How to write a PPE hazard assessment for your shop

Last updated 2026-07-10

What is a PPE hazard assessment and does OSHA actually require one?

Yes, OSHA requires it. The standard is 29 CFR 1910.132(d), and it applies to general industry employers of every size. The rule says you must assess the workplace to determine if hazards are present, or are likely to be present, that make PPE necessary ^[1]. If you find those hazards, you must select appropriate PPE, communicate your selection to employees, and produce a written certification.

The certification is the document most people call the "PPE assessment." It has to identify the workplace evaluated, the person doing the certifying, the date, and a statement confirming the assessment was completed. That's the minimum. A practical assessment goes further, because you want enough detail to defend your choices to an OSHA inspector and to actually protect your workers.

Small shops get cited for skipping this more than almost any other paperwork violation. OSHA's PPE standards (1910.132 through 1910.138) generate thousands of citations every year across general industry ^[2]. The written certification is a separate line item, so you can get cited for having PPE in use without a completed assessment even when your workers are wearing exactly the right gear.

Here's the part that trips people up. The assessment is not a one-time form you file and forget. OSHA expects you to update it when you add new equipment, change processes, bring in new chemicals, or after a PPE-related injury. Build that into your routine.

What hazard categories should I evaluate in my shop?

OSHA's PPE standard groups hazards into four main categories: impact, penetration, compression, and chemical. The agency's compliance guidance also adds heat, harmful dust, light radiation (from welding, cutting, or UV sources), and biohazards ^[3]. Your assessment has to walk through each category for every work area and task, more than the obvious ones.

For a typical fabrication or machine shop, these are the categories that usually turn up something:

Hazard Category	Common Shop Examples	PPE Commonly Selected
Impact / flying particles	Grinding, cutting, chipping, nailing	Safety glasses, face shields
Chemical splash or absorption	Coolants, solvents, degreasers, acids	Chemical splash goggles, gloves, aprons
Electrical	Panel work, live circuits, arc flash	Insulated gloves, arc-rated clothing
Heat / burn	Welding, torch cutting, hot parts	Welding helmet, leather gloves, flame-resistant sleeves
Noise	Air tools, grinders, saws	Hearing protection (muffs or plugs)
Foot hazards	Heavy material handling, rolling equipment	Steel- or composite-toe boots
Hand / laceration	Sheet metal, blades, glass	Cut-resistant gloves (rated by ANSI cut level)
Respiratory	Metal dust, fumes, aerosols	Respirators (which trigger a separate program under 1910.134)
Head	Overhead crane work, low clearances	Hard hats
Fall	Mezzanines, rooftop HVAC access	Fall protection (separate standard, 1910.28)

Respiratory hazards deserve a flag of their own. If your assessment identifies one, you're now required to run a full respiratory protection program under 29 CFR 1910.134, including fit testing. That's a bigger lift than the PPE assessment itself. Here's how those pieces connect to your overall hazard communication program.

Noise gets missed all the time. If your shop has equipment that forces employees to raise their voices to be heard at arm's length, you're probably above 85 dBA and heading toward an OSHA hearing conservation requirement under 1910.95.

What are the five steps to complete a PPE hazard assessment?

Here's the process OSHA lays out in its compliance directive for 1910.132, and the one most safety professionals follow in practice ^[3].

Step 1: Walk through each work area and task. Do this physically. Don't write the assessment from memory at a desk. Walk every area where employees work, watch what they actually do (not what the job description says they do), and note every energy source, chemical, tool, and surface they touch. Bring a notepad or use your phone.

Step 2: For each hazard found, identify the body part at risk. Eyes, hands, feet, head, respiratory system, hearing, skin. This mapping step is where most DIY assessments go thin. If a grinder throws sparks and flying debris, the at-risk body parts are eyes, face, and any exposed skin within arc range. Write them all down.

Step 3: Select PPE that controls each hazard for each at-risk body part. The PPE has to match the hazard. For chemical splash to the eyes, that means chemical splash goggles, not safety glasses with side shields. OSHA letters of interpretation are explicit about this distinction ^[4]. Reference ANSI/ISEA standards when you can: ANSI Z87.1 for eye and face protection, ANSI/ISEA 105 for hand protection cut levels, ANSI Z89.1 for head protection.

Step 4: Write up the certification document. The 1910.132(d)(2) certification must include the name of the workplace assessed, the name of the person certifying (you or your safety person), the date of the assessment, and a statement that it was performed. Attach your hazard-by-hazard findings. One page is fine for a small shop. Ten pages is fine for a bigger one.

Step 5: Train employees before they use the PPE. Under 1910.132(f), you must train each employee required to wear PPE on when PPE is necessary, what PPE is necessary, how to put it on and take it off, how to adjust and wear it, its limitations, and its care, maintenance, and useful life. Document the training with names, dates, and topics covered. This training is a separate OSHA requirement from the assessment, but you can run them back to back.

For small shops with a handful of hazard types, the walk-through and write-up usually take two to four hours the first time. Later reviews, when nothing has changed much, take maybe 30 minutes.

What does the written certification actually have to say?

The exact language in 29 CFR 1910.132(d)(2) is: "The employer shall verify that the required workplace hazard assessment has been performed through a written certification that identifies the workplace evaluated; the person certifying that the evaluation has been performed; the date(s) of the hazard assessment; and, which identifies the document as a certification of hazard assessment." ^[1]

That's the legal floor. In practice, you want your certification to list the specific hazards identified, the PPE selected for each, and the applicable ANSI standard that PPE meets. An OSHA inspector can ask why you chose a particular glove or goggle, and "it's what we had in the cabinet" is not a satisfying answer. A certification that shows you matched a specific chemical splash hazard to ANSI Z87.1-rated chemical splash goggles tells a much better story.

The document doesn't need to be elaborate. A table with columns for work area, task, hazard, body part at risk, PPE selected, and standard cited covers everything. Sign it, date it, keep it on file. OSHA lists no specific retention period for the PPE certification itself, but keep it at least three years and have the current version reachable within minutes during an inspection.

Got multiple distinct areas (welding bay, machine shop floor, chemical storage, shipping dock)? Do a separate section for each. You can combine them into one document. Just make sure each area is clearly identified.

How do I pick the right PPE once I've identified the hazards?

Start with the hierarchy of controls. PPE is the last line of defense, not the first. If you can eliminate the hazard, substitute a safer material, or engineer a guard, that beats PPE every time. Your assessment should note that you considered those options, even if you landed on PPE as the practical solution for a given task.

For the actual selection, the ANSI standards are your map:

• Eye and face: ANSI/ISEA Z87.1. Safety glasses marked Z87+ are impact-rated. Goggles marked Z87.1 splash-rated meet the chemical splash standard. Face shields don't replace eye protection; they supplement it.
• Head: ANSI/ISEA Z89.1 Type I (top impact only) or Type II (top and lateral impact). Class E for electrical work up to 20,000 volts.
• Hand: ANSI/ISEA 105 cut levels A1 through A9. Know your cut hazard level before buying gloves. A1 gloves won't stop razor-edged sheet metal that rates A4 or above.
• Foot: ASTM F2413 is the standard for protective footwear. Look for the ASTM label inside the boot, more than a brand claim.
• Hearing: NRR (Noise Reduction Rating) rated by EPA. OSHA lets you halve the labeled NRR when estimating real-world reduction, so a plug rated NRR 30 gives you roughly 15 dB of protection in practice.
• Respiratory: NIOSH-approved respirators only. Half-face air-purifying respirators for most shop fumes, supplied-air for higher hazard work. This triggers the full 1910.134 program.

Don't pick PPE on price alone. A glove rated wrong for your hazard costs you far more in a workers' comp claim than the price gap between product lines. Bureau of Labor Statistics 2022 data shows hand injuries account for around 23% of nonfatal occupational injuries in manufacturing ^[5]. The right cut-resistant glove for your specific task is one of the cheapest risk reductions you can buy.

What's the difference between a PPE assessment and a PPE program?

The assessment is the hazard evaluation document. The program is the broader written policy that governs how you select, issue, maintain, and replace PPE across the organization.

OSHA's 1910.132 requires the assessment (and its written certification) as a specific deliverable. A full written PPE program is not explicitly mandated by 1910.132, but OSHA's compliance guidance recommends one, and many state plan states effectively require it through more stringent regulations ^[6]. California's Cal/OSHA, for one, requires an Injury and Illness Prevention Program that covers PPE practices.

For a small shop, the practical difference is simple. The assessment answers: "What hazards exist and what PPE does each task require?" The program answers: "Who is responsible for PPE, how do we pay for it, how do we inspect it, how do we replace it, and what do we do when someone refuses to wear it?"

The two documents go together. Write the assessment first, because it feeds the program. If you already have a written safety program, the PPE assessment plugs into it as a supporting document.

One thing that trips up small shops: OSHA requires employers to provide PPE at no cost to employees for most PPE types under the 2008 revision to 1910.132(h) ^[7]. Prescription safety glasses, logging boots, and a few other categories are exceptions. But safety glasses, hard hats, and chemical gloves? Those come out of your pocket, not the employee's.

How often do I need to update my PPE assessment?

OSHA doesn't name a calendar interval. The standard requires a new assessment (or a review and update of the existing one) whenever conditions change enough to affect PPE needs. The triggers that require a fresh look:

• You add a new machine, process, or chemical
• You change a process (different cutting speed, different coolant, new coatings)
• An employee is injured or has a near miss while wearing the specified PPE
• You hire workers for tasks not previously covered in the assessment
• A PPE product is discontinued and you swap in a different one
• An OSHA inspection flags a gap

A sensible practice for small shops is to review the assessment annually as a standing calendar item, plus after any trigger above. Date each review on the certification document, even when nothing changed. That date tells an inspector you're actively managing the program, not filing a paper from five years ago.

If you use a tool like SafetyFolio to generate and maintain your safety program, updating the PPE section when you add a new process takes a few minutes instead of starting over.

What are the most common PPE assessment mistakes small shops make?

In roughly descending order of how often they show up in OSHA citations and violation reports:

Missing the certification document entirely. The hazard walk happened in someone's head, the right PPE ended up in the shop, but nobody wrote it down. OSHA can and does cite this.

Assessing by job title instead of by task. "Machinists wear safety glasses" misses the fact that the same machinist degreases parts with solvents (needs splash goggles) and sweeps metal shavings into a bin (needs cut-resistant gloves). Task-level thinking is more work upfront and far more accurate.

Selecting PPE that doesn't match the hazard rating. Impact safety glasses in a chemical splash environment. A1 cut gloves for sheet metal work. Hard hats with no electrical rating near live panels. The selection has to map to the specific hazard level, more than the general category.

Forgetting tasks that happen rarely. Maintenance, cleaning, seasonal work. The worker who climbs the mezzanine twice a year to clean a ventilation filter still needs to be covered.

Not training employees on the PPE after the assessment. The assessment and the training are two separate OSHA requirements. You need documentation of both. See the OSHA training requirements for what that documentation has to include.

Treating the assessment as permanent. A shop that adds a plasma cutter, starts using a new rust-inhibiting spray, or installs a conveyor and never updates the assessment is out of compliance even if the original document was perfect.

Letting employees supply their own PPE without verifying it meets the right standard. OSHA allows employee-owned PPE under 1910.132(h), but you must ensure the equipment is adequate, properly maintained, and sanitary. "He brought his own safety glasses" doesn't protect you if they're fashion sunglasses.

Does the PPE assessment requirement apply to office workers and non-production staff?

Yes, though in practice it usually ends with no PPE requirement for purely desk-based work. The standard applies to all general industry employees. You still have to assess their tasks and document that you did. For someone whose entire job is at a computer in a separate office, the assessment conclusion is simply that no PPE is required for the role.

Where it gets interesting is the crossover worker. A purchasing manager who sometimes walks the shop floor. A bookkeeper who occasionally moves inventory. A supervisor who splits time between office duties and production oversight. Those workers' shop-floor tasks belong in the assessment, even though their main workspace is a desk.

Visitors and contractors are a separate issue. OSHA doesn't require a formal PPE assessment for short-term visitors, but you are expected to make sure visitors entering hazard areas wear appropriate PPE. Many shops handle this with a visitor policy and a sign-in form noting required PPE for the area. Contractors in your facility are primarily covered by their own employer's PPE program, but if you control the worksite and the hazards, you may share some responsibility depending on the situation.

What do I need if I do construction work, more than shop work?

Construction PPE requirements fall under 29 CFR 1926 Subpart E, not 1910.132 ^[8]. The core obligation is similar: assess hazards and provide appropriate PPE. But the construction standards have their own specific rules for eye and face protection (1926.102), head protection (1926.100), hearing protection (1926.101), and foot protection (1926.96).

If your shop does both in-house manufacturing (general industry) and field installation or construction, you're subject to both sets of standards depending on where the work happens. The PPE assessment for shop work goes under 1910.132. A separate assessment for field construction activities should reference the 1926 standards.

For shops that send workers to customer sites, this distinction matters. The 1926 rules on hard hats, for example, require Type I or II hard hats meeting ANSI Z89.1, same as general industry, but the enforcement authority and citation standard differ. Know which standard applies to which work location.

While you're at it, think about lockout tagout procedures alongside your PPE assessment. Energy control work often requires specific PPE (insulated gloves, face shields) that should appear in both documents.

Where can I find a PPE assessment template and what should it include?

OSHA doesn't publish an official blank template, but its compliance guidance (OSHA Publication 3151, "Personal Protective Equipment") includes sample language and format guidance ^[3]. Several OSHA state plan agencies publish state-specific templates; Washington State's L&I and California's DIR both have publicly available assessment forms.

At minimum, your template should have columns or sections for:

1. Work area or location 2. Job task being evaluated 3. Hazard identified (type and severity) 4. Body part at risk 5. PPE selected 6. ANSI/ISEA or other standard the PPE meets 7. Date evaluated 8. Evaluator name and signature (this becomes the certification)

A good template also has a spot for the hierarchy of controls you considered before landing on PPE, and a notes column for follow-up actions (like "schedule respirator fit test" or "order cut A4 gloves for this station").

If building a safety program from scratch feels like a lot, tools like SafetyFolio can generate a PPE assessment template and written program tuned to your shop's specific hazards in about 15 minutes, a fair shortcut compared to hours of formatting a Word document. Whatever format you use, it has to be filled in with real, specific information about your workplace. A blank template in a drawer satisfies nothing.

What are the OSHA penalties for not having a PPE assessment?

As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation, and for willful or repeated violations it reaches $161,323 per violation ^[9]. PPE citations usually land as "serious" violations, meaning OSHA found a hazard that could cause death or serious physical harm and the employer knew or should have known about it.

The more damaging cost is often the workers' comp and liability exposure after a PPE-related injury. A hand laceration that needs surgery and lost time easily runs $40,000 to $100,000 in direct costs before you count productivity loss and insurance premium hikes. The PPE assessment, done well, costs you a few hours.

OSHA can also stack multiple violations from a single inspection. A shop with no PPE assessment, no training records, and PPE that doesn't meet the right ANSI standard can face three to five separate citations, each at the serious threshold. That adds up fast.

State plan states can set their own penalty structures. California's Cal/OSHA, for example, has different maximum amounts and its own citation categories. Check your state's plan if you're not under federal OSHA. About half of U.S. states run their own OSHA-approved state plans ^[6].

Frequently asked questions

Is a PPE hazard assessment required for businesses with fewer than 10 employees?

Yes. OSHA's 29 CFR 1910.132(d) applies to all general industry employers regardless of size. There is no small-business exemption for the PPE assessment requirement. Very small employers (under 10 employees in certain low-hazard industries) may be partially exempt from OSHA's programmatic inspection targeting, but the standard itself still applies and you can still be cited during a complaint-driven inspection.

Can I do the PPE assessment myself or do I need to hire a consultant?

You can absolutely do it yourself. OSHA does not require a certified safety professional to conduct the assessment. The person who certifies it needs to know the workplace and the relevant hazards, not hold a credential. Hire a consultant if your hazards are complex (arc flash calculations, industrial hygiene sampling for chemical exposures) or you want a second set of eyes. For a typical metal fab or woodworking shop, a careful walk-through by an informed owner or manager is enough.

Does my PPE assessment need to cover noise and respiratory hazards?

Yes, your assessment should identify both. But noise and respiratory hazards trigger separate OSHA programs. If you find noise above 85 dBA as an 8-hour TWA, you need a hearing conservation program under 1910.95. If you find respiratory hazards requiring respirators, you need a respiratory protection program under 1910.134, including medical evaluations and fit testing. The PPE assessment is the trigger document; those full programs are the response.

What OSHA standard covers the PPE assessment requirement specifically?

The requirement is at 29 CFR 1910.132(d) for general industry. The written certification requirement is specifically in 1910.132(d)(2). Subpart I (1910.132 through 1910.138) covers the broader PPE standards including eye and face protection (1910.133), respiratory protection (1910.134), head protection (1910.135), foot protection (1910.136), electrical protective equipment (1910.137), and hand protection (1910.138).

Who pays for PPE, the employer or the employee?

The employer pays for most PPE. OSHA's 2008 revision to 1910.132(h) requires employers to provide required PPE at no cost to employees. Exceptions include non-specialty safety-toe footwear and prescription eyewear (if you allow employees to wear their own), logging boots, and certain other items listed in the rule. If you require a specific type, brand, or rating of PPE that the employee can only get through you, you pay for it.

How do I document PPE training after completing the assessment?

Under 1910.132(f), training documentation should include each employee's name, the date of training, the topics covered (when PPE is needed, how to wear and adjust it, its limitations, care and maintenance), and the trainer's name. A simple sign-in sheet with those elements works. Keeping the records for the length of employment plus three years is a reasonable practice, though OSHA doesn't specify a retention period for PPE training records in 1910.132.

What happens if an employee refuses to wear the PPE specified in my assessment?

You document the refusal and enforce your policy consistently. OSHA holds the employer responsible for ensuring PPE is worn, more than provided. 'I gave it to them' is not a defense if you didn't enforce use. Your written PPE program should include a disciplinary process for PPE non-compliance. Apply it the same way regardless of employee seniority. Document each instance. Inconsistent enforcement is itself a liability in both OSHA inspections and personal injury litigation.

Can I use a generic PPE assessment template downloaded from the internet?

A template is a starting point only. The certification OSHA requires under 1910.132(d)(2) must identify your specific workplace, your specific hazards, and the specific PPE you selected. A generic template filled in with real information about your shop is fine. A generic template with placeholder text or left blank is useless for compliance and gives you nothing to show an inspector. Customize it to your actual tasks and hazards.

Do I need a separate PPE assessment for each job title or each work area?

OSHA doesn't prescribe the format. Most safety professionals organize assessments by work area and task rather than by job title, because the same person often does multiple tasks in multiple areas. Whatever format you choose, make sure every combination of task and hazard in your shop appears somewhere in the assessment. A matrix format (work area rows, hazard type columns, PPE selected at the intersection) works well for shops with multiple work stations.

What's the difference between safety glasses and chemical splash goggles, and does my assessment need to specify which?

Yes, your assessment must specify the correct type. Safety glasses (even with side shields) have gaps that let liquid splash reach the eye. Chemical splash goggles form a continuous seal around the eye socket and are the right protection for tasks involving liquid chemicals. OSHA letters of interpretation have confirmed that safety glasses do not substitute for splash goggles when a chemical splash hazard is present. Selecting the wrong type is a citable violation even if the employee is wearing eye protection.

Does an incident report affect my PPE assessment requirements?

An injury or near miss involving PPE is a trigger to review and possibly update your assessment. If someone gets a chemical splash to the eyes while wearing safety glasses you specified, that's a signal your PPE selection may have been wrong for the hazard. Review the task, re-evaluate the hazard, update the PPE specification if needed, retrain affected employees, and document the change. Your incident report and your updated assessment together show OSHA you responded appropriately.

Are there any industries or shop types where the PPE assessment rules are different?

The 1910.132 general industry standard covers most shops: metal fab, woodworking, auto repair, chemical processing, food manufacturing, and similar environments. Construction work falls under 29 CFR 1926 Subpart E instead. Maritime work has its own standards under 29 CFR 1915 and 1917. Agriculture falls under 29 CFR 1928. The underlying obligation (assess hazards, select PPE, document it, train employees) is consistent across all sectors, but the specific cited standard changes depending on your industry classification.

How does a PPE assessment relate to an OSHA inspection?

During a general industry inspection, OSHA compliance officers routinely ask to see your PPE hazard assessment and certification as part of reviewing your safety programs. They compare what the document says against what they observe on the floor. If employees are doing tasks not covered in the assessment, or wearing PPE that doesn't match the assessment's specifications, those are potential citations. Having a current, detailed assessment that matches actual practice is your best protection.

Sources

1. OSHA, 29 CFR 1910.132(d) - General Requirements for Personal Protective Equipment: Employers must assess the workplace to determine if hazards are present that necessitate PPE, and must produce a written certification of that assessment including workplace name, certifier, and date.
2. OSHA, Top 10 Most Frequently Cited Standards: OSHA's PPE standards (1910.132 and related) generate thousands of citations annually in general industry, consistently ranking among the most frequently cited standards.
3. OSHA Publication 3151, Personal Protective Equipment (compliance guidance): OSHA's compliance guidance identifies hazard categories including impact, penetration, compression, chemical, heat, harmful dust, light radiation, and biohazards, and describes the five-step hazard assessment process.
4. OSHA, Letters of Interpretation on eye and face protection under 1910.133: OSHA letters of interpretation state that safety glasses do not substitute for chemical splash goggles when a liquid chemical splash hazard is present.
5. Bureau of Labor Statistics, Occupational Injuries and Illnesses in Manufacturing, 2022: Hand injuries account for approximately 23% of nonfatal occupational injuries in manufacturing according to BLS injury and illness data.
6. OSHA, State Plans: Approximately half of U.S. states operate their own OSHA-approved state plans, which may have more stringent PPE and written program requirements than federal OSHA.
7. OSHA, 29 CFR 1910.132(h) - Payment for Protective Equipment (2008 revision): The 2008 revision to 1910.132(h) requires employers to provide most required PPE at no cost to employees, with specific exceptions for non-specialty safety-toe footwear and prescription eyewear.
8. OSHA, 29 CFR 1926 Subpart E - Personal Protective and Life Saving Equipment (Construction): Construction PPE requirements fall under 29 CFR 1926 Subpart E, with specific rules for eye and face (1926.102), head (1926.100), hearing (1926.101), and foot protection (1926.96).
9. OSHA, OSHA Civil Penalties: As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation and $161,323 per willful or repeated violation.
10. ANSI/ISEA Z87.1, American National Standard for Occupational Eye and Face Protection Devices: ANSI/ISEA Z87.1 is the applicable standard for rating and selecting occupational eye and face protection; devices marked Z87+ are impact-rated and splash-rated goggles meet the chemical splash standard.
11. OSHA, 29 CFR 1910.134 - Respiratory Protection: When a PPE assessment identifies respiratory hazards requiring respirator use, a full respiratory protection program under 1910.134 is required, including medical evaluations and fit testing.
12. OSHA, 29 CFR 1910.95 - Occupational Noise Exposure: If noise levels at or above 85 dBA as an 8-hour TWA are identified in the PPE assessment, a hearing conservation program is required under 1910.95.
13. OSHA, 29 CFR 1910.132(f) - Training requirements for PPE: Employers must train each employee required to wear PPE on when it is necessary, what type is needed, how to wear and adjust it, its limitations, and its care and maintenance, with training documented.