The safety management system

In short: A safety management system (SMS) is the organised, formal way you manage the safety risks in a higher-risk building - the arrangements you use to plan, monitor, track and complete every safety-related activity, and to review whether it is working. It is not optional or abstract: a summary of your SMS is a required, named section of your safety case report, and the Building Safety Regulator sets out what it should contain.

What the regulator means by a "safety management system"

The Building Safety Regulator defines an SMS as "a formal management system or framework for managing safety risks" - the spread of fire and structural failure. The model it recommends is the familiar Plan, Do, Check, Act cycle: plan your policy and how you will deliver it; do the work of assessing risks and putting controls in place; check by measuring performance; and act by reviewing and improving. Other recognised models exist, such as the fire-risk-management standard BS 9997:2019 and the health-and-safety standard ISO 45001:2018, but you do not have to be accredited to any external standard. What matters, in the Regulator's words, is that it is "a system that works for you".

Why it matters: it's part of your safety case

An SMS is not a nice-to-have. When you prepare your safety case report, one of the required sections is a summary of the safety management systems you use to manage building safety risks. That summary must describe your roles and responsibilities, how you maintain and inspect the building, how you track issues through to completion, how you manage change, how you monitor performance, and how you review the whole system. It must also include a statement of your commitment to continuous improvement - ideally backed by an improvement plan with named owners, timescales and resources. In other words, the safety case is where you show your SMS; the SMS is the thing you actually run day to day.

It must be proportionate

The Regulator is explicit that an SMS should be proportionate to the hazards of your building - based on a risk assessment, not a template. What shapes it includes the complexity of the building and its safety measures, how many buildings you manage, the size of your organisation, how far you rely on contractors, and your resident profile. Any documents you produce "should be concise and easily understood". This is the same principle that governs the golden thread - see our guide on proportionality.

What a safety management system covers

Following the Plan-Do-Check-Act structure, an effective SMS pulls together:

• Plan - leadership from senior managers, a clear policy, and defined roles and responsibilities. Anyone with a specific role must have the competence (skills, knowledge, experience and behaviours) to carry it out, with the training, authority and budget to match.
• Do - assessing the building safety risks; scheduling, carrying out and recording maintenance and statutory inspections; using contractors whose competence you have checked; and - critically - reviewing what inspections uncover and tracking every identified action through to completion, recording the reasons where something cannot be done and any temporary measures put in place. It also covers change management (to the building, the residents, the management systems, or changes made by others) and emergency planning.
• Check - monitoring performance using both active monitoring (leading indicators, like confirming fire-door inspections happen on time) and reactive monitoring (lagging indicators, like incident investigations and breakdowns). If you manage several buildings, each must be monitored on its own - never as a portfolio average - and performance must be reported to senior managers.
• Act - reviewing the system whenever there is an incident, a dip in performance, a change to the building or the people responsible, a change in law or guidance, or simply on schedule - with the leadership team involved so improvements actually get resourced.

The hard part: running it, and proving it

Most accountable persons can describe an SMS. The difficulty is operating it consistently across a real building - making sure inspections are scheduled and done, that findings are actioned and closed out, that changes are assessed, that performance is monitored and reported - and then being able to evidence all of it when the Regulator asks. A safety management system that lives in spreadsheets, inboxes and people's heads is exactly the kind that fails under scrutiny.

How CTS and BuildSafe help

This is precisely what the CTS BuildSafe platform is built to do. Alongside being compliance software for Building Safety Act duties, BuildSafe is the digital safety management system through which an accountable person operates and evidences their arrangements: it schedules and records statutory inspections, tracks every identified action through to completion, holds roles and competence records, logs changes to the building, and surfaces the performance information you report to your board - all held in the golden thread and ready to summarise in your safety case report. The SMS in law is broader than software - it includes leadership, competence and culture - but the system that runs and proves it, day to day, is exactly what CTS provides. Talk to us about putting a working, evidenced SMS in place for your buildings.

General information, not legal advice. Reviewed by the CTS building safety team.