How to build a safety program that shows good faith to OSHA

Last updated 2026-07-10

What does 'good faith' actually mean to OSHA?

Good faith is a formal penalty-adjustment factor, not a vibe. Under OSHA's Field Operations Manual, inspectors can reduce proposed penalties by up to 25% when an employer shows genuine effort to comply with safety requirements ^[1]. That effort has to be visible and documented. An inspector who walks into your facility looks for a written program, training records, hazard logs, and correction timelines. If those exist, you get credit. If they don't, you don't.

The statute behind this is the Occupational Safety and Health Act of 1970. Section 17(j) says OSHA "shall give due consideration to the good faith of the employer" when assessing penalties ^[2]. Courts have upheld that reading consistently. Good faith is not being a nice person or having good intentions. It's evidence of a safety management system that actually functions.

Here's what trips up small business owners. Good faith gets evaluated at the moment of inspection, not retroactively. Scrambling to write programs after a citation lands does not earn a good-faith reduction on that citation. It might help you in an informal settlement, but the baseline penalty calculation will treat you as if you had nothing. Build the program before the inspector shows up.

How much can good faith actually reduce an OSHA penalty?

The dollar stakes are real, so the math matters. As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation ^[3]. Willful or repeat violations can reach $161,323 each. For a small employer with a handful of citations, that can be $50,000 to $200,000 before any adjustments.

OSHA applies four penalty-adjustment factors: gravity of the violation, employer size, history of violations, and good faith. Size and history adjustments can run as high as 70% for small employers with clean records. Good faith adds up to 25% on top of that. A small employer with a clean record and a solid safety program can realistically see the base penalty cut by 80% to 95% before any settlement talk begins ^[1].

The table below shows how those adjustments stack for a $10,000 base penalty:

Adjustment Factor	Maximum Reduction	Example Reduction
Size (1-25 employees)	60%	$6,000 off
Size (26-100 employees)	40%	$4,000 off
History (no prior violations in 5 years)	10%	Applied to remaining amount
Good faith (documented program)	25%	Applied to remaining amount

The reductions are multiplicative, not additive, so you can't just add the percentages. But a 25-employee shop with no history and a documented program can end up paying 15 to 20 cents on the dollar of the base penalty. That's a powerful reason to build your program now, not after the citation arrives ^[1].

One more number worth knowing. Employers with fewer than 25 employees, and 10 or fewer in some high-hazard industries, may also qualify for OSHA's free on-site consultation program, which is completely separate from enforcement ^[4].

What are the core elements of a safety program OSHA wants to see?

OSHA does not mandate one universal written safety program for general industry, but its guidance on safety and health management systems, plus the requirements built into specific standards, paints a clear picture of what inspectors look for ^[5]. The core elements are:

Management leadership. Someone named and accountable. Not a committee with no chair, not a vague line that says "management is committed." A specific person with a specific job.

Written hazard assessments. A walkthrough-based list of your actual workplace hazards, documented and dated. For workplaces with chemicals, that means a hazard communication program and safety data sheets in order ^[6]. For workplaces with heavy equipment, that includes equipment-specific risks.

Employee training records. OSHA's specific standards each carry their own training requirements with frequencies and topics. OSHA training records need to show who was trained, on what topic, on what date, and by whom. No records means, from OSHA's perspective, it didn't happen.

A hazard reporting and correction process. Employees need a way to report hazards without fear of retaliation (29 CFR 1904.36), and reported hazards need a documented timeline for correction ^[7]. This is where a lot of small employers fall short. They fix things but never write it down.

Incident investigation. When something goes wrong, you document it, find the root cause, and fix the root cause. An incident report is more than a recordkeeping obligation. It's evidence of a safety culture that works.

Program review. At minimum, an annual review of your written program to confirm it reflects current conditions. Added a new machine or a new chemical? That review catches the gap.

None of this requires expensive software or a full-time safety director. Most of it is documentation discipline.

Which OSHA standards require a written program specifically?

Dozens of OSHA standards explicitly require a written program, more than safe practices. If your business touches any of the operations below, you have a legal obligation to have these in writing, beyond the general duty to be safe.

Standard	Written Program Required For
29 CFR 1910.119	Process safety management (PSM) of highly hazardous chemicals
29 CFR 1910.132(d)	PPE hazard assessment and selection (certification in writing)
29 CFR 1910.147	Lockout tagout energy control procedures
29 CFR 1910.1200	Hazard communication program
29 CFR 1910.134	Respiratory protection program
29 CFR 1910.38	Emergency action plan
29 CFR 1910.157	Portable fire extinguisher training and evacuation plan
29 CFR 1904	Injury and illness recordkeeping (employers with 10+ employees in non-exempt industries)

The lockout/tagout standard at 29 CFR 1910.147 is one of OSHA's most-cited standards year after year ^[8]. It requires machine-specific written procedures, not a general policy ^[12]. That distinction catches a lot of employers. They have a policy but no procedures for each piece of equipment.

Employers with fewer than 10 employees are exempt from OSHA 300 logs, but that exemption does not release you from maintaining written programs for the other standards above if those hazards exist in your workplace ^[7]. Size is not a blanket exemption from written program requirements.

How do you document training to satisfy OSHA?

Training documentation is one of the easiest places to demonstrate good faith and one of the most common places employers fall short during inspections. OSHA's specific standards each spell out what training is required, but the documentation format is generally up to you.

At minimum, each training record should capture the employee's name, the date of training, the topic covered (tie it to the specific standard if you can), the name of the trainer, and the delivery method. A signature line for the employee is best practice. Some employers add a brief quiz or sign-off confirming understanding.

For OSHA 30 and OSHA 30 training, the completion card itself is your proof, but keep a copy in your internal training file anyway. OSHA 30 is not technically required by any specific standard for most general industry employers. It still signals a real commitment to safety management, and inspectors notice it.

Refresher frequency varies by standard. Hazard communication (1910.1200) requires training when new hazards are introduced. Respiratory protection (1910.134) requires annual retraining. Lockout/tagout (1910.147) requires retraining when procedures change or when an inspection reveals deficiencies. Build a training calendar that tracks these deadlines by employee, more than by topic.

One practical tip. Train in the language your employees actually speak. OSHA has issued multiple letters of interpretation confirming that employers must provide training in a manner employees understand, and that language barriers do not excuse inadequate training ^[9]. If your workforce includes Spanish speakers, an English sign-off sheet does not prove they understood the content.

What is the role of a written safety program in an OSHA inspection?

When an OSHA compliance officer arrives, one of their first moves is to request your written safety programs and training records. This happens in the opening conference. What you hand over in the first 20 minutes shapes the inspector's entire approach.

A well-organized safety binder or digital folder with dated, employee-signed records tells the inspector this employer knows what they're doing. It does not mean violations won't be found, because inspectors still walk the floor and can cite physical conditions. But it shifts the penalty math immediately. The good-faith adjustment is essentially decided in that first documentation review.

An employer who hands over a dusty three-ring binder full of programs printed from the internet, with no training records, is telling the inspector two things: the programs aren't real, and the employer knows it. That usually means no good-faith reduction at all.

Written programs also protect you during informal settlement conferences. After citations are issued, you have 15 working days to file a Notice of Contest or request an informal conference with the OSHA area director ^[10]. In that conference, your documented safety effort is one of the strongest cards you can play. Employers with written programs, training records, and documented corrective actions get better informal settlement outcomes than those without.

OSHA's Voluntary Protection Programs (VPP) are the top tier of good-faith demonstration. VPP sites have documented injury and illness rates below their industry average and go through a formal OSHA application and site review. VPP participants are generally exempt from programmed inspections ^[5]. Most small businesses won't pursue VPP, but the framework describes exactly what a mature safety program looks like.

How does OSHA's on-site consultation program help small businesses show good faith?

OSHA's on-site consultation program is one of the most underused resources available to small employers. It's free, confidential, and entirely separate from OSHA enforcement ^[4]. A consultant comes to your workplace, identifies hazards, and helps you fix them. No citations, no penalties, no reports shared with enforcement staff.

OSHA funds the program, but state agencies deliver it. You request a visit by contacting your state's consultation program, which OSHA lists on its website. Visits are prioritized for small businesses, defined as those with 250 or fewer employees at a site and 500 or fewer company-wide ^[4].

The SHARP program (Safety and Health Achievement Recognition Program) is the graduation certificate of the consultation program. Employers who complete a full consultation visit, fix all identified hazards, and build a safety management system that meets OSHA's criteria earn SHARP recognition. SHARP sites get a one-year exemption from OSHA's programmed inspection schedule, renewable ^[4].

For small employers trying to demonstrate good faith, going through consultation creates a documented record that you sought expert review before anyone forced you to. Even if enforcement shows up later for a complaint inspection, the fact that you went through consultation is a meaningful data point in penalty adjustment discussions.

OSHA's free consultation program reached roughly 25,000 worksites in fiscal year 2022 and identified about 132,000 hazards, most of which were corrected ^[4]. That scale suggests the program works, though published data on penalty-reduction outcomes for consultation participants specifically is thin.

What records do you actually need to keep, and for how long?

Recordkeeping is where good faith either holds up or falls apart under scrutiny. OSHA's recordkeeping standard at 29 CFR 1904 requires employers with 10 or more employees in non-exempt industries to maintain OSHA 300 logs, 300A summaries, and 301 incident reports ^[7]. The 300A summary must be posted in the workplace from February 1 through April 30 each year. These records must be kept for five years.

Beyond injury logs, specific standards carry their own retention requirements:

Record Type	Retention Period	Standard
OSHA 300 Log and 301	5 years	29 CFR 1904.33
Medical records and exposure records	30 years	29 CFR 1910.1020
Respiratory fit test records	Duration of employment plus 1 year	29 CFR 1910.134
Lockout/tagout procedure reviews	Current version; no minimum retention stated	29 CFR 1910.147
Training records (general)	Best practice: 3 years minimum	Various standards

For training records, some standards state a retention period (hazardous waste operations requires 3 years under 1910.120) and some don't. Where no period is stated, keep records for at least 3 years as a safe default. Some employment attorneys recommend longer for records that might tie into a later injury claim.

Electronic records are fine. OSHA does not require paper. What matters is that records are accessible during an inspection and can be produced without a two-hour search. A shared drive folder organized by year and employee name does the job.

How do you handle hazard identification and correction the right way?

Hazard identification is the engine of a safety program. Training and written programs mean little if you're not actually finding and fixing the hazards in your specific workplace.

Start with a formal job hazard analysis (JHA), sometimes called a job safety analysis (JSA). Walk through each job task step by step, name what could go wrong, and document the controls in place or needed. OSHA has free JHA templates and a published guide on its website ^[5]. This documentation does double duty. It drives your training content, and it shows an inspector that your safety program reflects your actual work, not a generic template.

Inspections should run on a schedule. Weekly for high-hazard areas, monthly for lower-risk environments. Every inspection should produce a written log with the date, who conducted it, what was found, and what was done about it. The correction timeline matters. OSHA's inspectors reward employers who find hazards and fix them promptly, not employers who document hazards and leave them open for months.

Employee involvement is a real differentiator. Employers who give workers a formal way to report hazards, and who document how they responded, show OSHA the safety program is a two-way system. Near-miss reporting is especially useful. A near-miss program that generates reports and documented investigations proves your program is functioning, more than sitting on paper.

For any employer using powered industrial trucks, the forklift certification requirements under 29 CFR 1910.178(l) are specific: operator evaluation every three years plus refresher training after incidents ^[13]. This is one of the top-cited standards in warehousing and manufacturing, and documented training and evaluation records are exactly the evidence that earns a good-faith reduction.

How do you build a safety program if you don't have a safety manager?

Most small businesses don't have a safety director. The owner, the ops manager, or a senior employee doubles as safety coordinator on top of everything else. That's the reality, and OSHA knows it.

Start with your actual hazards, not a generic template. Walk your facility and list everything that could hurt someone. Group hazards by type: struck-by, caught-in, fall, electrical, chemical, ergonomic. That list becomes the foundation of your written program.

Then match each hazard to the applicable OSHA standard. OSHA's website has an industry-specific search tool that helps you find which standards apply to your work ^[8]. Got chemicals? You need a hazard communication program and safety data sheets accessible to employees (29 CFR 1910.1200). Employees working at heights? You need fall protection (29 CFR 1926.502 for construction, 1910.28 for general industry). Don't write programs for hazards you don't have.

Once you know what you need, building the documents takes time but not expertise. OSHA's free resources include sample written programs for most major standards. The hard part is customizing them to your workplace and training your employees to the content.

If you want to compress the time investment, tools like SafetyFolio's safety program generator can walk you through the customization in about 15 minutes per program instead of an afternoon of research per standard. The programs still have to reflect your actual workplace, but the structural work is done for you. Whatever tool you use, the document isn't the finish line. The training, the records, and the follow-through are what make it real.

Assign one person as the safety program owner. Give them a monthly calendar item to review the hazard log and training records. That rhythm, more than any single document, keeps a small business safety program alive over time.

What should you do before, during, and after an OSHA inspection to protect yourself?

Before an inspection, the main work is building and maintaining your program. But a few practical steps help too. Know your rights. Under the OSH Act, employers have the right to accompany the compliance officer during the walkaround ^[10]. Use that right. Decide in advance who meets the inspector, what records you'll provide, and who takes notes during the walkaround.

Organize your records so they can be found fast. An inspector who waits 30 minutes while you dig for a training record draws conclusions from that wait. A binder or digital folder that produces documents in two minutes looks like a functioning system.

During the inspection, be cooperative but careful. Answer questions honestly. Don't volunteer information beyond what's asked. Don't argue about citation categories in the moment. If the inspector flags a condition that can be corrected on the spot, fix it and document it. Immediate correction is a factor in penalty reduction under OSHA's informal settlement process ^[1].

After the inspection, if citations are issued, you have 15 working days from receipt to file a Notice of Contest or request an informal conference ^[10]. Request the informal conference. It's almost always worth doing. Bring your written programs, your training records, your corrective action logs. Employers who show up with organized documentation get better outcomes than those who don't.

For employers who received a citation and want to understand their options, talking to an attorney who handles OSHA cases can be worth the cost for citations above a few thousand dollars. Many offer free initial consultations.

Does OSHA treat small businesses differently than large ones?

Yes, in several formal ways. The penalty-adjustment matrix explicitly accounts for employer size. Employers with 1 to 25 employees can receive a 60% penalty reduction for size alone. Employers with 26 to 100 employees get up to 40%. Employers with more than 250 employees get no size reduction ^[1].

OSHA's free on-site consultation program is built for small and medium-sized employers ^[4]. Large employers generally can't access it.

Small employers with fewer than 10 employees are exempt from OSHA's injury and illness recordkeeping requirements under 29 CFR 1904 if they're not in a designated high-hazard industry ^[7]. The list of partially-exempt industries is based on NAICS codes and OSHA updates it periodically.

What doesn't change with size is the duty to comply with specific standards. If 29 CFR 1910.147 applies to your machinery, you need written lockout/tagout procedures whether you have 5 employees or 500. The standards themselves don't scale down for small employers. Only the penalty math does.

BLS data from 2022 shows establishments with fewer than 50 employees had a total recordable incident rate of 2.3 cases per 100 full-time workers in private industry, compared to 3.0 for establishments with 250 to 999 employees ^[11]. Smaller workplaces are not inherently safer. The injury rate varies hard by industry. Small manufacturers see far higher rates than small professional-services firms, for example.

The takeaway on size: small employers get real financial benefit from penalty adjustments, but the underlying obligation to have a real safety program is the same regardless of headcount.

Frequently asked questions

Does OSHA require a written safety program for all businesses?

Not a single universal written program. But many individual OSHA standards, including lockout/tagout (29 CFR 1910.147), hazard communication (29 CFR 1910.1200), and respiratory protection (29 CFR 1910.134), require their own written programs. If those hazards exist in your workplace, the written program is legally required regardless of company size. A general written safety policy is not required by law but is the strongest single factor in demonstrating good faith.

How much can OSHA reduce my penalty for having a safety program?

OSHA can reduce proposed penalties by up to 25% for demonstrated good faith. That stacks with size reductions (up to 60% for employers with 1-25 employees) and history reductions (up to 10% for a clean record). Combined, a small employer with a documented safety program and no prior violations can see base penalties cut by 80% to 95% before any informal settlement negotiation. The adjustments are multiplicative, not additive.

What records do I need to have ready for an OSHA inspection?

Have your written safety programs, employee training records (with dates, topics, trainer names, and signatures), OSHA 300 logs for the past 5 years if you're covered by recordkeeping requirements, and any hazard assessment or inspection logs. Machine-specific procedures for lockout/tagout, respiratory protection fit test records, and PPE hazard assessments in writing (per 29 CFR 1910.132) round out the most commonly requested documents.

Can I use a generic safety program template from the internet?

You can start with a template, but a generic program that doesn't reflect your actual workplace conditions is unlikely to earn full good-faith credit. OSHA inspectors are experienced enough to spot programs that were never customized or implemented. The template should be the skeleton; your specific hazards, equipment, chemical list, and employee names need to be the substance. A program that matches your real operations is far more valuable than a polished generic one.

How often do I need to update my written safety program?

At minimum, review your written programs annually and update them when operations change, new equipment is added, new chemicals are introduced, or an incident reveals a gap. Several specific standards carry review triggers beyond the annual calendar: lockout/tagout procedures must be reviewed when procedures change or when inspections reveal deficiencies. Documenting the date of each review, even if no changes were made, is itself evidence of an active program.

Does participating in OSHA's free consultation program protect me from enforcement inspections?

Consultation visits are confidential and separate from enforcement. Participating does not trigger enforcement, and consultation findings are not shared with OSHA enforcement staff. Employers who complete the full process and meet OSHA's criteria earn SHARP recognition, which exempts them from OSHA's programmed inspection schedule. It doesn't protect against complaint-driven inspections, but it does create a documented record of proactive safety effort.

What is the most commonly cited OSHA standard for small businesses?

OSHA's annual top-10 citation lists consistently show hazard communication (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), and respiratory protection (29 CFR 1910.134) in the top tier for general industry. In construction, fall protection (29 CFR 1926.501) leads every year. For small employers specifically, the overlap with these standards is high because they apply to common workplace activities across many industries.

Do I need an OSHA 30 certification to run a safety program?

No specific OSHA standard requires an employer or safety coordinator to hold an OSHA 30 certification. But completing an OSHA 30-hour course signals a real commitment to safety knowledge, and inspectors take note of it. More practically, the OSHA 30 curriculum covers the standards most likely to apply to your workplace and helps you find gaps in your current program. It's a reasonable investment for anyone who owns or manages the safety function.

What happens if I fix a hazard immediately during an OSHA inspection?

Immediate correction is viewed positively and can factor into informal settlement discussions, but it does not erase the citation for a condition that existed at the time of inspection. OSHA can still cite the condition, but your documented immediate correction, combined with other good-faith evidence, supports a penalty reduction in the informal conference. Document the correction in writing, including the date and who performed it, even if it happened on the spot.

How do I prove employees were actually trained, beyond signed paperwork?

Documentation alone does not prove comprehension, and OSHA inspectors know this. They interview employees during walkaround inspections and ask basic safety questions about their jobs. If employees can't answer, signed training forms don't save you. Supplement sign-off sheets with brief written quizzes, practical demonstrations, or operator evaluations. For employees with limited English proficiency, conduct and document training in the language they understand.

What is an employer's obligation if an employee reports an unsafe condition?

Employers must take reported hazards seriously and correct them within a reasonable timeframe based on the severity of the risk. OSHA's anti-retaliation provision at 29 CFR 1904.36 prohibits disciplining employees for reporting safety concerns. Best practice is a written hazard report form with a documented response and correction date. That paper trail shows OSHA the reporting system works and that management responds to it.

Can OSHA inspect my business without a warrant?

OSHA compliance officers can conduct inspections without advance notice in most cases, but employers have the right to require a warrant under the Fourth Amendment, as affirmed in Marshall v. Barlow's Inc. (1978). In practice, requiring a warrant is unusual and can complicate your relationship with the area office. Most employers cooperate with inspections, accompany the officer during the walkaround, and use the informal conference process afterward if they disagree with findings.

How long does an OSHA inspection typically take?

Scope drives the timeline. A focused complaint inspection at a small business might take a few hours. A full programmed inspection at a larger facility can run multiple days. The opening conference, walkaround, and closing conference are the three main phases. Organized records cut inspection time and create a better impression. Inspectors notice when a business can produce documentation quickly and accurately.

What is the difference between a programmed and unprogrammed OSHA inspection?

Programmed inspections are scheduled in advance based on OSHA's targeting criteria, which include high-hazard industries, employers with high injury rates, and random selection within certain industries. Unprogrammed inspections are triggered by a specific event: a fatality, a hospitalization, an employee complaint, or a referral. SHARP participants are exempt from programmed inspections. Unprogrammed inspections can happen to any employer at any time, driven by the triggering event, not OSHA's calendar.

Sources

1. OSHA, Field Operations Manual (FOM), Chapter 6: Penalty and Debt Collection Procedures: OSHA can reduce proposed penalties by up to 25% for demonstrated good faith; size reductions up to 60% for employers with 1-25 employees
2. Occupational Safety and Health Act of 1970, Section 17(j), Public Law 91-596: The OSH Act requires OSHA to give due consideration to the good faith of the employer when assessing penalties
3. OSHA, Penalties page, OSHA.gov: As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation; willful or repeat violations can reach $161,323
4. OSHA, On-Site Consultation Program, OSHA.gov: OSHA's free on-site consultation program is confidential and separate from enforcement; SHARP participants are exempt from programmed inspections; program served approximately 25,000 worksites in FY 2022
5. OSHA, Recommended Practices for Safety and Health Programs, OSHA.gov: OSHA's guidance on Safety and Health Management Systems outlines core elements including management leadership, hazard identification, education and training, and program evaluation
6. OSHA, Hazard Communication Standard, 29 CFR 1910.1200: 29 CFR 1910.1200 requires employers to maintain a written hazard communication program and make safety data sheets accessible to employees
7. OSHA, Recordkeeping Rule, 29 CFR 1904, OSHA.gov: Employers with 10 or more employees in non-exempt industries must maintain OSHA 300 logs, 300A summaries, and 301 incident reports; records retained for 5 years; 29 CFR 1904.36 prohibits retaliation for reporting
8. OSHA, Top 10 Most Frequently Cited Standards, OSHA.gov: Lockout/tagout (29 CFR 1910.147), hazard communication (29 CFR 1910.1200), and respiratory protection (29 CFR 1910.134) are consistently among OSHA's most-cited standards in general industry
9. OSHA, Training Standards Policy Statement and Letters of Interpretation, OSHA.gov: OSHA guidance confirms employers must provide training in a manner and language employees understand; language barriers do not excuse inadequate training
10. OSHA, Workers' Rights Booklet and Complaint/Inspection Guidance, OSHA.gov: Employers have the right to accompany OSHA compliance officers during walkaround inspections; employers have 15 working days from receipt of citations to file a Notice of Contest or request an informal conference
11. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses, 2022: BLS 2022 data shows establishments with fewer than 50 employees had a total recordable incident rate of 2.3 cases per 100 full-time workers in private industry, compared to 3.0 for establishments with 250-999 employees
12. OSHA, Lockout/Tagout Standard, 29 CFR 1910.147: 29 CFR 1910.147 requires machine-specific written energy control procedures, employee training, and annual periodic inspections of procedures
13. OSHA, Powered Industrial Trucks Standard, 29 CFR 1910.178: 29 CFR 1910.178(l) requires operator evaluation every three years and refresher training after incidents; forklift-related citations are consistently among OSHA's most-cited in warehousing and manufacturing