Workplace safety PDF: what to include, where to get them, and what OSHA actually requires

Last updated 2026-07-09

What is a workplace safety PDF and do you actually need one?

A workplace safety PDF is a written document, or a set of them, that describes how your business finds hazards, trains workers, and handles emergencies. The format does not matter to OSHA. PDF, binder, shared drive, all fine. What matters is that certain programs exist in writing and that workers can get to them.

OSHA does not mandate one master document. Specific standards each carry their own written program requirement. Hazard communication under 29 CFR 1910.1200 requires a written hazard communication program. Lockout/tagout under 29 CFR 1910.147 requires written procedures for each piece of energy-isolating equipment. Respiratory protection under 29 CFR 1910.134 requires a written program covering fit testing, medical evaluation, and maintenance.

So when people search for a 'workplace safety PDF,' they usually mean one of two things. Either a template to start their written programs, or a single document that satisfies OSHA. The first is genuinely useful. The second does not exist, because no single file can cover every standard that applies to your specific work.

Still, pulling your required written programs into one organized PDF or binder is smart. Inspectors ask for documents. Workers need to find procedures. One organized file beats 11 separate ones living in different folders that nobody can locate under pressure.

Which OSHA standards specifically require a written program?

This is the question most small business owners actually need answered. Not every OSHA standard demands a written program, but more than a dozen do, and the standards inspectors cite most often almost all carry a writing requirement.

Here are the common written program requirements across general industry (29 CFR 1910):

Standard	CFR Citation	Written Program Required?
Hazard Communication	29 CFR 1910.1200(e)	Yes
Lockout/Tagout	29 CFR 1910.147(c)(1)	Yes (plus machine-specific procedures)
Respiratory Protection	29 CFR 1910.134(c)	Yes
Emergency Action Plan	29 CFR 1910.38(b)	Yes (if 10+ employees)
Fire Prevention Plan	29 CFR 1910.39(b)	Yes (if 10+ employees)
Bloodborne Pathogens	29 CFR 1910.1030(c)(1)	Yes (Exposure Control Plan)
Personal Protective Equipment	29 CFR 1910.132(d)	Hazard assessment must be certified in writing
Hearing Conservation	29 CFR 1910.95(c)	Written program required if workers exposed ≥85 dB TWA
Confined Space Entry	29 CFR 1910.146(c)(4)	Written permit-required program
Electrical Safety	29 CFR 1910.333	Written procedures for energized work
Chemical Hygiene (labs)	29 CFR 1910.1450(e)	Chemical Hygiene Plan
Process Safety Management	29 CFR 1910.119(e)	Written process safety information and more

Construction employers work under 29 CFR 1926, which has its own parallel requirements for fall protection (29 CFR 1926.502), scaffolding, and excavation safety.

If you want the broader framework before building documents, our overview of osha covers how standards are organized and enforced. For the lockout tagout standard, the machine-specific written procedure is the piece most shops miss. And hazard communication carries its own written program requirement covering SDS management and container labeling.

One exemption is worth flagging. OSHA's 1910.38(b) lets employers with fewer than 10 employees communicate the emergency action plan orally instead of in writing. You still need the plan. You just do not have to type it up. ^[1]

What does a complete workplace safety PDF need to include?

Think of a complete written safety program as four layers. Most templates skip the last two, which is exactly why businesses still get cited even when they have a document sitting in a drawer.

Layer 1: Policy statement. Who is responsible for safety, what the employer commits to, and what workers' rights and responsibilities are. Everyone reads this page. Nobody gets hurt or saved by it alone.

Layer 2: Hazard identification. A list of the actual hazards in your workplace, not generic ones. A car repair shop has different chemical exposures than a restaurant. A program that says 'we identify all hazards' without naming them is close to worthless in an inspection.

Layer 3: Standard-specific procedures. This is the content that satisfies each CFR requirement. For hazard communication, that means documenting your SDS management system, labeling practices, and training records. For lockout/tagout, a written energy control procedure for each machine that carries unexpected energization risk. For respiratory protection, who needs a respirator, what type, how fit testing works, and how medical clearance happens. ^[2]

Layer 4: Records and training documentation. Written programs are not static. They have to show training happened, incidents got recorded, and the program was reviewed. OSHA's 29 CFR 1910.1020 requires employers to keep some medical and exposure records for up to 30 years. Training records under specific standards carry their own retention periods.

A tip that pays off during inspections: add a 'program review' page at the back with space to log annual reviews. When an inspector asks when this was last updated, you point to a signed date instead of shrugging.

Where can you find free workplace safety PDF templates?

Several legitimate sources publish free, usable templates. Quality varies a lot, so know what you are grabbing.

OSHA.gov Small Business resources. OSHA publishes guidance documents, e-tools, and model programs for specific standards. The OSHA Small Business page (osha.gov/smallbusiness) links to Injury and Illness Prevention Program guidance and standard-specific resources. Authoritative, but intentionally generic. ^[3]

The 29 CFR 1910 standards themselves. Each standard's text sits on OSHA.gov and the eCFR. Reading the actual standard tells you exactly what your written program has to contain, which beats most templates.

State plan agencies. If you operate in a State Plan state (California's Cal/OSHA, Washington's L&I, Michigan's MIOSHA, and others), your state agency often publishes templates tailored to state rules, which can run stricter than federal OSHA. ^[4] Cal/OSHA, for one, requires an Injury and Illness Prevention Program (IIPP) under California Labor Code Section 6401.7, and there is no direct federal equivalent.

NIOSH and CDC. The National Institute for Occupational Safety and Health publishes health and safety guides for specific industries and hazards at cdc.gov/niosh. Research-backed and free, though they are guidance rather than compliance templates. ^[5]

Industry associations. The National Safety Council, Associated Builders and Contractors, and trade groups in construction, food service, and manufacturing often publish industry-specific templates for members.

Here is the honest caveat. A template from any of these sources is a starting point, never a finished product. OSHA's letters of interpretation have repeatedly clarified that a model program must be adapted to the employer's specific workplace before it satisfies the standard. A lockout/tagout template with blank lines where machine-specific procedures belong is not a compliant program until you fill those blanks with real information about your equipment. ^[6]

What OSHA violations are most common, and could your PDF prevent them?

OSHA publishes its Top 10 Most Cited Standards every year from federal inspection data. For fiscal year 2023, here is the list.

Rank	Standard	Violations
1	Fall Protection (29 CFR 1926.501)	7,271
2	Hazard Communication (29 CFR 1910.1200)	3,213
3	Ladders (29 CFR 1926.1053)	2,978
4	Respiratory Protection (29 CFR 1910.134)	2,859
5	Scaffolding (29 CFR 1926.451)	2,859
6	Lockout/Tagout (29 CFR 1910.147)	2,732
7	Powered Industrial Trucks (29 CFR 1910.178)	2,294
8	Fall Protection Training (29 CFR 1926.503)	2,203
9	PPE Eye/Face (29 CFR 1926.102)	2,074
10	Machine Guarding (29 CFR 1910.212)	1,972

Source: OSHA, FY2023 Top 10 Cited Standards ^[7]

Look at that list. Ranks 2, 4, 6, and 8 are violations a written program directly prevents or at least softens. Hazard communication requires a written program by rule. So does respiratory protection. Lockout/tagout requires machine-specific written procedures. Fall protection training has to be documented in writing.

Ranks 1, 3, 5, 7, and 9 are mostly about physical conditions and equipment, not paper. A PDF does not stop a worker from falling off a roof. It does establish the training, inspection, and supervision procedures that lower the odds of that fall, and it documents that you met OSHA's training and planning duties.

OSHA's maximum penalty for a serious violation is $16,131 per violation as of 2024. Willful or repeated violations reach $161,323. ^[8] A current, worker-signed written program is evidence that a violation was not willful, and that can move penalty calculations in your favor.

For the osha training requirements that pair with your written programs, check that your training records match what the written program promises. Mismatches get noticed.

How do you write a safety program for a small business without a consultant?

You do not need a consultant to write a compliant safety program. You need the right standards, a clear process, and honest answers about your own workplace.

Start with a hazard survey. Walk the floor and list every task, chemical, machine, and physical condition that could hurt someone. People call this a Job Hazard Analysis (JHA) or Job Safety Analysis (JSA). OSHA's free JHA publication, OSHA 3071, walks through how to run one.

Next, match hazards to standards. For each hazard you found, look up whether a specific OSHA standard applies and whether it wants a written program. Use the table earlier in this article as your starting checklist.

Then write the procedures. For each required program, draft the minimum content the standard specifies. Do not over-engineer. A 40-page respiratory protection program for a shop where two people occasionally sand metal is overkill. Match the depth of the paperwork to the actual risk.

Assign real names. Every written program should name the person responsible for running it and reviewing it. 'The safety officer' is not a name. If you run a 6-person shop and the owner owns it, write that down.

Get worker input. OSHA's 1910.119(c) process safety standard requires worker participation, and even where the law does not demand it, the people doing the job know the hazards better than you do from a desk.

Review it every year. Most written program standards require or strongly imply annual review. Set a calendar reminder. Update the document whenever processes, chemicals, or equipment change, even mid-year.

To skip the blank-page problem, SafetyFolio's safety program generator builds a customized written program in about 15 minutes by asking you questions about your workplace hazards, industry, and headcount. You still review the output and add machine-specific details, but it gets you most of the way there.

For supervisors who need formal credentials, see what osha 30 training covers and whether yours need it.

Do your workers need to sign the safety program?

No single OSHA standard universally requires worker signatures on the safety program document itself. Several standards do require you to document that training happened and that workers understood it, which is where signatures earn their keep.

29 CFR 1910.1030 (bloodborne pathogens) requires training records showing the dates of training, the subjects covered, and the names and job titles of workers who attended. ^[2] 29 CFR 1910.134 (respiratory protection) requires records of fit testing results tied to specific workers.

In practice, a signed acknowledgment page is good evidence. If OSHA cites you for a training violation and you hold signed training records, you can contest the citation with documentation. If you have nothing, you contest with nothing.

The acknowledgment page should state what training was provided, on what date, and that the worker received and understood it. Keep these records. OSHA generally has six months from a violation to issue a citation, and the injury or complaint that triggers an inspection often happened well before the inspector shows up.

For workers who have finished formal OSHA training, your incident report procedures should be part of what they sign off on, since proper reporting is a required piece of most written programs.

What is the difference between a safety manual, a safety plan, and a written program?

These terms get swapped around, and it causes real confusion. Here is how to keep them straight.

A 'written program' is OSHA's term. It means the specific document a specific standard requires. Your lockout/tagout written program satisfies 29 CFR 1910.147(c)(1). Your hazard communication written program satisfies 29 CFR 1910.1200(e). Distinct documents, specific required content.

A 'safety manual' is a business's informal name for a collection of those written programs, plus company policies, contact lists, and general rules. A 50-page safety manual probably holds several OSHA-required written programs inside it alongside non-required content. That is fine, as long as the required content is actually in there.

A 'safety plan' can mean almost anything. Construction crews often call their site-specific document a 'safety plan,' a project-level file that may reference corporate written programs but applies to one job site. OSHA does not use this term in most standards.

The practical distinction matters during an inspection. If OSHA asks for your 'written hazard communication program,' point to the section of your manual that hits the requirements of 1910.1200(e), not the whole binder. Inspectors know what the standard requires. A 200-page manual does not impress anyone if the 4 pages that count are vague.

What does OSHA's General Duty Clause mean for your written programs?

Section 5(a)(1) of the OSH Act is the General Duty Clause. It says employers must provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." ^[9]

OSHA uses this clause to cite hazards that no specific standard covers. Ergonomic injuries, heat illness, workplace violence in certain industries, and novel chemical exposures have all drawn General Duty citations when no specific CFR standard applied.

For written programs, this cuts two ways. First, if OSHA inspects and finds a recognized hazard with no written procedure addressing it, a General Duty citation is possible even where no specific standard requires a written program. Second, a written program for a General Duty hazard is strong evidence that you recognized and addressed it, which supports a defense.

Heat illness is the live example. Federal OSHA has no specific heat illness standard for general industry yet (a proposed rule was published in 2024), but OSHA has cited employers for heat hazards under the General Duty Clause for years. Several state plans, including California, Washington, and Minnesota, already have specific heat illness standards with written program requirements. ^[4]

So your written safety PDF should cover every recognized hazard in your workplace, not only the ones with a specific CFR standard demanding paperwork.

How do state plan states change what your safety PDF needs to cover?

Twenty-two states and territories run OSHA-approved State Plans covering private sector employers. These plans have to be at least as effective as federal OSHA, and they can go further. Many do.

California requires every employer with one or more employees to keep a written Injury and Illness Prevention Program (IIPP) under California Labor Code Section 6401.7 and 8 CCR 3203. ^[4] Federal OSHA has no equivalent. If you operate in California and your safety PDF has no IIPP, you are out of compliance no matter how complete your federal written programs are.

Washington's L&I requires an Accident Prevention Program. Michigan's MIOSHA has its own General Industry Safety and Health standards that often mirror federal OSHA but carry state-specific twists.

If you are in a State Plan state, download and read your state's requirements before you build anything. Do not assume federal OSHA templates are enough. The state plan agency's website is your primary source. OSHA lists every State Plan state at osha.gov/stateplans. ^[10]

If you are in a federal OSHA jurisdiction state, the federal CFR standards are your baseline. No extra state-level written program is required, though some states carry right-to-know laws or chemical reporting rules separate from OSHA.

How often do you need to update your workplace safety PDF?

Some standards set a review frequency. Some do not. Here is the honest picture.

29 CFR 1910.147(c)(8) requires reviewing energy control procedures "at least annually." ^[2] 29 CFR 1910.134(l) requires evaluating the respiratory protection program at least annually. Bloodborne pathogen exposure control plans have to be reviewed and updated at least annually and whenever tasks change. ^[2]

For standards that name no frequency, annual review is the common practice and what most inspectors expect to see. If your document shows a 'last reviewed' date from five years back, expect questions.

Update the program whenever any of these happen: you add a new chemical, process, or machine; you hire workers with different tasks; you have an incident or near-miss; you change your facility layout; or a standard gets amended.

The single most common problem in written programs is neglect. Somebody wrote a decent document three years ago and it has not been touched since. The chemicals changed, a new machine came in, and the program still describes the old process. That is a compliance gap and a safety gap at the same time.

Set a calendar reminder for the same month every year. Review the program against current conditions. Sign and date the review page. It takes about an hour if the program is reasonably current, and it is one of the highest-value hours you will spend on compliance.

What does injury data tell us about the cost of skipping written programs?

The Bureau of Labor Statistics reported 2.8 million nonfatal workplace injuries and illnesses in private industry in 2022, a rate of 2.7 per 100 full-time equivalent workers. ^[11] The industries with the highest rates, private hospitals, nursing care facilities, and warehousing, are also where OSHA finds missing written programs most often during inspections.

Nobody has clean data linking 'missing written program' straight to injury rates, because companies missing programs tend to have other gaps too. The causal arrow runs both ways. But OSHA's analysis of its compliance assistance programs found that workplaces implementing formal Injury and Illness Prevention Programs saw injury rates drop 9 to 60 percent, depending on industry and program maturity. ^[3] That is a wide range, and OSHA acknowledges the data quality limits, but even the low end matters.

The direct cost side is clearer. Liberty Mutual's 2023 Workplace Safety Index estimated that the most disabling workplace injuries cost U.S. employers more than $58.6 billion a year in direct costs alone. The top causes, overexertion, falls, and being struck by an object, are the exact hazard categories written programs address through training and procedural controls. ^[12]

A penalty for a missing written program (usually a serious citation under the relevant CFR section) tops out at $16,131 per violation as of 2024. ^[8] One injury that runs through workers' compensation, lost productivity, and possible litigation almost always costs more. The written program is cheap insurance.

Frequently asked questions

Is there a single OSHA-approved workplace safety PDF I can download and use?

No. OSHA does not issue one approved template that satisfies all requirements. The agency publishes model programs for specific standards (hazard communication, respiratory protection, and others) on OSHA.gov, but each has to be customized to your actual workplace. A generic template with blank lines unfilled does not meet the standard's requirements, per OSHA's letters of interpretation.

What is the minimum a workplace safety PDF needs to include for a small business?

At minimum, include a hazard communication written program (29 CFR 1910.1200), an emergency action plan (29 CFR 1910.38), and written programs for any specific hazards present, such as lockout/tagout (29 CFR 1910.147) or respiratory protection (29 CFR 1910.134). The exact list depends on your industry and hazards. Start with a walk-through hazard survey and match what you find to the relevant standards.

Does a business with fewer than 10 employees need a written safety program?

Some written program requirements apply regardless of size. Hazard communication, lockout/tagout, and bloodborne pathogen exposure control plans have no size exemption. The emergency action plan can be communicated orally instead of in writing for employers with fewer than 10 employees under 29 CFR 1910.38(b), but the plan still must exist. Check each applicable standard individually.

Can I use a free safety program template from the internet?

Yes, as a starting point. Free templates from OSHA.gov, NIOSH, and state plan agencies are legitimate and legally grounded. The problem is that templates are generic and your workplace is specific. You have to fill in real information about your chemicals, equipment, and procedures. A template with blanks is not a compliant program. Treat any free template as a checklist, not a finished document.

What is a health and safety in the workplace PDF for employees?

This usually refers to an employee-facing version of your safety manual or written programs, formatted for readability rather than compliance documentation. It covers hazards, emergency procedures, how to report incidents, and workers' rights under OSHA. It can accompany the formal written program but does not replace it. Keep the compliance documentation complete even if the employee handout is simplified.

How long do I need to keep written safety program records?

It depends on the record type. Training records for most programs: at least three years is standard practice. Medical records and exposure records under 29 CFR 1910.1020 must be kept for 30 years (or the duration of employment plus 30 years for medical records). OSHA 300 logs must be kept for five years. Check the record-retention section of each applicable standard for specifics.

Does my written safety program need to be in languages other than English?

OSHA does not specify a language requirement in most standards, but it requires that employees understand their training and programs. If your workforce includes workers who are not fluent in English, materials only in English may not satisfy the requirement that employees be informed. OSHA.gov has hazard communication and other resources in Spanish and other languages. Practical compliance means workers actually understand the content.

What happens during an OSHA inspection if I do not have written programs?

The inspector cites you under the specific standard requiring a written program. Each missing program is typically a separate serious citation, currently up to $16,131 per violation. If multiple programs are missing, penalties stack. Inspectors usually ask for written programs within the first 15 minutes of an inspection. Having them organized and current is the fastest way to lower inspection risk.

Do I need separate written programs for each OSHA standard, or can I combine them?

You can combine them into one document or binder. Many businesses keep a single safety manual containing their hazard communication program, lockout/tagout program, PPE assessment, and other required documents as labeled sections. OSHA cares about content, not file structure. Just make sure each section holds the required elements for its specific standard.

How do I know if my state requires additional written safety programs beyond federal OSHA?

Check whether your state has an OSHA-approved State Plan at osha.gov/stateplans. If it does, visit your state plan agency's website directly. California (Cal/OSHA), Washington (L&I), Michigan (MIOSHA), and others publish their specific requirements. California's IIPP requirement applies to all employers regardless of size and has no federal equivalent. Assume your state plan may require more than federal OSHA until you verify otherwise.

What is a Job Hazard Analysis and does it count as a written safety program?

A Job Hazard Analysis (JHA) documents the hazards in a specific task and the controls that reduce each one. It is not itself a written program under any specific OSHA standard, but it feeds your written programs and satisfies documentation requirements for hazard assessment under 29 CFR 1910.132(d)(2). OSHA's free OSHA 3071 publication explains how to conduct one.

Can I store my written safety programs digitally instead of printing them?

Yes. OSHA does not require paper copies. Digital storage is acceptable as long as workers can reach the programs when needed. If your workers lack reliable computer access during shifts, a printed copy at a common location (break room, supervisor's desk) is practical. The point is that workers can actually get to the documents, not that they exist in a specific format.

Sources

1. OSHA, 29 CFR 1910.38 Emergency Action Plans: Emergency action plans may be communicated orally for employers with fewer than 10 employees under 1910.38(b)
2. OSHA, 29 CFR 1910 General Industry Standards (1910.134, 1910.147, 1910.1030): Written program requirements for respiratory protection, lockout/tagout, and bloodborne pathogens including annual review and record-retention requirements
3. OSHA, Small Business and Safety and Health Program resources: OSHA reports workplaces implementing formal Injury and Illness Prevention Programs see injury rates drop 9 to 60 percent depending on industry and program maturity
4. OSHA, State Plans listing page: State Plan states such as California, Washington, and Michigan set standards that can be stricter than federal OSHA, including California's IIPP requirement
5. CDC / NIOSH, Workplace Safety and Health resources: NIOSH publishes industry-specific health and safety guidance documents at cdc.gov/niosh
6. OSHA Letters of Interpretation, Lockout/Tagout written procedures: OSHA letters of interpretation clarify that model programs must be adapted to the employer's specific workplace; a template with blank machine-specific procedures is not compliant
7. OSHA, Top 10 Most Cited Standards FY2023: OSHA FY2023 Top 10 cited standards including violation counts for hazard communication (3,213), respiratory protection (2,859), and lockout/tagout (2,732)
8. OSHA, Penalties page (2024 civil penalty adjustments): OSHA maximum penalty for a serious violation is $16,131 per violation as of 2024; willful or repeated violations can reach $161,323
9. OSHA, OSH Act of 1970, Section 5 Duties (General Duty Clause): Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards causing or likely to cause death or serious physical harm
10. OSHA, State Plans listing page: OSHA lists 22 states and territories with approved State Plans that can set standards stricter than federal OSHA
11. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program: BLS reported 2.8 million nonfatal workplace injuries and illnesses in private industry in 2022, a rate of 2.7 per 100 full-time equivalent workers
12. Liberty Mutual, 2023 Workplace Safety Index: Liberty Mutual's 2023 Workplace Safety Index estimated the most disabling workplace injuries cost U.S. employers more than $58.6 billion per year in direct costs