How to document a job hazard analysis for OSHA compliance

Last updated 2026-07-11

What is a job hazard analysis and why does OSHA care about it?

A job hazard analysis, also called a job safety analysis (JSA), is a written record that ties specific job steps to their hazards and to the controls that address those hazards. It is more than a checklist. It is proof that someone thought hard about a task before workers ever touched it.

OSHA's guidance publication "Job Hazard Analysis" (OSHA 3071, revised 2002) frames the process around one idea: the analysis helps "identify hazards before they occur" and "focuses on the relationship between the worker, the task, the tools, and the work environment." ^[1] Those four elements matter because inspectors look for exactly them when they read a JHA during a site visit.

There is no single standard that says "you must keep a written JHA." What exists is a web of standards that require hazard assessments as a precondition for compliance. The PPE standard at 29 CFR 1910.132(d) tells employers to assess the workplace for PPE needs and to verify that assessment in writing. ^[2] Process Safety Management at 29 CFR 1910.119 requires a process hazard analysis for covered facilities. ^[8] The construction fall protection rule at 29 CFR 1926.502 requires certain fall protection plans in writing. ^[9] A JHA is the practical tool that satisfies most of those written-assessment duties at once.

The stakes are concrete for a small shop. The Bureau of Labor Statistics reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, and overexertion, slips, trips, and contact with objects drive most of that total. ^[3] Those events happen during routine tasks. Routine tasks are exactly what a JHA is built to analyze.

Which OSHA standards actually require a written hazard analysis?

No single "JHA standard" exists in the Code of Federal Regulations. Several standards do require written assessments that a JHA satisfies or supports, and one document can cover more than one of them.

Standard	What it requires in writing
29 CFR 1910.132(d)	Written PPE hazard assessment, signed and certified
29 CFR 1910.119 (PSM)	Written process hazard analysis for covered processes
29 CFR 1910.147 (LOTO)	Written energy control procedures for each piece of equipment
29 CFR 1926.502(k)	Written fall protection plan for certain construction work
29 CFR 1910.1200	Written hazard communication program tied to an SDS for each chemical

The PPE standard trips up more small employers than any other on that list. 29 CFR 1910.132(d)(2) requires the employer to "verify that the required workplace hazard assessment has been performed through a written certification that identifies the workplace evaluated, the person certifying that the evaluation has been performed, the date(s) of the hazard assessment, and which identifies the document as a certification of hazard assessment." ^[2] A JHA that carries those fields doubles as that certification.

For general industry employers outside PSM coverage, the General Duty Clause of the OSH Act, Section 5(a)(1), is the catch-all. OSHA can cite you for recognized hazards even where no specific standard applies. A documented JHA is evidence that you recognized a hazard and controlled it, which is your main defense under Section 5(a)(1). ^[4]

If your work involves chemicals, your JHA should connect to the safety data sheet for each substance. See our guide on hazard communication for how those two documents work together.

Energy control work needs more than a JHA. You also need a written lockout procedure. Our lockout tagout article covers what that document must contain. ^[7]

What fields must a JHA document include?

OSHA prescribes no form, but its OSHA 3071 guidance describes the minimum content a useful JHA carries. ^[1] Here is what belongs in every JHA your business produces.

Header block Job title or task name, and be specific: "unloading pallets from a delivery truck," not "warehouse work." Department or location. Date completed. Name and title of the person who ran the analysis. Names of the employees consulted. The supervisor who reviewed and approved it. Equipment, materials, and PPE involved.

Step-by-step task breakdown Break the job into its sequential steps, usually four to fifteen for most tasks. Each step describes what the worker does, not what could go wrong. "Lift box from pallet" is a step. "Worker might hurt their back" is not a step. That is a hazard, and it belongs in the next column.

Hazard column For each step, name what could cause harm and be specific about the type: struck-by, caught-in, fall from elevation, chemical exposure, ergonomic overexertion, electrical contact, temperature extremes. Generic entries like "injury" are useless and will not survive an inspection.

Control column For each hazard, record the control using the hierarchy of controls: elimination, substitution, engineering controls, administrative controls, then PPE. PPE is the last resort, not the first answer. If your control column is all PPE, an inspector will ask why you skipped engineering solutions.

Review and revision block Date of last review, the trigger for revision (incident, near-miss, new equipment, regulatory change), and the name of the reviewer. OSHA expects a JHA to be a living document, not file-and-forget paperwork.

How do you choose which jobs to analyze first?

You cannot analyze every task at once, so triage. OSHA's JHA guidance recommends ranking jobs by four factors: the highest injury or illness rates, the potential for severe or disabling injuries, jobs that are new or recently changed, and jobs complex enough to need written instructions. ^[1]

In practice, start with your OSHA 300 log. Any task that produced a recordable injury or illness in the past three years goes to the top. No three years of data yet? Use your near-miss reports and first-aid log as a stand-in.

New equipment and changed processes deserve immediate attention. A worker who has done the same job for ten years has built habits that hide hazards. Change the equipment or the process, and those habits turn into liabilities, with no JHA covering the new setup.

Once you have a priority list, put one person in charge of each analysis. That person should be the frontline supervisor for the task, not a safety officer at a desk down the hall. Supervisors know where the workarounds live. They know which step workers skip when nobody is watching. That knowledge is the whole point of a JHA.

How do you break a job into steps correctly?

This is where most first-time JHA writers stumble. They make steps too broad ("operate forklift") or too fine ("place right foot on first rung of ladder"). Neither one works.

A good step describes a distinct, observable action that moves the task forward. You should be able to watch a worker and call out each step as it happens. OSHA's guidance suggests ten to fifteen steps as a practical ceiling for most jobs. ^[1] If your analysis runs past fifteen, the task is probably two tasks and should split into two JHAs.

The most reliable method is to watch the job get done. Shadow the worker, take notes in order, then review the draft steps with them afterward. Workers almost always catch something you missed. They also catch steps that happen in reality but never made it into the official procedure, and those undocumented steps are where hazards hide.

If you cannot watch the job safely (a rare task, or one in a dangerous location), interview the people who do it most. Ask them to walk you through it in sequence. Ask what they do when something goes wrong. The deviations from the written procedure are the steps that most need a hazard column.

Take a forklift certification task. A JHA for "loading a truck with a forklift" should treat the pre-operation inspection, travel, lifting, placement, and shutdown as separate steps, because the hazard profile of each one is completely different.

How do you identify hazards in each step accurately?

Hazard identification is the analytical core of the JHA. Run every step through a standard category checklist. OSHA's JHA guidance lists these: struck-by, struck-against, caught-in, caught-between, fall to same level, fall to different level, overexertion, exposure to harmful substances, temperature extremes, and electrical contact. ^[1]

For each step, ask what could hurt someone here, and how. Be specific. "Struck-by from falling object during overhead lifting" is useful. "Hazard: injury" is not.

Work the routine case and the failure case both. What happens during normal operation? What happens if a component fails, a surface is wet, or the worker is distracted? Failure-case hazards are the ones that tend to produce serious injuries, and they are the ones missing from most weak JHAs.

Count everyone in the area. A hazard to a bystander is still a hazard that belongs in the document. Inspectors look at the whole work environment, well beyond the person doing the task.

Then check ergonomics. Musculoskeletal disorders make up a large share of recordable injuries across industries year after year. ^[11] Awkward postures, repetitive motion, and force requirements belong in the hazard column even when no single day produces an acute injury.

What controls should you document and how do you show the hierarchy?

OSHA expects the hierarchy of controls to shape your response to every hazard, and your JHA should make that logic visible on the page. The hierarchy runs from most to least effective: elimination, substitution, engineering controls, administrative controls, PPE. ^[1]

For each hazard, record what you weighed at each level before you landed on the control you chose. You do not have to install a control at every level. You do have to show why you passed over the higher-level options. Jump straight to PPE and an inspector will ask why you skipped engineering controls, and "we didn't think of it" is not an answer that survives.

Elimination means removing the hazard outright. Can you stop doing this step? Can the equipment be redesigned so the operation is unnecessary? Elimination is rarely possible and always worth asking.

Substitution means swapping the hazard for something less dangerous. A less toxic cleaner. A lighter tool. A lower-risk process.

Engineering controls are physical changes: guards, ventilation, interlocks, barriers. They cut exposure without leaning on worker behavior.

Administrative controls cover procedures, rotation schedules, warning signs, and training. They depend on behavior, so they are less reliable than engineering controls, though often more practical.

PPE gets documented last. For any PPE requirement, name the specific type ("ANSI Z87.1-rated safety glasses," not "eye protection") and connect it to your PPE hazard assessment under 29 CFR 1910.132(d). ^[2]

If your business needs a full written safety program that ties JHAs into a broader compliance structure, SafetyFolio's safety program generator builds one in about fifteen minutes, covering the program elements that reference hazard analysis documents.

What does a properly completed JHA document look like in practice?

Here is a stripped-down example for one task: "Removing a full drum of chemical from a shelf using a hand truck."

Step	Hazard	Control
1. Position hand truck at shelf	Struck-by from drum rolling off shelf	Verify drum bung is sealed; use drum with lip guard; clear path before approaching
2. Tilt drum onto hand truck	Overexertion / musculoskeletal strain	Two-person lift required for drums over 50 lbs; use mechanical drum handler if available
3. Secure drum with strap	Drum falls during transport	Ratchet strap to hand truck frame before moving; inspect strap before each use
4. Transport to use area	Slip/trip on wet or cluttered floor	Verify path is clear and dry before transit; maintain three-point contact on ramps
5. Position drum at use point	Chemical splash during uncapping	Nitrile gloves, chemical splash goggles (ANSI Z87.1), and face shield required; consult SDS for chemical-specific PPE

Notice a few things. Each step is one observable action. Each hazard names a specific event type. Each control is actionable, and where PPE is listed, it names the standard the gear must meet. The SDS reference in step five connects this JHA to the hazard communication program required under 29 CFR 1910.1200. ^[5]

The finished document also carries the header block (job title, date, analyst, employees consulted, supervisor signature) and a review block at the bottom. That full package is what an OSHA inspector expects to see.

How often do you need to review and update a JHA?

A JHA written once and filed forever is worse than no JHA at all. It builds a false paper trail that says a hazard was controlled when the facts on the floor may have moved.

OSHA's JHA guidance names four triggers for mandatory revision: a job change, a change in tools or equipment, a near-miss or accident involving the task, and any review that shows the document no longer matches actual practice. ^[1] Past those triggers, a reasonable default is an annual review for every active JHA.

The review should pull in the same people who ran the original analysis. Workers notice when the real work has drifted from what the JHA describes, and that drift is often the leading indicator of an incident.

Date-stamp every review inside the document. An undated JHA looks like it was written the week of the inspection. A JHA with three dated annual reviews and one revision triggered by a near-miss looks like a working safety management system, because it is one.

For high-hazard tasks (confined space entry, work on energized equipment, work at elevation), review the JHA before each job rather than once a year. Some industries treat the JHA as a daily pre-task planning tool instead of a once-written reference. That takes more time and catches the one-off conditions (an odd work setup, a missing guard, a new worker on the task) that annual reviews miss.

How should you store and present JHA documents during an OSHA inspection?

OSHA inspectors can ask for hazard analysis records on the spot. You need to produce them fast, and they need to be legible, complete, and obviously current.

Digital files are fine for storage. OSHA has no requirement for paper records. What matters is that the documents are accessible at the worksite where the job happens, that they are version-controlled (you can show what changed and when), and that they are signed or at least show authorship.

OSHA sets no general retention period for JHAs the way it does for OSHA 300 logs (five years under 29 CFR 1904.33). ^[6] Keeping JHAs for three to five years is a sound practice anyway. If a JHA was in place when an incident occurred, you want to be able to show it. If an incident occurred and no JHA existed, you do not want an inspector learning that you had one and destroyed it.

During an inspection, present the JHA next to any related written programs: the PPE assessment certification, lockout procedures, the hazard communication program. The inspector wants to see a coherent system, not scattered documents. A JHA that names your PPE program, and a PPE program that names the JHA process, tells a far better compliance story than two documents that never mention each other.

For how OSHA inspections actually run and what rights you have as an employer, the osha basics section on this site walks through the inspection process in detail.

Can employees participate in the JHA process, and does that help with OSHA?

Yes, and yes. OSHA's JHA guidance states plainly that employee involvement improves both the accuracy and the acceptance of a JHA. ^[1] Workers know where the unofficial shortcuts are. They know which machine vibrates differently on cold mornings. They know which step the procedure says to do second but everyone does fourth. None of that is in any manual.

Involvement also builds buy-in. A worker who helped write the JHA follows it. A worker who got it as a memo files it. OSHA recognizes this in its Voluntary Protection Programs (VPP), which treat worker participation in hazard identification as a mark of an effective safety management system. ^[10]

From a legal angle, documenting employee consultation in the JHA header gives you evidence that hazard identification was thorough. If OSHA cites you for a hazard and you can show that experienced workers were consulted and that hazard was weighed, you have a stronger basis for contesting or reducing the citation.

For supervisors who want to run JHA meetings well, OSHA training resources at the OSHA Training Institute cover hazard recognition as a core skill. Workers who finished an OSHA 30 course walk into a JHA session already sharing a vocabulary for hazard types, which speeds the whole conversation up.

What are the most common JHA documentation mistakes that lead to OSHA citations?

Read enough OSHA citation data and agency compliance guidance and a few patterns repeat across industries. Here are the ones that cost employers.

Vague hazard descriptions. "Possible injury" or "worker may be hurt" does not name a hazard. It names an outcome. Inspectors want the specific event: struck-by, fall, chemical exposure, electrical contact.

Controls that are only PPE. A JHA where every control entry starts with "wear gloves" or "use hard hat" signals that the analyst jumped past the hierarchy. Even when PPE is the right final answer, the document should show that elimination, substitution, and engineering controls were considered first.

Missing signatures. The PPE standard at 29 CFR 1910.132(d)(2) requires a written certification. ^[2] A JHA nobody signed or dated is not a certification. It is a draft.

Stale JHAs. A JHA written for a task that no longer exists, or that describes a process the shop dropped two years ago, is sometimes worse than none, because it implies the employer stopped paying attention.

No documented employee consultation. If a manager wrote the JHA without ever watching the task or talking to the workers who do it, that gap shows in the document quality. Inspectors notice.

Missing revision history. A JHA with no review date, or one clearly produced after an incident rather than before it, will not help your case. Date your reviews.

Is there a free OSHA JHA template or format you can use?

OSHA provides a sample JHA worksheet in the appendix of the OSHA 3071 publication, free as a PDF from OSHA.gov. ^[1] It uses a three-column format (job steps, hazards, controls) with a header block. That is the baseline most compliance practitioners work from.

The ANSI/ASSE Z590.3-2011 standard (Prevention through Design) offers more detailed hazard analysis frameworks for complex engineering tasks, though that standard is not free. Most small employers never need it.

For a small business that wants its JHA to plug into a broader written safety program, building the program structure first and slotting JHAs into it tends to beat writing JHAs in isolation. SafetyFolio's safety program generator builds the written program shell (hazard communication, PPE, incident reporting, training) in about fifteen minutes, and JHAs attach to that structure as supporting documents.

Whatever format you pick, the document must carry the four elements required for PPE certification under 29 CFR 1910.132(d)(2): the workplace evaluated, the person certifying, the date, and identification of the document as a hazard assessment certification. ^[2] Those four fields are non-negotiable regardless of layout.

When an incident happens despite a JHA being in place, review the JHA as part of the post-incident analysis and attach it to the incident report as a reference document.

Frequently asked questions

Does OSHA require a JHA for every job?

OSHA has no universal rule mandating a JHA for every task. Specific standards require written hazard assessments for PPE selection (29 CFR 1910.132), certain construction operations, process safety management, and energy control. In practice, employers in OSHA-inspected industries should have JHAs for any task with a meaningful injury risk, because the absence of one becomes evidence of a General Duty Clause violation when an incident occurs.

What is the difference between a JHA and a JSA?

Nothing significant. Job Hazard Analysis (JHA) and Job Safety Analysis (JSA) name the same process: breaking a job into steps, identifying hazards per step, and documenting controls. Some industries and companies prefer one term over the other. OSHA's guidance publication uses JHA. Either label is acceptable on your documents.

How long does it take to complete a JHA?

A straightforward task with four to eight steps and familiar hazards usually takes thirty to ninety minutes to analyze properly, including time to observe the job and consult the worker. Complex tasks such as confined space entry or work on energized systems can take half a day or more. The first JHA for a given task always takes longest; later revisions go much faster.

Who should sign a JHA document?

At minimum, the analyst who ran the assessment and the supervisor responsible for the work area should sign. For the document to serve as the PPE hazard assessment certification under 29 CFR 1910.132(d)(2), the certifying person must be identified by name and title. Many employers also have the employees who were consulted sign, as a record of participation.

Can a JHA be used as a training document?

Yes, and it is one of the better uses for a finished JHA. Walking a new employee through the JHA for their task covers job-specific hazards and controls in a structured way. It also creates a record that hazard-specific training happened for that task. The JHA should supplement formal training required under applicable OSHA standards, not replace it.

Does OSHA accept electronic JHA records?

Yes. OSHA has no general requirement that safety records live on paper. Electronic records are acceptable as long as they are accessible at the worksite, can be produced during an inspection, and include the required content (analyst name, date, workplace evaluated, and certification language where required). Version control matters so you can show what the JHA said at any specific point in time.

What is the hierarchy of controls and how does it appear in a JHA?

The hierarchy of controls ranks control methods from most to least effective: elimination, substitution, engineering controls, administrative controls, and PPE. In a JHA, the controls column should reflect that order. For each hazard, document the control level you chose and, if you passed over a higher-level option, note why. A controls column that lists only PPE without addressing higher-level options is a common inspection finding.

How many steps should a JHA have?

OSHA's JHA guidance suggests most jobs break into four to fifteen distinct steps. Fewer than four usually means the task description is too vague. More than fifteen usually means the task should split into two or more separate JHAs. Each step should describe a single observable action, not an outcome and not a hazard.

Do JHAs need to be updated after a workplace incident?

Yes. A near-miss or recordable injury involving a task that has a JHA is a mandatory revision trigger under OSHA's own guidance. The incident may reveal a hazard the original analysis missed or a control that did not work as expected. The revised JHA should document what changed and when. Failing to update a JHA after an incident is a gap OSHA inspectors look for specifically.

Is a JHA the same as a written safety program?

No. A written safety program covers the overall policies, procedures, and responsibilities for a safety topic (PPE, hazard communication, lockout/tagout) at the program level. A JHA is a task-level document that identifies hazards and controls for one specific job. The two work together: your written program describes the JHA process, and your JHAs are the task-specific documents that carry it out.

What industries most commonly need JHAs?

Construction, manufacturing, warehousing, oil and gas, healthcare (for patient handling and chemical exposure), and utilities all combine high injury rates with active OSHA enforcement, which makes JHAs especially important. Any employer under OSHA jurisdiction can benefit from JHAs, though, and any of them can be cited under the General Duty Clause for recognized hazards, regardless of industry.

Can a small business with no safety officer write their own JHAs?

Absolutely. OSHA's JHA guidance is written with small employers in mind and is free from OSHA.gov. The frontline supervisor for a task is usually the best person to lead the analysis. The key requirements are watching the actual job, consulting the workers who do it, and completing all required fields, including analyst name, date, and a signature for PPE certification purposes.

How does a JHA relate to OSHA's General Duty Clause?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause serious harm. A documented JHA is evidence that you recognized a hazard and put a control in place. If OSHA cites you under the General Duty Clause, a complete JHA for the task involved can support your defense or cut the penalty, while the absence of any hazard analysis can make the citation worse.

Sources

1. OSHA, Job Hazard Analysis (OSHA 3071, revised 2002): OSHA defines JHA as a method to identify hazards before they occur, focusing on the relationship between the worker, the task, the tools, and the work environment; recommends 4-15 steps per task; and lists four revision triggers.
2. OSHA, 29 CFR 1910.132 - Personal Protective Equipment, General Requirements: 29 CFR 1910.132(d)(2) requires a written certification identifying the workplace evaluated, the certifying person, the date, and the document as a certification of hazard assessment.
3. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses, 2023: BLS reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023.
4. OSHA, OSH Act of 1970, Section 5(a)(1) - General Duty Clause: Section 5(a)(1) of the OSH Act requires employers to furnish a place of employment free from recognized hazards causing or likely to cause death or serious physical harm.
5. OSHA, 29 CFR 1910.1200 - Hazard Communication: 29 CFR 1910.1200 requires a written hazard communication program tied to safety data sheets for each hazardous chemical in the workplace.
6. OSHA, 29 CFR 1904.33 - Recordkeeping, Retention and Updating: OSHA 300 logs and related records must be retained for five years under 29 CFR 1904.33.
7. OSHA, 29 CFR 1910.147 - The Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147 requires written energy control procedures for each piece of equipment covered by lockout/tagout requirements.
8. OSHA, 29 CFR 1910.119 - Process Safety Management of Highly Hazardous Chemicals: 29 CFR 1910.119 requires a written process hazard analysis for facilities covered by the Process Safety Management standard.
9. OSHA, 29 CFR 1926.502 - Fall Protection Systems Criteria and Practices: 29 CFR 1926.502(k) requires a written fall protection plan for certain construction activities where conventional fall protection is infeasible.
10. OSHA, Voluntary Protection Programs (VPP) Overview: OSHA's VPP emphasizes worker participation in hazard identification and analysis as a hallmark of effective safety management systems.
11. BLS, Nonfatal Occupational Injuries and Illnesses Requiring Days Away from Work, 2022: Overexertion, falls, and contact with objects consistently account for the majority of nonfatal occupational injuries requiring days away from work.