OSHA workplace safety: what every small business actually needs

Last updated 2026-07-09

What is OSHA and who does it actually cover?

The Occupational Safety and Health Act of 1970 created OSHA and handed it authority over private-sector employers and their workers in all 50 states ^[1]. That's roughly 10 million workplaces and 144 million workers, by OSHA's own count. Federal employees are covered through a separate executive order. State and local government workers are covered only if their state runs an OSHA-approved State Plan.

Self-employed people with no employees are out. Farms with 10 or fewer workers and no temporary labor camp qualify for a limited exemption on some rules. Almost everyone else is in.

Want the full background on the agency's history, mission, and structure? The osha primer covers that ground. The short version: OSHA enforces two layers of rules. First, specific standards written for particular hazards (forklifts, chemicals, fall protection, lockout, and the rest). Second, the General Duty Clause, Section 5(a)(1) of the Act, which says employers must furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[1]. That clause is how OSHA cites employers for hazards with no dedicated standard yet, and it reaches further than most owners expect.

What are the most frequently cited OSHA standards, and why do they keep showing up?

OSHA releases its Top 10 most cited standards every year at the NSC Safety Congress. The 2023 list, in order, was fall protection in construction (29 CFR 1926.501), hazard communication (29 CFR 1910.1200), ladders in construction (29 CFR 1926.1053), respiratory protection (29 CFR 1910.134), scaffolding (29 CFR 1926.451), fall protection training (29 CFR 1926.503), powered industrial trucks (29 CFR 1910.178), lockout/tagout (29 CFR 1910.147), personal protective equipment (29 CFR 1926.102), and machine guarding (29 CFR 1910.212) ^[2].

The same standards top the list year after year because they fail the same way. Employers know they need to do something, then skip the written program, skip the training records, or skip the equipment inspection. The citation is rarely about a dramatic accident. It's about paperwork nobody created or a procedure nobody wrote down.

Hazard communication tells the story. The standard wants a written hazard communication program, a full chemical inventory, safety data sheets workers can reach for every hazardous chemical, and container labels. Companies get cited for having SDSs for some chemicals but not all, or for having no written program at all. The hazard communication page digs into what that written program has to say. Lockout tagout runs the same play. The standard (29 CFR 1910.147) requires a written energy control program, machine-specific procedures, and documented annual inspections of each procedure. Companies that skip the machine-specific write-ups get cited even when their workers do the physical steps perfectly. See lockout tagout for the procedure template.

Rank	Standard	Topic Area
1	29 CFR 1926.501	Fall protection, construction
2	29 CFR 1910.1200	Hazard communication
3	29 CFR 1926.1053	Ladders, construction
4	29 CFR 1910.134	Respiratory protection
5	29 CFR 1910.178	Powered industrial trucks
6	29 CFR 1910.147	Lockout/tagout
7	29 CFR 1910.212	Machine guarding

How much can OSHA fine you, and how does the penalty math actually work?

OSHA maxes out at $16,550 per serious violation and $165,514 per willful or repeated violation as of 2024, and it raises those caps every January to track the Consumer Price Index. Failure-to-abate violations run $16,550 per day after a deadline passes ^[3]. Those are ceilings, not what most small shops pay.

The real number is usually lower. OSHA applies gravity-based reductions plus a small-business cut of up to 70 percent for employers with 25 or fewer workers (40 percent for 26 to 100 workers). A serious citation that starts at $15,625 can fall to roughly $4,700 after the small-business reduction. Still real money. Nowhere near the $165,000 headline.

The Amazon case is worth knowing. In 2023, OSHA cited Amazon for ergonomic hazards at several warehouses, arguing that its work pace and quota systems created recognized ergonomic hazards under the General Duty Clause. The settlement, finalized in 2024, required Amazon to build detailed ergonomic programs, worker feedback systems, and injury tracking at named facilities ^[4]. For a small business, the dollar figure isn't the point (Amazon's was modest given its size). The point is the confirmation that OSHA will chase General Duty Clause cases on ergonomics and work pace, subjects many employers assume sit outside OSHA's reach.

Reductions also apply for good faith (a real, documented safety program) and for fast abatement. An informal settlement conference almost always comes before you pay anything, and citations shrink at that stage all the time. Contesting a citation kicks off a formal process through the Occupational Safety and Health Review Commission.

What written safety programs does OSHA actually require?

Here's where most small businesses are out of compliance and don't know it. OSHA has no single master "safety plan" requirement. Instead, specific standards each demand their own written program when the matching hazard is present at your site ^[5].

The programs owners most often owe:

• Hazard Communication Program (29 CFR 1910.1200(e)) -- required any time you have hazardous chemicals
• Energy Control (Lockout/Tagout) Program (29 CFR 1910.147(c)(4)) -- required if workers service or maintain equipment with hazardous energy
• Respiratory Protection Program (29 CFR 1910.134(c)) -- required any time workers use respirators
• Emergency Action Plan (29 CFR 1910.38) -- required for employers with 10 or more employees (under 10 may communicate it orally)
• Bloodborne Pathogens Exposure Control Plan (29 CFR 1910.1030) -- required if occupational exposure to blood is reasonably anticipated
• Hearing Conservation Program (29 CFR 1910.95) -- required if workers are exposed to 85 dBA or more as an 8-hour time-weighted average
• Personal Protective Equipment Hazard Assessment (29 CFR 1910.132(d)) -- not technically a "program" but a documented written certification of the hazard assessment
• Fall Protection Plan, construction (29 CFR 1926.502) -- required in specific scenarios

Plenty of small business owners have none of these on paper. That's the single most common gap in the published OSHA citation data. Writing them from scratch is tedious, not hard. If you want to cut the time way down, SafetyFolio's safety program generator walks you through the key standards and produces a compliant written program in about 15 minutes.

Cal/OSHA and several other State Plan states add a requirement federal OSHA doesn't have: an Injury and Illness Prevention Program (IIPP). California mandates it for all employers under 8 CCR 3203. Even where your state doesn't require one, a general written IIPP is the best single move you can make to show an inspector good faith ^[6].

What OSHA training is required, and how do you document it?

Training rules are scattered across dozens of standards, but the pattern holds: if a standard regulates a hazard, it almost always requires documented training before workers touch that hazard, plus retraining after incidents or after procedures change.

A few examples, with the citation attached:

• Forklift operators must be trained and evaluated before running a powered industrial truck, and retrained at least every three years (29 CFR 1910.178(l)) ^[7]. The standard requires the employer to certify in writing that each operator was trained. The forklift certification article spells out exactly what that certification has to say.
• Workers exposed to electrical hazards on construction sites must get the training required by 29 CFR 1926.416(a).
• Respirator users must be trained on donning, doffing, fit checks, and the limits of their respirator before use (29 CFR 1910.134(k)).
• Hazard communication training must happen at initial assignment and again when new hazards enter the workplace (29 CFR 1910.1200(h)).

For supervisors and safety managers, the OSHA 30 course (30 hours of general industry or construction safety training) is the most widely recognized credential. It satisfies no specific standard's training requirement on its own, but it's a solid base. The OSHA 30 training page lists current options and pricing.

Documentation carries as much weight as the training. Keep a record showing the employee's name, the date, the topics covered, and the trainer's name or credential. Inspectors ask for training records right away. "We do this, we just never wrote it down" is not a defense.

How does an OSHA inspection actually work, step by step?

Most small businesses never face an inspection. The ones that do usually get caught flat-footed. Knowing the sequence takes out most of the fear.

OSHA orders inspections by priority: imminent danger reports first, then fatalities and catastrophes (any hospitalization of three or more workers), then worker complaints, then programmed inspections (industries or employers with high injury rates), then follow-ups from previous citations ^[8].

The five stages:

1. Credentials. A compliance officer (CSHO) shows up and presents identification. You can ask to see it. You can't refuse entry for a surprise inspection without forcing OSHA to get a warrant, which is rare and generally makes things worse. 2. Opening conference. The CSHO explains why they're there, the scope, and how it'll go. You can and should have your safety manager or a designated representative in the room. 3. Walkaround. The CSHO tours the facility with you and a worker representative (that rep has a right to take part even in non-union shops). Expect photos, measurements, and notes. Take the same photos and notes they do. 4. Document review. This is where a lot of citations come from. The CSHO asks for your written programs, training records, injury logs (OSHA 300, 300A, and 301 forms), equipment inspection records, and SDS binders. Missing paperwork is a citation. 5. Closing conference. The CSHO summarizes the findings. That's not the citation. It's a preliminary summary. Citations arrive later by mail, usually within six months.

One practical move: decide in advance who talks to the CSHO. Not the first employee they bump into. The owner or the safety manager, someone who knows what records exist and where they live.

What does the OSHA 300 log require, and who has to keep it?

Employers with 10 or more employees in most industries must record work-related injuries and illnesses on three forms: the OSHA 300 (Log of Work-Related Injuries and Illnesses), the OSHA 300A (Summary, posted February 1 through April 30 each year), and the OSHA 301 (Incident Report for each recordable case) ^[9].

Some low-hazard industries are partially exempt from routine recordkeeping even above 10 employees. OSHA keeps a current list of exempt industries by NAICS code at osha.gov.

A recordable case is any work-related injury or illness that results in days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or diagnosis of a significant injury by a healthcare professional.

Employers with 20 or more employees in high-hazard industries must submit their 300A data electronically each year through the Injury Tracking Application (ITA). As of 2024, establishments with 100 or more employees in designated high-hazard industries must also submit 300 log and 301 incident data electronically ^[9].

The incident report article walks through what goes on the 301 form and when the clock starts. You have seven calendar days from learning of a recordable case to log it.

Fatalities must be reported to OSHA within 8 hours. Hospitalization of one or more employees, an amputation, or the loss of an eye must be reported within 24 hours. Those are phone reports to your nearest OSHA area office or the 24-hour line at 1-800-321-OSHA.

What does OSHA require for personal protective equipment?

OSHA's PPE standard for general industry (29 CFR 1910.132) requires three things: a documented workplace hazard assessment to figure out what PPE is needed, PPE provided at no cost to workers (with narrow exceptions for everyday clothing-type items), and training on when and how to use it ^[10].

The "at no cost" rule came from a 2008 final rule. Employers pay for most gear: hard hats, safety glasses, hearing protection, gloves, fall harnesses, and so on. The narrow exceptions cover non-specialty safety-toe footwear, non-specialty prescription safety eyewear, and logging boots, where OSHA allows cost-sharing.

The hazard assessment certification is where companies trip. The standard says the employer must "verify" the assessment through a written certification that names the workplace evaluated, the person certifying it, and the date. Simple. But it has to exist on paper.

The specific PPE standards: eye and face protection is 29 CFR 1910.133, head protection is 29 CFR 1910.135, foot protection is 29 CFR 1910.136, and hand protection is 29 CFR 1910.138. Respiratory protection stands on its own at 29 CFR 1910.134, which requires medical evaluation, fit testing, and a written program before workers wear tight-fitting respirators.

BLS data from 2022 showed contact with objects and equipment caused 26 percent of private-sector nonfatal injuries requiring days away from work ^[11]. A big chunk of those are struck-by and caught-in hazards where the right PPE and guarding would have changed the outcome.

What are OSHA State Plans, and does your state have one?

Twenty-two states and two U.S. territories run their own OSHA-approved safety programs, called State Plans ^[12]. These states enforce their own standards, which have to be "at least as effective" as federal OSHA but can be (and sometimes are) tougher.

State Plan states for private employers include California (Cal/OSHA), Michigan (MIOSHA), Washington (WISHA/L&I), Oregon (Oregon OSHA), North Carolina (NC DOL), Virginia (VOSH), and others. A few states, like New York and Illinois, run State Plans only for state and local government workers. Private employers there fall under federal OSHA.

The differences are real. Cal/OSHA requires an Injury and Illness Prevention Program for every employer, which federal OSHA does not. Michigan runs its own penalty structure. Washington's ergonomics history (it passed a rule in 2000, voters repealed it in 2003, and the state has circled back through other mechanisms since) shows how far a State Plan can drift from federal policy.

If you're in a State Plan state, check both the state standard and the federal one. The state version controls, and it's sometimes the more demanding of the two.

What does OSHA's General Duty Clause actually cover, and how does the Amazon case illustrate it?

Section 5(a)(1) of the OSH Act says employers must furnish "employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees" ^[1]. OSHA reaches for this clause when no specific standard covers a hazard.

To prove a General Duty Clause violation, OSHA has to show four things: the employer failed to keep the workplace free from a hazard; the hazard was recognized (by the employer, the industry, or common sense); it was causing or likely to cause death or serious harm; and a feasible fix existed to reduce or remove it.

The Amazon settlements of 2023 and 2024 are the clearest recent illustration. OSHA alleged that Amazon's fulfillment and delivery operations exposed workers to ergonomic hazards from high-repetition tasks, awkward postures, and productivity quotas, and it pointed to injury rates at specific facilities that ran well above industry averages ^[4]. Amazon disputed the framing but agreed in the settlement to put ergonomic controls, worker committees, and injury tracking programs in place at named facilities.

For a small business, the takeaway is plain. If your workers do repetitive tasks, lift heavy objects regularly, or work in positions your own supervisors can see are hurting people, you don't get to wait for a specific ergonomics standard (federal OSHA withdrew its ergonomics rule in 2001, and none has replaced it at the federal level). The General Duty Clause already applies. Document your hazard assessments, take real corrective action, and don't let production pressure roll over safety controls.

How can a small business build a real safety program without a consultant?

Most small businesses don't need a $5,000 consultant to get compliant. They need a system for four things: finding hazards, writing programs, training people, and keeping records.

Start with a walkthrough of your facility using OSHA's free Small Business Handbook and the industry-specific checklists at osha.gov ^[13]. Write down every hazard you spot. Then run the list of written programs above and check which ones apply. Hazardous chemicals mean a hazcom program. Equipment with energy sources your workers service means a lockout program. Go one by one.

OSHA's On-Site Consultation Program sits apart from enforcement and is free for small businesses in most states. Consultants from this program visit your site, identify hazards, and help you fix them without triggering citations or handing findings to OSHA enforcement ^[13]. It's the most underused resource in occupational safety. Employers who use it and fix what turns up are not cited for what the consultant found.

To build your written programs faster, SafetyFolio's safety program generator walks through your specific operations and produces programs matched to your hazards. The point isn't to dodge consultant fees so you can skip the work. It's to get past the blank document.

For training, start with what's legally required for your hazards. The OSHA training resources break down the standard-by-standard requirements. Keep a training log from day one. A plain spreadsheet with employee name, date, topic, and trainer does the job. You don't need software.

What do injury and illness rates actually look like across industries?

BLS publishes the Survey of Occupational Injuries and Illnesses (SOII) every year. The 2022 data showed private industry recorded 2.8 million nonfatal workplace injuries and illnesses, a rate of 2.7 cases per 100 full-time equivalent workers ^[11].

Agriculture, forestry, fishing, and hunting posted the highest fatal work injury rate at 18.9 per 100,000 full-time equivalent workers in 2022. Construction stays near the top for fatalities, driven by the "Fatal Four": falls, struck-by objects, electrocution, and caught-in/between hazards, which OSHA estimates cause more than 60 percent of construction worker deaths each year ^[2].

Manufacturing, warehousing, and transportation run higher-than-average nonfatal injury rates. Healthcare posts surprisingly high injury rates from patient handling and workplace violence, which is why OSHA has been pushing healthcare-specific ergonomics guidance.

These numbers matter for a small business because OSHA uses injury rates to target programmed inspections. A high DART rate (days away from work, restricted duty, or job transfer) for your NAICS code raises your odds of landing in a planned inspection program. The best defense is a genuinely low injury rate built on genuine safety.

Frequently asked questions

What does OSHA stand for?

OSHA stands for Occupational Safety and Health Administration. It's the federal agency created by the Occupational Safety and Health Act of 1970 to set and enforce workplace safety standards. The what does osha stand for article covers the full history and organizational structure if you want more background.

Does OSHA apply to businesses with fewer than 10 employees?

Yes, with one narrow exception. Most OSHA standards apply to all private employers regardless of size. The main small-employer break is the recordkeeping rule: employers with 10 or fewer employees are exempt from routine injury logs (OSHA 300/300A/301) unless OSHA requests the records for a specific inspection or survey. Every other safety standard still applies.

How often does OSHA conduct inspections of small businesses?

OSHA's roughly 1,850 federal compliance officers cover about 10 million workplaces, so most small businesses are never inspected in a given year. Top priority is imminent danger, then fatalities, then worker complaints, then programmed inspections in high-hazard industries. Businesses with high injury rates or in construction, warehousing, and agriculture face higher inspection odds.

What happens if an employee files an OSHA complaint against my business?

OSHA screens the complaint first. A formal complaint from a current or former employee usually triggers an inspection when the alleged hazard is serious. For less severe complaints, OSHA may send a letter asking for a written response. Workers who complain are protected from retaliation under Section 11(c) of the OSH Act. Retaliating against a complainant is itself a serious violation.

Can I contest an OSHA citation?

Yes. You have 15 working days from receiving the citation to file a Notice of Contest. After that, the case goes to the Occupational Safety and Health Review Commission, an independent agency. Most employers who contest go through an informal settlement conference first, where many citations get reduced or withdrawn. Miss the 15-day window and the citation becomes final no matter its merit.

What is the OSHA General Duty Clause and when does it apply?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm, even where no specific standard covers the hazard. OSHA uses it for ergonomics, workplace violence in healthcare, heat stress, and other hazards without dedicated standards. The Amazon warehouse settlements of 2023 and 2024 are the most prominent recent example.

What are OSHA's reporting requirements for serious injuries?

Fatalities must be reported to OSHA within 8 hours. A single worker hospitalization, an amputation, or the loss of an eye must be reported within 24 hours. Reports go to your nearest OSHA area office or the 24-hour line (1-800-321-OSHA). Failing to report a fatality on time carries its own penalty, separate from any citation for the underlying hazard.

Is OSHA 30 training required by law?

Not by any OSHA standard itself. The OSHA 30-hour course is a voluntary credential, though many state agencies, general contractors, and project owners require it by contract or local rule. It satisfies no specific standard's training requirement on its own, but it shows good faith and builds solid general safety knowledge. The osha 30 hour online course page has current provider options.

What is a written Injury and Illness Prevention Program (IIPP) and do I need one?

An IIPP is a documented safety management system covering hazard identification, investigation, corrective action, training, and communication. California requires one for all employers under 8 CCR 3203. Federal OSHA doesn't mandate a universal IIPP, but having one is the strongest single piece of good-faith evidence during an inspection and usually earns a penalty reduction.

What does OSHA require for forklift safety?

29 CFR 1910.178 requires employers to train and evaluate each forklift operator before they run a powered industrial truck, and to retest operators every three years or after an accident, near-miss, or observed unsafe operation. The employer must certify in writing that each operator finished training. Third-party courses help, but the employer owns the evaluation. See forklift certification for the full checklist.

How does OSHA handle workplace ergonomics hazards?

Federal OSHA withdrew its ergonomics standard in 2001 and hasn't replaced it. OSHA now addresses ergonomic hazards through the General Duty Clause, issuing citations when injury data and work conditions show a recognized hazard the employer left alone. The Amazon settlements confirmed OSHA will pursue these cases. Some State Plan states, like Washington, keep separate ergonomics rules or guidance.

What safety data sheets (SDS) does my business need, and where do I keep them?

You need a current SDS for every hazardous chemical in your workplace, whether you brought it in or a contractor did. Under 29 CFR 1910.1200, SDSs must be immediately accessible to workers during their shift, on paper or electronically. Workers must be able to reach them without asking a supervisor. The hcl safety data sheet page shows what a proper SDS contains.

What's the difference between federal OSHA and a State Plan?

Twenty-two states and two territories run their own OSHA-approved programs that must be at least as effective as federal OSHA, and they can set stricter standards. California, Michigan, Washington, Oregon, North Carolina, and Virginia are major examples. If your state has a Plan, the state agency enforces the rules and runs the inspections. Always check your state's standards alongside the federal ones.

What free resources does OSHA offer to small businesses?

OSHA's On-Site Consultation Program gives free, confidential safety reviews by state-run consultants who don't share findings with OSHA enforcement. OSHA also publishes free guides, staffs compliance assistance specialists in each area office, and offers the Small Business Handbook plus eTools for specific hazards. These are genuinely useful and badly underused by the employers who need them most.

Sources

1. U.S. Department of Labor, OSHA -- OSH Act of 1970 (full text): Section 5(a)(1) General Duty Clause text; OSHA coverage of private-sector employers
2. OSHA.gov -- Top 10 Most Frequently Cited Standards: 2023 Top 10 most frequently cited OSHA standards list
3. OSHA.gov -- Civil Penalty Amounts (adjusted for inflation): 2024 maximum penalty amounts: $16,550 serious, $165,514 willful or repeated
4. OSHA -- Amazon Citations and Settlement News Release: OSHA cited Amazon under the General Duty Clause for ergonomic hazards; settlement required ergonomic programs at specific facilities
5. OSHA.gov -- Small Business Safety and Health Handbook: List of standards requiring written safety programs for general industry employers
6. California Department of Industrial Relations -- Cal/OSHA IIPP Requirements (8 CCR 3203): California requires an Injury and Illness Prevention Program for all employers under 8 CCR 3203
7. OSHA -- 29 CFR 1910.178 Powered Industrial Trucks standard text: Forklift operators must be trained and evaluated before operation; employer must certify training in writing; re-evaluation at least every three years
8. OSHA.gov -- Inspection Procedures and Priority: OSHA inspection priority order: imminent danger, fatalities, complaints, programmed inspections, follow-ups
9. OSHA -- Recordkeeping Rule 29 CFR Part 1904: Employers with 10 or more employees must keep OSHA 300/300A/301; 300A must be posted Feb 1-Apr 30; electronic submission requirements for larger employers in high-hazard industries
10. OSHA -- 29 CFR 1910.132 Personal Protective Equipment standard: Employers must conduct and document a hazard assessment and provide PPE at no cost to workers
11. Bureau of Labor Statistics -- Survey of Occupational Injuries and Illnesses, 2022: 2022 private industry recorded 2.8 million nonfatal injuries at a rate of 2.7 per 100 FTEs; contact with objects caused 26% of nonfatal injuries with days away from work
12. OSHA.gov -- State Plans: 22 states and 2 territories operate OSHA-approved State Plans; must be at least as effective as federal OSHA
13. OSHA.gov -- On-Site Consultation Program: Free, confidential on-site consultation available to small businesses; findings not shared with OSHA enforcement