Employee safety program: what it is, what OSHA requires, and how to build one

Last updated 2026-07-09

What is an employee safety program?

An employee safety program is a documented, employer-run system for finding hazards before they hurt anyone and keeping workers safe day to day. It is not a poster on a wall. It is not a one-time training video. It is a living set of written policies, procedures, and records that tells every person in the building what the risks are, what controls exist, and what to do when something goes wrong.

OSHA states the purpose plainly. Its 2016 Recommended Practices for Safety and Health Programs say such programs help employers and workers "proactively address workplace hazards before they cause injury, illness, or death." ^[1] Read that again. The point is prevention, not paperwork.

In practical terms, a program covers seven things at minimum: management commitment (someone is accountable), worker participation (employees help spot hazards), hazard identification, hazard controls, education and training, program evaluation, and coordination with contractors. Those elements come straight from OSHA's framework, and they apply to general industry, construction, maritime, and agriculture the same way. ^[1]

Small businesses sometimes assume a safety program is a big-company thing. That is wrong. OSHA holds every employer, no matter the size, to the General Duty Clause under Section 5(a)(1) of the OSH Act, which requires a workplace "free from recognized hazards." ^[2] A written safety program is how you show you are meeting that duty.

Does OSHA require a written employee safety program?

OSHA has no single universal rule that says "every employer must have a written safety program." What it has instead is a set of standards, each demanding a written program for a specific hazard, plus the General Duty Clause covering everything else. Add up the standards that touch your workplace and you almost certainly have a written obligation already.

Here is where written programs are required by CFR number:

Standard	CFR Reference	What it requires in writing
Hazard Communication	29 CFR 1910.1200(e)	Written HazCom program with SDS procedures and labeling
Lockout/Tagout	29 CFR 1910.147(c)(1)	Written energy control program
Respiratory Protection	29 CFR 1910.134(c)	Written respiratory protection program
Emergency Action Plan	29 CFR 1910.38(b)	Written EAP for most employers
Fire Prevention Plan	29 CFR 1910.39(b)	Written FPP for applicable employers
Personal Protective Equipment	29 CFR 1910.132(d)	Written hazard assessment certification
Bloodborne Pathogens	29 CFR 1910.1030(c)(1)	Written Exposure Control Plan
Process Safety Management	29 CFR 1910.119(e)	Written Process Hazard Analysis

If your workplace touches any of these hazards (and most do), you have a legal obligation to put something in writing. The smart move is to roll all of it into one coherent program instead of babysitting seven disconnected documents. ^[3]

Several states go further. California's Injury and Illness Prevention Program law under Title 8, CCR Section 3203 requires every employer, including one-person shops, to keep a written IIPP. ^[4] Washington, Oregon, Hawaii, Minnesota, and other state-plan states have similar mandates. If you are not in a federal OSHA state, check your state plan before you assume anything.

For the structural view of what a program should be covering, see our guide on a safety and health program should be.

Why does a safety program actually matter? (The numbers)

The business case is not abstract. The Bureau of Labor Statistics recorded 5,486 fatal work injuries in the United States in 2022, the highest count since 2016. ^[5] Non-fatal injuries and illnesses that pulled workers off the job totaled 1,057,400 cases in private industry that same year. ^[5]

The Liberty Mutual Workplace Safety Index, which draws on BLS and NCCI data, put the cost of the most disabling workplace injuries at $167 billion in direct costs in 2022, or roughly $1 billion every 47 hours. ^[6] Those are direct costs only: medical treatment, indemnity payments, legal fees. Layer on the indirect costs (retraining, lost productivity, damaged equipment, administrative time) and the multiplier usually runs 2x to 4x depending on the industry.

OSHA's own analysis found that every $1 invested in workplace safety returns $4 to $6 through lower workers' comp costs, less absenteeism, and better productivity. ^[1] Nobody has clean data on that return figure because it swings hard by industry and hazard, but the direction is consistent across studies.

Small employers feel this harder. A lost-time injury that a Fortune 500 company writes off as a rounding error can erase a quarter's profit for a 20-person shop.

What are the seven core elements every safety program needs?

OSHA's Recommended Practices for Safety and Health Programs build a program around seven elements. Think of them as the skeleton. Your written procedures are the muscle you hang on it.

1. Management leadership. Someone with real authority owns the program, sets goals, allocates budget, and shows up. A program owned by nobody gets followed by nobody.

2. Worker participation. Workers know where the real hazards hide. They need a channel to report them with no fear of payback. OSHA's anti-retaliation provisions under 29 CFR 1904.35 prohibit discouraging accurate injury reporting. ^[7]

3. Hazard identification and assessment. Regular inspections, incident investigations, and a hazard reporting system. This is where a Job Hazard Analysis (JHA) lives. Walk the floor, write down what could go wrong, and rank it by severity.

4. Hazard prevention and control. Work the hierarchy of controls: elimination first, then substitution, then engineering controls, then administrative controls, and PPE last. PPE is the last line of defense, not the first move. See our overview of workplace safety training for how training backs up each control layer.

5. Education and training. Workers need to know the specific hazards of their job before they start, when procedures change, and after incidents. Requirements vary by standard. HazCom training is required before workers touch chemicals; respirator fit-testing under 29 CFR 1910.134 has to happen before first use. The general rule is simple: if the hazard exists, training comes before exposure.

6. Program evaluation and improvement. Review the program at least once a year. Track leading indicators (near-misses reported, inspections completed, training current) next to lagging ones (injury rates, OSHA recordables). A program nobody evaluates never gets better.

7. Communication and coordination. If you use contractors, staffing agencies, or temps, your hazard information and safety rules have to reach them too. Host employers share responsibility under OSHA's multi-employer citation policy.

How do you build an employee safety program step by step?

A program from scratch feels like too much until you break it into a sequence. Here is the order that works for small employers.

Step 1: Assign ownership. Pick a person, not a title. That person owns the program, answers OSHA's questions, and keeps the records. In a 10-person shop it is usually the owner or ops manager. At 50 people it might be a dedicated safety coordinator.

Step 2: Do a baseline hazard assessment. Walk every work area. Write down what you see: chemicals, heavy equipment, fall exposures, electrical panels, ergonomic problems, temperature extremes. You are not fixing anything yet. You are building a catalog. OSHA's free hazard identification tools at osha.gov make a decent checklist baseline. ^[1]

Step 3: Write your core program documents. Start with the standards that apply to you (see the table above). Handle chemicals? Your HazCom program under 29 CFR 1910.1200 comes first. ^[3] Got equipment with lockout potential? Write the energy control program. Build outward from the specific requirements.

This is where a tool like SafetyFolio's safety program generator saves real time. Instead of staring at a blank document, you answer questions about your workplace and get a draft framework in about 15 minutes. You still verify it against your actual conditions, but the scaffolding is done.

Step 4: Build your training schedule. Map each written procedure to a training event. Who needs it, when, how often it repeats, and how you document completion. Keep training records as long as the standard requires (some HazCom exposure records run the duration of employment plus 30 years).

Step 5: Set up recordkeeping. If you have 10 or more employees and are not in a low-hazard exempt industry, you must keep OSHA 300 logs under 29 CFR 1904. ^[7] Even if you are exempt from the 300 log, keeping your own injury records is smart. You cannot improve what you do not measure.

Step 6: Schedule your first program review. Put a date on the calendar now, at least 12 months out. Before that date, run quarterly walkthrough inspections and document them. That paper trail is often what separates a citation with a fat penalty from a citation with a warning.

What is driver safety training, and when does your business need a driver safety program for employees?

Driver safety training is a structured program that teaches employees who drive for work how to cut collision risk, handle bad conditions, catch fatigue and distraction, and follow company driving policies. It covers behavior (defensive driving, speed management, phone rules) and mechanics (pre-trip inspections, tire checks, load securing).

Motor vehicle crashes are the leading cause of work-related death in the United States. BLS reported that "transportation incidents" accounted for 1,075 fatal work injuries in 2022, the single largest category at about 40% of all occupational fatalities that year. ^[5] That figure includes highway crashes, roadway struck-by events, and aircraft incidents, but highway crashes dominate.

You need a formal driver safety program if any of these are true:

• Employees drive company-owned or leased vehicles for any work purpose
• Employees use personal vehicles for work tasks (deliveries, client visits, and field work are generally covered even where the "coming and going" rule applies)
• You operate commercial motor vehicles (CDL-required vehicles fall under FMCSA rules on top of OSHA)
• Your industry has heavy driving exposure: delivery, landscaping, home healthcare, field service, construction, sales

A driver safety program usually includes a written fleet safety policy, pre-hire motor vehicle record (MVR) checks, new-driver orientation, defensive driving training (often every one to three years), a signed distracted driving policy, and vehicle inspection procedures. The National Safety Council's Defensive Driving Course is a widely used civilian standard. ^[8]

School bus fleets carry much heavier obligations. See our detailed look at school bus safety programs for the federal and state-specific rules.

Commercial truck and van operators should know that FMCSA's Federal Motor Carrier Safety Regulations (49 CFR Parts 382-399) add drug testing, hours-of-service limits, and inspection requirements that sit on top of any OSHA duty. ^[9] OSHA and FMCSA can both come after the same incident.

What should a driver safety training program actually cover?

A solid driver safety program rests on five content pillars. Deliver them through classroom sessions, online modules, behind-the-wheel observation, or a mix, but cover and document all five.

1. Defensive driving principles. Space management, scanning ahead, intersection awareness, right-of-way discipline, and matching speed to conditions. The goal is anticipating hazards, more than reacting to them once they arrive.

2. Distracted and impaired driving. OSHA's own materials name distracted driving a serious workplace hazard, phone use above all. ^[10] Your written policy should address hands-free use, texting, eating, and messing with GPS while moving. Plenty of employers go all the way to a full ban on phone use while the vehicle is moving, even hands-free. That stance is defensible and, in fleet insurance terms, often cheaper.

3. Fatigue recognition. Fatigue can dull reaction time as badly as alcohol at certain levels. Training should help drivers spot their own fatigue cues and know the company policy on reporting fatigue before a trip.

4. Pre-trip inspection procedures. A simple daily checklist: tires, lights, brakes, mirrors, fluids, load security. It takes three minutes and catches problems before they become roadside breakdowns or crashes.

5. Emergency and incident response. What to do after a crash: position the vehicle safely, call emergency services, protect the scene, notify the employer, and follow the reporting chain. Spell out who gets called first and what the recordkeeping obligations are under 29 CFR 1904 for work-related vehicle incidents.

For employees who ride motorcycles for work, the requirements shift. Our guide to the motorcycle safety program course and PA motorcycle safety program cover the standards if your workforce runs on two wheels.

Documentation is not optional. Keep a signed training record for every driver, with the date, trainer name, topics covered, and employee signature. In a negligent entrustment lawsuit, that record is your first defense.

What records does an employee safety program require you to keep?

Recordkeeping is where small employers slip, usually not because they do not care but because nobody told them what to keep and for how long. OSHA's recordkeeping rule under 29 CFR 1904 is the floor. Individual standards stack more on top.

The OSHA 300 log requirement applies to employers with 10 or more employees who are not in a partially exempt low-hazard industry (retail, finance, insurance, and real estate carry partial exemptions). ^[7] You record work-related injuries and illnesses that cause days away from work, restricted duty, job transfer, medical treatment beyond first aid, loss of consciousness, or a significant illness diagnosed by a healthcare professional.

Beyond the 300 log, here is a practical map:

Record type	How long to keep	Standard
OSHA 300/300A/301 forms	5 years	29 CFR 1904.33
HazCom SDS sheets	Duration of use + 30 years (certain exposures)	29 CFR 1910.1200(g)(8)
Respiratory fit-test records	Until next fit test	29 CFR 1910.134(m)(2)
Training records (general)	Duration of employment recommended	OSHA general duty best practice
Driver MVR checks	3 years for CMV operators	49 CFR 391.51
Lockout/Tagout procedure audits	1 year	29 CFR 1910.147(c)(6)(ii)

Keep training records even when no standard sets a duration. In a citation defense or a civil suit, a training record from three years back can be worth thousands in avoided penalties or settlement.

For how citations and recordkeeping intersect, our overview of american safety programs and training covers the enforcement side in detail.

How do you measure whether your safety program is actually working?

Most employers measure safety by counting injuries. Better than nothing, but that is a lagging indicator. You only learn something broke after someone got hurt. Leading indicators tell you whether your prevention systems are working before an incident lands.

Good leading indicators to track:

• Near-miss reports per month (more reports usually means a healthier reporting culture, not a more dangerous workplace)
• Percentage of scheduled inspections completed on time
• Training completion rate (what share of required training is current across all employees)
• Hazard close-out rate (how fast identified hazards get fixed)
• Number of safety suggestions submitted by workers

For lagging indicators, use your OSHA 300 log to calculate your Total Recordable Incident Rate (TRIR): (number of recordable incidents x 200,000) divided by total hours worked. The 200,000 represents 100 employees working 2,000 hours a year. BLS publishes industry-average TRIR rates every year, so you can benchmark against your sector. ^[5]

Review the whole program once a year. Ask: Did we hit our training targets? Did we close hazard findings inside our target window? Did TRIR go up or down? What near-misses did we have and what did they teach us? Write down the answers. That review document becomes proof your program is alive, not a shelf decoration.

On safety incentive programs, which can push participation in safety activities, see our guide on the principles of effective safety incentive programs. One warning: OSHA has stated that incentive programs rewarding low injury rates (rather than safe behaviors) can suppress reporting and may violate 29 CFR 1904.35. ^[7]

What does an OSHA inspection look for in your safety program?

When a compliance officer shows up, triggered by a complaint, a referral, a fatality, or a programmed inspection, your written safety program is one of the first things they ask for. Not the binder alone. They want evidence the program is real and followed.

They will typically ask for:

• Your written program documents (HazCom, LOTO, EAP, and any other standards that apply)
• OSHA 300/300A logs for the current and previous four years
• Training records for the standards under inspection
• Hazard inspection records or safety committee minutes
• SDS access for chemicals on site
• PPE hazard assessment certifications

The common mistake is a program written once and never touched again. A lockout procedure listing machines you scrapped two years ago, or a chemical list missing three products you added last spring, turns a minor paperwork citation into evidence of a systemic problem.

Citation categories drive the penalty. Willful violations (you knew about the hazard and left it) carry penalties up to $16,131 per violation as of 2024, with annual inflation adjustments. Repeated violations carry the same maximum. Serious violations run up to $16,131 each. Other-than-serious violations can reach $16,131 but often land lower after gravity and good-faith adjustments. ^[11]

A well-maintained, current program is your best good-faith argument for a penalty cut. Compliance officers have discretion, and documented systems show intent.

If your employees handle hazardous chemicals, start with the hazardous communication standard. HazCom sits in OSHA's top-10 most-cited standards every single year.

What does a safety program cost to build and maintain?

The honest answer: it depends on your hazard profile and whether you bring in outside help.

DIY, using OSHA's free resources (osha.gov has template programs, e-tools, and guidance documents at no cost): figure 20 to 60 hours for the initial build, then 5 to 10 hours a year to maintain for a typical small business. ^[1]

Consulting firm: program development usually runs $3,000 to $15,000 or more depending on size and complexity. Annual reviews run $1,000 to $5,000. Those ranges come from industry survey data, and real quotes swing widely.

Software-assisted: tools that generate templates and track training and records typically run $50 to $500 per month depending on headcount and features.

Online training: OSHA 10-hour cards (not a certification, just proof of attendance) cost $25 to $75 per employee through OSHA-authorized trainers. OSHA 30-hour cards run $150 to $300. ^[12]

For most businesses under 50 employees with moderate hazard exposure, the sweet spot is software-assisted build for the initial documents, self-managed maintenance with a scheduled annual review, and a mix of free OSHA resources and low-cost online training. Spending $10,000 on a consultant to produce a binder you do not understand is a worse outcome than spending $500 on a tool that helps you understand what you are actually running.

SafetyFolio's program generator is built for exactly this: answer questions about your workplace, get a structured, OSHA-aligned draft in about 15 minutes, then customize and maintain it yourself.

For employers connecting safety programs to the broader social safety net, our overview of safety net programs covers how workers' comp, OSHA benefits, and federal assistance intersect.

Frequently asked questions

What is the difference between a safety program and a safety plan?

In everyday use they mean the same thing. OSHA literature uses "safety and health program" for the ongoing management system and sometimes "plan" for a specific document inside it, like an Emergency Action Plan. If someone asks for your safety plan, hand them your written program. What matters is that you have documented policies, procedures, and records, not which word is on the cover.

What is driver safety training?

Driver safety training is a structured program that teaches employees who drive for work how to prevent crashes. It typically covers defensive driving, distracted driving policy, fatigue recognition, pre-trip vehicle inspections, and post-crash reporting. It applies to any employee who drives for work, from delivery drivers to sales reps using personal cars for client visits. Motor vehicle crashes are the leading cause of occupational death, roughly 40% of fatal work injuries in 2022 per BLS.

Does OSHA require a driver safety program for employees?

OSHA has no standard titled "fleet safety," but the General Duty Clause requires employers to address recognized hazards, and vehicle crashes are clearly recognized. OSHA's distracted driving guidance says employers must have policies prohibiting texting while driving. For commercial motor vehicle operators, FMCSA regulations under 49 CFR Parts 382-399 add mandatory drug testing, hours-of-service limits, and inspection requirements on top of OSHA obligations.

How often should employee safety training be repeated?

It depends on the standard. Respirator fit-testing under 29 CFR 1910.134 must happen annually. HazCom training is required when employees first work with chemicals and when new hazards appear. Lockout/Tagout retraining is required when procedures change or an inspection shows inadequate knowledge. As a baseline, most employers run at least annual refreshers for major hazards. Quarterly for high-hazard tasks is better practice.

What industries need employee safety programs the most?

Every industry needs one, but the highest-risk sectors by BLS fatal injury rates are agriculture, forestry and fishing; construction; and transportation and warehousing. Manufacturing and healthcare carry the highest non-fatal injury and illness rates. Even so, offices have real injury exposure from ergonomics, slips, trips, and falls, and any business with chemicals on hand (including cleaning products) must comply with HazCom.

Can a small business with fewer than 10 employees skip OSHA recordkeeping?

Employers with fewer than 10 employees are exempt from the OSHA 300 log requirement under 29 CFR 1904.1, and so are employers in certain low-hazard industries regardless of size. But exemption from the 300 log does not exempt you from a safe workplace, training, SDS sheets, or any applicable standard. The General Duty Clause covers every employer. Keeping your own injury records is still smart even when OSHA does not require it.

What are the most common OSHA citations for missing safety program elements?

OSHA's top-10 most-cited standards consistently include Fall Protection (29 CFR 1926.501), Hazard Communication (29 CFR 1910.1200), Respiratory Protection (29 CFR 1910.134), Lockout/Tagout (29 CFR 1910.147), Ladders (29 CFR 1926.1053), Powered Industrial Trucks (29 CFR 1910.178), and Scaffolding (29 CFR 1926.451). Most of these citations trace back to missing or weak written programs, absent training records, or procedures that exist on paper but nobody follows.

How do I write a Job Hazard Analysis (JHA) for my employee safety program?

A JHA breaks a job into its steps, names the hazard at each step, and lists the control. Pick the task, list every step in order, ask what could go wrong at each one, and write down the control that prevents it. OSHA's free booklet "Job Hazard Analysis" (OSHA 3071) walks through the process with examples. Do your JHAs with the workers who actually do the job. They know the hazards better than managers.

Does a driver safety program cover employees who use their personal vehicles for work?

Generally yes, for both liability and safety. When an employee drives a personal vehicle for a work errand (a delivery, a client visit, travel between job sites), the employer can face liability for a crash on that trip. Your program should include a personal vehicle use policy covering MVR checks for those employees, proof of personal insurance minimums, and the same distracted driving rules that apply to company vehicles.

What is an IIPP and which states require it?

IIPP stands for Injury and Illness Prevention Program. California requires one for every employer under Title 8, CCR Section 3203. Oregon, Washington, Hawaii, Minnesota, and other state-plan states have similar requirements under different names. A California IIPP must include a responsible person, a hazard communication system, a reporting procedure, inspection schedules, training, and recordkeeping. The structure mirrors OSHA's seven elements, but in those states it is a legal mandate, not a suggestion.

What is the cost of a preventable workplace injury to a small business?

The Liberty Mutual Workplace Safety Index puts the most disabling workplace injuries at $167 billion in direct costs across U.S. employers in 2022. For a single lost-time injury, direct costs (medical and indemnity) average $40,000 or more depending on severity and industry. Indirect costs (retraining, overtime, admin time, lost productivity) can multiply that by 2x to 4x. For a small employer, one serious injury can equal months of net profit.

How do I get employees to actually follow the safety program?

Management visibility is the single biggest driver of compliance. When the owner or manager follows the rules (wears the PPE, signs the inspection sheet, stops work over a safety concern), workers follow. When management skips steps, workers decide the program is theater. Beyond that: involve workers in writing procedures (people follow rules they helped write), keep reporting anonymous and retaliation-free, and close reported hazards fast so workers see that reports lead to fixes.

Do temporary workers from a staffing agency need to be included in our safety program?

Yes. Under OSHA's multi-employer citation policy and a 2014 memorandum on temporary workers, both the host employer and the staffing agency share responsibility for temp worker safety. The host employer controls the site and hazards and must provide site-specific training and PPE. The staffing agency ensures its workers understand their rights and get general safety training. OSHA has cited both parties in the same inspection. Treat temp workers like your own for safety purposes.

What OSHA resources are free for small businesses building a safety program?

OSHA's On-Site Consultation Program gives free, confidential safety and health advice to small and medium businesses. It runs separately from enforcement, and a consultation visit cannot trigger a citation. OSHA also offers free e-tools, template programs, the Small Business Handbook (OSHA 2209), and the Hazard Identification Training Tool online. State-plan states often add their own free consultation resources. These are genuinely good. Use them before you pay a consultant.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA's seven-element framework for safety and health programs; programs help employers and workers proactively address workplace hazards before they cause injury, illness, or death; $4 to $6 return per $1 invested estimate.
2. OSHA, OSH Act of 1970, General Duty Clause Section 5(a)(1): Every employer must furnish a workplace free from recognized hazards likely to cause death or serious physical harm.
3. OSHA, Hazard Communication Standard 29 CFR 1910.1200: Requires a written HazCom program with SDS procedures and labeling under 29 CFR 1910.1200(e); consistently among OSHA's top-10 most-cited standards.
4. California Department of Industrial Relations, Cal/OSHA, Injury and Illness Prevention Program (Title 8 CCR Section 3203): California requires every employer, including those with one employee, to maintain a written Injury and Illness Prevention Program under Title 8, CCR Section 3203.
5. Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2022 and Nonfatal Occupational Injuries and Illnesses 2022: 5,486 fatal work injuries in 2022; 1,075 transportation fatalities (approximately 40% of total); 1,057,400 nonfatal cases with days away from work in private industry 2022; industry TRIR benchmarks published annually.
6. OSHA, Recordkeeping Rule 29 CFR 1904 and Anti-Retaliation Provisions 29 CFR 1904.35: Employers with 10 or more employees in non-exempt industries must maintain OSHA 300 logs; 300/300A/301 forms retained 5 years; anti-retaliation provisions prohibit discouraging accurate injury reporting; rate-based incentive programs may suppress reporting.
7. National Safety Council, Defensive Driving Courses: NSC Defensive Driving Courses are a widely used civilian standard for driver safety training programs for employees.
8. Federal Motor Carrier Safety Administration, Federal Motor Carrier Safety Regulations 49 CFR Parts 382-399: FMCSA regulations impose drug testing, hours-of-service, and vehicle inspection requirements on commercial motor vehicle operators in addition to OSHA obligations; driver qualification file retention 3 years under 49 CFR 391.51.
9. OSHA, Penalties (Civil Monetary Penalty Adjustments): Willful and repeated violations carry penalties up to $16,131 per violation as of 2024 after inflation adjustments; serious violations also up to $16,131.
10. OSHA, Outreach Training Program (OSHA 10 and 30 cards): OSHA 10-hour and 30-hour cards issued through authorized trainers; 10-hour cards document attendance, not certification; cost ranges reflect authorized trainer market.
11. OSHA, Job Hazard Analysis (OSHA 3071): OSHA free booklet provides step-by-step guidance for conducting a Job Hazard Analysis as part of a safety program.
12. OSHA, On-Site Consultation Program: Free, confidential safety and health consultation for small and medium businesses; separate from enforcement; cannot trigger a citation.
13. OSHA, Temporary Worker Initiative and Multi-Employer Citation Policy: Host employers and staffing agencies share responsibility for temporary worker safety; both can be cited in the same inspection; 2014 memorandum establishes host employer obligations for site-specific training and PPE.