How to conduct a workplace safety audit with no safety staff

Last updated 2026-07-09

What is a workplace safety audit and why does it matter for small businesses?

A safety audit is a systematic review of your workplace, your equipment, your written programs, and your records to see where you stand against OSHA's requirements and against basic common sense. It is not an inspection. OSHA inspections happen to you. Audits happen for you.

Small businesses take the hardest hits from workplace injuries. The Bureau of Labor Statistics counted 2.3 million nonfatal occupational injuries and illnesses in private industry in 2023 ^[1]. Establishments with fewer than 50 employees carry a disproportionate share of fatal injuries, mostly because they rarely have the systems larger employers build over the years ^[1].

Here is the part that surprises people. OSHA does not require a credentialed safety professional to run an audit. The General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act, requires every employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[2]. An audit is how you prove, to yourself and to an inspector if one ever shows up, that you are actively hunting for those hazards.

The audit also doubles as your gap analysis. You will almost certainly find you are missing a written program or two. That is normal. The goal is to know, not to be perfect on day one.

Who should run the audit when you have no safety staff?

The owner or the most senior operations person should lead it, at least the first time. This is the question that stalls most small business owners, and the honest answer is that authority matters more than credentials.

OSHA does not specify who conducts internal audits. What matters is that the person knows the operation well enough to recognize what looks wrong and has enough authority to fix things afterward. A line worker who spots a problem but cannot order a repair is not an effective auditor.

A few practical options:

• The owner or general manager. You know the building, the equipment, and the people. That knowledge beats a stranger with a clipboard.
• A supervisor who finished an OSHA 30 course. The 30-hour course covers hazard recognition across the major standards, which is exactly what an audit demands ^[3].
• A peer exchange with a neighboring business. Two non-competing small businesses swap auditors for a day. Fresh eyes catch what familiarity hides.

Whatever you decide, write it down. Put the auditor's name and title in your audit report. OSHA compliance officers look for evidence that someone owns the safety function, even informally ^[4].

One thing I would not do is hire a consultant just to run a checklist audit. If you have a genuinely complex hazard, like a confined space program that has never been written, that is worth paying for. A general walkthrough? You can do that yourself.

What OSHA standards apply to your business before you start the audit?

Before you write a single checklist item, figure out which OSHA standards cover your operation. General industry lives in 29 CFR Part 1910. Construction is 29 CFR Part 1926. Agriculture is 29 CFR Part 1928. Maritime has its own set.

For most small businesses, these are the highest-frequency standards to audit against:

Standard	CFR Citation	What it covers
Hazard Communication	29 CFR 1910.1200	Chemical labeling, SDS binders, employee training
Lockout/Tagout	29 CFR 1910.147	Energy control procedures for machinery service
Emergency Action Plan	29 CFR 1910.38	Evacuation routes, fire extinguishers, alarm systems
Electrical (general)	29 CFR 1910.303-308	Wiring, panels, extension cord use
Walking-Working Surfaces	29 CFR 1910.22	Floor conditions, aisle clearance, housekeeping
Powered Industrial Trucks	29 CFR 1910.178	Forklift operation and forklift certification
Personal Protective Equipment	29 CFR 1910.132-138	Hazard assessment, PPE provision and training
Recordkeeping	29 CFR 1904	OSHA 300 log, 301 forms, annual summary

OSHA publishes its top ten most-cited standards every year ^[4]. Cross-referencing your operation against that list takes about 20 minutes, and it is time well spent before you build a checklist.

If your state runs its own plan (there are 22 state plans covering private-sector employers as of 2024), the standards are at least as strict as federal OSHA and often stricter ^[5]. Check before you assume the federal CFR numbers are your ceiling.

How do you build an audit checklist without a safety consultant?

You do not need to invent a checklist. OSHA publishes free inspection checklists and e-tools for dozens of industries at osha.gov ^[4]. The National Safety Council and many state labor departments put out more. Start there and customize.

A working checklist has three columns: the item being checked, what you found (compliant, deficient, not applicable), and a notes field for specifics. That is it. Do not overthink the format.

Organize the checklist by physical area, not by CFR number. Walk the warehouse, then the loading dock, then the break room, then the office. Lists built by location are faster to use in the field and easier to turn into corrective actions later.

For each area, cover:

• Physical conditions (floors, lighting, housekeeping, aisle clearance)
• Equipment condition and guarding
• Hazardous materials storage and labeling
• Emergency equipment (extinguishers, eyewash stations, exits)
• Written program availability (can someone find the lockout/tagout program in under two minutes?)
• Training records (does the paper exist?)

Do not build a 200-item list for your first audit. Forty to sixty well-chosen items beat two hundred vague ones. You can always add items after the first walkthrough surfaces gaps you did not expect.

For hazard communication specifically, your checklist should verify that every chemical in the building has a current Safety Data Sheet, that containers are labeled, and that employees can describe the hazards of what they work with. OSHA's HazCom standard at 29 CFR 1910.1200 requires all three ^[6].

How do you actually conduct the walkthrough?

Set aside a half-day minimum. Four hours is realistic for a facility under 10,000 square feet. Larger or more complex operations need six to eight hours, or you split the audit across two days.

Bring the checklist on a clipboard or tablet, a camera (your phone is fine), and a tape measure. Photograph every deficiency. Photos prove you found the issue, and once it is fixed, they prove you corrected it.

Walk every area where employees work, not only the shop floor. The break room, the parking lot, the server closet. OSHA citations have come from hazards in places employers forgot to check.

Talk to employees while you walk. Ask what they think the biggest safety issue is. Ask when they last had OSHA training. Ask where the nearest fire extinguisher is and whether they know how to use it. Their answers tell you more than the checklist will.

On equipment, check the guards themselves, more than whether a guard exists. A guard zip-tied open is not a guard. Lockout/tagout is the same story: a written procedure on file is a different thing from employees knowing and following it. Test the knowledge. Do not assume it. Our deeper guide on lockout tagout covers what a compliant energy-control program actually requires.

Note everything. A deficiency you do not write down gets forgotten. A deficiency you document becomes a corrective action.

One practical tip: do the records review before the physical walkthrough, not after. If the records show your emergency action plan has not been updated since 2017, you will know to look harder at the exit signage during the walk.

What should you review in your records during the audit?

Records tell a different story than the physical workplace. A facility can look spotless and still be a compliance disaster on paper.

The core records to pull:

• OSHA 300 log and 300A summary. With 10 or fewer employees you are partially exempt from routine recordkeeping under 29 CFR 1904.1, though you still must report certain severe injuries ^[7]. With 11 or more, the log should be current and complete.
• OSHA 301 incident reports (or equivalent). Every entry on the 300 log needs a matching 301 ^[7]. Our guide on writing an incident report covers what these need to contain.
• Training records. Written proof that each covered employee completed required training, with dates and the trainer's name. No record means, in OSHA's view, no training.
• Written safety programs. Lockout/tagout, hazard communication, emergency action plan, PPE hazard assessment. If a standard requires a written program, you need the actual document, not a promise that one exists.
• Equipment inspection logs. Forklifts require daily pre-shift inspections under 29 CFR 1910.178(q) ^[8]. Fire extinguishers need monthly visual checks and annual service. Log both.
• SDS binder or digital equivalent. Every hazardous chemical used or stored in the building needs an accessible Safety Data Sheet ^[6].

Missing records are one of OSHA's most common citation categories. You can run a perfectly safe physical workplace and still get fined for paperwork that does not exist.

How do you prioritize the deficiencies you find?

You will find more deficiencies than you can fix in a week. That is expected. The question is where to start, and the answer is severity first.

Use a simple three-tier system:

• Immediate hazards: anything with a realistic path to a fatality or hospitalization soon. An unguarded saw blade, a blocked emergency exit, a chemical stored without any labeling. Fix these before you finish writing the report.
• Near-term compliance gaps: missing written programs, incomplete training records, expired fire extinguisher tags. These carry citation risk and should close within 30 to 60 days.
• Ongoing improvements: things that are compliant but not ideal. Better lighting, ergonomic tweaks, extra signage. Put these on a quarterly or annual work plan.

OSHA classifies violations as other-than-serious, serious, willful, and repeat. Serious violations, those with a substantial probability of death or serious harm, carry penalties up to $16,550 per violation as of 2024 ^[4]. Willful and repeat violations can reach $165,514 each. Prioritizing by severity is also prioritizing by financial risk.

For each deficiency, write down three things: what the issue is, who owns the fix, and when it will be done. That corrective action log is what you hand an OSHA inspector if they visit after you have found and started fixing a problem. It shows good faith.

What written programs do most small businesses discover they are missing?

This is where audits generate the most work and the most value.

The programs general industry small businesses most often lack, based on OSHA's annual top-10 citation lists ^[4], are:

• Hazard Communication Program (29 CFR 1910.1200): required if any hazardous chemicals are present. Almost every business uses chemicals, even if it is just cleaning supplies.
• Lockout/Tagout Program (29 CFR 1910.147): required if employees ever service or maintain equipment that could unexpectedly energize.
• Emergency Action Plan (29 CFR 1910.38): required in writing for employers with more than 10 employees who cannot communicate the plan orally.
• Respiratory Protection Program (29 CFR 1910.134): required if respirators are used, even voluntarily.
• PPE Hazard Assessment (29 CFR 1910.132): required for all employers. It has to be a written certification that you assessed the workplace for PPE needs.

Writing these from scratch is where most owners stall. The programs have to be specific to your workplace, not generic boilerplate. If you want a faster path to programs that actually match your operation, SafetyFolio's safety program generator builds them in about 15 minutes by asking questions about your specific hazards and operations.

Once you have the written programs, audit them too. A program that says "employees will be trained annually" with no annual training records is not a functioning program. It is a document.

How do you document the audit findings and create an action plan?

The audit report does not need to be formal. It needs to be written, dated, signed, and specific.

At minimum, include:

• Date of the audit
• Name and title of the auditor
• Facility and areas covered
• List of deficiencies found, with the physical location and the relevant OSHA standard where applicable
• Photos of each deficiency
• Corrective action plan: who is responsible, what they will do, by when
• Sign-off line for each corrective action once completed

Store the report somewhere it will not get lost. A shared drive folder works fine. The point of documentation is that it creates a record of your safety management system in action. OSHA's Voluntary Protection Programs, which recognize employers with strong safety records, look specifically for evidence of systematic hazard identification and correction ^[4]. Even if you never apply for VPP, the habits are identical.

Schedule your next audit before you file this one away. Most small businesses should audit annually at a minimum. Higher-hazard industries like construction, manufacturing, and warehousing do better with quarterly or semi-annual audits. A calendar reminder set today beats a plan to do it when things slow down. Things never slow down.

What are the most common safety hazards small businesses miss during an audit?

Some hazards go invisible once you have walked past them every day for two years. Fresh eyes are the whole point of auditing.

The items most reliably missed in small business audits:

Electrical panel clearance. OSHA's standard at 29 CFR 1910.303(g) requires 36 inches of clear space in front of electrical panels ^[9]. Warehouses and stockrooms routinely stack boxes right in front of them.

Extension cords used as permanent wiring. A cord powering a desk for months is a code violation, not a convenience. 29 CFR 1910.305(g) covers flexible cord use ^[9].

Exit obstructions. Exit routes must be clear at all times under 29 CFR 1910.37 ^[10]. A box, a pallet, or a parked cart in front of an exit door is a violation.

Missing or expired fire extinguisher documentation. The extinguisher hanging on the wall is not enough. The annual inspection tag must be current and the monthly visual check must be logged.

Chemical storage incompatibility. Flammable and oxidizing chemicals stored side by side, usually because nobody read the SDS to learn they react. OSHA's HazCom standard and the fire prevention standard at 29 CFR 1910.106 both address this ^[6].

Forklift operator certification gaps. 29 CFR 1910.178(l) requires a formal, written evaluation of every forklift operator before they run a truck on their own ^[8]. Plenty of small businesses train operators informally and never document it. Our page on forklift certification spells out what the documentation has to contain.

Ladder inspection. Extension ladders and stepladders must be inspected before each use per 29 CFR 1910.23 ^[10]. Cracked rails, missing feet, and broken rungs show up constantly at businesses that never think of ladders as safety equipment.

How often should you repeat the audit, and how do you improve over time?

One audit is a snapshot. A series of audits is a safety management system.

For most small businesses, annual is the floor. Higher-hazard environment, or a workforce or equipment set that changes often? Go more often. Construction sites should audit at least monthly, given how fast the physical environment changes.

Each later audit should compare findings against the previous audit's corrective action log. Did the items get fixed? Did they stay fixed? A recurring finding in the same location signals a systemic problem, not a one-time oversight.

Over time you can add rigor: pre-task hazard assessments, monthly safety committee meetings, near-miss reporting. But do not wait for the perfect system before running the first audit. The imperfect audit you run this week beats the thorough audit you plan to run someday.

Want outside validation? OSHA's On-Site Consultation Program provides free, confidential workplace consultations through your state agency, separate from enforcement ^[4]. Consultants who visit through this program cannot issue citations. For a small business that has never been audited, this is one of the most underused resources available. The program served over 26,000 small and medium-sized businesses in fiscal year 2022 ^[4].

To keep the person running your audits sharp, an OSHA 30-hour online course covers the major standards in enough depth to make future audits faster and more reliable. One trained supervisor changes the quality of every audit that person ever runs. See our overview of OSHA training options for the rest.

After that first audit, once you know which programs you are missing, SafetyFolio can help you build the written programs quickly so you are not staring at a blank page.

Frequently asked questions

Does OSHA require small businesses to conduct safety audits?

OSHA has no standard that mandates periodic internal audits by name. But the General Duty Clause, Section 5(a)(1) of the OSH Act, requires employers to identify and correct recognized hazards, and an audit is the most direct way to show you are doing that. Some specific standards, like Process Safety Management at 29 CFR 1910.119, do require formal compliance audits. Most general industry standards leave the mechanism up to you.

How long does a safety audit take for a small business?

For a business under 20 employees in one location under 10,000 square feet, plan on four to six hours for the walkthrough and records review combined. Writing the report and action plan adds another one to two hours. Larger or more complex facilities take longer. Splitting the work into a records day and a walkthrough day is a fine approach if you cannot spare a full day at once.

What is the difference between a safety audit and an OSHA inspection?

A safety audit is something you start yourself, voluntarily, to find and fix problems. An OSHA inspection is run by a compliance officer with the authority to issue citations and fines. Inspections get triggered by a complaint, a severe injury report, a programmed targeting list, or a referral. Regular internal audits do not stop OSHA from inspecting, but they sharply cut the number of violations an inspector would find.

Can I use a free OSHA checklist, or do I need to buy one?

Free checklists from OSHA's website and state consultation programs are genuinely good starting points. OSHA publishes e-tools and industry-specific checklists at osha.gov at no cost. The main limit of a generic checklist is that it does not know your specific equipment or processes. Use the free version as your base and add 10 to 15 items unique to your operation. You do not need to pay for a checklist.

What records do I need to have ready before an OSHA inspection?

The records inspectors request most often are your OSHA 300 log and 301 forms for the past three years, written safety programs for any standard that requires one, training records showing who was trained and when, equipment inspection logs, and your most recent hazard assessments. Keeping these organized in a single binder or shared drive folder before a request arrives is far less painful than scrambling to find them after.

What happens if I find a serious hazard during my own audit?

Fix it immediately or take it out of service until it can be fixed. Do not finish the audit first. A machine with the guard removed, a blocked emergency exit, or an unlabeled chemical container that presents immediate risk should stop the walkthrough until the hazard is controlled. Document what you found, what you did, and when. That record shows good faith if the issue is ever reviewed by OSHA later.

Do I need to hire a safety consultant to write a safety program after the audit?

Not necessarily. Consultants make sense for complex programs, like Process Safety Management or a confined space program with detailed permit systems. For the most common written programs, hazard communication, emergency action plans, PPE assessments, a well-guided template or online program builder is usually enough and much cheaper. The key is that the program reflects your actual workplace, not a generic operation.

How do I get employees involved in the safety audit process?

Ask them directly. Walk the floor and ask each person what they think is the most dangerous thing they do each day, and whether they have ever reported a near-miss and what happened when they did. Their answers surface hazards no checklist catches. Beyond the audit, a brief safety committee or monthly safety meeting keeps employees flagging hazards year-round, which makes later audits faster because problems get caught between formal reviews.

What is OSHA's free consultation program and should small businesses use it?

OSHA's On-Site Consultation Program provides free, confidential workplace safety reviews delivered by state-agency consultants, completely separate from enforcement. Consultants cannot issue citations, and their findings are not shared with OSHA inspection staff unless there is an imminent danger the employer refuses to correct. The program targets small and medium-sized employers and served over 26,000 businesses in fiscal year 2022. It is genuinely worth using, especially for a first-ever audit.

How much can OSHA fine a small business for violations found during an inspection?

As of 2024, serious violations carry penalties up to $16,550 per violation. Willful or repeat violations can reach $165,514 per violation. OSHA offers penalty reductions for small size, good-faith efforts, and clean compliance history, and businesses with 25 or fewer employees may qualify for a 60 percent reduction in proposed penalties. The final fine depends heavily on whether the employer showed awareness and good-faith correction.

What is a PPE hazard assessment and do I need one in writing?

A PPE hazard assessment is a formal review of the tasks in your workplace to determine what personal protective equipment is needed. Under 29 CFR 1910.132(d), every employer must perform and certify this assessment in writing, with a document that names the workplace evaluated, the person who did the evaluation, and the date. The written certification is required regardless of business size. It is one of the most commonly missing documents found during inspections.

Can a safety audit protect me legally if an employee gets injured?

A documented audit history creates no legal immunity, but it is strong evidence of good faith in OSHA proceedings, workers' compensation disputes, and civil litigation. An employer who can show regular hazard identification, documented corrective actions, and current training records sits in a far better position than one with no safety documentation at all. Think of audits as evidence of a functioning safety management system, not a legal shield.

How is a safety audit different from a job hazard analysis?

A safety audit looks at the whole workplace: physical conditions, records, programs, and training. A job hazard analysis, sometimes called a job safety analysis, looks at a single task and breaks it into steps to find the hazards at each one. They work together. An audit might reveal that a job hazard analysis has never been done for a high-risk task. The JHA then goes one level deeper on that specific job.

Sources

1. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2023: BLS reported 2.3 million nonfatal occupational injuries and illnesses in private industry in 2023; small establishments bear a disproportionate share of fatalities.
2. OSHA, Occupational Safety and Health Act of 1970, Section 5(a)(1): The General Duty Clause requires every employer to provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm.
3. OSHA, OSHA Outreach Training Program (10-hour and 30-hour courses): The OSHA 30-hour course covers hazard recognition across major standards and is designed for supervisors and workers with safety responsibilities.
4. OSHA, Top 10 Most Frequently Cited Standards and enforcement resources: OSHA publishes its top ten most-cited standards annually; serious violation penalties reach $16,550 and willful/repeat reach $165,514 as of 2024; the On-Site Consultation Program served over 26,000 businesses in FY2022.
5. OSHA, State Plans overview: There are 22 state plans covering private-sector employers as of 2024; state plans must be at least as effective as federal OSHA and are often stricter.
6. OSHA, Hazard Communication Standard, 29 CFR 1910.1200: 29 CFR 1910.1200 requires that every hazardous chemical have a current Safety Data Sheet, that containers be labeled, and that employees be trained on chemical hazards.
7. OSHA, Recordkeeping Rule, 29 CFR 1904: Employers with 10 or fewer employees are partially exempt from routine recordkeeping under 29 CFR 1904.1 but must still report certain severe injuries; employers with 11 or more must maintain the OSHA 300 log and 301 forms.
8. OSHA, Powered Industrial Trucks Standard, 29 CFR 1910.178: 29 CFR 1910.178(q) requires daily pre-shift forklift inspections; 29 CFR 1910.178(l) requires formal written evaluation of every operator before independent operation.
9. OSHA, Electrical Standards, 29 CFR 1910.303 and 1910.305: 29 CFR 1910.303(g) requires 36 inches of clear space in front of electrical panels; 29 CFR 1910.305(g) restricts use of flexible cords as permanent wiring.
10. OSHA, Walking-Working Surfaces and Exit Routes, 29 CFR 1910.22 and 1910.37: 29 CFR 1910.37 requires exit routes to be free of obstructions at all times; 29 CFR 1910.23 requires ladder inspection before each use.