OSHA’s risk assessment requirements come from two places: the General Duty Clause in Section 5(a)(1) of the Occupational Safety and Health Act, which obligates every covered employer to keep the workplace free of recognized hazards likely to cause death or serious harm, and 29 CFR 1910.132(d), which requires general industry employers to assess the workplace for hazards that call for personal protective equipment and to certify that assessment in writing. Skipping either piece is expensive. A single serious violation now carries a maximum penalty of $16,550, and willful or repeated violations reach $165,514 each under the January 15, 2025 inflation adjustment.1Occupational Safety and Health Administration. US Department of Labor Announces Adjusted OSHA Civil Penalty Amounts for 2025
What the Law Actually Requires
Section 5(a)(1) is the catch-all. It applies whenever no specific OSHA standard covers a hazard, and to cite under it OSHA must show the hazard was recognized in the employer’s industry and that a feasible way to reduce or eliminate it existed.2Occupational Safety and Health Administration. Occupational Safety and Health Act of 1970 – Section: SEC. 5. Duties Because industry recognition is enough, a hazard doesn’t need to be written into a specific regulation for a citation to stick.
The PPE hazard assessment rule at 29 CFR 1910.132(d) is more prescriptive. It requires the employer to evaluate the workplace, decide what PPE is needed, communicate that selection to affected workers, ensure fit, and produce a written certification identifying the workplace assessed, the person who performed the assessment, and the date it was done.3eCFR. 29 CFR 1910.132 – General Requirements That certification is usually the first document an inspector asks to see, and its absence is a citable violation on its own.
Substance-specific standards (lead, asbestos, silica, and others) layer their own monitoring and assessment triggers on top. Whenever you introduce a new chemical, change a process, or modify equipment, treat the change as a trigger for a fresh evaluation. Both the General Duty Clause and the specific standards apply to current conditions, not the conditions that existed when the last assessment was written.
Who Falls Under Federal OSHA
Twenty-two states and territories run their own OSHA-approved plans covering both private-sector and government workers, and seven more run plans covering only state and local government employees. In those seven, private employers stay under federal OSHA.4Occupational Safety and Health Administration. State Plans State plans must be at least as protective as the federal program, and many add requirements such as mandatory written safety programs or more frequent assessments for specific industries. If you operate in multiple states, check each location’s jurisdiction because inspection procedures, penalty amounts, and filing deadlines differ.
Employers with ten or fewer employees during the prior calendar year get a partial exemption from recordkeeping and don’t have to maintain routine injury and illness logs unless OSHA specifically directs them to. They still must report fatalities, hospitalizations, amputations, and eye losses.5Occupational Safety and Health Administration. 29 CFR 1904.1 – Partial Exemption for Employers With 10 or Fewer Employees The exemption is from logs, not from the hazard assessment or General Duty Clause obligations.
What Belongs in the Written Assessment
OSHA publishes a free Job Hazard Analysis template that breaks each task into steps and prompts the assessor to note hazards and controls at each step.6Occupational Safety and Health Administration. OSHA Job Hazard Analysis Template Whatever form you use, each entry should identify the task being evaluated, the hazard type (biological, chemical, physical, ergonomic), the workers or job categories exposed, the likelihood and severity of potential injury, and the controls already in place. A risk-ranking scheme helps sort what needs immediate correction from what can be scheduled into a maintenance cycle.
The PPE certification under 29 CFR 1910.132(d)(2) is a separate document. It must stand on its own and identify the workplace evaluated, the certifier, and the date.3eCFR. 29 CFR 1910.132 – General Requirements It doesn’t have to be elaborate, but folding it into a general safety report without clearly labeling it as the PPE certification is a frequent source of citations.
Gathering the Data and Walking the Floor
A defensible assessment starts with paperwork, not a walkthrough. Pull the following before you leave the office:
- An equipment inventory covering every machine, power tool, and piece of heavy equipment, with make, model, age, and maintenance status.
- Safety Data Sheets for every hazardous chemical on site, organized by work area. Employees must have immediate access to SDSs without leaving their work area.7Occupational Safety and Health Administration. Hazard Communication Standard: Safety Data Sheets
- Real job descriptions that reflect what workers actually do day to day, including repetitive motion, awkward postures, and proximity to moving parts.
- OSHA Forms 300, 300A, and 301 from at least the past five years, which surface recurring injury patterns.8Occupational Safety and Health Administration. Recordkeeping
- Near-miss reports, which capture hazards before anyone gets hurt.
- Maintenance records for ventilation, fire suppression, machine guards, and electrical systems.
The physical inspection has to happen while normal operations are running. Watching a facility at rest tells you almost nothing about the hazards workers actually face. Walk every area, including loading docks and storage closets, and observe employees doing their standard work. Improvised shortcuts and ergonomic problems only become visible when people are working the way they actually work.
Test mechanical safeguards as you go. Emergency stops, safety interlocks, and light curtains should be verified as functional.9Occupational Safety and Health Administration. 29 CFR 1910.212 – General Requirements for All Machines Check for blocked exits, frayed wiring, improperly stored flammables, and missing guardrails. Add quantitative monitoring where the hazard calls for it: noise dosimeters worn during a full shift measure whether sound exceeds permissible exposure limits over an eight-hour average,10Occupational Safety and Health Administration. OSHA Technical Manual (OTM) – Section III: Chapter 5 – Noise and airborne contaminants like lead require initial monitoring whenever exposure could reach the action level, with follow-up monitoring every six months or quarterly depending on results.11Occupational Safety and Health Administration. 29 CFR 1910.1025 – Lead
Talk to the workers doing the jobs. They notice the conveyor that jams and forces someone to reach in, the storage area where fumes accumulate because the ventilation pulls the wrong direction, the ladder everyone avoids. Those conversations often surface the highest-priority fixes.
Choosing Controls in the Right Order
Once you’ve identified the hazards, OSHA expects you to control them using the highest feasible level of protection, ranked as follows:12Occupational Safety and Health Administration. Identifying Hazard Control Options: The Hierarchy of Controls
- Elimination. Remove the hazard: stop using the dangerous chemical, redesign the process, do the work at ground level rather than at height.
- Substitution. Replace it with something less dangerous, such as a less toxic solvent or a lower-voltage tool.
- Engineering controls. Physically separate workers from the hazard using machine guards, ventilation, noise enclosures, guardrails, and interlocks.
- Administrative controls. Change how work is organized through rotation, lockout/tagout procedures, warning signs, or schedule changes.
- Personal protective equipment. Safety glasses, respirators, hearing protection, hardhats, gloves. PPE is the last line because it depends on workers using it correctly every time.
Elimination and substitution aren’t always feasible. You can’t eliminate gravity from a roofing job. But OSHA expects you to justify defaulting to a lower level of control, so document the reason a higher-level fix wasn’t practical. When a permanent engineering control takes time to install, lower measures serve as interim protection until the fix is in place.
Training and Record Retention
Federal hazard communication rules require training on the hazardous chemicals in a worker’s area at initial assignment and whenever a new chemical hazard is introduced. Training must cover how to detect the presence or release of hazardous chemicals, the specific health and physical hazards, protective measures including emergency procedures, and how to read container labels and Safety Data Sheets.13eCFR. 29 CFR 1910.1200 – Hazard Communication Respiratory protection, fall protection, and powered industrial truck operation each carry their own training standards with separate documentation requirements. A defensible training log includes dates, attendee names, topics, and trainer qualifications.
Retention periods are longer than most employers realize, and confusing them is a common mistake. Injury and illness records (Forms 300, 300A, and 301) must be preserved for five years after the end of the calendar year they cover.14Occupational Safety and Health Administration. 29 CFR 1904.33 – Retention and Updating Employee medical records under 29 CFR 1910.1020 must be kept for the duration of employment plus thirty years. Employee exposure records, including monitoring data and sampling results, must be kept at least thirty years regardless of employment length.15eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records A medical record for someone who worked at the facility twenty years must be preserved for fifty years total.
Employees have the right to access their own exposure and medical records. The employer must provide access within fifteen working days of a request.16Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
Inspections, Penalties, and Abatement
OSHA doesn’t inspect on a fixed schedule. Its Site-Specific Targeting program uses electronically submitted injury and illness data to flag establishments with elevated rates, and complaints, referrals, and fatality reports trigger additional inspections. A workplace with a clean record can go years without an inspector; one with a high Days Away, Restricted, or Transferred rate can end up on a targeted list.
Current maximum penalties under the January 2025 adjustment are $16,550 per serious violation and $165,514 per willful or repeated violation. Failure-to-abate penalties run $16,550 per day past the abatement deadline, so a hazard left uncorrected for a few weeks can generate six-figure liability by itself.17Occupational Safety and Health Administration. OSHA Penalties Employers who receive citations must post them at or near the location of the violation, where employees can see them, for at least three working days or until the hazard is corrected, whichever is longer.18Occupational Safety and Health Administration. Employer Rights and Responsibilities Following a Federal OSHA Inspection
Within ten calendar days of the abatement deadline, the employer must certify that each cited violation has been corrected. The certification identifies the date and method of abatement and confirms that affected employees have been informed.19Occupational Safety and Health Administration. 29 CFR 1903.19 – Abatement Verification Willful and repeat violations, and some serious violations where the citation requires it, also demand supporting documentation such as purchase receipts, repair records, or photographs. When the allowed abatement period exceeds ninety calendar days, OSHA may require a formal abatement plan within twenty-five days of the final order, detailing the corrective steps, a completion schedule, and interim protections for workers while the fix is underway.
Treating the risk assessment as a one-time event rather than a living document is one of the most direct paths to a willful violation, because it signals that the employer knew the original assessment existed but chose not to maintain it. Any significant operational change (new equipment, modified workflows, different chemicals, major staffing changes, a new production process) triggers a reassessment obligation.
Free Help Before an Inspector Arrives
Nothing in federal law requires you to hire an outside consultant, and many small employers complete the assessment internally using OSHA’s free templates. For facilities with complex chemical exposures, confined-space entry, or process safety management obligations, a certified safety professional can catch gaps that internal staff miss.
OSHA also runs a free On-Site Consultation Program that is separate from its enforcement side and provides confidential hazard assessments to small and medium-sized businesses. Findings from these consultations do not trigger citations or penalties, which makes the program a low-risk way to find problems before a formal inspection does. Each state runs its own version, and wait times vary.