What a safety and health program should be (and do)

Last updated 2026-07-09

What should a safety and health program actually include?

A safety and health program is a written, working process that tells everyone in your company how you find hazards, fix them, and stop new ones from showing up. OSHA's Recommended Practices for Safety and Health Programs, published in 2016 and updated since, name seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and coordination with contractors and staffing agencies ^[1].

Not every small business needs a 200-page manual. A ten-person landscaping crew and a 500-person plant need the same seven elements at wildly different scales. Match the depth to the risk. A wood shop with table saws and silica dust needs far more than a food truck, full stop.

The written part matters more than most owners think. If your safety process lives only in your head, it walks out the door when you go on vacation. Documentation also gives you legal cover. When OSHA investigates an incident, the first thing the inspector asks for is your written program.

For a closer look at putting the written piece together, see our guide on building a written safety program.

Why does OSHA say a safety and health program should be management-led?

Management commitment is the load-bearing wall. OSHA's Recommended Practices put it plainly: leadership is the most important element of a successful safety and health program ^[10]. Workers read the owner faster than any policy. Skip the hard hat in the warehouse once, and the whole program loses credibility in about ten seconds.

Leadership means more than a signed policy taped to the breakroom wall. It means setting a measurable goal (injury rate below X by year-end), putting real money behind PPE and training, and showing up to safety meetings. It also means disciplining a supervisor who skips a procedure the same way you'd discipline anyone else.

This is where small businesses fall down. The safety binder exists. Nobody reads it. Someone gets hurt. OSHA shows up. The owner is genuinely surprised. The binder was never the problem. The problem was that nobody actually owned the program day to day.

Federal agencies treat this the same way. Executive Order 12196 and 29 CFR 1960 set the safety and health program structure for federal agencies ^[12], and DoD Instruction 6055.01 sets up the Department of Defense safety and occupational health program, requiring each military department to run one built on the same management-led principles ^[2]. The pattern holds across every serious safety framework because it matches how people behave. They follow what leadership does, not what it says.

What does worker participation mean in a safety program?

Worker participation is not a suggestion box. Done right, it means the people closest to the work help spot hazards before anyone gets hurt. A press operator knows the machine skips sometimes long before a manager does.

Some of this is law, not advice. Under the Process Safety Management standard (29 CFR 1910.119), workers must be consulted in developing process hazard analyses ^[11]. Under the Hazard Communication standard (29 CFR 1910.1200), workers have the right to see safety data sheets and know what chemicals they handle ^[3]. These aren't recommendations. They're requirements inside the General Industry standards at 29 CFR 1910.

BLS survey data has long shown that establishments with active joint labor-management safety committees report lower injury rates than those without. The size of the gap moves by industry. The direction doesn't ^[4].

In practice, worker participation looks like this: quick pre-shift safety talks (some call them tailgates), frontline workers sitting on incident investigation teams, and a reporting system where near-misses come in without anyone getting written up. That last piece is harder than it sounds. If your crew thinks reporting a near-miss lands them in trouble, they'll stay quiet until someone bleeds.

See also: principles of effective safety incentive programs, which covers how to reward the right behavior without accidentally paying people to stay silent.

How should a safety program identify and assess hazards?

You cannot control a hazard you haven't found. OSHA recommends three approaches running side by side: collect the information you already have (injury and illness logs, past inspection reports, safety data sheets), inspect the worksite on a schedule, and investigate every incident and near-miss ^[1].

The job hazard analysis (JHA), sometimes called a job safety analysis (JSA), is the workhorse. You break a job into steps, name the hazard in each step, and set a control for it. OSHA's Job Hazard Analysis booklet (Publication 3071) walks through the whole method and is free at OSHA.gov ^[5].

Higher-complexity operations need more. A Process Hazard Analysis (PHA) is required under 29 CFR 1910.119 for facilities holding threshold quantities of highly hazardous chemicals, and it demands a formal method like HAZOP or What-If analysis ^[11].

One thing surprises small business owners: hazard assessment is not a one-time job. New equipment, new chemicals, new tasks, and new hires all bring new risk. OSHA recommends a formal reassessment at least once a year and any time something significant changes.

What is the hierarchy of controls and how does it fit into a safety program?

Once you find a hazard, you need a structured way to decide how to handle it. That structure is the hierarchy of controls, ranked from most effective to least: elimination, substitution, engineering controls, administrative controls, and personal protective equipment ^[6].

Elimination means the hazard is gone. Redesign a task so nobody handles a toxic solvent, and you've eliminated the risk. That's always the best answer. PPE is the last resort, never the first, because it only protects a worker who wears it correctly every single time.

Most small businesses lean too hard on PPE because it's cheap and visible. Buying gloves is easy. Redesigning a workstation is hard. But engineering controls are more reliable. A machine guard works whether or not the operator remembers anything.

Your written program should say which control level applies to each significant hazard and who maintains it. "Everyone should wear gloves" is a wish. "Cut-resistant gloves (ANSI Level A4) required at the bandsaw, stored at Station 3, inspected monthly" is a control.

Control Level	Example	Reliability
Elimination	Remove the hazardous process	Highest
Substitution	Replace toxic chemical with safer one	High
Engineering	Machine guarding, local exhaust ventilation	High
Administrative	Job rotation, safe work procedures	Moderate
PPE	Gloves, respirators, hard hats	Lowest

How much training should a safety and health program require?

Training requirements track the hazards you actually have. OSHA sets specific training mandates in dozens of standards. Workers exposed to hazardous energy must be trained on lockout/tagout before touching the equipment (29 CFR 1910.147). Workers required to wear respirators need fit testing and training before first use (29 CFR 1910.134). Workers handling bloodborne pathogens need annual training (29 CFR 1910.1030) ^[3].

On top of the standard-specific rules, the General Duty Clause (Section 5(a)(1) of the OSH Act) creates an implied training duty. If a recognized hazard exists and training would reduce it, failing to train can be cited ^[7].

Quality matters as much as the fact that training happened. Reading a policy aloud and passing around a sign-in sheet is technically training. It's also close to useless. OSHA's Recommended Practices call for training "provided in a language and at a literacy level that all workers can understand," with hands-on or demonstration components for physical tasks ^[1].

Documentation is non-negotiable. Record who was trained, on what, when, and by whom. If you can't prove training happened, OSHA treats it as if it didn't. Keep training records for the length of employment plus three years as a safe default.

For a full breakdown of what your program has to cover, the workplace safety training guide runs through each major OSHA training standard.

How often should a safety program be evaluated and updated?

OSHA recommends evaluating your program at least once a year and after any significant incident, near-miss, or major change to operations ^[1]. The annual review is the floor, not the goal. High-hazard industries like construction, logging, and manufacturing do better with quarterly reviews or tighter.

Evaluation has two halves. First, outcomes. Did injury and illness rates move? How many near-misses came in? Are workers still bringing you concerns, or have the reports gone quiet (which usually means fear, not safety)? Second, process. Are scheduled inspections actually happening? Is training current? Do corrective actions get closed out, or do they sit open for months?

BLS data for 2023 shows total recordable injury and illness rates swing hard by industry, from around 0.5 per 100 full-time workers in finance to above 6.0 in animal production ^[4]. Benchmarking your own rate against your NAICS-specific rate (free in the BLS Survey of Occupational Injuries and Illnesses) tells you how you stack up against peers, which beats staring at your own number in isolation.

Programs that track leading indicators, things like near-miss reports, training completion rates, and inspection findings, catch problems earlier than programs watching only lagging indicators. Injury counts tell you what already went wrong. Near-miss reports tell you what's about to.

Does OSHA require every employer to have a written safety program?

Here's the honest answer: no single OSHA standard says every employer must have one unified written safety and health program document. The Recommended Practices are exactly that, recommended.

That doesn't let you off the hook. The General Duty Clause (Section 5(a)(1) of the OSH Act) requires a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[7]. Running a business with no systematic way to find and fix hazards is precisely what gets cited under that clause after someone gets hurt.

Then there are the standard-specific rules. Dozens of individual OSHA standards each require a written program for their own hazard. You need a written Hazard Communication program if you keep hazardous chemicals (29 CFR 1910.1200). A written Lockout/Tagout program if workers service equipment (29 CFR 1910.147). A written Respiratory Protection program if respirators are required (29 CFR 1910.134). A written Emergency Action Plan if you have 11 or more employees (29 CFR 1910.38) ^[3]. Stack those up and you effectively have a safety program whether you call it one or not.

Some State Plan states go further. California, under Title 8 CCR Section 3203, requires every employer to establish, implement, and maintain an Injury and Illness Prevention Program (IIPP) ^[8]. That's a hard legal requirement, not a suggestion.

If you operate in one of those states, our new york safety program guide covers state-specific rules that reach past federal OSHA.

What are occupational health and safety programs in academia, and are they relevant to small business?

Occupational health and safety master's programs (MS-OHS, MSPH, and similar) are academic degrees, usually two years, offered at schools like the Harvard T.H. Chan School of Public Health and the University of Michigan. They train industrial hygienists, safety professionals, and occupational health researchers.

For a small business owner, the connection is indirect but real. Graduates of these programs write the standards, run the research, and staff the consulting firms you might hire. The science behind exposure limits, ergonomic guidelines, and noise standards mostly comes from people with these credentials.

If you ever need to hire an in-house safety officer or bring in a consultant, a Certified Safety Professional (CSP) credential from the Board of Certified Safety Professionals or a Certified Industrial Hygienist (CIH) credential from the American Board of Industrial Hygiene is a reasonable screen. Both require a mix of education, experience, and a passed exam. They don't guarantee good judgment. They do signal a baseline of technical knowledge.

For most businesses under 50 employees, a part-time consultant or a well-trained internal champion beats a full-time hire. The spend still pays off. OSHA estimates employers get two to six dollars back for every dollar put into safety programs, through lower workers' comp costs, better productivity, and less absenteeism, though the exact ratio moves with industry and method ^[9].

What is the DoD safety and occupational health program, and what can civilian employers learn from it?

DoD Instruction 6055.01 sets up the Department of Defense safety and occupational health program across every military branch and defense agency. Its framework mirrors OSHA's Recommended Practices, with extra requirements for high-hazard work like munitions handling, aviation, and naval operations ^[2].

Civilian employers aren't bound by DoD rules, but the structure is worth studying. The framework names designated safety officers at every command level, requires mishap reporting with root cause analysis, and schedules formal program assessments. That multi-level ownership model works in large civilian organizations too.

The real lesson is simple. Safety responsibility can't live with one person. In the DoD model, every supervisor is a safety officer for their own unit. That spread of ownership is why safety outcomes in well-run military units can be strong even in dangerous work. Same logic on a factory floor: the shift supervisor should own safety on their shift instead of punting it to the safety manager who rolls in at 8 a.m.

How do you build a safety program without spending 15 hours on paperwork?

A basic program takes far less time than most consultants imply. OSHA's free resources (the Recommended Practices guide, the Job Hazard Analysis booklet, and the model IIPP programs published by State Plan agencies) hand you templates that cover about 80% of what a small business needs.

The other 20% is customization: naming the specific hazards in your shop, the specific procedures your workers follow, and the real people responsible for each one. That part you can't outsource without the whole thing turning generic and useless.

If you want a faster start, SafetyFolio's safety program generator builds a customized written program in about 15 minutes by walking you through your industry, headcount, and hazard exposures. What comes out is a real document you can use, not a placeholder.

The program is never really finished. It's a living document. The businesses that treat it as a one-time compliance checkbox are the ones that end up with a stale binder and a fresh OSHA citation.

Here's roughly what OSHA expects at different sizes:

Employer Size	Minimum Viable Program
1-9 employees	Written hazard assessment, emergency action plan if applicable, standard-specific written programs for any regulated hazards
10-49 employees	Above plus formal training records, incident investigation procedure, annual review
50-249 employees	Above plus designated safety coordinator, formal inspection schedule, contractor safety protocol
250+ employees	Full written program addressing all seven OSHA Recommended Practices elements, formal program evaluation metrics

What common mistakes make safety programs ineffective?

The most common failure is copying a generic template and filing it. The program looks complete. It checks no hazard that exists in your building. It names procedures nobody follows. It assigns duties to job titles you don't have. An OSHA inspector can tell within five minutes that nobody uses it.

The second failure is running the program as paperwork instead of behavior change. Training completion gets tracked. Nobody checks whether a worker can actually perform the safe procedure. Inspections happen on schedule. Findings sit uncorrected for six months.

Third: ignoring near-misses. A near-miss is a free warning. OSHA's investigation data has long shown incidents follow a pattern, many near-misses, then a minor injury, then a serious one. Organizations that investigate near-misses as hard as they investigate recordable injuries break that chain early.

Last, programs that ask only "what does OSHA require?" and never "what could actually hurt someone here?" leave gaps. OSHA standards cover common hazards well, but they can't anticipate every mix of equipment, process, and people in every workplace. The General Duty Clause exists for exactly that reason: you're responsible for recognized hazards even when no specific standard names them.

For industries with specialized programs, our american safety programs and training resource covers sector-specific frameworks.

Frequently asked questions

Does a small business with fewer than 10 employees need a written safety program?

No OSHA rule explicitly requires a small business to keep one unified written safety program. But many individual OSHA standards require written programs for specific hazards (lockout/tagout, hazard communication, respirators) regardless of headcount. In California, every employer of any size must have a written Injury and Illness Prevention Program under Title 8 CCR Section 3203. Other State Plan states have similar rules.

What is the General Duty Clause and how does it relate to safety programs?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm. OSHA uses this clause when no specific standard covers a hazard. Running a workplace with no systematic hazard identification or control process creates General Duty Clause exposure. A documented safety program is your evidence that you took the obligation seriously.

What are the seven elements of OSHA's Recommended Practices for safety programs?

OSHA's 2016 Recommended Practices name seven elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and coordination with contractors and staffing agencies. No single standard mandates all seven for most employers, but together they are OSHA's clearest statement of what an effective program looks like.

How is a safety and health program different from a written safety plan?

A written safety plan is a document. A safety and health program is the ongoing process the document describes: the inspections, training, incident investigations, and management reviews that happen on a schedule. The plan is the map. The program is the trip. A binder on a shelf is a plan. Only active, regular use turns it into a program.

What does OSHA require for safety program training records?

OSHA sets no universal retention rule for all training records, but individual standards do. Hazard Communication training records have no explicit retention period beyond being available for inspection. Bloodborne pathogens training records must be kept for the duration of employment plus 30 years (29 CFR 1910.1030). A safe general practice is keeping all safety training records for employment duration plus three years.

What is the difference between an Injury and Illness Prevention Program (IIPP) and a general safety program?

An IIPP is a specific program format required by California under Title 8 CCR Section 3203. It must name a person responsible for the program, a method for identifying and evaluating hazards, a procedure for correcting them, training provisions, and recordkeeping. Other states run similar programs under different names. A general OSHA safety program follows the same logic but is not always legally mandated by name at the federal level.

How do occupational health and safety master's programs prepare safety professionals?

Graduate occupational health and safety programs cover industrial hygiene, toxicology, ergonomics, epidemiology, safety management systems, and regulatory compliance. Graduates may sit for the Certified Industrial Hygienist (CIH) or Certified Safety Professional (CSP) exams. These professionals build and evaluate safety programs, write standards, and run research that informs OSHA rulemaking. For a small business, hiring a CSP-credentialed consultant is a practical way to reach that expertise without a full-time hire.

Can a safety and health program reduce workers' compensation costs?

Yes, and the evidence holds up. OSHA estimates a two-to-six dollar return for every dollar invested in safety programs, mostly through fewer workers' comp claims, lower absenteeism, and avoided productivity losses. The exact ratio moves with industry, employer size, and program quality. BLS data shows establishments with formal safety programs consistently report lower total recordable injury rates than comparable ones without them.

What should a safety program say about contractors and temporary workers?

Under OSHA's host employer doctrine, when a staffing agency places a temporary worker at your site, both the agency and the host share OSHA compliance duties. Your program should spell out how you onboard contract and temporary workers, what site-specific hazard information you give before work starts, and which training you deliver versus what you require from the agency. Skipping this is one of the most common gaps in small business programs.

How often should workplace safety inspections happen under a safety program?

OSHA's Recommended Practices don't set one inspection frequency, but they call for regular formal inspections. High-hazard industries (construction, manufacturing, logging) should inspect at least monthly. Lower-hazard offices or retail might do quarterly walkthroughs. Informal supervisor observations should run continuously. Any new process, piece of equipment, or chemical should trigger an immediate focused inspection before work begins.

What is incident investigation and why must a safety program include it?

Incident investigation is the process of analyzing injuries, illnesses, and near-misses to find root causes instead of just immediate ones. An OSHA 300 log tells you a worker fractured a wrist. An investigation tells you why: the machine guard came off three months ago and never went back on. Without it, you fix the symptom and the next incident repeats. OSHA recommends investigating incidents within 24 to 48 hours while facts are fresh.

Are there safety program templates OSHA provides for free?

Yes. OSHA's website offers the Recommended Practices for Safety and Health Programs guide, model IIPP programs through Cal/OSHA, the Job Hazard Analysis booklet (OSHA 3071), and eTool resources organized by industry. Several State Plan agencies (California, Washington, Michigan) publish detailed model written programs you can adapt. They're solid starting points, but they need customization to your real hazards to mean anything.

What records does an OSHA inspector typically ask for when reviewing a safety program?

Expect requests for the written program itself, OSHA 300 and 300A injury and illness logs, training records for any regulated hazards on site, inspection logs or reports, incident investigation reports for recordable injuries in the past three years, chemical inventory and safety data sheets, and any corrective action tracking logs. Gaps in these don't automatically mean a citation, but they invite closer scrutiny.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs (2016): Seven core elements of an effective safety and health program, including management leadership, worker participation, hazard identification, and training
2. U.S. Department of Defense, DoD Instruction 6055.01 (Safety and Occupational Health Program): DoD Instruction 6055.01 establishes the DoD safety and occupational health program across all military departments
3. OSHA, General Industry Standards (29 CFR 1910): Specific written program requirements under 29 CFR 1910.147 (lockout/tagout), 1910.134 (respiratory protection), 1910.1200 (hazard communication), and 1910.38 (emergency action plan)
4. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses (2023): Total recordable injury and illness incidence rates by industry, ranging from approximately 0.5 per 100 workers in finance to over 6.0 in animal production
5. OSHA, Job Hazard Analysis (OSHA Publication 3071): OSHA's step-by-step guidance for conducting a job hazard analysis
6. CDC/NIOSH, Hierarchy of Controls: The hierarchy of controls ranks controls from most to least effective: elimination, substitution, engineering, administrative, and PPE
7. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: Employers must provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm
8. California Department of Industrial Relations, Cal/OSHA Title 8 CCR Section 3203 (IIPP): California requires every employer to establish, implement, and maintain a written Injury and Illness Prevention Program
9. OSHA, Business Case for Safety and Health: OSHA estimates employers receive two to six dollars in return for every dollar invested in safety programs
10. OSHA, Process Safety Management Standard (29 CFR 1910.119): Workers must be consulted in the development of process hazard analyses under the PSM standard
11. U.S. Code of Federal Regulations, 29 CFR 1960 (Federal Agency Safety and Health Programs): 29 CFR 1960 establishes the safety and health program structure for federal agencies under Executive Order 12196