Safety procedures in the workplace: a complete guide for small business

Last updated 2026-07-09

What are workplace safety procedures and why does OSHA care?

A workplace safety procedure is a written, step-by-step instruction that tells workers how to do a specific task without getting hurt. It answers three questions: what hazards are present, what controls reduce those hazards, and exactly what steps to follow. That sounds basic, and it is. The problem is most small businesses either skip writing them down or write them once and never touch them again.

OSHA cares because the OSH Act of 1970 puts the burden on employers. Section 5(a)(1), called the General Duty Clause, says every employer must furnish a place of employment "free from recognized hazards that are causing or are likely to cause death or serious physical harm." ^[1] That one sentence is the legal hook OSHA uses when no specific standard directly applies to a hazard.

Beyond the General Duty Clause, dozens of specific 29 CFR 1910 standards (for general industry) and 29 CFR 1926 standards (for construction) require written procedures for particular tasks. Lockout/tagout under 29 CFR 1910.147, for instance, requires a written energy control program plus machine-specific procedures for every piece of equipment that could release stored energy. ^[2] Hazard communication under 29 CFR 1910.1200 requires a written program explaining how your workplace handles chemical hazards. ^[3]

OSHA cited lockout/tagout violations more than 2,000 times in fiscal year 2023, keeping it on the ten most-cited standards list it lands on every single year. Nearly every one of those citations traces back to missing or inadequate written procedures.

Here's the short version. Written safety procedures are not optional paperwork. They are the mechanism OSHA uses to prove you either did or did not take recognized hazards seriously.

Which specific safety procedures does OSHA actually require in writing?

Not every safety rule has to be a formal written procedure, but a surprising number do. Below are the core written programs most general-industry employers need, each paired with the standard that requires it.

Written Program Required	OSHA Standard	Who Needs It
Hazard Communication Program	29 CFR 1910.1200	Any employer using hazardous chemicals
Energy Control (Lockout/Tagout) Program	29 CFR 1910.147	Any employer with equipment that stores energy
Emergency Action Plan	29 CFR 1910.38	Employers with 10+ employees (all employers should have one)
Fire Prevention Plan	29 CFR 1910.39	Required when specific fire standards apply
Respiratory Protection Program	29 CFR 1910.134	Any workplace requiring respirators
Bloodborne Pathogens Exposure Control Plan	29 CFR 1910.1030	Any worker with occupational exposure to blood
Personal Protective Equipment Hazard Assessment	29 CFR 1910.132	All general-industry employers
Hearing Conservation Program	29 CFR 1910.95	Workers exposed at or above 85 dBA time-weighted average
Permit-Required Confined Space Program	29 CFR 1910.146	Employers with permit-required confined spaces

The hazard communication standard alone touches almost every workplace. If you keep cleaning supplies, lubricants, adhesives, or any chemical with a safety data sheet, you need a written hazard communication program. Full stop.

Employers with fewer than 10 employees can communicate the emergency action plan orally under 29 CFR 1910.38(b). That is a narrow exception. The moment you cross ten employees, the plan has to be in writing. ^[4]

Construction runs a parallel universe of required written programs under 29 CFR 1926, including fall protection plans (1926.502) for certain situations and written excavation plans. If you run a construction operation, the 1910 list above is not your only list.

One more thing worth knowing. The absence of a required written program is itself a citable violation, separate from any injury that occurs. OSHA can cite you for the missing paperwork even if nobody has been hurt yet.

How many workplace injuries happen each year, and what causes most of them?

The Bureau of Labor Statistics reported roughly 2.6 million nonfatal workplace injuries and illnesses in private industry for 2023, at a rate of 2.4 cases per 100 full-time equivalent workers. ^[5] Those numbers are down from historical peaks, but they've essentially flattened over the last several years.

The leading causes shift slightly by industry, though the pattern holds across all private employers. About one third of lost-workday injuries involve overexertion and bodily reaction: lifting, carrying, pushing, pulling. Falls, slips, and trips account for another 25 to 30 percent. Contact with objects and equipment (being struck by, caught in, or caught between) is a distant third.

Fatalities tell a starker story. The BLS Census of Fatal Occupational Injuries recorded 5,283 fatal work injuries in 2023. ^[5] Falls remain the top killer in construction. Transportation incidents dominate trucking and agriculture.

Here's what the data means at the shop level. If you're writing procedures for a warehouse, a shop floor, or any physical job, put manual material handling, walking surfaces, and machine guarding first. Those three areas cover the statistical majority of serious injuries. Good procedures there do more for your workers than a hundred pages of compliance paperwork covering rare risks.

What should a basic workplace safety procedure actually contain?

A good procedure does not need to be long. It needs to be specific enough that a new employee can follow it correctly without supervision. Here's what every procedure should include.

First, a scope statement. One or two sentences on which tasks and which workers the procedure covers. Vague procedures get ignored.

Second, the hazard list. What can actually hurt someone doing this task? List the energy sources, the chemicals, the pinch points, the ergonomic risks. If your hazard list is empty, you probably aren't looking hard enough.

Third, required controls. Personal protective equipment goes here, but PPE is the last line of defense, not the first. List engineering controls (guards, ventilation, interlocks) first, then administrative controls (training, job rotation, permit systems), then PPE. OSHA's hierarchy of controls is more than a philosophy. Many standards, including 29 CFR 1910.134 for respiratory protection, explicitly require you to exhaust engineering and administrative controls before defaulting to respirators. ^[6]

Fourth, the step-by-step procedure. Number the steps. Start each step with a verb. Keep the reading level manageable for your actual workforce. If your workers mostly speak Spanish, a procedure that only exists in English is not a real procedure.

Fifth, emergency response. What does a worker do if something goes wrong mid-task? Who do they call? Where is the nearest eyewash? This section gets skipped constantly, and it's the one that matters most in the thirty seconds after an incident.

Sixth, a revision date and the name of whoever keeps it current. A procedure with no owner becomes a stale document nobody trusts.

How do you write safety procedures for your specific workplace without hiring a consultant?

Most small business owners assume this means hiring a safety consultant at $150 to $300 per hour. That assumption is wrong, or at least outdated.

Start with a job hazard analysis (JHA), which OSHA sometimes calls a job safety analysis (JSA). You walk the job, watch it done, and write down every step, every hazard, and the control you already use or should. OSHA publishes a free Job Hazard Analysis booklet (OSHA publication 3071) that walks the exact process. ^[7] That document alone produces workable procedures for most common tasks.

For the written programs OSHA requires (the ones in the table above), OSHA's website provides free template programs for several, including hazard communication and respiratory protection. They aren't polished, but they're legally grounded. Start there, modify for your operation, and you have a defensible document.

The honest caveat: filling out a generic template without thinking about your actual workplace creates a false sense of security. An OSHA inspector will ask whether your workers know what's in the program. A program that lives only on paper fails that test.

If you want to move faster without giving up specificity, tools like SafetyFolio's safety program generator let you answer questions about your industry and operations and get a customized written program in about 15 minutes, formatted to match OSHA's requirements. That's a reasonable shortcut for a small business with no safety staff.

Either way, once you have the document, run a short training session where workers actually read the procedures that apply to their jobs. Training without documentation is invisible to OSHA. Documentation without training is shelf decoration.

What is the General Duty Clause and how can it be used against you?

The General Duty Clause is Section 5(a)(1) of the OSH Act of 1970. OSHA uses it to cite employers for hazards no specific standard directly addresses. ^[1] It requires proof of four elements: the employer failed to keep the workplace free of a hazard, the hazard was recognized (by the industry or the employer itself), the hazard was causing or was likely to cause serious physical harm, and a feasible means of abatement existed.

In practice, OSHA uses your own documents against you all the time. Sent an email about a slippery floor or a near-miss with a forklift? That email is evidence of a recognized hazard. Your safety meetings, inspection records, and incident reports can all establish recognition.

Several hazard categories get cited under the General Duty Clause regularly, including workplace violence in high-risk industries (healthcare, late-night retail), heat illness, and ergonomic hazards. None have a specific standard in 1910, yet OSHA has successfully cited employers for all of them under 5(a)(1). ^[8]

The takeaway for procedure writing is simple. Your written procedures should cover every recognized hazard in your operation, not only the ones with a matching CFR section number. If you know a hazard exists and you've written nothing about controlling it, you are exposed.

How do you train employees on safety procedures and document it for OSHA?

Training is where most small businesses fall down. The procedure exists. Nobody can prove anyone read it.

OSHA training requirements vary by standard. Some specify the trainer's qualifications, the topics, and how often retraining is required. The lockout tagout standard at 29 CFR 1910.147 requires retraining when inspections reveal deficiencies or when a new procedure is introduced. The bloodborne pathogens standard (1910.1030) requires annual retraining. Respiratory protection (1910.134) requires training before initial use and annually after. ^[6]

For OSHA training in general, the agency's guidelines say effective instruction has to address the hazards specific to the worker's job, the controls in place, and how to report problems. Generic slides that could apply to any industry satisfy almost nothing.

The documentation minimum is a sign-in sheet with the date, topics covered, trainer's name, and each employee's signature. Keep that record for the duration of employment plus three years, which matches OSHA's recordkeeping approach under 29 CFR 1904. Some standards demand longer retention: respiratory protection medical records, for instance, must be kept for the duration of employment plus 30 years. ^[9]

If you have workers with limited English proficiency, OSHA's letters of interpretation consistently hold that training must happen in a language and vocabulary the employee understands. Training conducted only in English for a workforce that doesn't speak English is not effective training under OSHA's view, and inspectors know to ask.

For structured training, the OSHA 30 course gives supervisors and managers a solid foundation across multiple standards, and the material maps directly to the hazard recognition your written procedures need to address.

What happens when OSHA finds missing or inadequate safety procedures?

OSHA citations come in four severity levels: other-than-serious, serious, willful, and repeat. Missing written safety procedures almost always land as serious violations when the underlying hazard could cause death or serious physical harm, which is the legal threshold for that classification.

As of 2024, the maximum penalty for a serious violation is $16,550 per violation. A willful or repeat violation can reach $165,514 per violation. ^[10] These are per-violation numbers. An inspection that turns up five missing or deficient written programs could produce five separate citations.

In practice, OSHA often reduces penalties through informal settlement conferences, and small employers with fewer than 25 employees may get additional reductions. But negotiating down from a citation eats time and creates stress small business owners don't have. Writing the procedures upfront always costs less.

OSHA also runs a free consultation program, separate from enforcement, where state-funded consultants visit your workplace, identify hazards, and help you build compliant programs. The visit is confidential, and findings are not shared with enforcement. ^[11] Small businesses badly underuse this. If you haven't built your safety program yet, a consultation visit is a low-risk way to understand your exposure before an inspector shows up.

If you receive a citation, the incident report process and your 300 log records can become part of OSHA's evidence about whether you knew about a hazard and failed to address it. Keep those records accurate and current.

How do safety procedures differ by industry?

The structure of a safety procedure stays the same across industries. The content changes completely.

Manufacturing shops need machine-specific lockout/tagout procedures for every piece of equipment. That is not one document. OSHA requires a separate written procedure for each machine unless you can affirmatively establish that a generic procedure gives full protection, which is a narrow exception. ^[2] A shop with 40 machines needs 40 procedures.

Restaurants and food service carry hazards people underestimate. Hot oil, slippery floors, sharp blades, and back-of-house chemical storage all need documented procedures. OSHA's hospitality industry page lists the specific standards that apply.

Health care employers carry a unique burden. Bloodborne pathogens, patient handling ergonomics, and workplace violence are all areas where OSHA has issued explicit guidance or standards. The bloodborne pathogens exposure control plan is required for any employee with occupational exposure, including dental offices, tattoo shops, and first-aid responders, not only hospitals. ^[9]

Warehousing and logistics operations need written procedures for powered industrial truck operation. The forklift standard at 29 CFR 1910.178 requires operator evaluation every three years and written records of that evaluation. forklift certification is a separate requirement from general training. Operators who aren't evaluated and certified in writing put you in citable territory.

Construction falls under 29 CFR 1926, which carries its own written program requirements. If you run a mixed operation (a company that both manufactures and installs), you may be subject to both 1910 and 1926 standards depending on the work being done.

The honest truth: no single set of safety procedures fits every workplace. Anyone selling you a generic procedure packet and telling you you're covered is oversimplifying.

How often should safety procedures be reviewed and updated?

No single OSHA rule says review your procedures every X months. But several standards build in review triggers, and the General Duty Clause creates an implicit obligation to keep procedures current as conditions change.

Here's the practical answer most safety professionals use. Review every procedure annually, and any time one of these happens. A worker is injured doing the task the procedure covers. You get new equipment or change how a task is done. A near-miss reveals a gap. OSHA issues new guidance or amends the relevant standard. A new chemical enters the workplace.

The lockout/tagout standard specifically requires an annual periodic inspection of the energy control procedure, plus a certification documenting the equipment reviewed, the date, and the employees involved. ^[2] That's a model worth applying to all your critical procedures, not only LOTO.

Procedure review is also your chance to close the loop with workers. The people doing the job know whether a procedure reflects what actually happens. If your procedure says one thing and workers do another, you have two problems: a procedure nobody follows and a procedure that may not be accurate. Both are safety problems. Both are compliance problems.

Date-stamp every revision. Keep the old version. If OSHA investigates an incident and asks whether your procedure was current at the time, you want a clear trail showing when it was last reviewed and what changed.

What is a safety management system and do small businesses need one?

A safety management system (SMS) is a structured approach that ties safety planning, procedure development, training, incident analysis, and continuous improvement into one operating framework. OSHA calls its version Injury and Illness Prevention Programs (I2P2) and has pushed voluntary adoption for years. ^[8] Several OSHA-approved state plans (California, Washington, and Minnesota, among others) actually require employers to have one.

Do small businesses need a full SMS? Honestly, probably not in the formal sense. A ten-person machine shop does not need an ISO 45001-certified management system. What it needs is the functional equivalent: written procedures for the hazards that actually exist, training records that prove workers received those procedures, an inspection or walkthrough process that catches new hazards, and a way for workers to report problems without fear.

That four-part framework is the skeleton of any safety management system. You can build it without consultants, without software subscriptions, without jargon. OSHA's Safety and Health Program Management Guidelines, published in the Federal Register in 1989 and still current agency guidance, outline the same elements. ^[8]

If you're in a state with an OSHA-approved state plan, check its requirements. California's Injury and Illness Prevention Program (IIPP) requirement under Title 8 CCR Section 3203, for example, applies to almost every California employer regardless of size. Check your state's plan requirements at the OSHA state plan page.

If building this from scratch feels like too much, SafetyFolio's program generator is designed for exactly this situation. It asks the right questions about your operation and produces the written documents that form the foundation of a working safety program.

How do you get workers to actually follow safety procedures?

This is the part no compliance guide talks about honestly. You can have perfect written procedures and workers who ignore them. That gap is a management problem, not a document problem.

The research here is fairly consistent. Workers deviate from procedures when they believe the procedure slows them down without cutting real risk, when they've never seen anyone corrected for skipping it, or when they weren't involved in writing it and don't trust that it reflects reality.

The involvement piece is undersold. OSHA's guidance on safety and health program management notes that worker participation in hazard identification and procedure development produces better outcomes. ^[8] Workers who helped write a procedure know it's accurate. They have a reason to follow it.

Enforcement matters too, but discipline-only enforcement produces workers who hide deviations instead of reporting them. Near-misses go invisible. Near-miss data is some of the most useful safety information you have. A near-miss report is not an admission of failure. It's an early warning.

The single most effective thing a small business owner can do is be visibly present on the floor and visibly follow the procedures themselves. Workers notice when management skips PPE or bypasses a lockout. They notice when management stops to do it right even when it's inconvenient. Leadership behavior predicts workforce behavior more reliably than any posting requirement.

Frequently asked questions

What are the most common OSHA violations related to safety procedures?

The top-cited OSHA violations consistently include fall protection (1926.501 in construction), hazard communication (1910.1200), respiratory protection (1910.134), lockout/tagout (1910.147), and powered industrial trucks (1910.178). Each of these standards requires written procedures or programs as a core element. Missing or inadequate written documentation is the citation most inspectors write first.

Does OSHA require a written safety program for every business?

OSHA has no single universal written safety program that applies to everyone. It has specific written program requirements tied to specific standards, like hazard communication, lockout/tagout, and respiratory protection. If any of those hazards exist at your workplace, those written programs are mandatory. Some OSHA-approved state plans (California, Washington) go further and require a general Injury and Illness Prevention Program for nearly all employers.

How long do you have to keep safety training records?

It depends on the standard. OSHA's general recordkeeping rule (29 CFR 1904) covers injury and illness logs, not training records specifically. Standard-specific rules vary: respiratory protection medical records must be kept for the duration of employment plus 30 years (29 CFR 1910.1020). For most training records, a practical minimum is three years from the date of training. Keep records for current employees until they leave, then three years beyond that.

What is a job hazard analysis and is it required by OSHA?

A job hazard analysis (JHA) is a structured process for identifying hazards in each step of a job task. OSHA recommends JHAs as a best practice and references them in multiple standards, but no single standard universally mandates a JHA for all jobs. Several standards do implicitly require the analysis a JHA produces, such as the PPE hazard assessment under 29 CFR 1910.132(d). OSHA's free publication 3071 explains the process.

Can a small business with fewer than 10 employees skip written safety procedures?

No. The exemption for employers with fewer than 10 employees is narrow. It applies to OSHA's injury and illness recordkeeping requirements under 29 CFR 1904, not to written safety programs. If your workplace has hazardous chemicals, equipment with stored energy, or workers who need respirators, the corresponding written program requirements apply regardless of headcount.

What is the difference between a safety procedure and a safety policy?

A safety policy is a high-level statement of commitment and expectations (for example, 'This company is committed to providing a safe workplace'). A safety procedure is a specific, step-by-step instruction for a specific task or hazard. Both have a place in a safety program. OSHA's enforceable requirements almost always refer to written programs and procedures, not policies. A policy without supporting procedures does not satisfy most OSHA standards.

How do I write a safety procedure for a task I have never documented before?

Start by watching the task done from start to finish. Break it into steps, then ask for each step: what could go wrong here and hurt someone? That is the hazard analysis. Then document the controls you already use and the controls you should add. Use OSHA's Job Hazard Analysis publication (OSHA 3071) as a worksheet. Have the worker who does the job review your draft for accuracy before you finalize it.

Do safety procedures need to be in a language other than English?

OSHA's enforcement position, documented in multiple letters of interpretation, is that training and related procedures must be communicated in a language workers can understand. If your workforce is primarily Spanish-speaking, procedures and training materials must be available in Spanish. The obligation is effective communication, not translation for its own sake. A procedure workers cannot read does not satisfy the underlying standard's requirements.

What is OSHA's free consultation program and should I use it?

OSHA funds a free, confidential on-site consultation service run by state agencies, separate from enforcement. Consultants visit your workplace, identify hazards, and help you develop safety programs. Findings from a consultation visit are not shared with OSHA enforcement. Small businesses get priority. If you've never had your workplace assessed and don't know where to start, this is one of the most underused free resources available.

What is the OSHA penalty for not having required written safety programs?

A missing required written safety program is typically cited as a serious violation when the underlying hazard could cause serious physical harm. As of 2024, the maximum penalty for a serious violation is $16,550. Willful or repeat violations can reach $165,514 per violation. OSHA can issue separate citations for each missing program, so an unprotected workplace with multiple deficiencies can rack up citations fast.

How do safety procedures interact with workers' compensation claims?

Written safety procedures create a documented standard of care. If a worker is injured doing a task covered by a procedure, a well-written procedure shows the employer took hazards seriously. The absence of any procedure for that task can be used in workers' compensation proceedings and civil litigation to argue negligence. Documented training records showing the injured worker received the procedure carry equal weight.

Are there safety procedures specific to office environments?

Yes, though they're less regulated than industrial settings. Offices need procedures covering emergency evacuation (required in writing for employers with 10-plus employees under 29 CFR 1910.38), electrical safety (no personal space heaters on extension cords, outlet capacity), ergonomic workstation setup, and hazardous materials if chemicals are present (cleaning supplies, toner cartridges with safety data sheets). The General Duty Clause applies to offices.

What is the difference between 29 CFR 1910 and 29 CFR 1926?

29 CFR 1910 covers OSHA's general industry standards, which apply to manufacturing, warehousing, healthcare, retail, and most non-construction workplaces. 29 CFR 1926 covers construction. If your business does both, you may need to comply with both sets depending on the work being done. Some 1910 standards are referenced in 1926 for topics like hazard communication, so those requirements effectively apply to construction workers too.

Sources

1. U.S. Department of Labor, OSH Act of 1970, Section 5: General Duty Clause requires every employer to furnish a workplace free from recognized hazards likely to cause death or serious physical harm
2. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Requires written energy control program and machine-specific procedures; annual periodic inspection and certification required
3. OSHA, 29 CFR 1910.1200 Hazard Communication: Requires a written hazard communication program for any employer whose workers may be exposed to hazardous chemicals
4. OSHA, 29 CFR 1910.38 Emergency Action Plans: Emergency action plan may be communicated orally for employers with 10 or fewer employees; must be in writing for employers with more than 10 employees
5. U.S. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: Approximately 2.6 million nonfatal workplace injuries and illnesses recorded in private industry in 2023; 5,283 fatal work injuries in 2023 per Census of Fatal Occupational Injuries
6. OSHA, 29 CFR 1910.134 Respiratory Protection: Requires employers to exhaust engineering and administrative controls before relying on respirators; requires written respiratory protection program and annual training
7. OSHA, Job Hazard Analysis publication OSHA 3071: OSHA's free Job Hazard Analysis booklet provides a step-by-step worksheet for identifying hazards and controls for each task
8. OSHA, Safety and Health Program Management Guidelines (Federal Register 1989): OSHA's voluntary Injury and Illness Prevention Program guidelines recommend worker participation in hazard identification and procedure development; General Duty Clause applied to recognized hazards without specific standards including workplace violence and heat
9. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens: Requires written exposure control plan for any employee with occupational exposure to blood; annual retraining required
10. OSHA, Penalties page: Maximum penalty for a serious violation is $16,550 per violation as of 2024; willful or repeat violations maximum $165,514 per violation
11. OSHA, On-site Consultation Program: OSHA funds free, confidential on-site consultation visits for small businesses; findings are not shared with OSHA enforcement