How to prioritize which OSHA programs to write first

Last updated 2026-07-11

Why does the order you write OSHA programs matter?

Order matters because you can't write everything at once, and OSHA doesn't care about everything equally. Most small business owners get handed a stack of required programs and freeze. Depending on your industry you might need three programs or a dozen, and nobody gives you a ranked list.

Two things drive the ranking. OSHA inspectors don't arrive with equal interest in every standard. They follow inspection targeting priorities, and a handful of standards generate citations far more often than the rest. Your workers also get hurt in patterns specific to your industry. A respiratory protection program makes sense for a welding shop. Writing one first for an insurance office wastes an afternoon.

This is a solvable problem. You need three inputs: which standards carry a mandatory written program requirement, which hazards are most likely to injure your workers, and which violations OSHA cites most often in your industry. Cross those three and a short, defensible priority list falls out.

Which OSHA standards actually require a written program?

Not every OSHA standard requires a written program. Some require training, some require equipment, some require both. Written program requirements sit in the standard text, usually phrased as "the employer shall establish a written program" or "a written plan is required."

Here are the major General Industry standards (29 CFR 1910) with hard written program requirements, sorted by how broadly they apply:

Standard	CFR Citation	Written Program Name	Applies To
Hazard Communication	29 CFR 1910.1200(e)	Written HazCom Program	Any employer using hazardous chemicals
Emergency Action Plan	29 CFR 1910.38(b)	Emergency Action Plan	Employers with 10+ employees (and some with fewer)
Fire Prevention Plan	29 CFR 1910.39(b)	Fire Prevention Plan	Specific triggering standards
Lockout/Tagout	29 CFR 1910.147(c)(1)	Energy Control Program	Any employer servicing or maintaining equipment
Respiratory Protection	29 CFR 1910.134(c)	Written Resp. Protection Program	When respirators are required or permitted
Bloodborne Pathogens	29 CFR 1910.1030(c)(1)	Exposure Control Plan	Employers with occupational exposure risk
Personal Protective Equipment	29 CFR 1910.132(d)	Hazard Assessment & PPE Program	Any employer requiring PPE
Hearing Conservation	29 CFR 1910.95(c)	Hearing Conservation Program	8-hr TWA noise at or above 85 dBA
Confined Space	29 CFR 1910.146(c)(4)	Permit-Required Confined Space Program	Employers with permit spaces
Chemical Hygiene (labs)	29 CFR 1910.1450(e)	Chemical Hygiene Plan	Laboratories using hazardous chemicals

Construction (29 CFR 1926) works a bit differently. An Injury and Illness Prevention Program is not federally mandated in general industry, but 22 states and two territories run their own OSHA-approved State Plans, and several of those do require a written I2P2 ^[1][2].

The HazCom text is a clean example. It reads: "Employers shall develop, implement, and maintain at each workplace a written hazard communication program" (29 CFR 1910.1200(e)(1)) ^[3]. That language leaves no room. If you use chemicals, you need it in writing.

How do I figure out which hazards are biggest for my specific business?

Start with Bureau of Labor Statistics injury data for your NAICS code. BLS publishes the Survey of Occupational Injuries and Illnesses every year, broken down by industry. It shows the total recordable case rate, the days-away-from-work rate, and the leading injury events: falls, overexertion, contact with objects and equipment, and so on ^[4].

The gaps between industries are huge. In 2022, BLS reported the incidence rate of nonfatal occupational injuries for private industry overall at 2.7 cases per 100 full-time workers. Warehousing and storage ran about 4.4. Professional and technical services ran around 0.7 ^[4]. Your priority list should reflect your industry, not some blended average that describes nobody.

Once you pull your NAICS data, map the leading injury categories to the standards that control them:

• Falls, slips, trips: Walking-Working Surfaces (29 CFR 1910.22), Fall Protection (29 CFR 1926.502 for construction)
• Contact with objects and equipment: Lockout/Tagout (29 CFR 1910.147), Machine Guarding (29 CFR 1910.212)
• Overexertion and bodily reaction: Ergonomics (no specific federal standard, but OSHA can cite through the General Duty Clause, Section 5(a)(1))
• Exposure to harmful substances: HazCom (29 CFR 1910.1200), Respiratory Protection (29 CFR 1910.134)
• Transportation incidents: fleet safety, not a direct OSHA written program but a place where OSHA and DOT overlap

Then pull OSHA's top-cited standards list, published every fiscal year. In fiscal year 2023, the top five were Fall Protection (29 CFR 1926.501), Hazard Communication (29 CFR 1910.1200), Ladders (29 CFR 1926.1053), Respiratory Protection (29 CFR 1910.134), and Lockout/Tagout (29 CFR 1910.147) ^[5]. That list is a reasonable proxy for where inspectors look hardest.

What is the simplest framework for ranking which program to write first?

Here is the three-factor scoring approach I'd use. It takes about 20 minutes and gives you a sequence you can defend.

Score each candidate program 1 to 3 on three factors:

1. Exposure: Do your workers actually face this hazard? (1 = minimal, 2 = occasional, 3 = daily or systemic) 2. Severity: If someone gets hurt here, how bad is it? (1 = minor, 2 = moderate lost-time injury, 3 = fatality or permanent harm potential) 3. Regulatory pressure: Is a written program explicitly required by a cited standard? (1 = no explicit requirement, 2 = implied or best practice, 3 = explicit written program required)

Multiply the three scores. The max is 27, the min is 1. Programs scoring 18 or above are your first wave. Programs scoring 9 to 17 are your second wave. Below 9 can wait until the others are done.

Why multiply instead of add? A hazard with high severity but zero exposure should not tie with one that scores moderate across the board. Multiplication forces a reckoning with zeros. Add the scores and a hazard your workers never touch sneaks onto your first-wave list.

One override. If OSHA can cite you for not having a program in writing and that citation carries a penalty, round it up regardless of your math. The penalty structure is the reason. A serious violation currently carries a maximum penalty of $16,550 per violation, and willful or repeated violations can hit $165,514 per violation ^[6]. A two-hour investment in a written program almost always beats a single citation.

What is the typical priority order for a small manufacturing or warehouse business?

For a small manufacturer or warehouse with 10 to 50 employees, here is the default sequence I'd build for the first six programs, and the reasoning behind each.

1. Hazard Communication Program. Nearly universal, explicitly required, and the most-cited standard year after year. It also gives workers real information about what they're handling, which is the foundation everything else sits on ^[3].

2. Energy Control (Lockout/Tagout) Program. Machine and equipment maintenance is where workers die. OSHA estimates Lockout/Tagout prevents roughly 120 deaths and 50,000 injuries a year ^[7]. The written program is required by 29 CFR 1910.147(c)(1). If your workers ever service, clean, or unjam equipment, this is non-negotiable.

3. Emergency Action Plan. Required for most workplaces under 29 CFR 1910.38. You can communicate it orally if you have fewer than 10 employees, but a written plan is better practice and required at 10 or more ^[8]. A solid one takes maybe 90 minutes.

4. PPE Hazard Assessment and Program. If you require any PPE, 29 CFR 1910.132(d) requires a documented written hazard assessment. It flows naturally from your HazCom work, since you'll already have your chemical hazards inventoried.

5. Machine-specific Lockout/Tagout procedures. These are separate from the written energy control program but part of the same compliance package. See our Lockout/Tagout guide for how the procedures attach to the program.

6. Respiratory Protection Program, if applicable. If anyone wears even a dust mask voluntarily, you may need a written program under 29 CFR 1910.134(c)(2). Employers are often surprised that voluntary use of filtering facepiece respirators still triggers written requirements.

For a service business with no chemicals and no heavy equipment, the order shifts. The Emergency Action Plan moves to number one, you may skip Lockout entirely, and Bloodborne Pathogens may jump the list if any workers have potential exposure.

How should a service business or office-based employer prioritize differently?

Service businesses and offices carry genuinely lower regulatory burdens, and pretending otherwise would be dishonest. But lower is not zero.

The baseline almost any employer needs, regardless of industry:

• Emergency Action Plan (29 CFR 1910.38, required if you have more than 10 employees in a permanent establishment)
• Hazard Communication if any cleaning chemicals, paints, or adhesives are present, and they almost always are
• An injury and illness recordkeeping system under 29 CFR 1904, even below the threshold for keeping OSHA 300 logs (partial exemptions apply based on size and industry classification ^[9])

Past that, the real question is whether your workers drive, do home visits, or handle bodily fluids. Healthcare workers and first responders need a Bloodborne Pathogens Exposure Control Plan under 29 CFR 1910.1030(c) before almost anything else. Home health, dental, tattooing, childcare, and custodial work all trigger it.

For service businesses where workers drive regularly, OSHA has no specific fleet written program standard, yet vehicle crashes are the leading cause of worker deaths in several service sectors. The General Duty Clause (Section 5(a)(1) of the OSH Act) is the citation pathway, and a written distracted driving or vehicle safety policy is documented good-faith evidence.

My honest take: a service business with 15 employees probably needs three solid written programs before it needs anything else. Don't let the full theoretical list scare you into writing none of them.

How long does it actually take to write these programs, and what should you do first?

Do the facility walkthrough first, before you write a single word. That's the one answer to "what should I do first" that nobody can shortcut for you.

Drafting times vary depending on whether you build from scratch or adapt a template. A realistic range:

• Hazard Communication Program: 2 to 4 hours from scratch, 30 to 60 minutes with a good template
• Emergency Action Plan: 1 to 3 hours depending on facility complexity
• Energy Control (Lockout/Tagout) Program: 3 to 6 hours for the written program, plus equipment-specific procedures at 30 to 60 minutes each
• Respiratory Protection Program: 2 to 4 hours for the written program, plus a medical evaluation process that adds time
• Bloodborne Pathogens Exposure Control Plan: 2 to 5 hours from scratch
• PPE Hazard Assessment: 1 to 2 hours if you've already done your chemical and physical hazard inventory

Those are practitioner numbers, not lab conditions. A tool like SafetyFolio's safety program generator cuts drafting time by walking you through the required elements for each standard and pulling in your company-specific information, which helps when you're building your first few programs under time pressure.

Back to the walkthrough. Walk every area. Note every chemical, every piece of powered equipment, every place a worker could fall, every confined space, every noise source that might need measurement. No template does this for you. That inventory is the input that makes each program real instead of generic.

Remember that writing and training are separate steps. Most written program standards also require you to train employees on the program's contents. See our OSHA training guide for how the two fit together. Both are required.

What happens if OSHA inspects before you've finished all your programs?

This is the question most owners actually have and won't ask out loud. If OSHA arrives before your programs are all in place, the outcome turns on what they find and whether you can show good-faith effort. OSHA runs a penalty adjustment process that weighs business size, good faith, and inspection history. An employer with fewer than 25 employees may get a 60% penalty reduction, and documented good-faith effort can add another 25% ^[6].

Good faith means you've started, you have something in writing, and you can show a timeline or a to-do list proving you knew about the gap and were closing it. It's not a free pass for having nothing. It's a real factor inspectors weigh.

The pragmatic move: finish your highest-scoring programs first, keep documentation of your prioritization logic (a simple spreadsheet counts), and don't let perfect block done. A program covering 80% of what the standard requires beats a program that doesn't exist. You can revise it next week.

One clarification worth having. OSHA's main enforcement mechanism for written programs is a citation under the specific standard that requires them, not a separate penalty for "not having a written program." A missing Lockout/Tagout program gets cited under 29 CFR 1910.147(c)(1) as a serious violation. The citation itself spells out the required correction and a deadline to fix it.

Does your state plan change which programs you need or how to prioritize?

Yes, and it changes things more than people expect. Twenty-two states and two territories run their own OSHA-approved State Plans, and those plans must be "at least as effective" as federal OSHA while free to go further ^[1].

California's Cal/OSHA is the clearest example. It requires every employer to have a written Injury and Illness Prevention Program (IIPP), which federal OSHA does not. That single rule reorders your list if you're in California: the IIPP becomes program number one, well past a best practice ^[10].

Other State Plan states with notable additions or stricter rules include Washington (WISHA), Michigan (MIOSHA), and Oregon (OR-OSHA). If you operate in a State Plan state, pull your state agency's standards before you finalize your priority list. Your state plan is the authoritative source, not federal OSHA.gov.

OSHA keeps a directory of State Plan states with links to each program at osha.gov ^[1]. Check it, especially if you operate across state lines, because requirements can vary a lot between locations.

For how federal and state OSHA fit together, our OSHA overview page is a good starting point.

What are the most common mistakes businesses make when prioritizing OSHA programs?

A few patterns show up again and again.

The first is writing programs for hazards you don't have. Some owners download a list of OSHA programs and try to cover the whole thing at once. No permit-required confined spaces means no confined space program. Writing one wastes time and can confuse employees who read a program that doesn't match their reality.

The second is treating the written program as the finish line. A program that sits in a binder nobody opens protects nobody and gives you only partial legal cover. OSHA can cite you for a program that isn't implemented or communicated. Writing it is step one. Training on it and following it are steps two and three.

The third is starting with low-hazard programs because they're easier. I get the impulse. But writing a heat illness plan in January while your workers are bypassing machine guards is a prioritization failure. Do the hard ones first.

Fourth: ignoring contractors and temporary workers. OSHA's multi-employer citation policy means you can be cited for hazards a contractor created if you had the ability to correct or control them ^[11]. If contractors work on your site, your written programs need to address them, and they belong in your prioritization.

Last, don't skip the annual review. Written programs go stale. Regulations change, operations change, your chemical inventory changes. Put a review date on every program and revisit them at least once a year. An incident report from a near-miss or injury is also a trigger for an immediate review.

How do you keep written programs from becoming shelf documents that no one uses?

Write them short, specific, and in plain language. A ten-page HazCom program that cites sections by CFR number and leans on regulatory jargon will not be read by your workers. A three-page program that says "here is our chemical list, here is where the SDSs are, here is what you do if you're exposed" actually gets used.

Build a training record process. Every OSHA standard that requires a written program also requires training, and that training should be documented with a sign-in sheet or a digital record. The documentation protects you legally and acts as a forcing function that makes sure the program gets communicated at all.

Assign ownership. One person should own each written program: keeping it current, training new hires on it, and flagging when the program stops matching what actually happens on the floor. At a small business that might be the owner for most programs, but the explicit assignment is what makes it stick.

For programs like Lockout/Tagout, where machine-specific procedures attach to the written program, laminate the procedures and post them at the equipment. That one step does more for real compliance than any amount of binder organization.

If you want to build your first set of programs quickly with the right structure, SafetyFolio's program generator walks through each required element of the major standards and produces a document you can hand to employees, not a wall of regulatory text.

Frequently asked questions

Do all employers need OSHA written programs, even if they have fewer than 10 employees?

Some written program requirements apply regardless of size. Hazard Communication (29 CFR 1910.1200) has no small-employer exemption if you use hazardous chemicals. Lockout/Tagout applies at any size if you service equipment. The Emergency Action Plan can be communicated orally for fewer than 10 employees under 29 CFR 1910.38, but most other written program standards have no such escape valve. Size affects penalty amounts, not whether the requirement exists.

What is the first OSHA written program most small businesses should write?

Hazard Communication (29 CFR 1910.1200) is the most universally applicable starting point. It covers nearly any employer that uses cleaning products, paints, lubricants, or industrial chemicals. It's consistently among OSHA's top-cited standards, the written program requirement is explicit, and completing it forces you to inventory your chemical hazards, which feeds directly into your PPE assessment and other programs.

How do OSHA's top 10 most-cited standards help me prioritize?

OSHA's annual top-10 citation list, published each fiscal year at osha.gov, shows where inspectors actually write citations. If a standard appears in the top 10, inspectors are trained on it, look for it specifically, and have established enforcement patterns. That list is a useful proxy for your own risk. In FY2023, HazCom, Lockout/Tagout, and Respiratory Protection all appeared in the top 10, confirming their spot at the front of most priority lists.

Can I use a template for my OSHA written programs or does everything have to be custom?

Templates are a legitimate starting point, and OSHA's website offers compliance assistance resources including sample programs. The key is customization. A program must reflect your actual workplace: your chemicals, your equipment, your procedures, your assigned contacts. An unedited generic template that names equipment you don't own or chemicals you don't use creates credibility problems in an inspection and confuses employees. Use templates to get the structure right, then make every factual detail specific to your site.

How often do OSHA written programs need to be updated?

Most standards don't specify a frequency, but best practice, and what inspectors look for, is an annual review plus an immediate review after any incident, near-miss, significant operational change, or regulatory amendment. Your Hazard Communication program should update whenever you add new chemicals. Your Lockout/Tagout program needs updating when you add or significantly modify equipment. Date every version so you can show a review history.

Does OSHA require an Injury and Illness Prevention Program (I2P2) in writing?

Federal OSHA does not currently require a written I2P2 or safety and health program for general industry employers. However, 22 states and two territories run their own State Plans, and several of those, including California (Cal/OSHA), require a written Injury and Illness Prevention Program for all employers. If you're in a State Plan state, check your state's requirements before assuming federal OSHA rules are your full obligation.

What OSHA written programs do construction companies need?

Construction falls under 29 CFR 1926, with its own written program requirements. Key ones include a written Fall Protection Plan for certain work (29 CFR 1926.502), an excavation and trenching program if you dig, HazCom (which applies the same as general industry), and an Emergency Action Plan. Competent person designations are also required documentation under several 1926 subparts. Your specific trades and activities drive the full list.

What is the penalty for not having a required OSHA written program?

A missing written program is typically a serious violation when the standard explicitly requires one. As of 2024, serious violations carry a maximum penalty of $16,550 per violation. Willful or repeated violations can reach $165,514 per violation. Penalty adjustments for employer size, good faith, and inspection history can cut the amount substantially, but the base maximum is where the inspector's calculation starts.

Do I need separate written programs for each worksite, or can one program cover all locations?

It depends on the standard and the locations. HazCom explicitly requires the written program to be available at each workplace (29 CFR 1910.1200(e)(1)), reflecting the chemicals present there. A single master document with site-specific appendices often works well for multi-location employers. For Lockout/Tagout, the machine-specific procedures are inherently site-specific because they document specific equipment at specific locations.

What is the difference between a written program, a written plan, and a written procedure in OSHA terms?

OSHA uses these terms somewhat interchangeably across standards, but there's a practical distinction. A written program is the overarching policy describing how you comply with a standard (your Energy Control Program). A written plan is often a site-specific operational document (an Emergency Action Plan). A written procedure is a step-by-step instruction for a specific task (a machine-specific Lockout/Tagout procedure). Many standards require all three at different levels.

How do I know if I have permit-required confined spaces and need a written program?

A confined space under 29 CFR 1910.146 has three traits: large enough to enter and perform work, limited means of entry or exit, and not designed for continuous occupancy. A permit-required confined space adds one more factor: a hazardous atmosphere, engulfment risk, internal configuration hazard, or another recognized serious hazard. Common examples include tanks, silos, vaults, pits, and some crawl spaces. Walk your facility and test each space against these criteria.

Can my OSHA written programs be stored digitally, or do they need to be paper?

OSHA does not require written programs to be on paper. Electronic formats are fine as long as employees can access them in their work area. For HazCom, the standard says the program must be available in the workplace, and a shared network drive, intranet, or tablet accessible to workers meets that. The practical test is whether an employee could locate and read it during their shift without jumping through hoops.

How does the General Duty Clause affect my priority list for hazards with no specific OSHA standard?

Section 5(a)(1) of the OSH Act, the General Duty Clause, requires employers to provide a workplace free from recognized serious hazards even when no specific standard covers the hazard. OSHA uses it for things like workplace violence in healthcare, heat illness, and ergonomic risk. A written program for these hazards, even when no standard requires it, is documented evidence that you recognized the hazard and took reasonable steps, which strengthens your defense in a General Duty Clause inspection.

Sources

1. OSHA.gov, State Plans overview page: 22 states and territories operate OSHA-approved State Plans that must be at least as effective as federal OSHA and can go further
2. OSHA.gov, Injury and Illness Prevention Programs: Federal OSHA does not require a written I2P2 for general industry; several state plans do
3. OSHA, 29 CFR 1910.1200(e)(1), Hazard Communication standard: 29 CFR 1910.1200(e)(1) states 'Employers shall develop, implement, and maintain at each workplace a written hazard communication program'
4. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2022: In 2022, overall private industry incidence rate was 2.7 per 100 full-time workers; warehousing and storage was approximately 4.4; professional and technical services approximately 0.7
5. OSHA.gov, Top 10 Most Cited Standards FY2023: In FY2023 OSHA's top five most-cited standards included Fall Protection, Hazard Communication, Ladders, Respiratory Protection, and Lockout/Tagout
6. OSHA.gov, Penalties page: Serious violations carry a maximum penalty of $16,550 per violation; willful or repeated violations can reach $165,514 per violation; small employers (fewer than 25 employees) may receive a 60% penalty reduction and good-faith effort an additional 25% reduction
7. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout) standard page: OSHA estimates that compliance with the Lockout/Tagout standard prevents approximately 120 deaths and 50,000 injuries annually
8. OSHA, 29 CFR 1910.38 Emergency Action Plans standard page: 29 CFR 1910.38 allows employers with 10 or fewer employees to communicate an emergency action plan orally; a written plan is required at 10 or more employees
9. OSHA.gov, Recordkeeping rule, 29 CFR 1904 partial exemptions: Certain employers with 10 or fewer employees or in low-hazard industries may be partially exempt from OSHA 300 log recordkeeping requirements under 29 CFR 1904
10. California Department of Industrial Relations, Cal/OSHA IIPP requirement: Cal/OSHA requires every California employer to have a written Injury and Illness Prevention Program, which federal OSHA does not require
11. OSHA, Multi-Employer Citation Policy, OSHA Instruction CPL 02-00-124: Under OSHA's multi-employer citation policy, a controlling employer can be cited for hazards created by contractors if the employer had the ability to correct or control them