OSHA Workplace Hazard Assessment: Certification, PPE, and Penalties

OSHA’s workplace hazard assessment requirements, set out in 29 CFR 1910.132(d), require every covered employer to evaluate the workplace for hazards that call for personal protective equipment, document that evaluation in a written certification with four specific elements, select and pay for the PPE that addresses each hazard, and train affected employees on how to use it.1eCFR. 29 CFR 1910.132 – General Requirements Skipping the assessment, or doing it poorly, exposes the company to fines that reach $16,550 for a serious violation and $165,514 for a willful one.2Occupational Safety and Health Administration. OSHA Penalties

The duty applies to every covered employer regardless of size. Small employers with ten or fewer employees get a partial exemption from OSHA’s injury and illness recordkeeping rules, but not from the hazard assessment rule at 1910.132.3Occupational Safety and Health Administration. 1904.1 – Partial Exemption for Employers With 10 or Fewer Employees

Hazards the Assessment Must Cover

A complete walkthrough looks at every category of hazard employees could encounter. Missing a category is one of the most common citation triggers.

Physical hazards cause immediate bodily harm: impact from falling tools or flying debris, penetration from sharp metal or blades, compression around presses and heavy machinery, and extreme heat in foundries, welding operations, and commercial kitchens.

Health and chemical hazards cause illness that can appear months or years later. Harmful dust from concrete cutting, silica processing, or wood milling drives occupational lung disease. Corrosive liquids, toxic vapors, and flammable gases require skin and respiratory protection. Light radiation from welding arcs, lasers, and high-intensity medical lighting calls for specialized eye and face protection.

Biological hazards appear anywhere workers contact blood, bodily fluids, mold, or animal waste, and OSHA identifies bloodborne pathogens including HIV, hepatitis B, and hepatitis C as major concerns.4Occupational Safety and Health Administration. Biological Agents

Ergonomic hazards from repetitive motion, heavy lifting, and awkward postures account for a large share of workplace injuries. OSHA expects engineering controls first — redesigned workstations, mechanical lifts, reduced load weights — with administrative controls like job rotation filling remaining gaps.5Occupational Safety and Health Administration. Ergonomics – Solutions to Control Hazards

Fall hazards trigger at different heights by industry. General industry requires fall protection at four feet above a lower level.6Occupational Safety and Health Administration. Fall Protection Construction sets the threshold at six feet.7Occupational Safety and Health Administration. 1926.501 – Duty to Have Fall Protection At any height, a fall into dangerous machinery or a chemical vat requires guardrails and toe-boards.

How to Conduct the Assessment

The regulation does not script the walkthrough. Section 1910.132(d)(1) sets the core requirement: evaluate the workplace to determine whether hazards are present or likely to be present that call for PPE. Appendix B to the standard offers a non-mandatory model procedure, and in practice the work runs like this:

  • Gather existing data. Pull Safety Data Sheets for every chemical on-site, review equipment manuals for manufacturer safety warnings, and check incident logs for injury patterns and near-misses.
  • Walk each work area and observe tasks in real time. Look for impact, penetration, compression, heat, chemical contact, radiation, dust, and noise. Note where employees work at height, near open edges, or around moving equipment.
  • Talk to the workers doing the job. They often know about hazards that don’t appear in manuals.
  • Match each identified hazard to the PPE that will address it, and confirm the equipment properly fits each worker.
  • Tell each affected employee what PPE is required and why.

The person doing the assessment should be familiar with both the work and the hazards involved. Outside credentials are not required by the regulation, though complex environments often warrant a safety professional.

The Written Certification: Four Required Elements

After the assessment, the employer must produce a written certification. Under 29 CFR 1910.132(d)(2), the certification must contain four elements:1eCFR. 29 CFR 1910.132 – General Requirements

  • The workplace evaluated. Identify the specific area — a production line, a department, a warehouse wing — with enough detail for an inspector to know what was covered.
  • The person who certified that the evaluation was performed.
  • The date or dates of the assessment.
  • A statement identifying the document itself as a certification of hazard assessment. This is the element employers most often forget; labeling the document matters.

The certification is the minimum. Linking each identified hazard to the specific PPE selected for it is not strictly required by the certification provision, but it shows the methodical analysis OSHA expects and provides strong evidence of compliance during an inspection.

Who Pays for the PPE

Once the assessment identifies necessary PPE, the employer pays for it. Since 2008, OSHA has required employers to provide and pay for all PPE used to comply with its standards.8Occupational Safety and Health Administration. Employers Must Provide and Pay for PPE Workers cannot be required to supply their own gear. If an employee chooses to use personally owned equipment, that choice must be voluntary, and the employer still has to verify the equipment is adequate for the hazards.9Occupational Safety and Health Administration. General Requirements – 1910.132

The payment rule has narrow exceptions for items commonly used off the job:

  • Non-specialty footwear and eyewear the employee is allowed to wear off-site, including steel-toe boots and basic prescription safety glasses.
  • Ordinary clothing such as long pants, long-sleeve shirts, and standard work boots.
  • Weather gear including winter coats, rain jackets, sunscreen, and regular sunglasses.
  • Consumer safety items like hairnets and food-service gloves worn for customer rather than worker protection.
  • Lifting belts, which OSHA considers of unproven protective value.
  • Replacement of lost or intentionally damaged PPE, which can be charged back to the employee.

Training and Retraining

Under 29 CFR 1910.132(f), every employee required to use PPE must be trained on when it is necessary, what PPE is necessary for each task, how to put it on, take it off, adjust, and wear it properly, its limitations, and its proper care, maintenance, useful life, and disposal.10eCFR. 29 CFR Part 1910 Subpart I – Personal Protective Equipment Each employee must demonstrate understanding and the ability to use the PPE properly before performing work that requires it. Most employers document this with a sign-off sheet naming the employee and the date competency was shown.

Training only counts if the worker understands it. OSHA’s position is that “train” and “instruct” mean presenting information in a manner employees can actually understand. If an employee does not speak English, the training must be delivered in a language they do understand; if workers are not literate, a written manual does not satisfy the obligation. A failure here can be cited as a serious violation.11Occupational Safety and Health Administration. OSHA Training Standards Policy Statement

Retraining is required under 29 CFR 1910.132(f)(3) when workplace changes make prior training outdated, when the types of PPE used change, or when an employee’s behavior suggests the knowledge or skill hasn’t stuck.10eCFR. 29 CFR Part 1910 Subpart I – Personal Protective Equipment That last trigger surprises employers. A supervisor who sees a worker with loose respirator straps or skipping face shield use at a grinding station has just created a legal obligation to retrain, not merely to remind.

When to Reassess

The regulation does not set a calendar-based reassessment cycle. Several events require a fresh evaluation:

  • New equipment or processes, such as a new press, a different welding method, or a reconfigured production line.
  • New chemicals or materials, which call for updated Safety Data Sheet review and possibly different PPE.
  • Workplace injuries or near-misses, which should prompt an immediate review for gaps.
  • Employee complaints or observed failures indicating current PPE is inadequate.

Keep the certification and training records in a secure, accessible location. The PPE regulation itself does not set a retention period. For comparison, OSHA’s injury and illness recordkeeping rules require a five-year retention period.12Occupational Safety and Health Administration. 1904.33 – Retention and Updating

Penalties for Non-Compliance

OSHA adjusts its maximum fines annually for inflation. For citations issued after January 15, 2025, the maximums are:2Occupational Safety and Health Administration. OSHA Penalties

  • Serious violations: up to $16,550 per violation. A missing or inadequate hazard assessment typically lands here.
  • Willful or repeated violations: up to $165,514 per violation. An employer who knows the assessment is required and deliberately ignores it faces this tier.
  • Failure to abate: up to $16,550 per day past the abatement deadline set in the citation.

These are per-violation maximums, and violations stack. An employer who fails to assess hazards, fails to provide PPE, and fails to train employees across three different job tasks can face separate citations for each failure at each task.

Multi-Employer Worksites

Construction sites, industrial complexes, and facilities that use staffing agencies frequently host multiple employers in the same space. OSHA’s multi-employer citation policy allows more than one company to be cited for the same hazardous condition, sorting employers into creating, exposing, correcting, and controlling roles.13Occupational Safety and Health Administration. Multi-Employer Citation Policy For hazard assessments, a staffing agency cannot assume the host employer handled everything, and a general contractor cannot assume each subcontractor assessed its own workers’ exposure. Both can be cited if a gap exists and they failed to exercise reasonable diligence to catch it.

State-Plan Variations

Twenty-two states operate OSHA-approved plans covering both private-sector and state and local government workers, and seven more cover only state and local government employees.14Occupational Safety and Health Administration. State Plans State plans must be at least as effective as federal OSHA, and some impose stricter documentation requirements or lower thresholds for certain hazards. Employers in state-plan states should check the state agency’s rules rather than assuming federal minimums apply.

Protection for Employees Who Report Problems

Section 11(c) of the OSH Act protects employees who report a missing hazard assessment or inadequate PPE, internally or to OSHA, from being fired, demoted, disciplined, or otherwise retaliated against. A worker who believes retaliation has occurred must file a complaint with OSHA within 30 calendar days of the adverse action.15Occupational Safety and Health Administration. Investigator’s Desk Aid to the OSH Act Whistleblower Protection Provision A limited right to refuse dangerous work also exists when PPE is absent or the assessment has failed, but only when the employee asked the employer to fix the danger and was refused, genuinely believes imminent danger exists, would be seen by a reasonable person as facing a real risk of death or serious injury, and has no time to resolve the issue through an OSHA inspection request.16Occupational Safety and Health Administration. Workers’ Right to Refuse Dangerous Work A worker exercising this right should stay at the worksite until the employer orders them to leave.