What a company's safety and health program should cover

Last updated 2026-07-09

What does OSHA actually require a safety and health program to include?

OSHA has no single standard that forces every private employer to write one universal safety program. That surprises people. What OSHA does have is the general duty clause under Section 5(a)(1) of the OSH Act, which requires employers to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." Beyond that clause, roughly 30 specific OSHA standards require their own written programs tied to particular hazards: hazard communication (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), respiratory protection (29 CFR 1910.134), and emergency action plans (29 CFR 1910.38) among them. ^[1]

On top of those specific rules, OSHA published its Recommended Practices for Safety and Health Programs in 2016. These aren't legally mandatory for most private employers. But OSHA uses them as the yardstick when it decides whether an employer manages hazards responsibly. Some state plans go further. Cal/OSHA, under California Labor Code Section 6401.7, requires a written Injury and Illness Prevention Program (IIPP) from every employer in the state, no exceptions. ^[2]

Here's the practical read. Even if your state doesn't require a written program by law, building one around OSHA's seven recommended elements is the fastest way to satisfy all those scattered written-program rules at once. It's also the clearest thing you can hand an inspector to show your workplace takes hazard control seriously.

What are the seven core elements OSHA recommends?

OSHA's 2016 Recommended Practices organize a safety program into seven elements. They aren't arbitrary buckets. They map to the management systems used by companies with the lowest injury rates. ^[3]

1. Management leadership. A written commitment from the top of the org chart. Someone with real authority and budget has to own safety outcomes, more than safety paperwork.

2. Worker participation. Employees need a real channel to report hazards, join inspections, and review incident reports without fear of retaliation. OSHA's anti-retaliation provisions under Section 11(c) of the OSH Act protect workers who raise safety concerns.

3. Hazard identification and assessment. Scheduled inspections, a formal way for employees to flag hazards, review of near-misses, and analysis of injury and illness records.

4. Hazard prevention and control. The hierarchy of controls: elimination first, then substitution, engineering controls, administrative controls, and PPE last. The program documents which controls you chose and why.

5. Education and training. Workers and supervisors need training matched to their actual tasks and the hazards those tasks create. Not a one-time event.

6. Program evaluation and improvement. A scheduled review, at least annually or after any serious incident, to check whether controls work and whether new hazards have shown up.

7. Communication and coordination with contractors and staffing agencies. If someone who doesn't work directly for you is on your site, your program has to address their hazards too. ^[3]

Those seven are the skeleton. The rest of this article puts flesh on each one and shows where specific OSHA standards bolt mandatory detail on top.

What written programs does OSHA require by specific standard?

This is where small businesses get tripped up. Even if your state skips the universal-program mandate, dozens of federal OSHA standards demand a written plan for the specific hazard they cover. If the hazard exists in your workplace, the written program is mandatory. Not optional.

Here are the ones cited most often:

Hazard / Topic	OSHA Standard	Written Program Required?
Hazard communication (chemicals)	29 CFR 1910.1200	Yes
Lockout/tagout	29 CFR 1910.147	Yes
Respiratory protection	29 CFR 1910.134	Yes
Emergency action plan	29 CFR 1910.38	Yes (10+ employees)
Fire prevention plan	29 CFR 1910.39	Yes
Bloodborne pathogens	29 CFR 1910.1030	Yes (Exposure Control Plan)
Permit-required confined spaces	29 CFR 1910.146	Yes
Personal protective equipment	29 CFR 1910.132	Written assessment required
Hearing conservation	29 CFR 1910.95	Yes
Process safety management (PSM)	29 CFR 1910.119	Yes (covered processes only)
Electrical safety (NFPA 70E-aligned)	29 CFR 1910.333	Documented procedures required

Hazard communication was OSHA's most frequently cited standard in FY2023, with over 3,500 violations issued. ^[4] If you keep chemicals on site and have no written HazCom program, you are the statistical norm for OSHA violations. Bad place to be.

For what a HazCom program actually needs to say, see our guide to hazardous communication.

How should management leadership be structured in a safety program?

The management leadership section answers one plain question: who is accountable, for what, and with what authority? Nail that and the rest of the program has a spine. Leave it vague and everything below it drifts.

At minimum, name a specific person as the safety program coordinator. A job title works. A person's name works better. That person needs enough authority to stop work, require corrective action, and approve safety spending. A program with no budget and no stop-work authority isn't a program. It's a binder.

Include a written safety policy statement signed by the owner or CEO. OSHA's Voluntary Protection Programs (VPP), which recognize employers with strong safety records, treat a signed policy statement as a baseline requirement, not a nicety. ^[5]

Supervisors need defined safety responsibilities written into their job descriptions or into the program itself. If supervisors know they'll be judged on safety performance, the program works. If they won't, it doesn't. It really is that simple.

How should the program handle worker participation?

Worker participation isn't a feel-good add-on. OSHA's own data and decades of industrial hygiene research show that workplaces where employees report hazards freely have lower injury rates. The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023. Near-miss reporting is the earliest signal that something's going wrong before those injuries land. ^[6]

Your written program should describe three things. First, how employees report hazards without fear of discipline or retaliation. Second, how management responds to those reports and in what time frame. Third, how employees take part in incident investigations as contributors to root cause analysis, more than as witnesses.

Spell out the anti-retaliation piece in the document itself. Section 11(c) of the OSH Act prohibits employers from retaliating against workers who report safety concerns. Reference that protection by name so nobody has to guess whether it applies.

For structure and examples, the principles of effective safety incentive programs guide can help you encourage reporting without accidentally suppressing it by rewarding zero-incident streaks (which quietly pushes people to stop reporting).

What does hazard identification and assessment need to cover?

This section has to describe a real, scheduled process, not a vague plan to "regularly inspect the workplace." Inspectors and VPP evaluators want specifics: who inspects, how often, with what checklist, and what happens to the findings.

A solid hazard identification process has four parts.

First, routine inspections on a set schedule. Monthly is common for most workplaces. High-hazard sites (construction, manufacturing, chemical processing) often need weekly or daily checks in specific areas.

Second, a job hazard analysis (JHA) or job safety analysis (JSA) for any task that carries serious injury risk. 29 CFR 1910.132(d) requires a written PPE hazard assessment, which is effectively a JHA for PPE-relevant tasks. ^[7]

Third, a near-miss and incident reporting system. Record every near-miss and review it before the next incident. OSHA requires employers with 10 or more employees in most industries to record work-related injuries and illnesses on Forms 300, 300A, and 301 under 29 CFR 1904. ^[8]

Fourth, a change management review. Add new equipment, a new chemical, a new process, or a new shift structure, and the hazard assessment gets updated before the change goes live. Not after someone gets hurt.

What is the hierarchy of controls and how does your program document it?

The hierarchy of controls isn't optional language. OSHA references it directly in standards including 29 CFR 1910.134 (respiratory protection) and the general industry PPE rule at 29 CFR 1910.132, and the National Institute for Occupational Safety and Health (NIOSH) endorses it as the framework for hazard control decisions. ^[9]

From most to least effective:

Elimination: physically remove the hazard. The gold standard. Substitution: swap the hazardous material or process for a less hazardous one. Engineering controls: isolate people from the hazard through physical design (guards, ventilation, interlocks). Administrative controls: change how work gets done (scheduling, rotation, procedures). PPE: protect the worker's body. Last resort, not first instinct.

For each significant hazard you've identified, your program should document which control level you picked and why. Chose PPE over an engineering control? The program should explain what made elimination or engineering unfeasible. OSHA citations often turn on exactly this: whether the employer could have used a higher-level control and didn't.

This feeds straight into your workplace safety training requirements. Workers need to know the controls that apply to their specific tasks, not a generic safety orientation that names none of them.

What training does a safety and health program require?

Training splits two ways. General safety orientation for everyone, and standard-specific training required by individual OSHA rules. Your program needs both, and it needs to prove both happened.

For general orientation, define what every new hire gets before starting work: emergency exits, fire extinguisher locations, first aid kit locations, how to report a hazard. Then define how you document it.

Standard-specific training gets detailed. A few examples:

Hazard communication (29 CFR 1910.1200(h)) requires training before initial assignment to tasks involving hazardous chemicals, and again whenever a new hazard is introduced. It has to cover reading safety data sheets and using the labeling system.

Lockout/tagout (29 CFR 1910.147(c)(7)) requires authorized employees to show they understand the energy control procedures for their specific equipment, with retraining whenever there's reason to think a worker doesn't.

Respiratory protection (29 CFR 1910.134(k)) requires training before initial respirator use and annually after that.

Bloodborne pathogens (29 CFR 1910.1030(g)(2)) requires annual training for all workers with occupational exposure.

Build a training matrix: a table listing each job role, its hazards, the training required by standard or hazard, the refresher frequency, and where records live. Skip the matrix and training gaps are close to guaranteed.

Records matter in an OSHA investigation. If it isn't documented, it didn't happen.

How often should a safety and health program be reviewed and updated?

Annually is the baseline. Sooner if any of these hit: a recordable injury or illness, a near-miss with serious injury potential, a real change in operations, equipment, or chemicals, a new OSHA standard that reaches your industry, or a failed audit.

OSHA's Recommended Practices put it plainly. The 2016 guidance states programs should be evaluated to "verify that the program is being implemented and is on track to achieve its goals." That's the expectation an inspector will carry in the door.

Document the review itself. Who ran it, when, what they found, what changed, and who signed off. A program that was reviewed and left unchanged is still compliant. A program with no record of any review is a problem waiting for an inspection.

Building or rebuilding from scratch? A tool like SafetyFolio's safety program generator can produce a compliant baseline document in about 15 minutes instead of a blank page and a long weekend.

How does a safety program address contractors and staffing agency workers?

This is where a lot of small businesses have a real gap. Hire contractors, temps, or staffing agency workers, and you still carry OSHA obligations toward them while they're on your site.

OSHA's multi-employer citation policy (CPL 02-00-124) states that both controlling employers and exposing employers can be cited for hazards. A controlling employer, usually the host, must exercise reasonable care to keep contractors clear of site hazards. ^[10] The Recommended Practices name "communication and coordination for host employers, contractors, and staffing agencies" as one of the seven core elements.

Your written program should cover three things for contractor management. First, pre-work hazard communication: contractors learn the site hazards they'll face before work starts. Second, a check that contractors have their own adequate safety programs for the work they'll do. Third, a protocol for handling a contractor safety violation you spot on your site.

For staffing agency workers, OSHA's 2013 Temporary Worker Initiative made clear that host employers own site-specific training even when the agency handles general onboarding. You can't outsource that part.

What should a safety program include for recordkeeping and incident investigation?

Two separate jobs live here: OSHA's recordkeeping rules and your own incident investigation process. Handle them as one section and you'll miss half of each.

On recordkeeping: employers with 10 or more employees in most industries must keep OSHA 300 logs of work-related injuries and illnesses, post a 300A summary from February 1 through April 30 each year, and complete a 301 incident report for each recordable case. That's 29 CFR 1904. ^[8] Certain low-hazard industries are partially exempt. Construction, manufacturing, healthcare, and most trades are not.

Electronic submission is now required for many employers too. As of the January 1, 2024 rule, establishments with 100 or more employees in designated high-hazard industries must submit 300 and 301 data electronically through OSHA's Injury Tracking Application (ITA). Establishments with 20 to 249 employees in high-hazard industries submit 300A summary data. ^[11]

On incident investigation: your program should describe a root cause process that goes past "employee wasn't paying attention." Look for the system failure: missing guarding, thin training, a procedure that never matched how the work actually gets done, a supervisor who skipped the pre-task check. The report recommends corrective actions, assigns an owner to each, and sets a completion date. A follow-up confirms each one actually got done.

Does a safety and health program need to be different for specific industries?

Yes, and it goes well past tone. The OSHA standards that apply, the hazards you have to cover, and the written programs you're legally required to keep all shift by industry.

OSHA runs three primary sector rulebooks: General Industry (29 CFR 1910), Construction (29 CFR 1926), and Maritime (29 CFR 1915 through 1919). Agriculture has its own standards under 29 CFR 1928. A retail store and a construction site need fundamentally different programs even though both hang on the same seven-element frame.

Higher-hazard industries (much of manufacturing, warehousing, utilities, healthcare, and construction) face more specific written-program requirements and get inspected more often. BLS data for 2023 shows industries with the highest total recordable incident rates include nursing and residential care, warehousing and storage, and animal slaughtering, all above 4.0 cases per 100 full-time workers. ^[6]

A food business, for one, needs food safety plans running alongside its OSHA program. See our guide to food safety certification programs for how the two systems mesh. Any operation with fleet vehicles picks up driver-safety requirements a general office program never touches.

The a safety and health program should be guide covers the principles that hold across every one of these industry variations.

How does a small business build a complete safety and health program efficiently?

Straight answer: building a complete, compliant program by hand takes real time. Gathering the applicable standards, drafting each required written program, writing the training matrix, building inspection checklists. That's easily 15 to 30 hours if you know what you're doing, and longer if you're learning as you go.

A few practical routes.

First, use OSHA's free On-Site Consultation Program, available in every state and run separately from enforcement. A consultant visits, identifies hazards, and helps you prioritize, with no citations issued. ^[12] It's genuinely useful and badly underused. Businesses with 250 or fewer employees at a site are the primary audience.

Second, industry associations often publish template programs for their sector. The Associated General Contractors, the National Restaurant Association, and plenty of others offer written-program templates as member resources.

Third, if you want a faster path to a finished document, SafetyFolio's safety program generator takes the seven-element frame plus your industry inputs and produces a compliant program in about 15 minutes.

Whichever route you take, the program is only as good as what you do with it. A perfect document in a drawer protects nobody. The training has to happen. The inspections have to happen. The records have to be kept.

Frequently asked questions

Is a written safety and health program legally required by OSHA?

Not universally under federal OSHA. But specific standards require written programs for individual hazards like hazard communication (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), and respiratory protection (29 CFR 1910.134). Some state plans, like California's, require a written Injury and Illness Prevention Program from every employer. Even where it isn't mandated, a written program is your best evidence of good-faith compliance.

What are the seven elements of an OSHA safety and health program?

OSHA's 2016 Recommended Practices list seven: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and communication and coordination with contractors and staffing agencies. They apply to all industries and business sizes, though the specific content differs by workplace.

How often does a safety and health program need to be updated?

At minimum annually, per OSHA's Recommended Practices. Update it sooner after any recordable injury or illness, a significant near-miss, a change in operations or equipment, a new hazardous chemical on site, or any change to applicable OSHA standards. Document every review with dates, findings, changes made, and who approved them.

What is the hierarchy of controls and why does it matter for a safety program?

The hierarchy of controls ranks hazard reduction from most to least effective: elimination, substitution, engineering controls, administrative controls, and PPE. OSHA references it in multiple standards including 29 CFR 1910.132 and 1910.134. Your program should document which control level you chose for each significant hazard and why. Leaning on PPE without weighing higher-level controls is a common reason employers get cited.

Does a safety program need to cover temporary and contract workers?

Yes. OSHA's multi-employer worksite policy holds host (controlling) employers responsible for keeping contractors and temporary workers on their site clear of site hazards. OSHA's 2013 Temporary Worker Initiative made clear that host employers must provide site-specific training even for workers supplied by a staffing agency. Your written program should include a contractor pre-work hazard communication process.

What records does OSHA require as part of a safety program?

Employers with 10 or more employees in most industries must keep OSHA 300 injury and illness logs, prepare a 300A annual summary (posted February 1 to April 30), and complete a 301 incident report for each recordable case, under 29 CFR 1904. As of 2024, establishments with 100 or more employees in high-hazard industries must submit 300 and 301 data electronically to OSHA's Injury Tracking Application.

What is the most frequently violated OSHA standard related to safety programs?

Hazard communication (29 CFR 1910.1200) was OSHA's most frequently cited standard in FY2023, with over 3,500 violations. Employers who use, store, or produce hazardous chemicals must keep a written HazCom program, maintain safety data sheets for all hazardous chemicals, train employees before initial exposure, and use the GHS labeling system. Fall protection and respiratory protection round out the top citation categories most years.

Does a safety and health program have to be in writing?

For the specific standards that require written programs (hazard communication, lockout/tagout, respiratory protection, bloodborne pathogens, and others), yes. For the overall program framework under OSHA's Recommended Practices, writing is strongly advised even where it isn't legally required. Written documentation is your main evidence during an inspection that policies and training actually exist.

Can OSHA fine a company for not having a safety program?

OSHA can cite employers under the General Duty Clause (Section 5(a)(1) of the OSH Act) for failing to address recognized serious hazards, even without a specific written-program requirement. Companies can also be cited under each specific standard that requires a written program they don't have. As of 2024, serious violations carry penalties up to $16,131 per violation, and willful or repeat violations up to $161,323.

How is a safety and health program different from a safety manual?

A safety manual is usually a collection of rules and procedures. A safety and health program is a management system: it defines accountability, processes for finding and controlling hazards, training requirements, and review cycles. The manual describes what workers should do. The program describes how the organization makes sure those things happen, and how it checks whether they're working.

What free resources does OSHA offer to help build a safety program?

OSHA's On-Site Consultation Program provides free, confidential workplace visits in every state to help employers find hazards and set up safety programs. It's completely separate from enforcement, so no citations are issued. OSHA also publishes free template programs and guidance at osha.gov, including the full Recommended Practices document. Businesses with 250 or fewer employees at a site are the primary audience for consultation.

Do small businesses with fewer than 10 employees need a formal safety program?

They're exempt from the OSHA 300 recordkeeping requirement (29 CFR 1904) but not from specific written-program requirements tied to actual hazards. If a business with five employees uses hazardous chemicals, a written HazCom program is still required. OSHA's General Duty Clause applies to employers of any size. A written program is smart risk management regardless of headcount.

How should a safety program handle emergency action planning?

29 CFR 1910.38 requires a written emergency action plan for employers with 10 or more employees whose buildings require evacuation. It must cover escape procedures and routes, procedures for employees who stay to run critical equipment, a system for accounting for everyone after evacuation, rescue and medical duties, how employees report emergencies, and designated contacts. Employers with 10 or fewer employees can communicate the plan orally instead of in writing.

What's the difference between OSHA's Recommended Practices and a state plan requirement?

OSHA's Recommended Practices are voluntary guidance for private employers under federal OSHA jurisdiction. State OSHA plans, which cover 22 states and territories, must be at least as effective as federal OSHA and can be stricter. California's IIPP requirement under Labor Code 6401.7 is the best-known example: every California employer must maintain a written Injury and Illness Prevention Program, no exceptions.

Sources

1. OSHA, OSH Act of 1970 Section 5 Duties (General Duty Clause): Section 5(a)(1) requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm
2. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA identifies seven core elements of an effective safety and health program and recommends regular program evaluation
3. OSHA, Top 10 Most Frequently Cited Standards FY2023: Hazard communication (29 CFR 1910.1200) was the most frequently cited OSHA standard in FY2023 with over 3,500 violations
4. OSHA, Voluntary Protection Programs (VPP): VPP treats a signed management safety policy statement as a baseline requirement for recognition
5. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program: BLS reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023; nursing/residential care, warehousing, and animal slaughtering have rates above 4.0 per 100 full-time workers
6. OSHA, 29 CFR 1910.132 Personal Protective Equipment General Requirements: 29 CFR 1910.132(d) requires a written PPE hazard assessment for each affected workplace
7. OSHA, Recordkeeping (29 CFR 1904): Employers with 10 or more employees in most industries must keep OSHA 300, 300A, and 301 records under 29 CFR 1904
8. NIOSH, Hierarchy of Controls: NIOSH endorses the hierarchy of controls as the framework for occupational hazard control decisions
9. OSHA, Multi-Employer Citation Policy (CPL 02-00-124): Controlling employers can be cited for hazards exposing contractor employees on their worksites
10. OSHA, Injury and Illness Recordkeeping and Reporting Requirements: As of the January 2024 rule, establishments with 100+ employees in high-hazard industries must submit 300 and 301 data electronically via OSHA's ITA
11. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program is available in every state, separate from enforcement, and does not result in citations