How often must your safety program be revised?

Last updated 2026-07-09

Does OSHA require a specific revision schedule for safety programs?

No single OSHA rule says 'review your safety program every 12 months.' That surprises a lot of people. What OSHA actually does is scatter revision requirements across individual standards, each with its own trigger or interval. So the real answer is: it depends which standard your program is written under.

The most commonly cited requirement comes from 29 CFR 1910.119, OSHA's Process Safety Management (PSM) standard, which requires that process safety information, procedures, and the program itself be reviewed and certified accurate by employees involved in the process at least every three years, and updated whenever a change is made to process technology or equipment ^[1]. That three-year cycle is often the closest thing people find to a universal schedule, but it only applies to facilities with highly hazardous chemicals above threshold quantities.

For most small businesses, the revision obligation comes from a different direction. The General Duty Clause (Section 5(a)(1) of the OSH Act) requires employers to keep workplaces free from recognized hazards. If a hazard changes and your written program doesn't reflect it, you've got a documentation gap that a compliance officer can cite. That's a practical driver even when no CFR section names a specific date ^[2].

The short version: check the standards that apply to your industry and operations. Each one has its own update trigger. Then set a calendar review on top of that to catch everything else.

Which OSHA standards name a specific revision interval?

Here's where it gets concrete. Several standards either name a time-based review or require updates when defined events happen. The table below pulls the clearest ones.

Standard	Topic	Revision trigger or interval
29 CFR 1910.119 (PSM)	Process safety management	Every 3 years, and after any change to process/equipment [1]
29 CFR 1910.147 (LOTO)	Lockout/tagout	When procedures change or annual inspection finds inadequacy [3]
29 CFR 1910.38	Emergency action plans	When the plan no longer reflects the facility layout or staffing [4]
29 CFR 1910.1030 (BBP)	Bloodborne pathogens	Annually, and when new tasks or procedures affect exposure [5]
29 CFR 1910.120 (HAZWOPER)	Hazardous waste operations	When site conditions, regulations, or practices change [6]
29 CFR 1910.1200 (HazCom)	Hazard communication	When new chemicals are introduced or SDS information changes [7]

The bloodborne pathogens standard at 29 CFR 1910.1030 is the most explicit about annual review. It says employers shall review and update the Exposure Control Plan 'at least annually and whenever necessary to reflect new or modified tasks and procedures' ^[5]. Run a healthcare facility, a first-aid program, or any business where workers might contact blood, and that annual date is non-negotiable.

For hazard communication, the trigger isn't a calendar date, it's a change event. Bring in a new chemical, update your written HazCom program. Simple rule, easy to miss in practice.

Lockout/tagout under 29 CFR 1910.147 requires an annual audit of each energy control procedure, performed by an authorized employee other than the one who uses the procedure. If the audit finds a deficiency, the procedure must be updated before work continues ^[3]. That annual audit is a revision trigger in everything but name.

What events should trigger an immediate safety program review?

Calendar reviews are the floor. Events in your workplace should kick off reviews between scheduled dates. These are the triggers that matter most.

A serious injury or fatality is the obvious one. After any OSHA-recordable injury (the ones logged on your OSHA 300 log) or any near-miss, look at the relevant section of your written program and ask whether it actually covers the hazard involved. If it doesn't, or if workers weren't following it, the program needs updating. BLS reported that private-sector employers logged 2.8 million nonfatal workplace injuries and illnesses in 2022 ^[8]. A meaningful share of those happened where written procedures existed but hadn't kept up with how the work actually ran.

Workplace changes are the second big trigger. New equipment, a new chemical, a new process, new workers, a new facility layout. Any of these can outdate your program. A written program that describes a three-person team running equipment you've since automated, or that lists a chemical you dropped while missing one you added last quarter, isn't just stale. It's actively misleading.

Regulatory changes matter too. OSHA issues final rules and updated standards. When a standard covering your industry changes, your written program has to catch up. OSHA's website keeps a current list of standards, and subscribing to OSHA's QuickTakes newsletter is a reasonable way to track updates without hiring a consultant ^[2].

An OSHA inspection can generate its own revision requirements. If an inspector issues a citation and you enter an informal settlement, the abatement terms frequently include updating written programs. That's a hard deadline, not a suggestion.

Other common triggers: changes in workforce size or demographics (new language needs, higher turnover affecting training), insurance carrier audits that flag gaps, workers' comp claim patterns, and state-plan updates if you operate in a state-plan state.

How often should you do a routine (non-triggered) safety program review?

Once a year. That's the practical consensus among safety professionals for a routine program-wide review, even where no specific standard demands it. OSHA's own guidance on Injury and Illness Prevention Programs recommends that employers evaluate the program 'at least annually' to determine whether it is effective and whether goals and objectives have been met ^[9]. That guidance isn't a binding standard, but it reflects what OSHA compliance officers expect to see.

Annual reviews work because they fall in line with cycles you already run: year-end budget reviews, insurance renewals, annual training refreshers. Schedule your safety program review alongside one of those and you've built in the reminder.

For a smaller business with steady operations (a small retail shop, a single-trade contractor with a stable crew), a true annual review is probably enough on top of the triggered ones. For businesses with high turnover, frequent process changes, or several regulated hazards, twice a year makes more sense.

What does a routine review actually look like? At minimum: walk the facility against the written program and check that what the program describes matches what's happening. Confirm that job hazard analyses still reflect current tasks. Check training records against the people currently employed. Read any incident reports from the past year and ask whether the program addresses those situations. Review your OSHA 300 log entries. For a small operation, the whole thing shouldn't take more than a half day if the program is well organized.

If you built your program with a tool like SafetyFolio's safety program generator, it's structured so section-by-section review goes faster than working through a dense, consultant-written document.

What must actually change in the document when you revise?

A revision isn't bumping the 'last reviewed' date at the top. That's a paperwork charade that won't hold up during an inspection. A real revision means the written content matches current reality.

Here's what should change when it's out of date.

Personnel and role assignments. If your program names a safety officer who left two years ago, update it. OSHA compliance officers look for named responsible parties during inspections, and a program that lists someone no longer with the company signals neglect.

Procedures and equipment. Any standard operating procedure that references equipment you no longer use, or omits equipment you've added, needs rewriting. Same for chemical lists under your HazCom program.

Regulatory citations. If a standard has been updated and the CFR section number or requirement has changed, your program's reference has to follow.

Training requirements. If your training schedule changed, or you added training topics, the written program should say so. There should be no gap between what your program claims employees are trained on and what your training records actually show.

Emergency contacts and procedures. Phone trees, emergency assembly points, hospital routes. These change more often than people realize, especially in facilities that have moved or reorganized.

Document every revision with a version number or date, and keep prior versions. OSHA doesn't mandate version control by name, but if you're ever defending yourself in a citation dispute, showing that the program changed over time in response to conditions is evidence of good faith.

Does OSHA inspect written safety programs during audits?

Yes, and it's often one of the first things a compliance officer asks for. When OSHA runs a programmatic inspection (as opposed to a simple walkaround for an obvious hazard), the officer will typically request your written Injury and Illness Prevention Program, the specific written procedures required by applicable standards, and training records.

OSHA's Field Operations Manual guides compliance officers to evaluate whether required written programs exist, are current, and are actually followed in practice ^[10]. A written program that hasn't changed in five years, or that describes procedures workers demonstrably ignore, creates an easy citation pathway.

The most common violations involving written programs are not having one at all, having one that misses the minimum content requirements of the applicable standard, and having one workers can't locate or access. Staleness (failing to update after changes) gets cited less often than absence, but it does come up, especially after incident investigations.

State-plan states sometimes carry stricter requirements than federal OSHA ^[11]. California's Cal/OSHA, for example, requires an Injury and Illness Prevention Program (IIPP) under California Code of Regulations Title 8, Section 3203, and that program must include procedures for reviewing its own effectiveness. Cal/OSHA compliance officers are trained to ask how recently the IIPP was reviewed.

Are there different rules for small businesses versus large ones?

OSHA standards apply the same regardless of employer size, with a few narrow exceptions. Most small-business exemptions aren't about which standards apply. They're paperwork simplifications, like the partial exemption from OSHA 300 log requirements for businesses with 10 or fewer employees in low-hazard industries ^[12].

The real difference is resources, not obligation. A 10-person landscaping company and a 500-person manufacturing plant both have to comply with the standards covering their operations. The landscaping company just probably can't afford a full-time safety manager, so the owner ends up doing the annual review personally.

That's fine. OSHA doesn't require a credentialed safety professional to maintain a written program. It requires that the program exist, be accurate, and be followed. A small business owner who does a genuine annual walk-through, updates the program when things change, and keeps training records is in better shape than a larger company with a safety binder nobody has opened in three years.

For workplace safety training records, business size doesn't change what you need to document, but it does change how practical it is to keep those records organized. Simple spreadsheets work fine for most small businesses.

What happens if you don't revise your safety program on time?

The consequences run from nothing (if OSHA never shows up) to real citations and penalties (if they do). But the more immediate risk is operational, not regulatory.

An outdated written program opens a gap between what you say your safety procedures are and what's happening on the floor. When an injury occurs and OSHA investigates, that gap becomes the center of the inquiry. If a worker got hurt doing something your program doesn't address, or doing something the program prohibits but supervisors allowed, you're in a weak spot.

On the penalty side, OSHA amounts were last adjusted in January 2024. Serious violations carry a maximum penalty of $16,131 per violation. Willful or repeated violations can reach $161,323 per violation ^[13]. An employer who hasn't updated a required written program for years, especially after a cited incident, risks a 'willful' characterization, which is how penalties jump from the thousands into the six figures.

The practical argument for timely revision is simpler than the penalty math. A current written program is a training document. New employees use it to understand what safety looks like at your company. If it describes a reality that no longer exists, you're training people wrong.

How do you set up a revision system that actually works?

The single most effective move is to tie safety program review to something that already happens on a schedule. Most small businesses find that anchoring it to the start of the year or the annual workers' comp insurance renewal works well, because those conversations already prompt a look at risk.

For the structure, here's a simple approach that holds up.

Assign one person as the program owner. Even if that's you, the owner. The program should name who is responsible for maintenance.

Keep a log of revision triggers. Any incident, new equipment, regulatory update, or personnel change that should prompt a review goes in the log immediately. At your annual review, you then have a list to work through instead of relying on memory.

Use a cover page with a version history. Each time you revise, update the version number, the date, and a one-line note about what changed. Five minutes of work, and it creates an audit trail that reads as good faith.

For state-specific obligations, check your state plan if you're in one of the 26 states and territories with their own OSHA-approved programs ^[11]. Requirements sometimes exceed the federal floor.

Scheduling is the part most small businesses skip. Put a recurring calendar appointment for the annual review on the books right now. Two to four hours, depending on business complexity. No other prep required.

Does updating your safety program require retraining employees?

Sometimes, and this is where people trip up. Not every revision triggers a retraining requirement, but substantive changes to procedures that employees are expected to follow usually do.

Under 29 CFR 1910.1200 (HazCom), if you add a new chemical that workers handle, training on that chemical is required before exposure ^[7]. Under 29 CFR 1910.147 (LOTO), if a lockout/tagout procedure for a specific machine changes, affected employees need to know ^[3]. You don't have to run a formal classroom session every time, but documentation showing workers were informed of and understand the changed procedure matters.

For emergency action plans under 29 CFR 1910.38, the standard requires that the plan be reviewed with employees when it's developed or changed, and when employees are given a new emergency action responsibility ^[4].

A reasonable rule of thumb: if the revision changes what an employee is expected to do, or changes a hazard they need to know about, document that they've been informed. If it changes only administrative information (a new version date, an updated regulatory citation, a personnel name change), informal communication is usually enough.

For a closer look at how to structure employee training alongside program updates, the principles of effective safety incentive programs article covers how to build reinforcement into your safety culture without piling on administrative work.

What does a complete written safety program revision look like in practice?

Here's what an actual annual review looks like for a small manufacturing business with 20 employees. This isn't a template. It's an honest walk-through of the process.

Step one: Pull out last year's program and your OSHA 300 log. Read the 300 log entries. For each recordable incident or near-miss, find the relevant section of the written program and ask whether it covers the hazard that caused the event. If not, the section needs updating.

Step two: Walk the facility with the program in hand. Check that every piece of equipment named in the program still exists and is described accurately. Check that anything added in the past year is covered. Check that PPE requirements in the program match what workers actually wear (and if there's a gap, figure out whether the program or the practice needs to change).

Step three: Check personnel. Is the named safety contact still employed? Are the emergency phone numbers current?

Step four: Check for regulatory updates. Visit OSHA.gov and look at any new standards or updates relevant to your industry. If a standard changed and your program cites the old version, fix the citation.

Step five: Update the version history. Write a brief note on what changed. If the changes are substantial, plan short crew meetings to communicate them.

Total time for most small businesses: two to four hours if the program is organized. If it takes longer, that's a signal the program structure itself needs attention. A well-structured program built with a generator like SafetyFolio's takes far less time to revise than a 40-page consultant-written document with no clear section headings.

For a broader look at what a program should contain, the article on what a safety and health program should be covers minimum content requirements across program types.

Frequently asked questions

How often does OSHA require safety programs to be updated?

OSHA has no single universal update schedule. Individual standards set their own timelines: the bloodborne pathogens standard (29 CFR 1910.1030) requires annual review, PSM (29 CFR 1910.119) requires review every three years, and many standards require updates after triggering events like workplace changes, new chemicals, or equipment modifications. When no standard specifies a schedule, annual review is the widely accepted best practice based on OSHA's I2P2 guidance.

Is there a penalty for not updating a written safety program?

Yes. Failing to maintain a required written program, or maintaining one that no longer reflects actual conditions, can bring OSHA citations. Serious violations carry maximum penalties of $16,131 per violation as of January 2024. Willful or repeated violations can reach $161,323 per violation. The larger practical risk is that an outdated program weakens your position if an injury occurs and OSHA investigates.

Do I have to retrain employees every time I update the safety program?

Not for every change. If the revision affects what employees physically do, or changes a hazard they're exposed to, some form of communication and documentation is required. Examples include adding a new chemical under HazCom or changing a lockout/tagout procedure. Administrative changes like updating a contact name or version date don't require formal retraining, but a brief mention at a safety meeting is always smart.

What triggers a safety program review between annual reviews?

Key mid-cycle triggers include any OSHA-recordable injury or near-miss, introduction of new equipment or chemicals, changes to work processes or job tasks, personnel changes in safety-responsible roles, an OSHA inspection or citation, changes to an applicable regulatory standard, and insurance or workers' comp audits that identify program gaps. Any one of these should prompt review of the affected sections, not necessarily the whole document.

Does updating a safety program in one location require updating all locations?

Only if the change applies to the other locations. If you add a chemical at one facility but not another, you update the HazCom program for the facility that uses it. If a regulatory change affects all locations equally, update all programs. Each facility under OSHA jurisdiction should have its own program reflecting conditions specific to that site, even when it's based on a common template.

How long should I keep old versions of my safety program?

OSHA doesn't set a universal retention period for written program versions, but three to five years is the common recommendation, matching OSHA's three-year records retention requirement for some standards. For incidents that led to OSHA citations or litigation, keep the program version in place at the time of the incident for the duration of any proceedings plus a reasonable buffer. Many small businesses keep prior versions indefinitely since storage costs are minimal.

Can an employee trigger a required safety program update?

Yes, indirectly. OSHA's PSM standard specifically requires employee involvement in reviewing and certifying the accuracy of procedures. Under other standards, if an employee reports a hazard not covered by the current program, the employer's obligation under the General Duty Clause to address recognized hazards creates a practical requirement to update the program. Employee-reported hazards are also one of the most reliable sources for identifying gaps.

Do state OSHA plans have stricter revision requirements than federal OSHA?

Some do. California's Cal/OSHA requires an Injury and Illness Prevention Program (IIPP) under Cal. Code Regs. Title 8, Section 3203, and that program must include a mechanism for reviewing effectiveness. Several other state-plan states have similar IIPP requirements that go beyond federal OSHA's general industry standards. If you operate in a state-plan state, check your state's specific requirements on top of federal CFR requirements.

Does a safety program revision have to be done by a certified safety professional?

No. OSHA does not require that a credentialed safety professional write or revise written programs. The standards require that programs meet specific content requirements, not that a professional author them. Small business owners and operations managers regularly maintain their own programs. A CSP or safety consultant can help with complex operations or after serious incidents, but it's not a legal requirement for most small businesses.

What is the minimum content a revised safety program must include?

It depends on which standard applies. Under OSHA's voluntary I2P2 guidance, a safety and health program should address management leadership, worker participation, hazard identification, hazard prevention and control, and program evaluation. Standard-specific programs like HazCom or LOTO have their own minimum content requirements in the applicable CFR section. The point is that the program has to reflect current workplace conditions accurately, more than check a format box.

How does a safety program review differ from a safety audit?

A safety program review focuses on the written document: is it current, accurate, and complete? A safety audit looks at whether actual workplace conditions and worker behavior match what the program says. Both matter, and they work best together. An audit finding that workers aren't following a written procedure can mean the procedure is wrong for the actual environment, which triggers a program revision.

If I buy a new business, do I have to revise the existing safety program?

Yes, and quickly. An acquired business's safety program reflects the prior owner's operations, personnel, and sometimes a different OSHA region's enforcement priorities. Review the program against your actual equipment, workforce, chemicals, and processes right after acquisition. Personnel listed in the program will have changed. Procedures may not match how work is actually done. OSHA holds the current employer responsible regardless of what the prior owner had in place.

What is an Injury and Illness Prevention Program (I2P2) and does it have its own revision schedule?

OSHA's I2P2 is a voluntary framework, not a binding standard, describing best practices for a full safety and health program. It recommends annual evaluation of program effectiveness. Several state-plan states (California, Washington, Oregon, and others) have made similar programs mandatory under state regulations. If you operate under a state mandate, that state's rule sets your revision obligations, not the federal voluntary guidance.

Sources

1. OSHA, 29 CFR 1910.119 Process Safety Management of Highly Hazardous Chemicals: PSM standard requires process safety information and procedures be reviewed and updated at least every three years and after any change to process technology or equipment
2. OSHA, OSH Act Section 5(a)(1) General Duty Clause: Employers must keep workplaces free from recognized hazards, creating an implicit obligation to update programs when hazards change
3. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): LOTO standard requires annual inspection of each energy control procedure and update when the inspection reveals a deficiency
4. OSHA, 29 CFR 1910.38 Emergency Action Plans: Emergency action plans must be reviewed when the plan is developed or changed and when employees receive new emergency action responsibilities
5. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens: Bloodborne pathogens Exposure Control Plan must be reviewed and updated at least annually and whenever necessary to reflect new or modified tasks and procedures
6. OSHA, 29 CFR 1910.120 Hazardous Waste Operations and Emergency Response (HAZWOPER): HAZWOPER safety and health program must be updated when site conditions, regulations, or practices change
7. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: HazCom written program must be updated when new chemicals are introduced or SDS information changes
8. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2022: Private-sector employers reported 2.8 million nonfatal workplace injuries and illnesses in 2022
9. OSHA, Recommended Practices for Safety and Health Programs (I2P2): OSHA's I2P2 guidance recommends that employers evaluate the program at least annually to determine whether it is effective and goals have been met
10. OSHA, Field Operations Manual (FOM), CPL 02-00-160: OSHA compliance officers are guided to evaluate whether required written programs exist, are current, and are actually followed in practice
11. OSHA, State Plans overview: There are 22 state-plan states covering private and public sector employees, plus 4 covering state and local government only; state plans must be at least as effective as federal OSHA
12. OSHA, Penalties page (adjusted January 2024): As of January 2024, serious violations carry a maximum penalty of $16,131 per violation; willful or repeated violations can reach $161,323 per violation