EHS safety programs: what they are and how to build one

Last updated 2026-07-09

What is an EHS safety program?

EHS stands for environment, health, and safety. An EHS safety program is the documented system a company uses to prevent injuries, manage environmental risks, and stay legal. It is not a binder on a shelf. It is the actual rules, training records, inspection checklists, and emergency procedures your people use every day.

The "environment" piece covers chemical storage, spill response, and waste disposal under EPA rules. The "health" piece covers occupational exposures: noise, chemicals, ergonomic strain, heat. The "safety" piece is the injury-prevention side, which is where OSHA's general industry and construction standards (29 CFR 1910 and 29 CFR 1926) live. In most small businesses all three overlap constantly, which is why they get bundled under one umbrella.

Some people use "safety program" and "EHS program" interchangeably. Technically an EHS program is broader, because it includes environmental and health exposures that OSHA's safety standards do not always touch. For this article, treat the terms as the same integrated system.

The closest thing to an official federal definition comes from OSHA's Safety and Health Program Management Guidelines, first published in the Federal Register in 1989 and updated as Recommended Practices in 2016. OSHA states the goal is "preventing worker injuries and illnesses and the costs these events impose on workers, families, businesses, and communities." ^[1]

Does OSHA actually require a written EHS safety program?

OSHA does not have one rule that says "every employer must have a written EHS program." What it has is dozens of specific standards, each requiring a written program for a specific hazard. So the answer is no single mandate, but yes in pieces, and most small businesses trip over several pieces at once.

Here are the most common ones:

OSHA Standard	Written Program Requirement
29 CFR 1910.119	Process Safety Management (PSM) program for highly hazardous chemicals
29 CFR 1910.146	Permit-required confined space program
29 CFR 1910.147	Lockout/tagout (energy control) program
29 CFR 1910.1030	Bloodborne pathogen exposure control plan
29 CFR 1910.1200	Hazard Communication program (HazCom)
29 CFR 1910.132	PPE hazard assessment and training (written certification required)
29 CFR 1910.38	Emergency Action Plan (written if 11+ employees)
29 CFR 1926.502	Fall protection plan (construction)

The practical reality: if your facility has any of those hazards, you already owe a written program by law. Most employers carry four to eight overlapping requirements they have never heard of. ^[2]

Beyond the hazard-specific rules, OSHA's General Duty Clause (Section 5(a)(1) of the OSH Act) requires every employer to provide a workplace free from recognized hazards likely to cause death or serious harm. Inspectors use this clause to cite employers who have obvious hazards but no documented control, even when no specific standard names that exact hazard. ^[3]

Some states go further. California (Cal/OSHA) requires every employer to have a written Injury and Illness Prevention Program (IIPP) under California Code of Regulations Title 8, Section 3203. That is a true blanket requirement with no carve-outs. If you operate in a state-plan state, check your state's rules. See the state plans section below.

What are the core elements every EHS program needs?

OSHA's 2016 Recommended Practices for Safety and Health Programs lays out seven core elements. They are not legally binding on their own, but they are what inspectors look for and what the research says actually works. ^[1]

1. Management leadership. Someone at the ownership or senior level has to commit money, set goals, and visibly care. Paper programs that exist because a manager signed a form do not reduce injuries. OSHA is blunt that leadership "sets the tone" for the whole safety culture.

2. Worker participation. The people doing the job find hazards managers never see. Put frontline employees in your hazard walkthroughs, your incident investigations, and your program reviews. Give them a way to report hazards without fear. Retaliation is illegal under Section 11(c) of the OSH Act. ^[3]

3. Hazard identification and assessment. This is the inspection and job hazard analysis (JHA) work. You need a system for regular walkthroughs, change analysis (any time equipment, processes, or materials change), and post-incident analysis. OSHA's Job Hazard Analysis publication (OSHA 3071) gives a step-by-step method. ^[4]

4. Hazard prevention and control. Once you find a hazard, control it using the hierarchy of controls: elimination, substitution, engineering controls, administrative controls, then PPE. PPE comes last because it protects only the worker, never the source. Most enforcement happens because employers jumped straight to PPE. For a deeper look at PPE requirements, see our guide on workplace safety training.

5. Education and training. Every affected employee gets trained before exposure, in a language they understand, with documentation. Requirements vary by standard. Bloodborne pathogen training (29 CFR 1910.1030) happens at initial assignment and annually. Hazard Communication training (29 CFR 1910.1200) happens at hire and whenever a new chemical hazard shows up. ^[5] For how to structure all of it, see a safety and health program should be.

6. Program evaluation and improvement. Review the program at least once a year and after any serious incident. Compare your incident rates against your industry's Bureau of Labor Statistics (BLS) numbers so you know whether you are actually getting better. ^[6]

7. Communication and coordination. Share a worksite with contractors or a host employer, and you need written agreements defining who controls which hazards. This is where small businesses that bring in subs get burned.

Have all seven documented and actually practiced, and you have a functioning EHS program no matter what you call it.

How do injury rates actually change when you have a real EHS program?

The evidence here is solid, and I want to be straight about where it comes from. OSHA's own publications cite a 20 to 40 percent drop in injury and illness rates for workplaces with formal safety and health programs. ^[1] A widely cited 2012 report from the American Society of Safety Professionals (ASSP) found that every dollar spent on safety returns roughly $4 to $6 in reduced workers' compensation, lost productivity, and other costs. That range swings hard by industry, so treat it as directional, not a promise.

The Bureau of Labor Statistics reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, at an incidence rate of 2.4 cases per 100 full-time workers. That rate has fallen for decades, and OSHA credits broad adoption of safety programs as part of the reason. ^[6]

Construction is a different animal. BLS data for 2023 puts the construction fatal work injury rate at 9.6 per 100,000 full-time equivalent workers against a private-sector average of 3.3, roughly three times higher. Some of that gap is higher baseline hazard. Some of it is that small construction firms implement formal EHS programs the least consistently. ^[7]

Small businesses under 50 employees have historically run higher injury rates than large ones. The work is not inherently more dangerous. They are just less likely to have a formal program in place. OSHA's small business outreach data backs the pattern, though exact figures vary by sector.

What is the difference between an EHS program and an IIPP?

An Injury and Illness Prevention Program (IIPP) is a specific type of safety program that Cal/OSHA requires under California Code of Regulations Title 8, Section 3203. Every California employer must have one. The required elements are a named responsible person, a system for employee compliance, hazard communication, hazard identification, accident investigation, hazard correction, training, and recordkeeping. ^[8]

An EHS program is the broader industry term for any integrated system covering safety, health, and environmental compliance. An IIPP is basically the safety-and-health slice of an EHS program, written to California's format.

Operate in California and your IIPP is the foundation. On top of it you layer any required written programs for specific hazards (HazCom, lockout/tagout, and so on) plus any environmental plans required by CalEPA or a local air quality management district.

Operate in a federal-OSHA state and you have no IIPP requirement, but OSHA's Recommended Practices describe an almost identical structure. Building to IIPP requirements is a smart baseline even outside California, because it covers nearly everything an inspector wants to see.

Other state-plan states have their own versions. Washington's Department of Labor and Industries requires an Accident Prevention Program. Oregon OSHA requires a written safety and health program. Check with your state agency directly. The specifics matter.

How do you build an EHS safety program from scratch?

Start with a gap analysis, not a template. Walk your facility and list every hazard category you have: chemical exposures, fall hazards, machine guarding, electrical, ergonomic stressors, fire risk, plus environmental items like waste streams or stormwater discharge. Match each category to the OSHA standard that covers it. That list is your build checklist.

For most small manufacturers, the required written programs are Hazard Communication (29 CFR 1910.1200), Lockout/Tagout (29 CFR 1910.147), Emergency Action Plan (29 CFR 1910.38), and PPE written assessment (29 CFR 1910.132). Add Bloodborne Pathogen exposure control if you have any first-aid responders. Add Confined Space if you have tanks, pits, or utility vaults. ^[2]

A small office needs far less: an Emergency Action Plan, a basic HazCom program for cleaning chemicals, and an ergonomics policy. Short list.

Here is the build sequence that actually works:

1. Write your policy statement. One page, signed by the owner or top manager, stating the commitment and naming the person responsible. 2. Document your hazard inventory from the walkthrough. 3. Write or adapt a standard operating procedure (SOP) for each hazard that has a required written program. 4. Build your training matrix: which employees, which topics, what frequency, how you document it. 5. Create your inspection schedule and checklists. 6. Set up your incident investigation procedure. 7. Set your annual review date.

Starting from zero and need to get compliant fast? SafetyFolio's safety program generator walks this structure in about 15 minutes and produces OSHA-aligned documents tailored to your industry and hazard profile.

The mistake I see most: downloading a generic program and never customizing it to your real equipment, chemicals, and processes. OSHA inspectors ask your employees what the program says. If your HazCom program lists chemicals you do not use, or names an emergency contact number that is dead, the program fails even though it looks complete. It has to match your actual workplace.

What written programs do most small businesses actually need?

The honest answer depends on your industry and hazards. But here is the pattern across common small business types:

Business Type	Most Likely Required Written Programs
Small manufacturer	HazCom, Lockout/Tagout, Emergency Action Plan, PPE assessment, possibly Confined Space
Construction contractor	Fall Protection Plan, HazCom, Emergency Action Plan, PPE assessment
Restaurant / food service	Emergency Action Plan, HazCom (cleaning chemicals), possibly Bloodborne Pathogens
Auto repair shop	HazCom, Emergency Action Plan, PPE assessment, possibly Respiratory Protection
Office / retail	Emergency Action Plan, HazCom (if any chemicals on-site)
Healthcare / dental	Bloodborne Pathogens, HazCom, Emergency Action Plan, Respiratory Protection
Landscaping / agriculture	HazCom, PPE assessment, Heat Illness Prevention (in applicable states)

The hazardous communication program is close to universal, because nearly every workplace has at least some chemicals, even if it is just cleaning products. OSHA's HazCom standard (29 CFR 1910.1200) requires a written program, a chemical inventory list, Safety Data Sheets (SDS) accessible to all employees, and documented training. It lands in the top five most-cited OSHA standards almost every year. ^[9]

Thinking about safety incentives to support these programs? See our article on principles of effective safety incentive programs.

Food businesses carry an extra layer: food safety programs under FDA's FSMA (Food Safety Modernization Act) plus any state health department rules. Those are separate from OSHA and cover product safety, not worker safety, though they often share documentation systems. Our food safety certification program guide covers that lane.

How does OSHA enforce EHS programs and what happens if you do not have one?

OSHA enforces written-program requirements mostly through inspections. Those get triggered by employee complaints, referrals from other agencies, severe injury reports (a hospitalization, amputation, or loss of an eye must be reported within 24 hours), and programmed targeting in high-hazard industries. ^[10]

During an inspection, the compliance officer asks to see your written programs. Cannot produce a written HazCom program while chemicals sit on-site? That is a citable violation under 29 CFR 1910.1200. Same logic for every other standard that requires a written program.

OSHA's penalty structure as of 2024 (adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act):

• Other-than-serious violations: up to $16,131 per violation
• Serious violations: up to $16,131 per violation
• Willful or repeated violations: up to $161,323 per violation

A missing written program is almost always cited as serious, meaning the inspector found a substantial probability that death or serious physical harm could result. ^[10]

The indirect costs usually dwarf the fine. BLS analysis of workers' compensation data consistently shows the average cost of a lost-time workplace injury runs past $40,000 once you add medical costs, wage replacement, productivity loss, and administrative burden. A required hospitalization report triggers a mandatory follow-up inspection in most OSHA regions.

One stubborn myth: small employers (under 10 employees in low-hazard industries) are exempt from some OSHA recordkeeping. True. They are not exempt from the written program requirements themselves. Those still apply.

How do state-plan states change your EHS program requirements?

Twenty-two states and two territories run their own OSHA-approved state plans. ^[11] Every state plan must be "at least as effective" as federal OSHA, and plenty are stricter.

California is the clearest example. Cal/OSHA requires a written IIPP for every employer, no exceptions, versus federal OSHA's hazard-by-hazard approach. California also carries specific written-program requirements for heat illness prevention (Title 8, Section 3395), wildfire smoke (Section 5141.1), and indoor heat (effective 2024 under the indoor heat standard).

Washington (L&I) and Oregon OSHA both require written accident prevention programs. Michigan OSHA, North Carolina OSH, and Virginia OSHA each maintain their own standards that can differ from 29 CFR.

The practical rule: in a state-plan state, start your compliance research at the state agency's website, not OSHA.gov. Federal OSHA lists every state-plan contact at osha.gov/stateplans. ^[11]

Contractors crossing state lines face the worst of it. A general contractor headquartered in Virginia doing a job in California follows California's rules on that California site. The state where the work happens controls, not the state on your letterhead.

How often should you review and update your EHS program?

Many OSHA standards that require written programs also set the review clock. The bloodborne pathogen standard (29 CFR 1910.1030) requires annual review and update. Lockout/tagout (29 CFR 1910.147) requires the energy control procedures reviewed at least annually. The PSM standard (29 CFR 1910.119) requires a process hazard analysis revalidation every five years. ^[2]

For programs with no specific interval in the standard, OSHA's Recommended Practices say review at least annually, and after any triggering event: a workplace injury or illness, a near-miss, a change in process or equipment, a new chemical, a regulatory change, or employee feedback flagging a gap. ^[1]

In practice, the annual review date you set at creation is often the only review that ever happens. That is fine as a floor. What matters is that the review is real, documented, and produces actual changes when the program has drifted out of date.

One thing to update every single year: your chemical inventory list and SDS binder under HazCom. Chemical inventories change constantly. An SDS for a chemical you stopped using, sitting in a binder full of chemicals you do use, creates confusion in an emergency. Purge what you dropped. Add what you brought in.

What does a good EHS program actually look like on paper?

A program document should read like something a frontline employee can use, not something a lawyer wrote for another lawyer. If your lockout/tagout procedure for one machine runs four pages of dense legalese, nobody follows it. The best programs work in two layers: a policy and procedure section that documents your commitments and compliance framework, and job-specific one-pagers (or laminated cards) posted right at the point of use.

Each written program should carry, at minimum, the purpose and scope, the person responsible, the specific procedures employees must follow, the training requirements, and the record-retention rules. That is usually two to four pages per program. A small manufacturer with six required written programs ends up with roughly 15 to 25 pages total, not counting training records and inspection logs.

Records matter as much as the procedures. OSHA sets retention periods by standard. Bloodborne pathogen training records: three years. Medical records under 29 CFR 1910.1020: duration of employment plus 30 years. OSHA 300 logs: five years. ^[12]

SafetyFolio generates these documents in a format built for small businesses, filling in your company-specific details and flagging which standards apply to your industry. Even so, no generator replaces walking your actual facility to confirm the documents match reality.

Want the philosophy behind what makes a safety program work, more than what it must contain? Our article on a safety and health program should be goes deep on that question.

What are the most common EHS program mistakes small businesses make?

Skipping the environmental layer entirely. Most owners hear "EHS program" and think only about OSHA safety standards. But if you generate hazardous waste, discharge to a storm drain, or use regulated refrigerants, you carry EPA obligations that are separate from OSHA and come with their own penalties. The EPA's small business compliance assistance resources are the right starting point for that layer. ^[13]

Generic programs that never name your specific hazards. An inspector will point and say, "Show me the SDS for that cleaner." If your employee cannot, the program fails. Every program has to be site-specific.

Training with no paper trail. The training happened, but there is no sign-in sheet, no competency record, nothing. OSHA does not accept "we trained them" on faith. Keep signed training records for every required topic.

No incident investigation process. After an injury or near-miss, most small businesses just push it through workers' comp and move on. A formal investigation that finds root cause and assigns corrective actions is required by the spirit of every OSHA program standard and explicitly required by California's IIPP rule. It is also how you stop the next one.

Forgetting contractors. Bring in a contractor and you are often still the controlling employer. OSHA's multi-employer citation policy means you can be cited for hazards your contractor created on your property if you had the authority to correct them or control the site. Get certificates of insurance, verify contractors run their own safety programs, and put safety expectations in writing before work starts. ^[14]

Frequently asked questions

What does EHS stand for in safety?

EHS stands for environment, health, and safety. It bundles three compliance areas: environmental rules (mostly EPA), occupational health (chemical and physical exposure limits), and safety (injury prevention under OSHA). The three overlap constantly in real workplaces, which is why most companies run them as one program instead of three separate ones.

Is an EHS safety program legally required for small businesses?

Not as a single document, but most small businesses have four to eight specific OSHA standards that each require a written program. The most common are Hazard Communication (29 CFR 1910.1200), Emergency Action Plan (29 CFR 1910.38), and Lockout/Tagout (29 CFR 1910.147). California employers also face a blanket written IIPP requirement under Title 8, Section 3203, regardless of size or industry.

How long does it take to build an EHS program from scratch?

For a small business with straightforward hazards, building the core written programs takes eight to twenty hours if you do it yourself and know the standards a little. A focused program generator cuts that time by asking the right questions and outputting compliant documents. The bigger investment is the initial walkthrough and hazard identification, which you cannot skip.

What is the difference between a safety program and an EHS program?

A safety program usually means only OSHA injury-prevention requirements. An EHS program adds environmental compliance (EPA waste, emissions, spill rules) and occupational health (exposure monitoring, medical surveillance). For most small businesses the practical difference is small, but regulated industries with chemical processes, air emissions, or hazardous waste need all three layers documented separately.

How much do OSHA fines cost if you do not have required written programs?

As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation, and willful or repeated violations reach $161,323 per violation. A missing written program like HazCom or lockout/tagout is almost always cited as serious. Multiple missing programs mean multiple citations, and penalties add up fast even for small employers.

What is an IIPP and who is required to have one?

An Injury and Illness Prevention Program (IIPP) is a written safety program Cal/OSHA requires for every California employer under Title 8, Section 3203. It must name a responsible person, document hazard identification and correction, include employee training, and establish recordkeeping. No federal OSHA state has an equivalent blanket requirement, though several state-plan states have similar mandates.

How do you do a job hazard analysis for an EHS program?

A job hazard analysis (JHA) breaks a task into steps, names the hazard in each step, and documents the control. OSHA's publication OSHA 3071 gives a structured method. Start with jobs that have had injuries or near-misses, then move to high-consequence tasks. Get frontline workers involved, because they see details managers miss. Document it, train to it, and update it when the task changes.

Does OSHA require employee participation in safety programs?

OSHA's Recommended Practices list worker participation as one of seven core elements and state workers "must be involved" in hazard identification and program development. Section 11(c) of the OSH Act prohibits retaliation against employees who raise safety concerns. Worker participation is not mandated in a single standard, but its absence is a red flag during inspections and is required under Cal/OSHA's IIPP rule.

What records does an EHS program require you to keep?

Retention varies by standard. OSHA 300 injury logs: five years. Bloodborne pathogen training records: three years. Medical exposure records (29 CFR 1910.1020): duration of employment plus 30 years. Respiratory protection fit-test records: until the next test. Keep all training sign-in sheets, inspection logs, and incident reports indefinitely if space allows. These are the first documents OSHA asks for in an inspection.

Can you use an EHS program template, or does it need to be custom?

Templates are a fine starting point, but every program must be customized to your actual workplace. Inspectors expect programs to reference your specific chemicals, equipment, emergency contacts, and procedures. A generic lockout/tagout template that never names your machines is not a compliant program. The customization step is not optional, even when it takes only an hour per document.

How is an EHS program different from an emergency action plan?

An Emergency Action Plan (EAP) is one required component of a broader EHS program. Under 29 CFR 1910.38, employers with 11 or more employees must have a written EAP covering evacuation procedures, emergency contacts, and assembly points. The EHS program is the larger system that holds the EAP plus all the hazard identification, training, and prevention programs.

What industries need the most complex EHS programs?

Process industries with highly hazardous chemicals face the most complexity, because they trigger OSHA's Process Safety Management standard (29 CFR 1910.119), which requires a full process hazard analysis, mechanical integrity program, management of change procedures, and emergency response planning. Construction, healthcare, and manufacturing also carry above-average burdens. Low-hazard retail and office environments need much simpler programs.

How do you handle EHS programs when using contractors on your worksite?

Under OSHA's multi-employer citation policy, you can be cited for hazards your contractor created if you are the controlling or correcting employer on the site. Before any contractor starts, verify they have their own safety programs, get proof of insurance, and write safety responsibilities into the contract. Hold a pre-work safety meeting and document it. Not knowing about a contractor's unsafe practices is not a defense.

How often should you update your EHS safety program?

Review the whole program at least annually and update it after any serious injury, near-miss, process change, new chemical, or regulatory change. Specific standards set their own intervals: bloodborne pathogens require annual review, lockout/tagout requires annual procedure review, and PSM hazard analyses must be revalidated every five years. Document every review with a date and the reviewer's signature.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA defines the goal of safety and health programs as preventing worker injuries and illnesses and cites 20-40% injury rate reduction for workplaces with formal programs
2. OSHA, Standards requiring written programs (29 CFR 1910 index): Multiple 29 CFR 1910 standards require specific written programs including 1910.119, 1910.146, 1910.147, 1910.1030, 1910.1200, 1910.132, and 1910.38
3. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause and Section 11(c): Section 5(a)(1) requires employers to provide a workplace free from recognized hazards; Section 11(c) prohibits retaliation against employees who raise safety concerns
4. OSHA, Job Hazard Analysis, OSHA 3071: OSHA's JHA publication (OSHA 3071) provides a step-by-step method for identifying and controlling workplace hazards by breaking tasks into steps
5. OSHA, Hazard Communication Standard 29 CFR 1910.1200: HazCom standard requires written program, chemical inventory, SDS access, and documented training at hire and when new chemical hazards are introduced
6. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2023: BLS reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, with an incidence rate of 2.4 cases per 100 full-time workers
7. Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2023: Construction industry fatal work injury rate was 9.6 per 100,000 full-time equivalent workers in 2023 compared to the private-sector average of 3.3
8. OSHA, Top 10 Most Frequently Cited Standards: Hazard Communication (29 CFR 1910.1200) is consistently among the top five most-cited OSHA standards annually
9. OSHA, Penalties: OSHA 2024 maximum penalty for serious violations is $16,131 per violation; willful or repeated violations up to $161,323 per violation
10. OSHA, State Plans: Twenty-two states and two territories operate OSHA-approved state plans that must be at least as effective as federal OSHA
11. OSHA, Access to Employee Exposure and Medical Records, 29 CFR 1910.1020: Medical records must be kept for duration of employment plus 30 years; OSHA 300 logs must be retained five years
12. EPA, Small Business Compliance Assistance: EPA provides small business compliance assistance resources for hazardous waste, emissions, and spill obligations separate from OSHA
13. OSHA, Multi-Employer Citation Policy, CPL 02-00-124: OSHA's multi-employer citation policy allows citations of controlling and correcting employers for hazards created by contractors on shared worksites