Elements of a safety program: what every business actually needs

Last updated 2026-07-09

What are the elements of a safety program?

OSHA published its Recommended Practices for Safety and Health Programs in 2016, updating guidance first issued in 1989. The document lays out seven core elements that, together, form what OSHA calls an effective safety and health program. ^[1]

Here are the seven:

1. Management leadership 2. Worker participation 3. Hazard identification and assessment 4. Hazard prevention and control 5. Education and training 6. Program evaluation and improvement 7. Communication and coordination (for multi-employer worksites)

You'll see different numbering in different sources. Some consultants break out worker participation as its own bucket. Others tuck it under management leadership. The content underneath is the same. What matters is that your program addresses each area, not how you label the tabs in the binder.

A few of these elements are spelled out in specific OSHA standards. The rest ride on the General Duty Clause, Section 5(a)(1) of the OSH Act, which requires every employer to provide a workplace free from recognized hazards. ^[2] Think of the seven elements as the skeleton. The written programs, training records, and inspection logs are the muscle that makes the thing move.

Is a written safety program actually required by OSHA?

It depends on what hazards live in your workplace. That's the honest answer, and anyone who tells you differently is selling something.

OSHA has no single rule saying "every employer must have a written safety program." What it has is roughly 50 standards that each require a written program for a specific hazard. ^[3] A few examples:

• Hazard Communication (29 CFR 1910.1200) requires a written HazCom program if you keep hazardous chemicals on site.
• Lockout/Tagout (29 CFR 1910.147) requires a written energy control program.
• Respiratory Protection (29 CFR 1910.134) requires a written respiratory protection program.
• Emergency Action Plans (29 CFR 1910.38) require a written plan if you have 11 or more employees.

Use chemicals, run energized equipment, or employ a crew of any size, and you almost certainly owe OSHA multiple written programs. ^[4]

State Plan states go further. California's Cal/OSHA (8 CCR 3203) requires every California employer, no matter the industry or size, to keep an Injury and Illness Prevention Program in writing. ^[5] Washington, Oregon, Hawaii, and around 20 other states have similar mandates under their own plans.

Even if no specific standard touches your business, inspectors use the General Duty Clause to cite employers who ignored recognized hazards. Having nothing on paper makes that citation easy to write and hard to fight.

What does management commitment look like in practice?

Management commitment is Element 1 for a reason. Injury rates track back to whether leaders visibly treat safety as real, not whether they hung a poster in the break room.

In practice it means a handful of concrete things. Someone with real authority, ideally an owner or senior manager, signs the safety policy and is named responsible for it. Safety gets line items in the budget: PPE replacement, paid training time, equipment maintenance. Managers show up for inspections and incident reviews instead of leaving it all to "the safety person."

OSHA's Recommended Practices describe management leadership as "establishing safety and health as a core organizational value" and making "clear expectations for safety and health responsibility." ^[1] That's the official language. In plain terms: the owner doesn't walk past a trip hazard without saying something.

One thing gets skipped constantly. Put the program in writing, date it, and sign it. When an inspector asks who owns safety here, you want a document that answers in one sentence, not a manager clearing his throat.

How do you identify and assess hazards at your workplace?

Hazard identification is the diagnostic step. You can't control what you never found.

The standard approach uses three methods. Walk the place: a baseline survey where someone physically inspects the facility and documents conditions, equipment, and tasks. Read the history: pull your OSHA 300 logs and near-miss reports to spot patterns. Ask the crew: the people doing the job every day know where the risk hides better than anyone strolling through with a clipboard. ^[1]

For specific tasks, OSHA's Job Hazard Analysis (JHA) guidance walks you through breaking any job into steps and naming the hazard at each one. ^[6] A JHA for a forklift operator looks nothing like one for a painter. That's the point.

Hazards sort into a few broad buckets:

Hazard Type	Examples
Physical	Noise, heat, radiation, slips/trips
Chemical	Solvents, dusts, fumes, corrosives
Biological	Bloodborne pathogens, mold
Ergonomic	Repetitive motion, awkward posture, heavy lifting
Safety	Struck-by, caught-in, fall, electrical

The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries and illnesses in the private sector in 2023. ^[7] Falls, slips, and trips alone were about 18% of them. Skip fall hazards and you've skipped one of the most common ways American workers get hurt.

Write down what you find. A hazard log that shows you spotted a problem, rated its severity, and acted on it is exactly the evidence that proves good faith to OSHA and helps you spend limited money where it counts.

What is hazard prevention and control, and how does the hierarchy of controls work?

Finding hazards only helps if you do something about them. Hazard prevention and control is the action phase, and it follows a set priority order called the hierarchy of controls.

From most effective to least:

1. Elimination: physically remove the hazard 2. Substitution: swap in something less hazardous 3. Engineering controls: isolate people from the hazard (guards, ventilation) 4. Administrative controls: change how the work gets done (scheduling, procedures, training) 5. Personal protective equipment: protect the worker as the last line

OSHA's guidance and NIOSH both lay out this hierarchy the same way. ^[8] PPE sits at the bottom because it does nothing to the hazard itself. If the respirator seal fails, the worker breathes it. An engineering control keeps working even when someone is distracted or having a rotten day.

Small shops won't always have the budget for an engineering fix on day one. That's real life. The move is to document that you worked the hierarchy: you considered elimination, it wasn't feasible, you put interim administrative controls in place, and you set a timeline for the permanent fix. That paper trail matters.

For any hazard that can kill or maim and isn't fully controlled, interim controls are not optional. "We'll fix it next quarter" is not an answer OSHA accepts for an imminent danger.

What safety training does OSHA require?

Training is where safety programs fall apart on paper, and where OSHA finds a big share of its violations in the field.

There's no single training standard. OSHA has dozens, each tied to a hazard or an industry. Our workplace safety training guide covers the specifics, but the broad rules hold across most standards:

• Training happens before initial assignment to hazardous work
• Training is delivered in a language and vocabulary workers understand
• Training is documented (a written record of who, what, when)
• Retraining kicks in when a process changes, when an incident shows the training failed, or on the schedule the specific standard sets

Some of the most frequently cited training standards:

Standard	Topic	Documentation Required?
29 CFR 1910.1200	HazCom / GHS	Yes
29 CFR 1910.147	Lockout/Tagout	Yes
29 CFR 1910.132	PPE hazard assessment and training	Yes
29 CFR 1910.134	Respiratory protection	Yes
29 CFR 1926.503	Fall protection (construction)	Yes

The language requirement is not negotiable, and small employers trip on it most. OSHA has issued letters of interpretation stating plainly that training given only in English, to workers who aren't English-proficient, does not meet the standard. ^[9]

Keep training records where you can grab them fast. A binder, a spreadsheet, a software system, whatever. When OSHA shows up, training documentation is usually the first thing the inspector asks to see.

What should an emergency action plan include?

An Emergency Action Plan (EAP) must be in writing for employers with 11 or more employees under 29 CFR 1910.38. Employers with 10 or fewer can deliver the plan orally, but writing it down still protects you. ^[4]

A compliant EAP has to cover:

• Procedures for reporting fires and other emergencies
• Evacuation procedures and exit route assignments
• Procedures to account for all employees after an evacuation
• Procedures for employees who stay to run critical operations before they leave
• Rescue and medical duties for assigned employees
• Names or job titles of people employees can contact for more detail

That list comes straight from 29 CFR 1910.38(c). ^[4] The plan has to be in writing, kept in the workplace, and available for employees to read.

Evacuation drills aren't explicitly required by the EAP standard for most general industry employers. But OSHA has used the General Duty Clause to cite employers who wrote a plan and never practiced it. Run at least one drill a year and note it in your records. It's worth the hour.

Store or use hazardous chemicals above threshold quantities and you may also owe obligations under 29 CFR 1910.119 (Process Safety Management) or EPA's Risk Management Program, which stack extra emergency planning on top of the basic EAP.

How should you investigate workplace incidents and near misses?

Incident investigation is the most neglected element in small business safety programs. Most owners treat an injury as paperwork: fill out the 301, log it on the 300, done. That misses the whole point.

The goal of an investigation is root cause, not blame. The question isn't "who screwed up." It's "what in our system let this happen." Human error is almost always a symptom. The real causes are thin training, missing guarding, fuzzy procedures, time pressure, or equipment nobody maintained.

A basic investigation should:

1. Preserve the scene before anything gets moved or cleaned 2. Interview the injured worker, witnesses, and the supervisor 3. Document physical conditions (photos help) 4. Trace the sequence of events back to contributing factors 5. Name corrective actions and assign owners and deadlines 6. Follow up to confirm the fixes actually happened

Investigate near misses the same way. A near miss is a free warning. The thing that almost hurt someone this week will hurt someone next month if nothing changes.

For recordkeeping, you have to log a work-related injury or illness on the OSHA 300 if it results in days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or diagnosis of a significant injury by a healthcare professional. ^[10] Employers with 10 or fewer workers in low-hazard industries are partially exempt from routine recordkeeping, but everyone still has to report fatalities and severe injuries.

How do you evaluate whether your safety program is actually working?

A safety program that sits in a binder and never gets opened isn't a program. It's a document that gathers dust and gives you false comfort.

Program evaluation means checking, on a schedule, whether the program is current, whether people follow it, and whether it produces results. OSHA's Recommended Practices suggest doing this at least once a year and after any significant change to operations, processes, or equipment. ^[1]

What to look at:

• Injury and illness rates against the industry average (BLS publishes NAICS-specific rates every year)
• Near-miss and first-aid trends
• Whether every required written program is up to date
• Training completion, and whether any retraining is overdue
• Inspection findings, and whether corrective actions actually closed
• Whether supervisors and workers can tell you what the program expects of them

The most honest number is your OSHA recordable rate, the Total Recordable Incident Rate (TRIR). TRIR = (number of recordables x 200,000) / total hours worked. Set your TRIR next to the BLS average for your NAICS code and you'll know whether you beat your peers or lag them. ^[7]

Don't grade the program from a desk. Walk the floor. Talk to workers. Ask a supervisor to explain the lockout procedure cold. If they can't, the training either never happened or didn't stick. That's the kind of finding that stops the next serious injury before it happens.

What written programs does OSHA require for small businesses?

"Small business" is not an exemption under most OSHA standards. The requirement attaches to the hazard, not the headcount. A five-person machine shop that runs chemicals and powered equipment needs essentially the same written programs as a 50-person operation.

The programs employers need most often, by standard:

Written Program	Standard	Who Needs It
Hazard Communication Program	29 CFR 1910.1200	Any employer with hazardous chemicals
Lockout/Tagout Program	29 CFR 1910.147	Employers with energized equipment requiring service
Respiratory Protection Program	29 CFR 1910.134	Employers requiring respirator use
Bloodborne Pathogens Exposure Control Plan	29 CFR 1910.1030	Healthcare, first aid, janitorial with exposure
Emergency Action Plan	29 CFR 1910.38	11+ employees; any size if required by other standards
Fire Prevention Plan	29 CFR 1910.39	When referenced by other standards
Hearing Conservation Program	29 CFR 1910.95	Noise at or above 85 dBA TWA
Personal Protective Equipment Program	29 CFR 1910.132	Any employer requiring PPE

For hazardous communication specifically, the written program has to spell out how you keep SDSs, how you label containers, and how you train people. None of that is optional for a business that uses cleaning chemicals, paints, adhesives, or industrial fluids.

Staring at this list and seeing gaps? That's useful. Knowing what you're missing is the first step to fixing it. SafetyFolio's safety program generator produces OSHA-compliant written programs for your specific hazards in about 15 minutes, without paying a consultant to retype standard language.

Our guide to the principles of effective safety incentive programs covers how to build in positive reinforcement without tripping OSHA's anti-retaliation rules.

How do multi-employer worksites change safety program requirements?

Run a general contracting business, a staffing agency, or any operation that shares a worksite with subs or temp workers, and your safety obligations grow.

OSHA's multi-employer citation policy lets the agency cite more than one employer for the same hazard. The "creating employer" who made the hazard, the "exposing employer" whose workers face it, the "correcting employer" tasked with the fix, and the "controlling employer" who directs the work can each catch a citation. ^[11] Being a subcontractor doesn't shield you if your workers are exposed to something you could reasonably have corrected.

For staffing agencies and host employers, OSHA's guidance is that both share responsibility for temporary worker safety. The host is usually on the hook for site-specific hazard training and day-to-day conditions. The staffing agency handles general safety training and makes sure the host provides a safe environment. ^[12] Spell that split out in the contract between them.

Element 7 of OSHA's Recommended Practices speaks to exactly this: coordination and communication on shared sites should be formal, with clear agreements about who controls which hazards. ^[1] If your business works alongside another employer's workers on the regular, this part of your program needs to name names, not recycle generic boilerplate.

What does a good safety program actually cost to build?

The range is wide, and it's mostly a function of how you build it.

Hire a safety consultant to write a custom program from scratch and a small business typically pays $1,500 to $5,000 or more, depending on how many written programs you need and how complicated your operation is. That figure comes from informal market surveys. OSHA doesn't publish consulting cost data, so treat it as a rough benchmark, not gospel.

Buy a pre-written template bundle from a trade association or safety publisher and you'll spend $200 to $600. But templates need real customization to match your workplace, your equipment, and your actual procedures. A template that doesn't fit your operation is worse than nothing in a way, because it implies you addressed something you never did.

Build it yourself with OSHA's free guidance, publications, and the free On-Site Consultation Program (available in every state, 50-plus locations, walled off from enforcement) and it costs nothing but time. ^[13] That consultation program is badly underused by small businesses. It's free, it's confidential, and it prioritizes small shops. Consultants won't issue citations. They help you find and fix problems.

The real cost of skipping a program shows up in penalties and injury bills. OSHA's maximum penalty for a serious violation is $16,550 per violation as of 2024, and willful or repeat violations can hit $165,514 per violation. ^[3] A workers' comp claim for a serious back injury can run $40,000 to $80,000 in direct costs before you count lost productivity, replacement hiring, and retraining. The math on prevention isn't close.

Want a solid first draft without a consultant? SafetyFolio's generator walks you through your specific hazards and produces the required written programs, ready to customize and sign.

Frequently asked questions

What are the 7 elements of a safety program?

OSHA's Recommended Practices for Safety and Health Programs names seven: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and coordination on multi-employer worksites. Every effective program addresses all seven, though the specific written documents and procedures vary by industry and hazard profile.

Do small businesses need a written safety program?

Most do. OSHA has no blanket rule requiring one, but roughly 50 specific standards require written programs tied to specific hazards. If your business uses chemicals, runs powered equipment, or has workers who need PPE, multiple written programs are almost certainly required. State Plan states like California require a written Injury and Illness Prevention Program from every employer regardless of size.

What is the most important element of a safety program?

Management commitment. Injury rates correlate most strongly with whether leadership treats safety as a real priority instead of a compliance exercise. An employer can have perfect written programs and still run a dangerous workplace if supervisors don't enforce them. The reverse is also true: strong leadership on safety tends to pull every other element up over time.

What is the difference between a safety program and a safety plan?

People use the terms interchangeably, but in practice a safety program is the whole system: management structure, training, hazard controls, and evaluation. A safety plan usually means a single document for one hazard or situation, like an emergency action plan or a fall protection plan. Your safety program contains multiple specific plans inside it.

How often should a workplace safety program be reviewed and updated?

At least annually, per OSHA's Recommended Practices. Review it again after any incident or near miss, after a significant change in operations or equipment, after adding a new chemical or process, and after any OSHA inspection or citation. Programs nobody has touched in three or more years are almost always out of date and out of compliance.

What OSHA standards require a written program?

The common ones include Hazard Communication (29 CFR 1910.1200), Lockout/Tagout (29 CFR 1910.147), Respiratory Protection (29 CFR 1910.134), Bloodborne Pathogens (29 CFR 1910.1030), Emergency Action Plans (29 CFR 1910.38), Hearing Conservation (29 CFR 1910.95), and PPE (29 CFR 1910.132). The list grows depending on your industry and specific hazards.

What is a Job Hazard Analysis and do I need one?

A Job Hazard Analysis (JHA), sometimes called a Job Safety Analysis, is a written breakdown of a task by step, with the hazard at each step identified and the control noted. OSHA recommends one for any task where injury could result. They aren't always required by a specific standard, but they're strong evidence of hazard assessment and make good training tools.

What is the hierarchy of controls in safety?

It's the priority order for controlling hazards: elimination first, then substitution, then engineering controls, then administrative controls, then PPE last. Higher-level controls work better because they reduce or remove the hazard itself instead of relying on worker behavior. OSHA and NIOSH both describe this hierarchy in their guidance, and it's baked into several specific standards.

What are OSHA penalties for not having a safety program?

OSHA cites violations of specific written program requirements. Serious violations carry penalties up to $16,550 per violation as of 2024. Willful or repeat violations can reach $165,514 per violation. An employer with no safety program at all who suffers a fatality may face multiple willful citations at once. Penalties adjust for employer size, good faith, and history.

What is OSHA's free consultation service for small businesses?

OSHA's On-Site Consultation Program gives free, confidential safety and health advice to small and medium-sized businesses, with priority for high-hazard industries. Consultants help identify hazards, suggest fixes, and assist with written programs. The service is completely separate from OSHA enforcement. Consultants do not issue citations, and their findings are not shared with enforcement staff.

How do I know if my safety program meets OSHA requirements?

Compare your written programs against the specific CFR standards that apply to your hazards. For each required program, check that it covers every element the standard lists, that it's signed and dated, that training records back it up, and that it reflects your current operations. OSHA's website publishes the full text of every standard. The free consultation service is the most reliable way to get an expert review.

What records does OSHA require me to keep as part of my safety program?

At minimum: training records for each hazard-specific standard (who, what, when), OSHA 300 injury and illness logs (if you have 11+ employees and aren't in a partially exempt industry), OSHA 301 incident reports, hazard assessment documentation, equipment inspection and maintenance records, and medical surveillance records where required. Retention periods vary by standard. Bloodborne pathogen medical records must be kept 30 years.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA identifies seven core elements of an effective safety and health program, including management leadership, worker participation, hazard identification, hazard prevention and control, education and training, program evaluation, and multi-employer coordination.
2. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: The General Duty Clause requires every employer to provide a workplace free from recognized hazards likely to cause death or serious physical harm.
3. OSHA, Penalties: OSHA's maximum penalty for a serious violation is $16,550 per violation; willful or repeat violations can reach $165,514 per violation as of 2024.
4. OSHA, 29 CFR 1910.38, Emergency Action Plans: 29 CFR 1910.38 requires a written Emergency Action Plan for employers with 11 or more employees and specifies the required elements including evacuation procedures, employee accounting, and contact information.
5. OSHA, Job Hazard Analysis (Publication 3071): OSHA's Job Hazard Analysis guidance describes how to break tasks into steps, identify hazards at each step, and determine preventive measures.
6. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses, 2023: BLS reported 2.6 million nonfatal workplace injuries and illnesses in the private sector in 2023; falls, slips, and trips accounted for approximately 18% of cases.
7. NIOSH, Hierarchy of Controls: NIOSH describes the hierarchy of controls as: elimination, substitution, engineering controls, administrative controls, and PPE, in order from most to least effective.
8. OSHA, Training Standards Policy Statement (letters of interpretation on employee training): OSHA has stated in interpretation letters that training given only in English to workers who are not English-proficient does not satisfy the training requirement.
9. OSHA, 29 CFR 1904, Recording and Reporting Occupational Injuries and Illnesses: 29 CFR 1904 requires employers to record work-related injuries and illnesses on the OSHA 300 log when they result in days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or diagnosis by a healthcare professional.
10. OSHA, Multi-Employer Citation Policy (CPL 02-00-124): OSHA's multi-employer citation policy allows the agency to cite creating, exposing, correcting, and controlling employers for the same hazard on a shared worksite.
11. OSHA, Temporary Worker Initiative: OSHA's Temporary Worker Initiative establishes that both staffing agencies and host employers share responsibility for temporary worker safety, with host employers primarily responsible for site-specific hazard training.
12. OSHA, On-Site Consultation Program: OSHA's On-Site Consultation Program provides free, confidential safety and health advice to small and medium-sized businesses; consultants do not issue citations and findings are not shared with enforcement.