How to build a safety program from scratch for a new small business

Last updated 2026-07-09

Does a small business actually need a formal safety program?

Yes. Headcount doesn't change that answer.

OSHA's General Duty Clause (Section 5(a)(1) of the OSH Act) requires every employer, regardless of size, to provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm ^[1]. That's federal law, not a suggestion.

What changes with size is the paperwork. The written programs you owe depend entirely on the hazards in your workplace. A 3-person graphic design studio has almost no written program requirements. A 10-person landscaping crew has several. A 15-person auto shop has a stack. OSHA gives no blanket exemption from standards just because a company is small. It does exempt certain low-hazard industries from routine programmed inspections ^[2], but that's a world away from being exempt from compliance.

Here's the practical reality. OSHA has nowhere near enough inspectors to visit every small business. In fiscal year 2023, federal OSHA conducted about 32,000 inspections ^[3]. Roughly 10 million workplaces fall under OSHA jurisdiction. Your odds of a routine inspection are low. Your odds of an employee getting hurt are not. The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries in private industry in 2023 ^[4]. Small businesses eat a disproportionate share of those costs because they don't have the safety infrastructure to stop them before they happen.

What are the first steps to building a safety program from zero?

Treat this as a 7-step build. You can jump around, but businesses that skip ahead usually end up backtracking to something they should have done first.

Step 1: Walk your workplace and write down every hazard you can find. This is a Job Hazard Analysis (JHA), sometimes called a Job Safety Analysis. OSHA publishes a free worksheet for it ^[5]. Go task by task, more than room by room. Ask one question at each step: what could hurt someone here? Falling, crushing, burning, chemical exposure, electrical shock, ergonomic strain. Write it all down before you write a single policy.

Step 2: Sort hazards by severity and likelihood. A hazard that could kill someone tomorrow beats a hazard that might cause a sprain next year. This ranking tells you which written programs to build first.

Step 3: Identify which OSHA standards apply. Once you know your hazards, cross-reference OSHA's standards (29 CFR 1910 for general industry, 29 CFR 1926 for construction). Each standard tells you whether a written program is required. More on this in the next section.

Step 4: Write your required programs first, then your voluntary ones. Don't burn two weeks on a drug-free workplace policy while your Hazard Communication program sits unwritten. Required programs come first.

Step 5: Build a training calendar. A written program is dead weight if nobody knows it exists. Map out who needs training on what, by when, and how you'll document it.

Step 6: Create your recordkeeping system. Decide now how you'll track injuries, near-misses, training completions, and equipment inspections. A spreadsheet works. A paper binder works. Software is optional.

Step 7: Review and update at least once a year. Safety programs go stale fast when operations change. Set the calendar reminder for your annual review before you finish the first draft.

Which written safety programs does OSHA actually require?

This is where small business owners get stuck, because the honest answer is "it depends on your hazards." There's no universal master list. Here's how to reason through it.

A general industry standard (29 CFR 1910) requires a written program when the standard itself says so. The ones small businesses trigger most often:

OSHA Standard	Written Program Required	Triggered When
29 CFR 1910.1200	Hazard Communication Program	Any chemicals in the workplace
29 CFR 1910.147	Lockout/Tagout (Energy Control Program)	Employees service or maintain equipment
29 CFR 1910.134	Respiratory Protection Program	Respirators used (even voluntarily)
29 CFR 1910.157	Fire Extinguisher Program	Employees expected to use extinguishers
29 CFR 1910.132	PPE Hazard Assessment (written certification)	Any PPE use
29 CFR 1910.38	Emergency Action Plan	Written required at 11+ employees
29 CFR 1910.1030	Bloodborne Pathogens Exposure Control Plan	Occupational exposure to blood or OPIM
29 CFR 1910.119	Process Safety Management Plan	Threshold quantities of listed chemicals

Construction employers under 29 CFR 1926 will almost certainly need a written fall protection plan when work happens at 6 feet or more above a lower level ^[6].

Here's the one that trips people up. Hazard Communication (29 CFR 1910.1200) applies to nearly every workplace ^[11]. Cleaning supplies count. Touch-up paint counts. Propane counts. If you have a single hazardous chemical in the building, even one stored under a sink, you need a written HazCom program, a chemical inventory, Safety Data Sheets your employees can reach, and labeled containers. See our guide to Hazard Communication for the full build.

Lockout/tagout is the standard that ambushes small manufacturers and maintenance shops. If any employee ever adjusts, cleans, or unjams a machine, 29 CFR 1910.147 almost certainly applies and demands a written energy control program plus equipment-specific procedures ^[12]. It lands on OSHA's most-cited list nearly every year.

One honest caveat. The table above covers the common triggers for businesses with 1 to 50 employees. Your situation might need more programs or fewer. The safest move is to read the applicability section of every standard you think might apply, or call OSHA's free consultation service (which is separate from enforcement) and ask.

What goes inside a written safety program?

Every OSHA-required written program has a structure it mandates. You can't scribble "we care about safety" and call it a Respiratory Protection Program. Most required programs follow the same skeleton.

Purpose and scope. What hazards does this program address, and which employees does it cover?

Responsibilities. Who owns this program? Who enforces it? Name real job titles, not vague roles. "The owner" or "the shop manager" is fine for a small business.

Procedures. Step-by-step instructions for doing the work safely. For lockout/tagout, that means equipment-specific procedures for every covered machine. For Hazard Communication, it means how you keep the SDS library current and how you label incoming chemicals.

Training. When training happens (before first exposure to the hazard, annually, after incidents), who delivers it, and how you document completion.

Recordkeeping. What forms, logs, or inspection records this program generates, and where they live.

Review and update. When the program gets reviewed, and what triggers an off-cycle review (new equipment, a near-miss, a changed process).

Specificity beats length. A 3-page Hazard Communication program that names your actual chemicals, your actual SDS location, and your actual labeling process is worth more than a 15-page template describing a warehouse you don't own. An inspector can tell in about 90 seconds whether a written program describes your floor or got copy-pasted from a generic file.

How do you do a workplace hazard assessment?

The hazard assessment is the most important thing you'll do. Every written program, every training requirement, every PPE decision flows out of it. Skip it and jump straight to writing, and you'll write the wrong programs.

OSHA's 29 CFR 1910.132(d) requires employers to assess the workplace for hazards that call for PPE and to certify that assessment in writing ^[7]. The written certification isn't optional. It has to name the workplace evaluated, the person certifying it, and the date.

A practical approach that works for most small businesses:

1. Walk each work area with a notebook. Not from your desk. Go where the work actually happens.

2. Think in hazard categories. Physical (falls, struck-by, caught-in), chemical (inhalation, skin contact, fire), biological (bloodborne pathogens, mold), ergonomic (repetitive motion, awkward posture), and electrical.

3. Watch people work, more than the space. Many hazards live in the motion, not the machine. Someone reaching overhead 200 times a shift is a hazard that never shows up in a room scan.

4. Talk to the people doing the work. They know the near-misses nobody reported. They know the machine that "kicks a little" sometimes. That information is gold.

5. Document each hazard. Location, the task tied to it, severity (kill someone or cause a strain?), and frequency (daily or once a year?).

6. Sign and date the document. That's your written certification. File it.

OSHA's free Job Hazard Analysis publication (OSHA 3071) walks through this in detail ^[5]. It's genuinely useful, and it costs nothing to download.

What safety training does OSHA require for new employees?

Training requirements are buried inside individual OSHA standards, never collected in one tidy place, which is exactly why small businesses miss them.

The general rule is simple. If an OSHA standard applies to your workplace and includes a training requirement, you train employees before they're exposed to the hazard. Not within 30 days. Before exposure.

The triggers that catch small businesses most often:

Hazard Communication (29 CFR 1910.1200(h)): Train on the chemicals present, SDS use, and labeling at initial assignment and whenever a new chemical hazard shows up.

Lockout/Tagout (29 CFR 1910.147(c)(7)): Train authorized employees (those who perform lockout/tagout) and affected employees (those who work nearby) before they perform or are exposed to the procedure.

PPE (29 CFR 1910.132(f)): Train before employees use PPE. Cover when it's needed, which type, and how to put it on, take it off, adjust it, and dispose of it.

Emergency Action Plan (29 CFR 1910.38(e)): Train all employees when the plan is first set up and whenever their responsibilities change.

Bloodborne Pathogens (29 CFR 1910.1030(g)(2)): Train at initial assignment and every year after.

For training that goes past OSHA minimums, look at OSHA training options, including the OSHA 10-hour course for frontline workers and the OSHA 30 course for supervisors. The 30-hour course covers program management on top of hazard recognition, which fits the person who owns the safety program at a small company.

Document every session: date, topic, trainer's name, and the names and signatures of everyone who attended. In OSHA's view, undocumented training didn't happen.

How do you handle OSHA recordkeeping as a small business?

OSHA's injury and illness recordkeeping rules under 29 CFR 1904 apply to employers with more than 10 employees in industries that aren't on OSHA's partial exemption list ^[8]. If you stay at or below 10 employees, or you're in a low-hazard industry like retail or finance, you're exempt from the main recording requirements. You are never exempt from reporting.

Reporting is not the same as recording. If any employee dies from a work-related incident, you report it to OSHA within 8 hours. If any employee is hospitalized, loses an eye, or has an amputation, you report it within 24 hours ^[8]. Every employer owes those reports. No size exemption.

Businesses that do have to record use three forms: the OSHA 300 Log for work-related injuries and illnesses, the OSHA 300A Summary posted each February 1 through April 30, and the OSHA 301 Incident Report (or an equivalent) for each recordable case.

A case is recordable when it's work-related, it's a new case, and it hits one of these: medical treatment beyond first aid, days away from work, restricted duty, loss of consciousness, or diagnosis by a healthcare professional.

Here's what a lot of small employers miss. OSHA doesn't require near-miss tracking (with narrow exceptions), but it's one of the most useful habits you can build. Near-misses predict future injuries. A paper form in the breakroom and a 10-minute monthly review of what got dropped in the box can catch a hazard before it hurts anyone.

For step-by-step help with post-incident paperwork, see our guide on writing an incident report.

What does a safety program cost to build for a small business?

Do the work yourself and the out-of-pocket cost can be close to zero. Hire a consultant to write everything from a blank page and it runs $3,000 to $10,000 or more. That's the honest range.

Where the money goes, or doesn't:

Free resources. OSHA's website has free template programs, free publications, and a free On-Site Consultation program where a state-funded consultant (not an inspector, not tied to enforcement) visits your business and tells you what to fix ^[9]. That visit is confidential and free. Most owners don't know it exists. The same free service runs in California, Oregon, Washington, Michigan, and the other State Plan jurisdictions under each state's program ^[10].

Time cost. Budget 8 to 20 hours to run a thorough hazard assessment and write your core required programs for a small operation. More if you have serious chemical, electrical, or machinery hazards.

Training costs. OSHA 10-hour courses run $150 to $250 per person online. The OSHA 30-hour online course runs $150 to $300. Training you deliver yourself costs your time.

PPE costs. Highly variable. Gloves and safety glasses might be $20 per worker. A respiratory protection program with fit-tested half-face respirators can run several hundred per employee once you add fit testing and medical evaluation.

The cost of not doing it. OSHA penalties for a serious violation reach $16,550 per violation as of 2024 ^[3]. Willful or repeated violations climb to $165,514 per violation. A single lost-time injury at a small business can top $40,000 once you add wage replacement, medical bills, and the hidden cost of training a replacement.

If you want to cut time without cutting corners, tools like SafetyFolio's safety program generator produce a draft that reflects your actual operations in about 15 minutes, which you then review, adjust, and sign. That's the middle ground between blank-page paralysis and a $5,000 consultant invoice.

How do you get employees to actually follow the safety program?

This is the part nobody talks about enough. The binder on the shelf is not a safety program. The binder in your employees' heads is.

What actually works in small businesses, based on what safety-culture research consistently shows ^[13]:

Visible leadership behavior. If the owner walks past a spill without cleaning it or telling someone to, the program is a joke no matter what the paper says. What leaders do outweighs what they write down.

Short, frequent talks over long, rare trainings. A 5-minute toolbox talk at the start of a shift, three times a week, builds more retention than one 4-hour annual session. OSHA doesn't mandate the format, but it's one of the most effective tools a small business has.

Near-miss reporting without punishment. If the first thing that happens to someone who reports a near-miss is a write-up or public embarrassment, near-misses stop getting reported. Injuries take their place.

Specific accountability, not vague responsibility. "Everyone is responsible for safety" means nobody is. Assign named people to named tasks: who checks the fire extinguishers monthly, who restocks the first aid kit, who reviews the 300 Log each quarter.

Involve employees in hazard hunting. A worker who helped find a hazard and design the fix owns the solution. A worker handed a rule feels compliance pressure. Those two people behave very differently under stress.

Nobody has clean data on what share of small-business safety programs get followed versus filed and forgotten. But OSHA's own recommended practices name management commitment and employee involvement as the two factors most predictive of an effective program, which is why the agency's voluntary guidelines lead with both ^[13].

How often do you need to update your safety program?

Review every written program at least once a year. Most standards don't require the annual review by name, but it's the baseline that makes sense.

Beyond the yearly review, five things should trigger an immediate update:

1. New equipment or a new process. That can mean new lockout/tagout procedures, new chemical exposures, or new PPE.

2. A new chemical enters the workplace. Add it to the inventory, get the SDS, check whether new training is required.

3. A recordable injury or a near-miss. Investigate, then fix the procedure if the program failed to prevent it.

4. An employee's duties change significantly. Recheck whether their training still fits what they're now doing.

5. OSHA publishes a new or amended standard that applies to you. It happens. OSHA's website posts proposed and final rules, and signing up for the QuickTakes newsletter is a practical way to stay current without watching the Federal Register yourself.

Date-stamp every version of every program. If OSHA ever asks whether your Hazard Communication program was current at the time of an incident, you want version history to show. A footer reading "Last reviewed: [date] by [name]" is enough.

What are OSHA's most frequently cited standards, and should your safety program address them?

Every year OSHA publishes its top 10 most cited standards from the prior fiscal year. The list barely moves.

For fiscal year 2023, the most cited standards across general industry and construction were ^[3]:

1. Fall Protection (29 CFR 1926.501) - Construction 2. Hazard Communication (29 CFR 1910.1200) 3. Ladders (29 CFR 1926.1053) - Construction 4. Respiratory Protection (29 CFR 1910.134) 5. Scaffolding (29 CFR 1926.451) - Construction 6. Lockout/Tagout (29 CFR 1910.147) 7. Powered Industrial Trucks (29 CFR 1910.178) 8. Fall Protection Training (29 CFR 1926.503) - Construction 9. Personal Protective Equipment (29 CFR 1926.102) - Construction 10. Machine Guarding (29 CFR 1910.212)

Run a business in construction, manufacturing, warehousing, or anything with machinery, chemicals, or work at heights, and this list tells you exactly where to focus first. Hazard Communication and Lockout/Tagout land on it nearly every year because they apply so broadly and because their written-program requirements are specific enough that an inspector can document a violation fast.

If you run a forklift or any powered industrial truck, 29 CFR 1910.178 applies and requires operator training and certification before anyone drives. Our guide on forklift certification covers what that training has to include.

The point of the top-10 list isn't to write programs for the sake of checking boxes. These are the hazards most likely to injure your workers and most likely to draw OSHA's eye. They earn priority.

Can you use a template to build a safety program, or does everything need to be custom-written?

Templates are fine as a starting point. They're a disaster as the finish line.

OSHA hands out model programs for some standards. The Hazard Communication standard, for one, comes with a model written program you can adapt ^[11]. State consultation programs often carry industry-specific templates. These are legitimate tools.

The catch is that OSHA doesn't require you to have a document called a safety program. It requires procedures that actually protect employees from the actual hazards in their actual workplace. An inspector who reads a generic template, then walks your floor and sees that nothing matches, notes the gap. A court reviewing a serious injury case notes it too. A document describing equipment you don't have and processes you don't run gives you no legal cover and no real safety.

Here's a practical test. Hand your written Hazard Communication program to a new hire and ask them to find the Safety Data Sheet for your most-used chemical. If they can't do it using the program alone, the program isn't specific enough.

SafetyFolio's program generator is built around this idea. It asks about your specific operations and produces programs that describe your workplace, not a fictional average one. You still review the output for accuracy before you sign it, but you're editing a real draft instead of staring at a blank page.

For standard-by-standard detail on what your programs must contain, the 29 CFR texts are the authoritative source. They're dense but readable section by section. Understanding what OSHA stands for and how the agency writes rules gives you context when you sit down with the regulations themselves.

Frequently asked questions

Do I need a safety program if I only have 2 or 3 employees?

Yes. OSHA's General Duty Clause applies to every employer with at least one employee, regardless of size. A smaller workforce changes which written programs you need, not whether you must address safety. If your 3-person shop uses any chemicals, you need a written Hazard Communication program. If anyone services machinery, you likely need a lockout/tagout program. Size changes the scope, not the obligation.

How long does it take to build a basic safety program from scratch?

For a low-hazard business like an office or small retail shop, a focused person can finish a basic program in one to two days of real work. For a higher-hazard operation like a small manufacturer, auto shop, or construction crew, budget a full week spread over a few weeks for the hazard assessment, research, writing, and review. Rushing produces programs that don't match real conditions, which is the main failure mode.

Is OSHA's free consultation service really separate from inspections?

Yes, genuinely separate. OSHA's On-Site Consultation Program is funded by federal grants and delivered by state agencies. Consultants are not compliance officers, cannot issue citations, and are barred from sharing findings with OSHA enforcement. The one exception is an imminent danger the employer refuses to correct. For a small business with no safety infrastructure, it's the most underused free resource out there. Find your state's program at osha.gov/consultation.

What is the most common OSHA violation for small businesses?

Hazard Communication (29 CFR 1910.1200) sits among the most cited standards across all industry sizes. It applies any time hazardous chemicals are present, which covers almost every workplace. Common failures are missing Safety Data Sheets, unlabeled containers, and no written program. Lockout/Tagout (29 CFR 1910.147) and Respiratory Protection (29 CFR 1910.134) also draw frequent citations for small manufacturers and shops.

What records does OSHA require me to keep, and for how long?

Under 29 CFR 1904, employers required to keep injury logs must retain OSHA 300 Logs, 300A Summaries, and 301 Incident Reports for five years after the calendar year they cover. Training records vary by standard; some, like certain exposure records, require retention for the duration of employment plus 30 years. Build your recordkeeping system with these timelines in mind from day one.

Do I need to post anything in my workplace to comply with OSHA?

Yes. Every employer must post the OSHA Job Safety and Health: It's the Law poster where employees can see it. It's the same poster regardless of state plan or federal jurisdiction, though state plan states may issue their own version. It's free to download from osha.gov. Employers with 11 or more employees who must keep OSHA records also post the OSHA 300A Summary from February 1 through April 30 each year.

What is an Emergency Action Plan and does every small business need one?

An Emergency Action Plan (EAP) is a written document covering evacuation procedures, emergency reporting, accounting for employees after evacuation, rescue and medical duties, and who employees contact for more information. Under 29 CFR 1910.38, employers with 10 or fewer employees can communicate the plan orally instead of in writing. Employers with 11 or more must have a written plan. Every OSHA-covered workplace needs some form of emergency plan regardless of that written threshold.

Do I need a safety committee or a safety officer as a small business?

Federal OSHA doesn't require small private-sector employers to have a formal safety committee or a designated safety officer. Some state plans do. California, for example, requires an Injury and Illness Prevention Program with a named person responsible for it, which is a functional safety officer role even if not called that. Check your state plan requirements if you operate in one of the 22 state plan states.

What happens if OSHA inspects my small business and I don't have a written program?

If a specific standard required a written program and you don't have one, expect a citation for that standard. A missing written Hazard Communication program is typically cited as a serious violation, which currently carries penalties up to $16,550 per instance. A program that exists on paper but plainly doesn't match real operations can draw citations too. Even an inspection that ends without penalties disrupts a small business.

Can employees refuse to follow safety rules without consequences?

You can and should enforce safety rules as employment conditions, like any other work rule. OSHA doesn't block discipline for safety violations; its enforcement criteria actually consider whether an employer has an established program with real disciplinary provisions when judging whether a violation was willful. Consistency matters. Discipline one employee for skipping PPE and ignore the same behavior from another, and both your program's credibility and your legal defense suffer.

How do I know if I'm in a state plan state or under federal OSHA?

Twenty-two states and two territories run OSHA-approved State Plans covering private-sector employers: Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. If you're in one, your state agency enforces standards at least as effective as federal OSHA's. Find the full list and contacts at osha.gov/stateplans.

Is a digital safety program binder acceptable, or does OSHA require paper?

OSHA generally accepts electronic records and programs as long as employees can reach them. Access is the key. If an employee needs a Safety Data Sheet mid-shift, it has to be retrievable right then, not buried behind a login they don't have. A tablet mounted in the work area with SDS access, a shared drive reachable from their phones, or a physical binder all work. Format matters less than accessibility.

What's the difference between an OSHA 10 and an OSHA 30 course for a small business owner?

The OSHA 10-hour course is built for entry-level workers and covers hazard recognition and worker rights. The OSHA 30-hour course targets supervisors and managers and adds program management, incident investigation, and broader compliance topics. For an owner who is also the de facto safety manager, the 30-hour course gives you more of what you need to build and run a program. It takes about 30 hours and can be done online at your own pace.

Do I need to hire a safety consultant to write my safety programs?

No. Plenty of small businesses write their own using OSHA's free model programs, the free state consultation service, and industry guidance. A consultant makes sense if your operation has complex hazards (process chemicals, confined spaces, heavy construction), if you've already been cited and need fast corrections, or if you flat-out lack the time. For a straightforward operation, a consultant's cost often isn't justified when free and low-cost resources get you there.

Sources

1. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: Every employer must furnish a workplace free from recognized hazards likely to cause death or serious physical harm, regardless of company size.
2. OSHA, Enforcement: Certain low-hazard industries are exempt from OSHA routine programmed inspections, but not from compliance with applicable standards.
3. OSHA, Top 10 Most Frequently Cited Standards FY2023: Federal OSHA conducted approximately 32,000 inspections in FY2023 and publishes annual top-10 cited standards lists. Maximum penalty for a serious violation is $16,550 per violation as of 2024.
4. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities: Private industry employers reported 2.6 million nonfatal workplace injuries and illnesses in 2023.
5. OSHA, Job Hazard Analysis Publication 3071: OSHA provides a free Job Hazard Analysis publication (OSHA 3071) and worksheet employers can use to identify and document workplace hazards.
6. OSHA, 29 CFR 1926.501 Fall Protection Duty to Have Fall Protection: Construction employers must provide fall protection at heights of 6 feet or more above a lower level and have a written fall protection plan in certain circumstances.
7. OSHA, 29 CFR 1910.132(d) Personal Protective Equipment Hazard Assessment: Employers must assess the workplace to determine PPE hazards and certify that assessment in writing, including the workplace evaluated, name of person certifying, and date.
8. OSHA, 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses: Employers with more than 10 employees in non-exempt industries must keep injury and illness records. All employers must report fatalities within 8 hours and hospitalizations, amputations, or eye losses within 24 hours.
9. OSHA, On-Site Consultation Program: OSHA's free, confidential On-Site Consultation Program is separate from enforcement and helps small and medium-sized businesses identify hazards and improve safety programs without risk of citation.
10. OSHA, State Plans: Twenty-two states and two territories operate OSHA-approved State Plans covering private-sector employers; state standards must be at least as effective as federal OSHA standards.
11. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: The Hazard Communication Standard requires employers to have a written program, chemical inventory, Safety Data Sheets, and employee training for all workplaces where hazardous chemicals are present.
12. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Lockout/Tagout requires a written energy control program and equipment-specific procedures whenever employees service or maintain equipment where unexpected energization could cause injury.
13. OSHA, Recommended Practices for Safety and Health Programs: OSHA's voluntary safety and health program guidelines identify management commitment and employee involvement as core elements of effective safety programs.