OSHA laws explained: what every small business must know

Last updated 2026-07-09

What is OSHA and what law created it?

The Occupational Safety and Health Administration exists because of a single piece of legislation: the Occupational Safety and Health Act of 1970, signed by President Nixon on December 29, 1970, and effective April 28, 1971. ^[1] That statute is almost always shortened to "the OSH Act" in legal writing, and OSHA (the agency) takes its name directly from it.

The OSH Act covers virtually every private-sector employer in the country, regardless of size. There is no small-business exemption from the law itself, though some recordkeeping rules have a threshold of 10 or fewer employees. Federal, state, and local government workers are not covered under the federal OSHA program, but many states have extended coverage through their own approved programs.

The law did three things that still define how workplace safety works in the U.S. First, it created OSHA inside the Department of Labor. Second, it created the National Institute for Occupational Safety and Health (NIOSH) inside what is now the Department of Health and Human Services to do the research OSHA relies on. Third, it established the independent Occupational Safety and Health Review Commission (OSHRC) to hear contested citations. Three separate agencies, one law.

If you want to read the actual text, it is codified at 29 U.S.C. § 651 et seq. ^[1] The regulations OSHA writes under that authority live in Title 29 of the Code of Federal Regulations, which is why every OSHA standard has a "29 CFR" prefix. Learn more about what OSHA stands for and its full history.

Who does OSHA law actually cover?

The OSH Act covers employers engaged in a business affecting interstate commerce who have at least one employee. That is an intentionally broad definition. If your business is in any way connected to goods or services that cross state lines, you are almost certainly covered. Courts have read "affecting interstate commerce" so broadly that it reaches nearly every for-profit private employer in the country.

Who is not covered: self-employed workers with no employees, immediate family members working on a family farm, and workers in industries where other federal agencies have their own safety authority (mining under MSHA, certain aviation work under the FAA, nuclear under the NRC). ^[1]

State and local government workers are excluded from federal OSHA coverage. But 29 states and two territories run OSHA-approved State Plans that extend coverage to those workers, and in many cases cover private employers under state rules that must be at least as effective as federal OSHA. ^[2] If you operate in California, Michigan, Washington, or any of the other State Plan states, check whether the state agency (Cal/OSHA, MIOSHA, L&I, etc.) is your actual regulator for day-to-day compliance. The rules can differ in important ways.

One thing that trips up small employers: farm operations employing 11 or more workers are covered by OSHA's agricultural standards. Farms with 10 or fewer workers and a certain type of field sanitation situation may be exempt from some rules, but the general duty clause (more on that below) still applies to everybody.

What does the General Duty Clause require?

Section 5(a)(1) of the OSH Act says: "Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees." ^[1] That sentence is the General Duty Clause, and it does a lot of work.

Here is why it matters. OSHA cannot write a specific standard for every hazard that exists. The General Duty Clause fills the gap. If there is no specific 29 CFR standard covering a hazard, OSHA can still cite you under Section 5(a)(1) if the hazard is recognized (either by the industry or by you, the employer), it could cause death or serious harm, and a feasible method to abate it existed.

Heat illness is the clearest current example. There is no federal OSHA heat standard for general industry as of mid-2025 (a proposed rule has been in development). But employers have been cited under the General Duty Clause for heat-related deaths for years because heat hazards are obviously recognized and engineering or administrative controls obviously exist. ^[3]

The practical lesson: you cannot pull up your industry's CFR section, check off every written standard, and call yourself done. You also have to look at your actual workplace and ask whether a reasonable person would call any of those conditions a recognized hazard.

What are the main OSHA standards small businesses need to know?

OSHA's rules are organized into four main parts of 29 CFR:

• Part 1910: General Industry (manufacturing, retail, offices, healthcare, warehousing)
• Part 1926: Construction
• Part 1915, 1917, 1918: Shipyard and marine terminals
• Part 1928: Agriculture

For most small businesses, you live in 1910 or 1926. Here are the standards that generate the most citations and the most injuries:

Standard	What it covers	Who it applies to
29 CFR 1910.147	Lockout/tagout (control of hazardous energy)	Any employer with equipment maintenance
29 CFR 1910.1200	Hazard Communication (HazCom), the "right to know" rule	Nearly every employer (chemicals in the workplace)
29 CFR 1910.134	Respiratory protection	Employers requiring or permitting respirator use
29 CFR 1910.132	Personal protective equipment (PPE) general requirements	General industry, all sizes
29 CFR 1910.303	Electrical, general requirements	General industry
29 CFR 1926.501	Fall protection in construction	All construction employers
29 CFR 1926.1053	Ladders in construction	All construction employers
29 CFR 1910.178	Powered industrial trucks (forklifts)	Warehousing, manufacturing, distribution

Fall protection, hazard communication, respiratory protection, scaffolding, and lockout/tagout have topped OSHA's most-cited standards list in general industry and construction for over a decade. ^[4] If you run a construction company, fall protection alone accounts for a huge share of citations and fatalities. The BLS reported 395 fatal falls in construction in 2022. ^[5]

You do not need to read all of 29 CFR. You need to read the standards that map to the actual hazards in your workplace. Start with the OSHA website's industry-specific pages to find which standards apply, then read those standards directly. Learn more about OSHA training requirements to go with your compliance work.

What are the OSHA recordkeeping and reporting laws?

Two separate legal obligations live here, and people mix them up constantly.

Recordkeeping (29 CFR 1904) requires employers with more than 10 employees in non-exempt industries to record work-related injuries and illnesses on OSHA Forms 300, 300A, and 301. You keep these internally. Partially-exempt industries (most retail, finance, real estate, and certain services) are exempt from routine recordkeeping but are not exempt from reporting. ^[6]

Reporting is mandatory for everyone, regardless of size or industry. You must report a worker fatality to OSHA within 8 hours. You must report any inpatient hospitalization, amputation, or loss of an eye within 24 hours. ^[6] These are phone or online reports to OSHA, not paperwork you file away.

The recordkeeping rule has a few key definitions. A recordable injury is one that results in days away from work, restricted duty, transfer, medical treatment beyond first aid, loss of consciousness, or a diagnosis of a significant injury by a healthcare professional. First aid only? Not recordable. A tetanus shot, over-the-counter medication at nonprescription strength, and wound closures with butterfly bandages are all first aid under the rule.

Form 300A, the summary of injuries and illnesses, must be posted in your workplace each year from February 1 through April 30 for the previous year's data. If OSHA asks for your logs, you have to produce them. Failure to maintain or produce records is itself a citable violation.

Employers with 100 or more employees in high-hazard industries (and 20 or more in certain medium-hazard industries) face an electronic submission requirement under 29 CFR 1904.41. You submit your Form 300A data to OSHA's Injury Tracking Application (ITA). ^[6]

What penalties can OSHA issue under current law?

Penalties adjust each year under the Federal Civil Penalties Inflation Adjustment Act. For violations cited on or after January 15, 2024, the figures are: ^[7]

Violation type	Maximum penalty per violation
Serious	$16,550
Other-than-serious	$16,550
Posting requirement	$16,550
Failure to abate	$16,550 per day beyond abatement date
Willful or repeated	$165,514

Other-than-serious violations sound minor but still carry the same maximum as serious ones. The difference is in how OSHA exercises its discretion. Serious violations are those where there is substantial probability that death or serious physical harm could result. Willful means the employer knew about the requirement and intentionally disregarded it, or was plainly indifferent to it.

Repeated is a different category and it catches employers off guard. If you were cited for a similar hazard at any facility under your company in the past five years, a new citation for that type of violation can be classified as repeated and jump straight to the $165,514 maximum.

OSHA also has discretion to reduce penalties based on employer size (small business discounts are real), good faith effort, and history. A company with fewer than 25 workers may get up to a 60 percent reduction on a serious citation penalty. Willful citations are not eligible for the good-faith reduction.

Criminal penalties are possible but rare: a willful violation causing death can result in a fine and up to six months in prison under the OSH Act itself. ^[1] State prosecutors have pursued more serious charges under state criminal codes in some high-profile cases, but that is outside OSHA's direct authority.

How do OSHA inspections work and what triggers them?

OSHA has the authority to inspect workplaces without advance notice. The Supreme Court ruled in Marshall v. Barlow's Inc. (1978) that OSHA does need a warrant if an employer refuses entry, but OSHA can usually get an administrative warrant quickly, and most employers admit inspectors without requiring one. Refusing entry escalates the situation without helping you much.

Inspections are prioritized in this order: imminent danger situations, severe injury/fatality investigations, worker complaints, programmed inspections (random or targeted high-hazard industries), and follow-up inspections after prior citations. ^[8] If a worker calls OSHA with a formal written complaint, an inspection is very likely. OSHA may handle informal complaints by phone or letter, giving you a chance to respond, but formal written complaints usually get an on-site visit.

During an inspection, the compliance officer (CSHO) will ask for your written safety programs, injury logs (if applicable), and training records, then walk the facility. Workers have the right to speak privately with the CSHO. You have the right to accompany the inspector as the "employer representative." Take notes on everything the CSHO looks at and asks about.

After the inspection, OSHA issues citations by certified mail, typically within six months of the inspection. You have 15 working days from receipt to contest a citation. Miss that deadline and it becomes a final order regardless of merit. That 15-day window is the most important deadline in OSHA enforcement, and many small employers blow it simply by not opening certified mail promptly.

If you get a citation, you have three options: pay and abate, negotiate an informal settlement with the OSHA area director (this is how most citations resolve, often with reduced penalties), or contest formally to the OSHRC. Most small employers settle informally. See more on the full OSHA program overview.

What written safety programs does OSHA law require?

Several specific OSHA standards explicitly require a written program. Others strongly imply one even where the word "written" never appears. Here are the standards that specifically require a written program in general industry:

• Hazard Communication Program: 29 CFR 1910.1200(e) requires a written HazCom program if hazardous chemicals are in the workplace. Almost everyone qualifies.
• Lockout/Tagout Program: 29 CFR 1910.147(c)(1) requires a written energy control program.
• Respiratory Protection Program: 29 CFR 1910.134(c) requires a written program when respirators are required.
• Emergency Action Plan: 29 CFR 1910.38 requires a written EAP for employers with more than 10 employees (those with 10 or fewer may communicate it orally).
• Fire Prevention Plan: 29 CFR 1910.39 requires a written plan for employers with more than 10 employees.
• Bloodborne Pathogens Exposure Control Plan: 29 CFR 1910.1030(c) for any employer with occupational exposure to blood or OPIM.
• PPE Hazard Assessment: 29 CFR 1910.132(d) requires a written certification of the PPE hazard assessment.
• Hearing Conservation Program: 29 CFR 1910.95(c) for workplaces where noise exposures equal or exceed 85 dB(A) TWA.

Written program requirements also run through the construction standards in 29 CFR 1926, including fall protection plans for certain work over 15 feet where conventional fall protection is infeasible, and site safety and health programs for larger excavation and demolition projects.

Writing these programs is where most small employers struggle. Not because the content is hard, but because it takes time to document and customize for your specific workplace. A tool like SafetyFolio's safety program generator can get your HazCom, lockout/tagout, EAP, and other required written programs drafted in about 15 minutes, instead of you spending days researching each standard and starting from a blank document.

Keep your written programs accessible to employees and update them when your processes change. An outdated program that no longer reflects how you actually do work can be cited as readily as having no program at all.

How do state OSHA laws differ from federal OSHA?

Section 18 of the OSH Act explicitly allows states to develop their own occupational safety and health programs if OSHA approves them. A State Plan must be "at least as effective" as the federal program. In practice, many state plans are more stringent in specific areas. ^[2]

As of 2025, 22 states and Puerto Rico have State Plans covering both private and public sector employers. Six additional states plus the Virgin Islands (Connecticut, Illinois, Maine, New Jersey, New York, and the U.S. Virgin Islands) have plans covering only state and local government workers. In those latter jurisdictions, private employers are still under federal OSHA.

Here is how a few state plans diverge from the federal baseline:

• Cal/OSHA (California): Requires an Injury and Illness Prevention Program (IIPP) under 8 CCR 3203 that applies to essentially every California employer. Federal OSHA has no equivalent universal written program requirement. Cal/OSHA also has specific heat illness standards for both outdoor and indoor work, predating any federal rule.
• Washington (L&I): Runs its own penalty structure and inspection process, often with lower penalty thresholds for small employers but more frequent enforcement in certain industries.
• Michigan (MIOSHA): Covers all private and public sector employers and maintains its own set of standards that can differ in technical detail from the federal equivalents.

If you operate in a State Plan state, go to that state agency's website to find the applicable standards. Do not rely on 29 CFR alone. You can end up compliant with federal rules but still cited under the stricter state standard.

Federal OSHA monitors State Plan programs through evaluation reports and can withdraw approval if a state program becomes inadequate, though that has happened rarely in the program's history. ^[2]

What are workers' rights under OSHA law?

Section 11(c) of the OSH Act prohibits employers from retaliating against workers who exercise rights under the law. That includes filing a complaint with OSHA, reporting an injury, participating in an inspection, or refusing to perform work they reasonably believe poses imminent danger of death or serious injury. ^[1]

The retaliation protection is broad on paper but has real procedural limits. A worker must file a Section 11(c) retaliation complaint within 30 days of the adverse action. That is a short window, and many workers miss it. OSHA investigates these complaints and, if it finds merit, can require reinstatement, back pay, and other relief.

Workers also have the right to:

• Request an OSHA inspection (and request that their identity be kept confidential).
• Receive training in a language they understand, as specified in individual OSHA standards.
• Review the OSHA 300 log at their workplace.
• Receive copies of their own exposure and medical records (29 CFR 1910.1020).
• Have a representative accompany the OSHA compliance officer during a workplace inspection.

Other whistleblower protections exist under laws OSHA administers, including Section 405 of the Surface Transportation Assistance Act, the Sarbanes-Oxley Act, and others. These run through OSHA's Whistleblower Protection Programs office. ^[9]

From an employer's seat, the practical takeaway is simple. Document your safety training. Document that workers received it and understood it. If a worker complains about a hazard internally, write down what was said and what corrective action you took. Not because you are building a legal defense, but because responding to safety concerns in a consistent way is how you actually kill the hazard.

What is an OSHA compliance program and do you legally need one?

Federal OSHA does not require one universal written safety program for all employers the way California does with its IIPP. What OSHA requires instead is a collection of specific written programs tied to specific hazards and standards.

The practical answer to "do you need a safety program" is still yes, absolutely, even where no single rule technically mandates it. Here is why. OSHA's penalty reduction for "good faith" gives up to a 25 percent reduction to employers with effective safety and health programs in place. OSHA's compliance assistance materials say a well-documented, complete safety program is evidence of good faith. ^[8] The OSHRC has also treated an employer's overall safety management as relevant to whether a violation was willful.

More to the point, the aggregate data on injuries and programs is pretty clear: workplaces with formal safety management systems have lower injury rates. The BLS reported a private sector total recordable injury rate of 2.7 per 100 full-time equivalent workers in 2022, down sharply from rates above 10 in the 1970s. That improvement happened alongside the spread of formal safety management, though pinning down causation precisely is hard. ^[5]

If you want to build out your required written programs without burning weeks on it, SafetyFolio generates the specific programs each OSHA standard requires, customized to your industry and workplace answers, in about 15 minutes.

If you are pursuing OSHA's Voluntary Protection Programs (VPP) recognition or applying to an OSHA-aligned safety council, a documented safety management system is required. VPP sites get removed from routine OSHA programmed inspection lists, which is a real operational benefit for larger employers.

How has OSHA law changed in recent years and what is coming?

Penalty amounts adjust annually by regulation. The big substantive rulemaking in progress for several years is a heat illness prevention rule. OSHA published a proposed rule in August 2024 that would set specific requirements for outdoor and indoor work at or above 80 degrees Fahrenheit. ^[3] As of mid-2025, the final rule had not been issued, and the regulatory future under the current administration was uncertain. But the General Duty Clause enforcement for heat continues regardless of where the rulemaking lands.

Electronic recordkeeping submission requirements (29 CFR 1904.41) expanded under a 2023 final rule. Establishments with 100 or more employees in high-hazard industries must now submit their Form 300 and 301 data (more than the 300A summary) electronically each year. This took effect starting with calendar year 2023 data submitted in 2024. ^[6]

OSHA has also been active on walkaround rights. A 2024 OSHA rule on worker walkaround representation clarified that workers can designate a third-party representative, such as a union representative from outside the company, to accompany OSHA inspectors. That rule faced legal challenges, and its practical status deserves a check on OSHA.gov before an inspection. ^[8]

On enforcement, OSHA's national emphasis programs (NEPs) shift focus periodically. Current NEPs target silica, heat, warehousing and distribution, and nursing homes. If your industry matches an active NEP, your odds of a programmed inspection run higher than baseline. You can find the current NEP list on OSHA.gov.

The bottom line on regulatory change: OSHA law moves slowly. The core requirements (the OSH Act, the major standards) have been stable for decades. The edges (penalty amounts, new hazard-specific standards, reporting thresholds) shift more often. Set a reminder to check OSHA.gov once a year for updates to standards that apply to your workplace.

Frequently asked questions

Does OSHA apply to companies with fewer than 10 employees?

Yes. The OSH Act covers private employers with even one employee. The 10-employee threshold only affects whether you are required to keep OSHA injury and illness logs (29 CFR 1904). Employers with 10 or fewer workers in any industry are exempt from routine recordkeeping but must still comply with all safety and health standards and must still report fatalities, hospitalizations, amputations, and eye loss to OSHA within the required time windows.

What is the difference between OSHA and the OSH Act?

The OSH Act (Occupational Safety and Health Act of 1970) is the law, passed by Congress and signed by the president. OSHA (Occupational Safety and Health Administration) is the federal agency the law created inside the Department of Labor to enforce its requirements and write the specific regulations. People use "OSHA" to refer to both the agency and sometimes the law itself, but technically they are distinct: one is a statute, one is a bureaucracy.

What is the General Duty Clause and when does OSHA use it?

Section 5(a)(1) of the OSH Act requires employers to keep the workplace free from recognized hazards likely to cause death or serious harm, even when no specific OSHA standard covers that hazard. OSHA uses it to cite employers for hazards like heat illness, workplace violence in high-risk settings, and ergonomic risks. To issue a General Duty Clause citation, OSHA must show the hazard was recognized, it could cause serious harm, and a feasible abatement method existed.

How long do I have to contest an OSHA citation?

You have 15 working days from the date you receive the citation to file a Notice of Contest. Miss that deadline and the citation and penalty become a final order of the Occupational Safety and Health Review Commission, period, regardless of whether the citation was valid. Most small employers resolve citations through an informal settlement conference with the OSHA area director, which can reduce penalties and sometimes the characterization of the violation without a formal contest.

What is the maximum OSHA fine for a serious violation?

For violations cited on or after January 15, 2024, the maximum penalty for a serious violation is $16,550 per violation. Willful or repeated violations can reach $165,514 per violation. Penalty amounts adjust annually under the Federal Civil Penalties Inflation Adjustment Act. Small employers (fewer than 25 workers) may receive a reduction of up to 60 percent on serious violations, but willful citations are not eligible for the good-faith reduction.

Which industries have the highest OSHA citation rates?

Construction consistently tops the citation list, with fall protection (29 CFR 1926.501) the single most-cited OSHA standard most years. General industry follows, with hazard communication, lockout/tagout, respiratory protection, and powered industrial trucks generating the most citations. The BLS reported 395 fatal falls in construction in 2022. Warehousing and distribution have seen increased enforcement focus under OSHA's current national emphasis programs.

Does OSHA require a written safety program for every employer?

Federal OSHA does not require one universal written safety program, but multiple specific standards require their own written programs: HazCom (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), respiratory protection (29 CFR 1910.134), emergency action plans (29 CFR 1910.38 for employers with more than 10 workers), bloodborne pathogens, and others. California's Cal/OSHA is the exception: it requires an Injury and Illness Prevention Program from essentially every employer under 8 CCR 3203.

Can OSHA inspect my workplace without notice?

Yes. OSHA compliance officers can show up unannounced. You can refuse entry without a warrant, but OSHA can obtain an administrative warrant relatively quickly, and refusing entry tends to escalate the situation. During an inspection, you have the right to accompany the compliance officer as the employer representative and to take notes. After the inspection, citations are issued by certified mail, typically within six months.

What is the difference between a federal OSHA state and a State Plan state?

In the 28 states and territories without an approved State Plan, federal OSHA directly enforces the law. In the 22 states and Puerto Rico with approved State Plans covering private employers, the state agency is your primary regulator and sets the standards, which must be at least as effective as federal OSHA but can be stricter. California, Washington, Michigan, and Oregon are examples. Check your state agency's website to confirm which rules apply to you.

What injuries and illnesses must I report to OSHA?

Every employer, regardless of size or industry, must report a worker fatality to OSHA within 8 hours. Any in-patient hospitalization (even one worker), amputation, or loss of an eye must be reported within 24 hours. Reports go to OSHA by phone (1-800-321-OSHA) or online. Separate from reporting, employers with more than 10 employees in non-exempt industries must record qualifying injuries and illnesses on OSHA Forms 300, 300A, and 301.

Can a worker refuse to do a job because it is unsafe under OSHA law?

Yes, with conditions. Under Section 11(c) of the OSH Act and OSHA's regulations, a worker may refuse work if they have a reasonable, good-faith belief that the task poses imminent danger of death or serious physical harm, the hazard is so urgent there is no time to report it to OSHA first, and the employer refuses to correct it. Employers cannot legally retaliate against a worker for a protected refusal, but this is narrower than many workers assume.

Are OSHA penalties tax deductible?

No. Fines and penalties paid to a government agency for violating the law are not deductible as ordinary business expenses under IRS rules. This is a meaningful financial distinction: a $16,550 serious citation penalty actually costs more than face value after taxes because the payment comes from post-tax dollars. It is one more reason that investing in compliance up front is genuinely cheaper than the alternative.

What OSHA training is legally required?

Training requirements are standard-specific. For example, 29 CFR 1910.147 requires training before workers perform lockout/tagout procedures. 29 CFR 1926.503 requires fall protection training before workers are exposed to fall hazards in construction. 29 CFR 1910.1200 requires HazCom training before workers are exposed to hazardous chemicals. There is no single universal OSHA training requirement, but if a standard that applies to your workplace contains a training provision, that training is legally mandatory. See our guide to OSHA training requirements for a full breakdown.

What does OSHA's multi-employer citation policy mean for my business?

On construction sites and some other multi-employer worksites, OSHA can cite employers who do not directly employ the workers exposed to a hazard. The policy identifies four roles: the creating employer (who created the hazard), the exposing employer (whose workers are exposed), the correcting employer (responsible for fixing the hazard), and the controlling employer (who supervises the worksite). A general contractor can be cited even if subcontractor employees were the ones exposed, if the GC had the ability and responsibility to correct the condition.

Sources

1. U.S. Department of Labor, OSH Act of 1970 full text: The OSH Act of 1970, signed December 29, 1970, created OSHA, NIOSH, and the OSHRC; Section 5(a)(1) is the General Duty Clause; willful violation causing death carries up to six months imprisonment
2. OSHA.gov, State Plans program page: 22 states and Puerto Rico have OSHA-approved State Plans covering private employers; State Plans must be at least as effective as federal OSHA
3. OSHA.gov, Heat Illness Prevention rulemaking page: OSHA proposed a heat illness prevention rule in August 2024; General Duty Clause enforcement for heat hazards has been ongoing
4. OSHA.gov, Top 10 Most Frequently Cited Standards: Fall protection, hazard communication, respiratory protection, scaffolding, and lockout/tagout are perennially among the most-cited OSHA standards
5. U.S. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program: BLS reported 395 fatal falls in construction in 2022; private sector total recordable injury rate was 2.7 per 100 FTE workers in 2022
6. OSHA.gov, Recordkeeping rule 29 CFR 1904 and electronic submission (ITA): Employers with more than 10 employees in non-exempt industries must keep OSHA 300/300A/301 logs; fatalities must be reported within 8 hours; hospitalizations, amputations, and eye loss within 24 hours; 100+ employee high-hazard establishments must submit Form 300 and 301 data electronically starting with CY2023 data
7. OSHA.gov, Civil Penalty Adjustments page: For violations cited on or after January 15, 2024: maximum serious violation penalty $16,550; maximum willful/repeated penalty $165,514
8. OSHA.gov, Inspections overview and enforcement page: OSHA inspection priority order; good-faith penalty reduction available; employers have 15 working days from citation receipt to contest; walkaround rights rule published 2024
9. OSHA.gov, Whistleblower Protection Programs: OSHA administers whistleblower protections under the Surface Transportation Assistance Act, Sarbanes-Oxley Act, and other statutes through its Whistleblower Protection Programs
10. California Department of Industrial Relations, Cal/OSHA IIPP requirement 8 CCR 3203: Cal/OSHA requires a written Injury and Illness Prevention Program (IIPP) from essentially every California employer under 8 CCR 3203