer, and know when and how to hand something upward. It’s the same principle as everything else in this piece. The policy was never the problem. Nobody being trained to use it is.
Good workplace training does more than produce certificates. It gives people the confidence and practical ability to respond properly when something genuinely goes wrong.
How Do You Know If Your Training Is Real or Just Paperwork?
A written risk assessment is a legal minimum under the Management of Health and Safety at Work Regulations 1999, and HSE’s own guidance is clear that assessing risk is only part of the job. The rest is covered by that separate training duty under the 1974 Act. A handbook or a risk assessment that nobody’s been tested against isn’t compliance in any meaningful sense; it’s a document that exists in case something goes wrong, rather than a reason nothing will.
FAQ
What’s the difference between awareness and training?
Awareness means someone knows a risk or a procedure exists. Training means they can actually carry it out, under realistic conditions, without needing to look it up first.
How quickly do practical skills like CPR fade without practice?
Faster than most people expect. Research on CPR skill retention has found measurable decay beginning within weeks of training, which is why spaced practice between full refreshers matters, not just the refresher date itself.
Whose job is it to check staff competency between training courses?
The employer’s, not the training provider’s. A course confirms competency on the day it’s delivered. What happens to that skill over the following months, whether it’s practised, tested or left to fade, is down to the organisation, through spot checks, drills and honest conversations, not the certificate itself.
Is a written risk assessment enough to meet UK health and safety law?
No. A risk assessment identifies and records risk, but the Health and Safety at Work etc. Act 1974 separately requires employers to provide training, not just documentation, so staff can actually respond to the risks that have been identified.
If you want your team to be the ones who act, not the ones standing around waiting for someone else to, our WAVE, First Aid, Health & Safety Awareness and Complaints and Conflict Resolution courses, and our Basic Life Support and AED refresher, are all built around genuine competency, not just attendance.
Get in touch if you’d like to talk through what a proper refresher and competency schedule would look like for your team.
This article reflects Steph’s professional opinion and her own ongoing experience. References to the organisers of EddFest describe a formal complaint Steph submitted in good faith, along with two follow-up emails copying in the organisation’s directors, none of which had received any acknowledgement or response at the time of publication; no formal finding of wrongdoing is implied beyond that lack of response. Figures on bystander CPR and AED use are drawn from Prima Cura’s Chain of Survival blog, sourced from the Resuscitation Council UK 2025 guidelines and the British Heart Foundation. Legislative and regulatory references, including to the Health and Safety at Work etc. Act 1974, CQC Regulation 16 and ISO 10002, are correct to the best of our knowledge at the time of writing and do not constitute legal advice. Always check hse.gov.uk, legislation.gov.uk, cqc.org.uk and resus.org.uk directly for current guidance.
