OSHA Safety Plan: Elements, Recordkeeping, and Penalties

An OSHA safety plan is a written safety and health program that identifies workplace hazards, spells out how the employer will control them, trains workers to work safely, and documents that all of it is actually happening. Federal OSHA does not mandate a single specific written plan, but its recommended practices are the framework most employers follow, and roughly half the states require a formal written program under their own OSHA-approved plans. Either way, employers without a documented program face steeper penalties after incidents and have a much harder time defending against citations under the General Duty Clause.

Is a Written Safety Plan Legally Required

The Occupational Safety and Health Act of 1970 is the source of every employer’s basic obligation. Section 5(a)(1), the General Duty Clause, requires every employer to “furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm.”1Office of the Law Revision Counsel. 29 USC 654 – Duties of Employers and Employees The language is intentionally broad. It does not tell you exactly how to run a safe workplace.

At the federal level, OSHA’s Safety and Health Program Management Guidelines are advisory. The agency’s own preamble states they “do not create any new legal obligations or alter existing obligations created by OSHA standards.”2Occupational Safety and Health Administration. OSHA Safety and Health Program Management Guidelines So no, federal OSHA will not cite you for the mere absence of a written plan. What it can do is cite you under the General Duty Clause for the underlying hazards a plan would have caught, and an employer with a documented, functioning program is in a far stronger position during an inspection than one operating on good intentions.

State law is a different story. According to OSHA’s own survey, 24 states require some form of written safety program. Five require one from every employer regardless of size or industry. Eight target high-hazard employers. Others limit the requirement to employers above a certain headcount or those who self-insure for workers’ compensation.3Occupational Safety and Health Administration. Safety and Health Programs in the States If you operate in a state with an OSHA-approved plan, check the specific rule that applies to you. State penalties for missing a required program are separate from any federal citation.

The Seven Core Elements Your Plan Must Cover

Whether you are building a program because your state requires one or because you want to meet OSHA’s recommended practices, the framework is the same. OSHA identifies seven building blocks.4Occupational Safety and Health Administration. Recommended Practices for Safety and Health Programs

  • Management leadership. Senior leadership sets safety goals, allocates budget and staff time, and visibly participates. A program that exists only in a binder no one opens creates a false sense of compliance.
  • Worker participation. Employees, including contractors and temporary workers, help identify hazards, investigate incidents, and track progress.
  • Hazard identification and assessment. Ongoing procedures find and evaluate hazards from routine work, non-routine tasks, and emergencies.
  • Hazard prevention and control. Once hazards are identified, the employer selects controls following the hierarchy of effectiveness.
  • Education and training. Everyone from frontline workers to supervisors receives training suited to their role and the hazards they face.
  • Program evaluation and improvement. The program is reviewed periodically to verify controls are working and to catch shortcomings before they cause injuries.
  • Communication and coordination. Workers have a reliable channel to report hazards without fear of retaliation, and multi-employer worksites coordinate safety responsibilities across companies.

OSHA’s guidelines note that “there may be several ways to implement each core element” and that programs should evolve over time.2Occupational Safety and Health Administration. OSHA Safety and Health Program Management Guidelines The goal is a living system, not a compliance document you file and forget. Review the whole program at least annually, and again whenever a significant incident occurs, new equipment or processes come in, or the workforce changes substantially. Pull your injury log and look for patterns. If the same injury keeps appearing, your controls are not working regardless of what the written plan says.

Identifying and Controlling Hazards

Hazard identification starts with an initial worksite survey covering the physical environment, equipment, materials, and work practices. Routine inspections keep the picture current after that.

Job Hazard Analysis

A job hazard analysis breaks a task into its component steps, identifies what could go wrong at each step, and determines how to prevent it. OSHA’s guidance describes the focus as “the relationship between the worker, the task, the tools, and the work environment.”5Occupational Safety and Health Administration. Job Hazard Analysis Watch an employee perform the job, list each step, ask what could go wrong and how severe the consequences would be, then rank jobs by risk so the most dangerous ones get addressed first. Involving employees is not optional in any meaningful sense. They know the shortcuts, the awkward positions, and the moments when things tend to go sideways.

Chemical Hazard Communication

For workplaces using hazardous chemicals, OSHA’s Hazard Communication standard requires Safety Data Sheets to be “readily accessible during each work shift” to employees in their work areas.6Occupational Safety and Health Administration. Hazard Communication Standard 1910.1200 A worker handling a chemical at 2 a.m. on a weekend needs the same immediate access as someone working Monday morning. A binder locked in a supervisor’s office does not meet the standard. Digital systems work fine as long as every employee can actually reach them during their shift.

Incident and Near-Miss Investigation

Every incident, including near-misses where no one was hurt, should be investigated using a consistent written procedure aimed at finding root causes rather than assigning blame. Near-miss investigations are arguably more valuable than injury investigations because you get the lesson without the cost.

The Hierarchy of Controls

Once a hazard is identified, choosing the control follows a hierarchy ranked from most to least effective:7Centers for Disease Control and Prevention. Hierarchy of Controls

  • Elimination. Remove the hazard entirely. If a task requires working at a dangerous height, redesign the process so it happens at ground level.
  • Substitution. Replace the hazardous material or process with a less dangerous one.
  • Engineering controls. Physically isolate workers through ventilation, machine guards, sound barriers, or similar modifications.
  • Administrative controls. Change how people work through procedures, scheduling, signage, or rotation to limit exposure.
  • Personal protective equipment. Gloves, respirators, hard hats, and similar gear. PPE is the last resort because it depends on the worker using it correctly every time.

Too many employers jump straight to PPE because it is the cheapest option. The higher controls protect workers regardless of human behavior; PPE fails the moment someone forgets to put it on. A documented plan should show that higher-level controls were considered first and explain why PPE was chosen when it was.

Training Rules That Get Enforced

OSHA requires initial safety training for new hires and specialized training for employees exposed to particular hazards. The details matter more than most employers realize.

Language and Comprehension

All training must be delivered “in a manner that employees receiving it are capable of understanding.” In practical terms, “this means that an employer must instruct its employees using both a language and vocabulary that the employees can understand.”8Occupational Safety and Health Administration. OSHA Training Standards Policy Statement If you routinely give work instructions in Spanish, safety training needs to be in Spanish too. Handing a written manual to workers who cannot read does not satisfy the requirement. Inspectors are trained to look beyond the paperwork and determine whether employees actually understood what they were taught.

Retraining Triggers

Refresher training is not a calendar exercise. Under specific OSHA standards, retraining is required when a supervisor observes an employee not following safe work practices, when new equipment or procedures change how a task is performed, or when an employee must perform a task they do not normally handle. Employees who have not performed a particular task in more than a year must be retrained before doing it again.9Occupational Safety and Health Administration. Training Requirements Under 1910.269 The trigger is the situation, not an expiration date set by a training vendor.

Competent Person vs. Qualified Person

Many OSHA standards require a “competent person” or “qualified person,” and the terms are not interchangeable. A competent person can identify existing and predictable hazards and has authority to stop work and correct dangerous conditions. No specific degree is required, but the person must demonstrate the ability. A qualified person holds a recognized degree, certificate, or professional credential and has the technical expertise to design or install safety systems. The competent person is the on-the-ground enforcer; the qualified person is the engineer or designer. High-risk operations like excavation, scaffolding, and fall protection often need both.

Recordkeeping and Severe-Injury Reporting

Recordkeeping is one of the most concrete obligations employers face, and the details trip up even well-intentioned companies.

Who Must Keep Records

Employers with more than 10 employees are generally required to maintain injury and illness records.10Occupational Safety and Health Administration. Recordkeeping Businesses in certain low-hazard industries listed in OSHA’s regulatory appendix are partially exempt from routine recordkeeping, even if they exceed the 10-employee threshold.11Occupational Safety and Health Administration. 1904.2 – Partial Exemption for Establishments in Certain Industries Both exemptions disappear if OSHA specifically asks you to keep records or if a reportable severe injury occurs. Every employer, regardless of size or industry, must report fatalities, hospitalizations, amputations, and eye losses.

The Three Forms

Covered employers use three forms:

  • OSHA Form 300, the ongoing log of every recordable work-related injury and illness throughout the year.
  • OSHA Form 301, a detailed incident report completed for each individual incident on the 300 Log.
  • OSHA Form 300A, the year-end summary, which must be certified by a company executive and posted where employees can see it from February 1 through April 30 of the following year.12eCFR. 29 CFR 1904.32 – Annual Summary

All three forms, along with any privacy case list, must be kept for five years after the end of the calendar year they cover.13eCFR. 29 CFR 1904.33 – Retention and Updating Depending on establishment size and industry classification, larger employers and those in designated high-hazard industries must also submit some or all of this data electronically through OSHA’s Injury Tracking Application each year.14eCFR. 29 CFR 1904.41 – Electronic Submission of Records

Severe-Injury Deadlines

Separate from routine recordkeeping, every employer must report certain severe events directly to OSHA within strict time limits. A workplace fatality must be reported within 8 hours. An inpatient hospitalization, amputation, or loss of an eye must be reported within 24 hours. The clock starts when you learn of the event. If you discover a day later that an injury was work-related, you have 8 or 24 hours from that discovery. A fatality is reportable if it occurs within 30 days of the work-related incident; a hospitalization, amputation, or eye loss is reportable if it occurs within 24 hours of the incident.15Occupational Safety and Health Administration. 1904.39 – Reporting Fatalities, Hospitalizations, Amputations, and Losses of an Eye Missing these deadlines is one of the fastest ways to draw an OSHA inspection and a separate citation.

Penalties for Non-Compliance

OSHA penalties are adjusted annually for inflation. The current maximums, effective since January 15, 2025, carry forward into fiscal year 2026:16Occupational Safety and Health Administration. OSHA Penalties

  • Serious or other-than-serious violation: up to $16,550 per violation.
  • Failure to abate: up to $16,550 per day beyond the abatement deadline.
  • Willful or repeated violation: up to $165,514 per violation.

The failure-to-abate penalty catches employers off guard. If OSHA cites you for a hazard and gives you a deadline to fix it, every day past that deadline can add another $16,550. A hazard sitting uncorrected for two months could generate six figures in daily penalties alone, on top of the original citation.

When you receive a citation, you have 15 working days (Monday through Friday, excluding federal holidays) to notify the OSHA Area Director in writing if you intend to contest the citation, the penalty amount, or the abatement deadline.17Occupational Safety and Health Administration. Field Operations Manual – Chapter 7 Email counts. A phone call does not. Miss the 15-day window and the citation becomes a final, unappealable order.

Worker Rights That Intersect With Your Plan

A safety plan is only as good as the information flowing into it, which is why anti-retaliation protections exist. Section 11(c) of the OSH Act prohibits employers from firing, demoting, transferring, or otherwise retaliating against any employee for filing a safety complaint, reporting an injury, participating in an inspection, or exercising any right under the Act.18Whistleblowers.gov. Occupational Safety and Health Act, Section 11(c) An employee who believes they were retaliated against must file a complaint with OSHA within 30 days of the retaliatory action.19Occupational Safety and Health Administration. Protection From Retaliation for Engaging in Safety and Health Activity Under the OSH Act The 30-day window is short and catches many workers by surprise.

During an OSHA inspection, employees have the right to have a representative accompany the compliance officer on the physical walkthrough. That representative can be a coworker or a third party such as a union representative, safety consultant, or community advocate, if the inspector determines their knowledge, skills, or language abilities are “reasonably necessary to the conduct of an effective and thorough physical inspection.”20Occupational Safety and Health Administration. Worker Walkaround Designation Process Rule FAQ A single employee can authorize a walkaround representative. Employers can limit access to areas containing trade secrets, and the inspector can exclude a representative whose conduct disrupts operations.

Free Help Through OSHA’s Consultation Program

Small and medium-sized employers who want help building a plan without triggering enforcement should know about OSHA’s On-Site Consultation Program. State-employed consultants conduct free, confidential safety and health assessments. They identify hazards, suggest corrections, and help establish or strengthen safety programs, but they do not issue citations or propose penalties. The program is entirely separate from OSHA enforcement.21Occupational Safety and Health Administration. The OSHA On-Site Consultation Program

There is one obligation. If the consultant finds a serious hazard or an imminent danger, you must agree to correct it within the timeframe they set. The consultant’s report, including the list of hazards and correction deadlines, must be posted in the workplace for at least three days or until the hazards are corrected, whichever is longer.21Occupational Safety and Health Administration. The OSHA On-Site Consultation Program For employers starting from scratch, this is one of the best resources available, and it is significantly underused.