How to conduct an OSHA-style hazard assessment for a new job task

Last updated 2026-07-11

What is an OSHA-style hazard assessment and when do you need one?

A hazard assessment is a structured look at one job task to find what could hurt someone before it does. OSHA calls this a Job Hazard Analysis (JHA), also written as Job Safety Analysis (JSA). The agency's core guidance is OSHA Publication 3071 ^[1], which says a JHA "focuses on the relationship between the worker, the task, the tools, and the work environment."

You need one any time a new task shows up. New equipment. A process change. A repair job outside the normal routine. Any task that appears in your incident records more than once. OSHA doesn't always require a written JHA by that name, but several standards require a hazard assessment as a condition of compliance. The PPE standard at 29 CFR 1910.132(d) requires a written certification that a workplace hazard assessment was performed before PPE is issued ^[2]. The confined space standard at 29 CFR 1910.146 requires you to evaluate entry conditions before each entry ^[3]. Lockout/tagout under 29 CFR 1910.147 requires an energy control procedure for each machine ^[4].

For general industry employers, the General Duty Clause (Section 5(a)(1) of the OSH Act) fills the gaps. Employers must furnish a workplace free from recognized hazards likely to cause death or serious harm ^[5]. A documented hazard assessment is your best evidence that you took that duty seriously.

Small businesses skip this step most often on one-time or unfamiliar tasks, which is exactly when people get hurt. BLS reported roughly 2.8 million nonfatal workplace injuries in private industry in 2022 ^[6], and a disproportionate share involve tasks the worker hadn't done before. If you're not sure whether a task needs an assessment, it does.

What is the difference between a JHA, JSA, and a risk assessment?

These terms get used interchangeably in the field, and that's mostly fine. Job Hazard Analysis (JHA) is OSHA's preferred term. Job Safety Analysis (JSA) is common in construction and manufacturing. Risk assessment is the broader term you'll see in ISO 45001 and many international standards.

The real difference is the output. A JHA lists job steps, hazards, and controls, usually in a three-column format. A risk assessment adds a probability-times-severity score to each hazard before and after controls. Some employers call the scored version a Risk-Ranked JHA.

For most small businesses, a clean JHA without formal scoring satisfies OSHA and is far more likely to actually get done. If you work in a high-hazard trade like roofing, trenching, or chemical handling, adding a simple 1-5 likelihood and 1-5 severity matrix earns its ten minutes. It helps you argue for budget to fix the real problems first.

A Process Hazard Analysis (PHA) is a different animal. That's for chemical facilities holding highly hazardous chemicals above OSHA's threshold quantities under 29 CFR 1910.119 ^[7]. Don't confuse it with a JHA.

Who should be involved in the hazard assessment?

The single biggest mistake employers make is writing JHAs at a desk without talking to the people who do the job. OSHA Publication 3071 is blunt about it: "Involve your employees. Employees who do the job know the hazards and risks better than anyone else" ^[1].

For a brand-new task you probably don't have a veteran doing it yet, so your team should include the supervisor who designed the task, the workers most likely to perform it (even if they've only done something similar), and your safety officer or committee rep if you have one. Four to six people is plenty. More than that and the meeting slows down without getting better.

Use a contractor for the task? You still have to understand what hazards it creates for your own workers nearby. Don't hand the whole JHA to the sub and call it done.

A word on documentation. Whoever leads the assessment signs the completed JHA. Workers who reviewed it sign it too. That signature isn't bureaucratic theater. It creates a record that they were trained on the hazards and controls before work started, which matters enormously if there's ever a citation or a lawsuit.

Step 1: Break the job task into steps

Start by watching the task from start to finish. Write down each discrete action in the order it happens. "Move the pallet" is a step. "Start the machine" is a step. Each step is a verb phrase describing what the worker physically does.

Most tasks land between 5 and 15 steps. If you're past 20, you've gone too granular. If you have fewer than 4, you've probably missed something. Aim for the level of "what would a new hire need to know to do this in sequence."

Don't describe how the step is done safely in this column. That belongs in the controls column. The steps column captures what happens: "Open valve on tank," not "Carefully open valve on tank using PPE."

Watch the task at normal pace, not a slowed-down demo. Hazards in real work often appear only at actual speed, like a pinch point that's obvious the moment someone reaches quickly for a part.

Step 2: Identify the hazard at each step

For each step, ask two things: what could go wrong here, and what energy or agent would cause the harm? OSHA groups hazards into categories worth keeping in your head as a checklist.

Hazard Category	Examples
Physical / Mechanical	Struck-by, caught-in, fall, cut, pinch point
Chemical	Inhalation, skin contact, ingestion of substances
Ergonomic	Repetitive motion, awkward posture, heavy lift
Electrical	Shock, arc flash, contact with live parts
Thermal	Burns, heat stress, cold stress
Biological	Bloodborne pathogens, mold, animal contact
Noise	Hearing loss from sustained exposure above 85 dBA [8]

Write the hazard as a specific statement, not a category label. "Worker could inhale isocyanate vapors while spraying foam" is useful. "Chemical hazard" is not.

For a new task you may not know the size of a chemical exposure yet. That's honest. Note it as an unknown, flag that air monitoring may be needed, and run conservative controls until you have data. OSHA's permissible exposure limits (PELs) sit in 29 CFR 1910 Subpart Z ^[9], and they're the floor, not the ceiling. Many industrial hygienists work to ACGIH TLVs, which are often lower.

Biological and ergonomic hazards get missed the most. Overexertion and bodily reaction was the single largest injury event type in 2022, at roughly 790,000 cases ^[6]. If the task involves lifting more than 35 pounds repetitively, or holding an awkward posture, write it down.

Step 3: Apply the hierarchy of controls

Once you've named the hazard, pick a control. OSHA's hierarchy of controls runs from most effective to least, and you climb as high as the task allows ^[1].

1. Elimination: Remove the hazard entirely. Redesign the task so the dangerous step doesn't exist. 2. Substitution: Swap the hazardous material or process for a less dangerous one. 3. Engineering controls: Isolate people from the hazard with physical barriers, ventilation, machine guards, or interlocks. 4. Administrative controls: Change how and when people work. Job rotation, warning signs, written procedures, training. 5. PPE: Give the worker protective equipment as the last line of defense.

PPE is last because it does nothing to the hazard itself. It only reduces injury if it's worn correctly, fits properly, and doesn't fail. If your JHA lists "wear gloves and safety glasses" as the control for every hazard, your JHA isn't finished.

For PPE to be legally compliant, 29 CFR 1910.132(d)(2) requires a written certification that states the workplace was assessed, gives the date, names the person who performed it, and identifies the document as a certification of hazard assessment ^[2]. A JHA that identifies PPE needs and is signed and dated by the assessor satisfies this in most cases.

Generating safety programs for multiple job types? A tool like SafetyFolio's safety program generator can pull your hazard assessment outputs into a formatted written program without starting from scratch each time.

Step 4: Document the assessment and certify it

A JHA lives or dies on its documentation. A verbal walkthrough with no paper trail does almost nothing for you when OSHA shows up or a worker gets hurt.

Your completed document should contain, at minimum:

• Job title and task description
• Date of assessment
• Names and signatures of who participated
• Each job step, listed in sequence
• The hazard identified at each step
• The control selected and any PPE required
• Who is responsible for implementing each control
• A scheduled review date

Keep JHAs where the workers who perform the task can reach them. OSHA's standard at 29 CFR 1910.132(d) requires the written certification to be available ^[2]. "In the supervisor's file cabinet" doesn't count as available.

Some employers laminate a simplified version and post it at the workstation. That's good practice, especially for tasks done intermittently where muscle memory can't carry the load.

On the PPE certification specifically: OSHA's 1995 letter of interpretation to James W. Wink confirmed the hazard assessment and PPE certification can be the same document as long as it contains the required elements ^[10]. You don't need two separate forms.

When should you update a hazard assessment?

A JHA isn't a one-time checkbox. It goes stale when the task changes, the workplace changes, or someone gets hurt doing it.

Update your JHA when:

• A new machine, chemical, or tool enters the task
• The process flow changes (different sequence, location, or staffing)
• A near-miss or recordable injury happens during the task
• Workers report a hazard you didn't catch the first time
• A scheduled review date passes (annual is common; quarterly for high-hazard tasks)

OSHA doesn't set a mandatory review interval for JHAs in most standards, but Publication 3071 recommends reviewing them "periodically" and especially after incidents ^[1]. The working standard across industry is annual review for routine tasks and immediate review after any incident.

Make a significant process change and skip the JHA update before work restarts, and you've essentially revoked the original document. Don't let the update sit in a draft for weeks while work continues under changed conditions.

What does a completed hazard assessment look like? (Example)

Here's a simplified JHA for a task that's common and often skipped: changing a propane cylinder on a forklift. This is for illustration, not a template to use without adapting it to your workplace.

Step	Hazard	Control
1. Position forklift on level surface and shut engine off	Forklift rolls during cylinder change; worker struck	Engage parking brake; chock wheels; verify engine off
2. Release pressure in line and close tank valve	Residual propane release; ignition risk	No open flames within 10 feet; worker stands upwind; wear safety glasses
3. Disconnect hose fitting	Wrench slip; hand injury	Use correct-size wrench; wear leather gloves
4. Lift empty cylinder out of bracket	Back strain from awkward lift (cylinder weighs 33-38 lbs)	Two-person lift or use cylinder cart; keep cylinder close to body
5. Install full cylinder and reconnect hose	Cross-thread fitting; leak	Hand-tighten first; torque to spec; leak-test with soap solution before restart
6. Open valve slowly and test for leaks	Propane release; fire	Open 1/4 turn; soap test all connections; no ignition sources present

This format works. It's readable by workers, auditable by inspectors, and specific enough to change behavior. Notice that not every control is PPE.

For workers who operate forklifts, know that forklift certification is a separate legal requirement under 29 CFR 1910.178(l) and not something a JHA covers on its own.

What are the most common JHA mistakes OSHA inspectors find?

OSHA doesn't audit JHAs by name in most inspections, but hazard assessment failures show up in citation patterns. The recurring problems:

No written document at all. An inspector asks for the hazard assessment, and the supervisor says "we talked about it." That's a citation under 29 CFR 1910.132(d) for any task requiring PPE ^[2].

Controls that are entirely PPE. If the only control listed is "wear gloves," the employer hasn't shown they considered engineering or administrative options. Legal in narrow cases, but it draws scrutiny.

Outdated JHAs. The task changed two years ago and nobody touched the form. The controls no longer match the work.

Workers don't know the JHA exists. OSHA has cited employers where a written JHA existed but the workers doing the task had never seen it. If they haven't been trained on it, it isn't functioning as a control.

Missing hazard categories. Ergonomic hazards are systematically underrepresented, and so are heat stress and noise, especially in outdoor and manufacturing settings. An inspector who sees a JHA for repeated heavy lifting with no ergonomic hazard identified is going to wonder what else got missed.

A quick self-audit. Pull your three riskiest tasks. Does a JHA exist for each? Has it been updated in the past 12 months? Can a worker in that role put their hands on it today? If the answer to any of those is no, start there.

For supervisors, OSHA 30 training covers hazard recognition in depth, and it's one of the parts of the course that actually changes how people think on the floor.

How does a hazard assessment connect to your written safety program?

A JHA is a building block, not a standalone document. It feeds your written safety program directly.

Your program's PPE section should list PPE requirements by task, and those requirements come straight from your hazard assessments. Your hazard communication program references the chemicals your JHAs flag as hazardous. Your lockout tagout energy control procedures should exist for every piece of equipment a hazard assessment flagged as needing energy isolation. Your incident report process should trigger a JHA review any time a recordable injury happens.

JHAs are the connective tissue between what actually happens on your floor and what your written programs say should happen. A written program that doesn't connect to job-level hazard assessments is aspirational at best and fiction at worst.

If you're building or rebuilding your written safety program, SafetyFolio's generator uses your industry and job type inputs to pre-populate program templates you then customize with your actual JHA findings. It doesn't replace the observation and conversation steps. It cuts the formatting and structure work considerably.

Does OSHA require a hazard assessment for every job task?

Not in those exact words, no. There's no single standard that says "thou shalt write a JHA for every task." The requirement comes in through several doors.

The PPE standard at 29 CFR 1910.132(d) requires a written certification for any task where PPE is used. Since most tasks in manufacturing, construction, warehousing, and food processing involve some PPE, that covers a lot of ground ^[2].

The General Duty Clause covers the rest. If a recognized hazard exists and you have no evidence of assessment or control, you're exposed ^[5].

Construction has its own version. 29 CFR 1926 Subpart C requires safety and health programs that include hazard identification, which OSHA reads to include task-level analysis on multi-employer worksites.

The practical answer: yes, you need one for any task with a recognized hazard. The legal mechanism varies by standard, but the exposure for skipping it is real. And the bigger risk isn't the citation. It's that without an assessment, you genuinely don't know what's going to hurt someone.

Frequently asked questions

How long should a job hazard analysis take to complete?

For a straightforward task with 6 to 10 steps, a JHA takes 30 to 60 minutes if you observe the task and include the worker who does it. A complex task with chemicals, confined spaces, or multiple trades interacting can run 90 minutes or more. Don't rush it. A JHA written in 10 minutes without watching the actual task is almost always incomplete.

What is the difference between a hazard and a risk?

A hazard is the source of potential harm, like an unguarded saw blade or a chemical vapor. Risk is the probability that the hazard causes harm combined with how severe that harm would be. In a JHA you identify hazards; in a risk assessment you score them. For most small business JHAs the formal distinction isn't required, but thinking about likelihood and severity helps you prioritize which controls to fund first.

Can I use a generic JHA template from the internet?

Use it as a starting point for the format, but the content must reflect your specific workplace, equipment, and chemicals. A generic template you didn't customize is almost certainly incomplete. OSHA inspectors and attorneys look for site-specific detail. The three-column format (step, hazard, control) is standard; everything you put in those columns has to be yours.

Who is legally responsible for completing a hazard assessment?

The employer is always responsible under the OSH Act. In practice the supervisor of the work area or the safety officer leads it. Supervisors who sign JHAs accept responsibility for making sure controls get implemented. Workers who sign acknowledge they were trained. If an employer delegates the work to a contractor, the host employer still bears responsibility for its own workers' exposure.

Does a hazard assessment satisfy the OSHA PPE certification requirement?

Yes, if it contains the required elements. OSHA's 1910.132(d)(2) says the certification must state the workplace was assessed, give the date, name the person who performed it, and identify the document as a certification of hazard assessment. A signed, dated JHA that names the assessor and identifies PPE needs by task satisfies this. OSHA confirmed it in a 1995 letter of interpretation.

How often should a job hazard analysis be reviewed?

Annual review is standard for routine tasks. High-hazard tasks like confined space entry, work at height, or chemical handling warrant quarterly review, or review before each occurrence. Immediate review is expected after any near-miss or recordable injury involving the task. OSHA Publication 3071 recommends review after incidents and whenever conditions change.

What records do I need to keep after a hazard assessment?

Keep the signed, dated JHA. Keep any PPE certification it generates. Keep records of who was trained on it and when. OSHA doesn't set a retention period for JHAs specifically, but a common practice is to keep them for the life of the task plus three years, in line with the general recordkeeping rule at 29 CFR 1904. If a worker is injured, the JHA becomes a legal document.

Can a small business with no safety officer conduct a hazard assessment?

Yes, and most do. You don't need a credentialed safety professional to run a JHA. You need someone who understands the task, can watch it being performed, and can systematically ask 'what could go wrong here.' OSHA Publication 3071 is free and walks through the whole process. The worker doing the job is often the most valuable person in the room.

What tasks should I prioritize for hazard assessments first?

Start with tasks that appear in your injury and near-miss records, tasks using equipment with energy isolation needs (electrical, hydraulic, pneumatic), tasks involving chemicals with an SDS, and tasks that are new or changed. After that, work through tasks done by your newest or least-experienced workers. BLS data consistently shows new workers get hurt at higher rates regardless of industry.

Does a job hazard analysis replace a safety data sheet?

No. An SDS is a document from the chemical manufacturer describing the hazards, exposure limits, and safe handling of a specific substance. A JHA uses information from the SDS to decide what controls a task needs when it involves that chemical. They work together. Your hazard communication program, required under 29 CFR 1910.1200, governs how SDSs are kept and accessed.

What is the hierarchy of controls and why does it matter for a JHA?

The hierarchy (elimination, substitution, engineering, administrative, PPE) ranks controls from most to least effective at removing the hazard itself. It matters because employers who jump straight to PPE often leave the underlying hazard in place. OSHA expects you to consider higher-order controls first. Showing that you evaluated elimination and engineering before landing on PPE is evidence of a good-faith effort.

How do I handle a hazard I can't fully identify or measure yet?

Document the unknown out loud. Write something like 'chemical exposure level from X process is unknown; air monitoring needed before routine work begins.' Apply conservative interim controls (the most protective available) and set a deadline for getting data. OSHA doesn't expect perfect information, but it does expect you to acknowledge and respond to uncertainty rather than ignore it.

Sources

1. OSHA, Job Hazard Analysis (Publication 3071): OSHA's core JHA guidance stating the analysis focuses on the relationship between worker, task, tools, and work environment, and recommending worker involvement.
2. OSHA, 29 CFR 1910.132 - Personal Protective Equipment, General Requirements: Requires a written certification that a workplace hazard assessment was performed before PPE is issued, including date, location, and assessor name.
3. OSHA, 29 CFR 1910.146 - Permit-Required Confined Spaces: Requires evaluation of entry conditions before each permit-required confined space entry.
4. OSHA, 29 CFR 1910.147 - Control of Hazardous Energy (Lockout/Tagout): Requires a documented energy control procedure for each machine or piece of equipment covered.
5. OSHA, OSH Act of 1970 Section 5(a)(1) - General Duty Clause: Employers must furnish a workplace free from recognized hazards likely to cause death or serious physical harm.
6. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2022: Approximately 2.8 million nonfatal workplace injuries were recorded in private industry in 2022, with overexertion and bodily reaction the largest event type at roughly 790,000 cases.
7. OSHA, 29 CFR 1910.119 - Process Safety Management of Highly Hazardous Chemicals: Requires a Process Hazard Analysis for facilities with highly hazardous chemicals above threshold quantities.
8. OSHA, 29 CFR 1910.95 - Occupational Noise Exposure: Establishes a permissible noise exposure action level of 85 dBA as an 8-hour TWA for hearing conservation programs.
9. OSHA, 29 CFR 1910 Subpart Z - Toxic and Hazardous Substances: Contains OSHA permissible exposure limits (PELs) for toxic and hazardous substances in general industry.
10. OSHA, Standard Interpretation Letter (1995) on PPE hazard assessment certification: OSHA confirmed the hazard assessment and PPE certification may be combined into a single document if it contains the required certification elements.
11. OSHA, 29 CFR 1910.1200 - Hazard Communication: Governs the maintenance and worker access to Safety Data Sheets for hazardous chemicals in general industry.