How to write a safety program for a small roofing company

Last updated 2026-07-11

Why does a small roofing company need a written safety program?

OSHA has no single rule that says "you must have a written safety program." What it has is about a dozen separate standards, most of them inside 29 CFR 1926 (Construction), and each one carries its own written-document requirement. Fall protection, hazard communication, emergency action, scaffolding, ladder safety, PPE assessments, and heat illness prevention (in states with their own OSHA plans) all attach a written program.

Run a crew of two, and those standards apply the moment your workers step onto a roof. There is no small-business exemption in construction. OSHA's what does OSHA stand for page lays out the coverage: any employer in a covered industry with at least one employee falls under the OSH Act ^[1].

The numbers make the case on their own. The Bureau of Labor Statistics put roofing's fatal injury rate at 51.5 per 100,000 full-time equivalent workers in 2022, one of the highest of any trade ^[2]. Falls cause roughly a third of all construction deaths every year ^[3]. A written program forces you to think through the hazards before a crew is standing on a 6-pitch roof in October. That pre-job thinking is what stops the incidents that bankrupt small companies and wreck families.

Underwriters read your program too. Many carriers hand out an experience modification credit when you can produce documented programs and training records. That is not marketing copy. It is standard practice in commercial general liability underwriting for specialty contractors.

What OSHA standards apply specifically to roofing work?

Roofing sits under 29 CFR 1926, OSHA's Construction Industry standards. Here are the core ones by number.

Standard	Topic	Written program required?
29 CFR 1926 Subpart M (1926.502)	Fall protection	Yes, site-specific plan when conventional systems are infeasible [4]
29 CFR 1926.59 / 1910.1200	Hazard communication (HazCom)	Yes
29 CFR 1926.35	Emergency action plan	Yes (in writing for employers with more than 10 employees)
29 CFR 1926 Subpart L	Scaffolding	Written procedures where required
29 CFR 1926 Subpart X	Ladders	Inspection and training records
29 CFR 1926.95, .100	PPE	Written hazard assessment and certification
29 CFR 1926.21	Safety training and education	Training records

The standard people miss most is 1926.502(k). It requires a written fall protection plan any time you use an alternative to conventional fall protection on residential or low-slope roofs. That plan has to be prepared by a qualified person and be site-specific, or at least job-type specific. A generic one-pager pulled off the internet does not meet the requirement.

Roofers handle coal tar pitch, adhesives, solvents, and sealants. Every one of those has a Safety Data Sheet that must be reachable on the job site. That is your hazard communication program at work ^[5].

If your state runs its own OSHA-approved State Plan (California, Michigan, Washington, and 19 others), you may face extra rules. Cal/OSHA's heat illness prevention standard at Title 8, Section 3395 is the classic example. Check your state's plan before you assume federal OSHA is the only authority in the room ^[11].

What documents actually go into a roofing safety program?

Think of a roofing safety program as a folder, not a single document. Here is what goes in it.

1. A company safety policy statement. One page, signed by the owner, stating that safety is a condition of employment and naming who owns what. It sounds ceremonial. Inspectors look for it anyway, because it establishes management commitment, the first element OSHA's own VPP framework asks for.

2. A written fall protection plan. Required under 29 CFR 1926.502(k) whenever you skip conventional fall protection (guardrails, safety nets, personal fall arrest). Even if you use conventional systems every single time, document your procedures, equipment, and rescue plan. Inspectors especially want to see that you thought about rescue, more than prevention.

3. A hazard communication program. It lists every hazardous chemical on your jobs, explains how your SDS binder is organized and where it lives, and spells out your labeling procedure. The binder can be electronic as long as workers can reach it with no barriers during their shift ^[5].

4. An emergency action plan. Required in writing when you employ more than 10 workers. Under 10, you can deliver it orally, but writing it costs nothing and kills future arguments. It covers evacuation routes, emergency contacts, first aid, and who dials 911.

5. A PPE program. It documents your written hazard assessment (required by 29 CFR 1926.95(b)), lists required PPE by task, and records that workers were trained on each piece.

6. A scaffold program and a ladder safety program. If you use scaffolding, 29 CFR 1926 Subpart L requires a competent person to oversee erection and trained workers on the deck. Name that competent person and record their qualifications.

7. An incident investigation procedure. No single standard spells it out word for word, but OSHA expects you to investigate incidents and near-misses. Your procedure names who investigates, the timeframe, and how corrective actions get tracked.

Optional add-ons: a heat illness prevention plan for hot climates or states like California, a tool inspection log, and a subcontractor safety requirements document if you hire subs.

Those seven to ten documents are your safety program. You do not need a 200-page binder. You need accurate, readable documents that match what you actually do.

How do you write a fall protection plan for roofing?

The fall protection plan is the heart of a roofing safety program. It is also the document most likely to be wrong when OSHA reads it. Here is what a site-specific plan needs under 29 CFR 1926.502(k) ^[4].

Start with the scope of work and why conventional fall protection is either infeasible or a greater hazard. This language is not optional. OSHA permits alternative measures only when conventional systems genuinely will not work. If you can hang a guardrail or run a personal fall arrest system, you must.

Name the qualified person who prepared or reviewed the plan. Under OSHA's definition, a qualified person holds a recognized degree or extensive experience and can spot hazards and put controls in place. A foreman with an OSHA 30 in Construction and years on roofs can qualify, but write down the basis for the designation.

Describe the specific alternative measures. Running a warning line and safety monitor system on a low-slope roof? The plan has to state the warning line height (minimum 34 inches, maximum 39 inches per 29 CFR 1926.502(f)), the distance from the edge (at least 6 feet for non-mechanical equipment), and the duties of the designated safety monitor.

Include a rescue procedure. Almost every small company skips this. If a worker falls and hangs suspended in a harness, how do you get them down before suspension trauma sets in? The UK Health and Safety Executive's widely cited guidance notes that suspension can become dangerous quickly, though the exact timing varies by person and the science is not precise. Your plan names who starts the rescue, what equipment is on site, and when to call 911.

Keep the plan on the job site. Not in your truck. On the site. A laminated copy does the job.

What training do roofers need under OSHA, and how do you document it?

Training is where small roofing companies are most exposed, more than the written programs themselves. OSHA's 29 CFR 1926.503 requires that workers exposed to fall hazards get trained by a competent person before they start, and that the training cover recognizing fall hazards and the procedures to minimize them ^[4]. Document it: worker name, date, topic, trainer name and title.

For anyone handling hazardous chemicals, 29 CFR 1910.1200(h) requires HazCom training at initial assignment and again whenever a new hazard shows up. The documentation matters more than any certificate. A sign-in sheet listing the topics covered is enough.

Ladders fall under 29 CFR 1926.1060, which requires training on ladder fall hazards, correct setup and climbing, and maximum load ratings. Retrain workers whenever you have reason to think they lost the knowledge.

An OSHA 30 card is not required by any OSHA standard, but plenty of general contractors and state DOT projects demand it by contract. For a foreman or safety lead, an OSHA 30 training course is probably the best value you can buy. It walks through the construction standards in a structured way and gives your safety person real depth. The OSHA 30 hour online course runs roughly $150 to $189 at authorized providers. Prices vary and OSHA sets none of them ^[6].

Keep all training records in the same folder as the safety program. When OSHA shows up after an incident, the first thing they ask for is proof the injured worker was trained. Fail to produce it and a serious violation can climb to willful or repeat.

How do you handle hazard communication for roofing chemicals?

Roofers use genuinely dangerous materials: coal tar pitch (a Group 1 carcinogen per the International Agency for Research on Cancer), modified bitumen adhesives, solvent-based cements, silicone sealants, and sometimes spray polyurethane foam. Your hazard communication program has to cover all of them.

The written HazCom program explains three things: how you maintain your chemical inventory, how workers reach the Safety Data Sheets, and how containers get labeled ^[5]. The inventory does not need to be a fancy database. A spreadsheet with product name, manufacturer, and SDS location works fine.

Safety Data Sheets have to be on the job site and reachable during a worker's shift. Electronic access is allowed under OSHA's 2012 HazCom update, but only when nothing blocks access and workers know how to pull the sheet up. An SDS binder in the work truck at the site is the simplest fix for roofing crews.

Coal tar pitch has its own limit. Under 29 CFR 1926.55, the permissible exposure limit is 0.2 mg/m3 as a ceiling value ^[7]. If your crews run hot-applied built-up roofing regularly, evaluate whether you need engineering controls or respiratory protection, and record that evaluation in your PPE program.

What does a PPE program for roofers need to cover?

A PPE program has two required pieces that many companies do not know are mandatory. First, a written hazard assessment under 29 CFR 1926.95(b). You walk through the job tasks, name the hazards for each body part (eye, head, hand, foot, body), and specify the PPE required. It does not need to be long. A one-page table by task is plenty.

Second, training on each type of PPE, documented by signature. The training covers when PPE is necessary, which type to use, how to put it on and take it off, its limits, and how to care for it.

A roofing PPE list usually runs like this:

• Hard hats (Class E near electrical hazards)
• Safety glasses or goggles
• Fall arrest harnesses, lanyards, and connecting hardware (inspect before every use per manufacturer instructions)
• Non-slip footwear
• Cut-resistant gloves for sheet metal and flashing work
• Respiratory protection for coal tar pitch, spray foam, or solvent vapor exposure

Issue respiratory protection beyond a nuisance dust mask and you trigger 29 CFR 1910.134, which requires a written respiratory protection program, medical evaluations, and fit testing ^[12]. That is a real added burden. If exposure levels stay low, document that finding and treat N95 filtering facepieces as voluntary rather than required. That distinction carries legal weight.

How do you set up an incident investigation process?

OSHA's recordkeeping rule at 29 CFR 1904 requires employers with 10 or more employees (and not on the partial-exemption industry list) to keep a Form 300 injury and illness log, a Form 301 incident report, and a Form 300A annual summary ^[8]. Roofing is not on the partial exemption list, so 10 or more employees means you keep the records.

Even under 10 employees, keep an incident investigation procedure anyway. Here is why. OSHA can still cite hazards it observes, and proof that you investigated past incidents and fixed the causes counts as good faith. Good faith can knock a willful violation down to serious, which changes the penalty range in a big way.

An incident report procedure for a small roofing company answers five questions: who fills out the report, the timeframe (24 hours for most incidents, immediately for hospitalizations), what root causes get analyzed, what corrective actions get assigned, and who follows up. The corrective-action tracking is the part most companies skip. Writing down what happened and changing nothing is worse than no investigation at all, because now you have documented that you knew about the hazard.

Reporting deadlines are firm. Fatalities must be reported within 8 hours. Inpatient hospitalizations, amputations, and loss of an eye must be reported within 24 hours. Report by calling 1-800-321-OSHA or filing online at osha.gov ^[9].

What is a realistic timeline and cost to build this program from scratch?

Start from a blank page and you are looking at 15 to 20 hours spread across a week. The fall protection plan alone takes 3 to 4 hours done right, because you have to think through every roof type and condition you touch. HazCom eats another 2 to 3 hours once you gather your SDS sheets and build the inventory.

Roofing-specific templates cut that roughly in half. Generic construction templates do not, because they leave out warning line systems, monitor procedures, and hot-work controls for modified bitumen.

Hire a safety consultant to write it and expect $1,500 to $4,500 for a small roofing company, based on typical contractor billing of $75 to $150 per hour. That is real money for a 5-person crew. Worth it if you are chasing commercial work that requires third-party program verification. It is not the only road to compliance.

Want a faster route? A purpose-built generator like SafetyFolio walks you through your operations and produces OSHA-formatted written programs in about 15 minutes. You still review the output and confirm it reflects your actual work, but it handles the structure and the standard citations.

However you build it, budget for annual review time. A program that describes 2019 operations at a company that has since added a scaffold crew and moved into flat roofing is no longer compliant.

How do you keep a roofing safety program current and actually used?

The most common failure mode is not a bad document. It is a good document nobody reads. Here is a maintenance structure that does not require a full-time safety manager.

Monthly toolbox talks. Pick one hazard per month: falls in April before the busy season, heat in July, ladder safety in October when crews rush to beat winter. A toolbox talk is a 10 to 15 minute conversation on the job site. Keep a sign-in sheet. Twelve documented talks a year is evidence of an active safety culture, and OSHA notes that during an inspection.

Annual program review. Set a January reminder. Go through each document and ask: has the work changed? Did we add or drop chemicals? Any new equipment? Any incidents or near-misses that exposed a gap? Update, re-sign, re-date.

New hire orientation. Every new employee gets a safety orientation before their first shift. It covers the fall protection plan, PPE requirements, emergency action plan, and HazCom basics. Document it with a signature. This single step prevents the most common roofing finding: an untrained worker doing hazardous work in their first week.

Post-incident review. Every incident, near-misses included, triggers a review of the relevant program section. A worker slips on a wet surface hauling shingles and the fall protection plan never mentioned it? Update the plan.

None of this needs a safety manager. It needs a foreman or owner who sets aside two hours a month and means it. That is achievable for any small roofing operation.

What OSHA penalties can a roofing company face without a safety program?

OSHA's penalty amounts adjust every year under the Federal Civil Penalties Inflation Adjustment Act. As of 2024, the maximum for a serious violation is $16,131 per violation ^[9]. Willful or repeat violations top out at $161,323 per violation ^[9]. Those are per-violation numbers. An inspection after a fall might turn up five or six separate violations at once: no fall protection plan, no training records, improper PPE, unlabeled containers, no emergency action plan. The total climbs fast.

Construction draws more OSHA citations than any other sector, year after year. In OSHA's FY2023 data, "Fall Protection, Construction" at 29 CFR 1926.501 was the single most cited standard for the third straight year, with over 7,000 citations ^[10]. Scaffolding and ladder safety trailed close behind.

For small contractors, the fine is not the worst part. The follow-on is. After a serious injury, your workers' compensation experience modification factor spikes and raises premiums for three years. A fatality can trigger OSHA's Severe Violator Enforcement Program, which brings enhanced monitoring and follow-up inspections. And in a wrongful death suit, the absence of a written safety program comes in as evidence of negligence.

OSHA does offer help. Its On-Site Consultation Program gives small businesses free, confidential compliance assistance ^[1]. A visit from your state's program produces no citations. It is genuinely advisory. If you have never had one, get it before an enforcement inspector gets you.

Where can you get real OSHA-compliant templates and resources for roofing?

OSHA's own site has free construction publications. OSHA Publication 3146, "Fall Protection in Construction," is the reference for fall protection procedures and lives at osha.gov ^[4]. OSHA's Small Business page links to the On-Site Consultation Program by state ^[1].

NIOSH, the National Institute for Occupational Safety and Health, publishes roofing hazard profiles and has studied roofing fatality patterns. Its data helps when you write the hazard identification section of your fall protection plan.

The National Roofing Contractors Association (NRCA) produces technical guidance, including safety resources for members. The NRCA Roofing Manual is a paid resource, but it is the industry reference for roofing procedures.

For the document-building itself, if you want to move faster than a blank page allows, SafetyFolio's generator is built for small contractors. You answer questions about crew size, roof types, chemicals, and equipment, and it produces written programs formatted to OSHA's requirements. You review, customize, and sign. The tool does not replace your judgment about your own hazards. It handles the regulatory scaffolding so you are not starting from nothing.

Once the written programs exist, make sure your foreman has finished at least an OSHA 30 course and that you keep a documented OSHA training schedule for the rest of the crew. Those two things, the written programs and the training records, separate a company that survives an OSHA inspection from one that does not.

Frequently asked questions

Does a roofing company with only 3 employees need a written safety program?

Yes. OSHA's Construction standards at 29 CFR 1926 apply to any employer with at least one employee in a covered industry. The only size-based exemption is the written emergency action plan, which can be communicated orally for employers with 10 or fewer workers. Every other written program requirement, including the fall protection plan and hazard communication program, applies no matter how small the company is.

What is the most common OSHA violation for roofing companies?

Fall Protection at 29 CFR 1926.501 is the single most cited OSHA standard across all of construction, and it has held that spot for years. For roofing, the typical violations are no fall protection at all on residential roofs, a missing or inadequate written fall protection plan under 1926.502(k), workers untrained in fall hazard recognition per 1926.503, and warning line systems set up wrong.

Can I use a generic safety program template for my roofing company?

A generic template is a starting point, not a finished program. OSHA's fall protection plan requirement at 29 CFR 1926.502(k) calls for a site-specific or job-type-specific plan prepared by a qualified person. A downloaded template with placeholder names, generic job descriptions, and no mention of your actual chemicals, equipment, or roof types will not satisfy it. Customize every section to match what your crews really do.

How often does a roofing safety program need to be updated?

Review and re-date the program at least once a year. Also update it any time operations change: new roof types, new equipment, new chemicals, a change in crew size, or after any incident or near-miss. An out-of-date program that no longer reflects your work can be used against you in a citation or lawsuit, because it shows you knew the requirement existed but let the program go stale.

Does a subcontractor working for me need their own safety program?

Yes. Subcontractors are responsible for their own workers under OSHA's multi-employer worksite policy. But as the controlling employer on a job site, you can still be cited for hazards you created or controlled, even when a subcontractor's worker is the one exposed. Your safety program should include a section on subcontractor requirements and how you communicate site-specific hazards to subs before they start.

What records do I need to keep if a roofer gets injured on the job?

With 10 or more employees, record the injury on OSHA Form 300 and complete Form 301 within 7 calendar days of learning about it. If it results in inpatient hospitalization, amputation, or loss of an eye, report it to OSHA within 24 hours. A fatality must be reported within 8 hours. Employers with fewer than 10 employees are generally exempt from the 300 log but must still report fatalities and hospitalizations.

Is an OSHA 30 card required for roofing foremen?

No OSHA standard requires an OSHA 30 card. The requirement is that hazard training happens and gets documented, under standards like 29 CFR 1926.503 for falls. That said, many general contractors require OSHA 30 by contract, and it gives a foreman genuine depth in construction safety. An OSHA 30 in Construction runs about $150 to $189 at authorized providers and is one of the better values for a small roofing operation.

What is a safety monitor system and when can a roofing company use it?

A safety monitor system is an alternative fall protection method allowed under 29 CFR 1926.502(h) for low-slope roofs (4:12 pitch or less). A designated competent person watches workers exclusively for fall hazards and warns them before they get within 6 feet of an unprotected edge. It is only permitted when no mechanical equipment operates inside the warning line and a written fall protection plan documents why conventional systems are infeasible.

Do I need a respiratory protection program if workers use dust masks on roofing jobs?

It depends on the mask. If workers voluntarily wear N95 filtering facepieces and you have determined exposures fall below the OSHA PEL, you only need to provide OSHA's Appendix D information sheet and document that. If you require respirators because exposures reach or exceed the PEL, you need a full written respiratory protection program under 29 CFR 1910.134, including medical evaluations and fit testing. The voluntary-versus-required distinction carries real compliance weight.

How do I find my state's OSHA plan requirements for roofing?

Twenty-two states and territories run their own OSHA-approved State Plans covering private-sector employers, including California, Michigan, Washington, and Oregon. State Plans must be at least as effective as federal OSHA and can be stricter. California, for example, has mandatory heat illness prevention rules for outdoor workers. Find your state plan at osha.gov's State Plans page. Always check state requirements on top of federal 29 CFR 1926 standards.

What does a roofing emergency action plan need to include?

Under 29 CFR 1926.35, an emergency action plan covers procedures for reporting fires and emergencies, evacuation procedures and exit routes, procedures for workers who stay to run critical operations before evacuating, how to account for everyone after evacuation, rescue and medical duties for designated employees, and how workers learn the plan. Employers with more than 10 employees must have it in writing. Keep a copy accessible on the job site, not back at the office.

What is the OSHA On-Site Consultation Program and should a small roofing company use it?

The On-Site Consultation Program is a free, confidential program funded by OSHA but run by state agencies separately from enforcement. A consultant visits your site or office, finds hazards, and suggests corrections. No citations or penalties result from a consultation visit. For a small roofing company that has never been inspected, it is one of the best ways to find gaps in your safety program before an enforcement inspector does. Request a visit at osha.gov.

What is a 'qualified person' versus a 'competent person' under OSHA roofing standards?

OSHA defines a competent person as someone who can identify existing and predictable hazards and has authority to take prompt corrective action. A qualified person has a recognized degree, certificate, or professional standing plus experience to solve problems in the subject. For roofing, a competent person supervises scaffolding and conducts fall protection inspections. A qualified person prepares the written fall protection plan. One person can hold both designations with the right training and experience.

How much does it cost to build a roofing safety program?

Doing it yourself from a blank page takes 15 to 20 hours of your time and costs nothing but that time. A safety consultant runs $1,500 to $4,500 for a small roofing company at typical rates of $75 to $150 per hour. A generator like SafetyFolio produces OSHA-formatted written programs in about 15 minutes, which you then review and sign. Whatever route you pick, budget time each January to update it.

Sources

1. OSHA.gov, Small Business resources and coverage overview: OSHA covers any employer with at least one employee in a covered industry; the On-Site Consultation Program provides free, confidential compliance assistance to small businesses
2. Bureau of Labor Statistics, Census of Fatal Occupational Injuries, 2022: Roofing had a fatal injury rate of 51.5 per 100,000 full-time equivalent workers in 2022, one of the highest rates of any trade
3. OSHA, Fall Protection in Construction overview: Falls account for roughly a third of all construction fatalities each year
4. OSHA, 29 CFR 1926 Subpart M and Publication 3146, Fall Protection in Construction: 29 CFR 1926.502(k) requires a written, site-specific fall protection plan when conventional fall protection systems are infeasible; 1926.503 requires training by a competent person with documentation
5. OSHA, Hazard Communication Standard, 29 CFR 1910.1200: The written HazCom program must address chemical inventory, Safety Data Sheet accessibility, and container labeling; electronic SDS access is acceptable when there is no barrier to access and workers are trained to retrieve them
6. OSHA, Outreach Training Program information for Construction (OSHA 30): OSHA 30 is a voluntary outreach training program; OSHA does not set prices for authorized providers, with market rates typically ranging from $150 to $189
7. OSHA, 29 CFR 1926.55, Appendix A, Gases, Vapors, Fumes, Dusts, and Mists: The permissible exposure limit for coal tar pitch volatiles under 29 CFR 1926.55 is 0.2 mg/m3 as a ceiling value
8. OSHA, Recordkeeping Rule, 29 CFR 1904: Employers with 10 or more employees not on the partial exemption list must maintain OSHA Form 300, 301, and 300A; roofing is not on the partial exemption list
9. OSHA.gov, Civil Penalty Adjustments, 2024 penalty amounts: As of 2024, the maximum OSHA penalty is $16,131 per serious violation and $161,323 per willful or repeat violation; fatalities must be reported within 8 hours and hospitalizations within 24 hours
10. OSHA, Top 10 Most Cited Standards, FY2023: Fall Protection at 29 CFR 1926.501 was the single most cited OSHA standard in FY2023, with over 7,000 citations issued
11. OSHA, State Plans overview: Twenty-two states and territories operate OSHA-approved State Plans covering private sector employers; state plans must be at least as effective as federal OSHA and may impose additional requirements
12. OSHA, Respiratory Protection Standard, 29 CFR 1910.134: When respirator use is required rather than voluntary, 29 CFR 1910.134 mandates a written respiratory protection program including medical evaluations and fit testing