How to write a control of hazardous energy program for a small bakery

Last updated 2026-07-11

Does OSHA's hazardous energy standard actually apply to small bakeries?

Yes, and there's no small-employer exemption. The standard, 29 CFR 1910.147, applies to any general industry employer whose workers perform servicing or maintenance on equipment where unexpected energization or release of stored energy could injure them ^[1]. A bakery with a 20-quart Hobart mixer, a spiral dough mixer, a commercial slicer, a deck oven, or a conveyor system has every piece of equipment this standard was written for.

The hazards are real. Mixers have rotating dough hooks that pull in a hand in a fraction of a second. Slicers have blade mechanisms under spring tension. Ovens trap thermal energy and pressurized steam. Conveyors can restart remotely if a Variable Frequency Drive (VFD) is wired to a central control panel. None of those hazards disappear because the machine has an off switch.

OSHA cited 29 CFR 1910.147 more than 2,600 times in fiscal year 2023, making it the fourth most-cited standard agency-wide ^[2]. Food manufacturing, which includes commercial baking, shows up again and again in OSHA's injury data for caught-in and amputation incidents.

The question isn't whether the standard applies. It's whether your written program, your machine-specific procedures, and your training records would survive an inspection.

What exactly does a written energy control program for a bakery have to include?

Four documents. A program-level policy, machine-specific procedures, training records, and an annual inspection certification. Everything else in your program hangs off those four.

The standard at 29 CFR 1910.147(c)(1) states: "The employer shall establish a program consisting of energy control procedures, employee training and periodic inspections to ensure that before any employee performs any servicing or maintenance on a machine or equipment where the unexpected energizing, startup or release of stored energy could occur and cause injury, the machine or equipment shall be isolated from the energy source, and rendered inoperative." ^[1]

Here's what each of the four covers:

1. A program-level written document. This is the policy for your whole facility. It sets the scope (which machines, which energy types), names who can apply and remove lockout/tagout devices, lists the hardware you stock (locks, tags, hasps, blocks), and spells out what workers do when they need to service equipment.

2. Machine-specific energy control procedures. The standard requires a separate written procedure for each machine unless you can show the procedure elements are the same across machines, the machines have a single energy source, and no residual or stored energy hazard exists ^[1]. Most bakery equipment fails that test. That means individual procedures for your mixer, slicer, oven, proofer, and conveyor at a minimum.

3. Training records. You have to document that each authorized employee (the one who applies locks) and each affected employee (the one who runs the machine but doesn't service it) got trained before they worked with or near covered equipment ^[1].

4. Annual certification of periodic inspections. Once a year, a qualified person certifies that the procedures are still accurate, that workers follow them, and that the procedures actually protect workers. That certification has to be in writing.

What are the energy sources in a typical small bakery and how do you identify all of them?

Walk your bakery from the front door to the loading dock. List every form of energy that could injure someone if it released while a worker had a body part in the machine. That walk finds almost everything. Here's what a bakery hides:

• Electrical: Every motor-driven machine. Mixers, slicers, sheeters, dividers, rounders, molders, proofer fans, oven conveyors, refrigeration compressors. The hazard is re-energization, usually from a breaker flipped back on at the panel while someone has a hand in the mixing bowl.
• Mechanical/stored kinetic energy: A rotating dough hook or impeller that keeps spinning after the motor cuts off. A spiral mixer drum can coast for several seconds. Blades under spring tension on a slicer.
• Thermal: Deck ovens, rack ovens, steam injection systems, hot water lines feeding steam-injected proofers. Even a proofer running at 105°F with steam burns you if you reach in to clear a jam before it de-energizes.
• Pneumatic: Larger lines use pneumatic dough dividers, pneumatic scoring machines, or compressed air cleaning systems. Pressurized lines stay pressurized after power is cut until the line is bled.
• Hydraulic: Bigger bakeries run hydraulic lifts on tilt mixers or dough troughs. Hydraulic pressure doesn't drop to zero when you hit the power switch.
• Gravitational: A raised tilt bowl on a 60-quart mixer, a loaded dough trough on a lift cart, a suspended load on an overhead hoist.

The most-missed hazard in a bakery audit is the control panel with remote restart. If your production line runs on a PLC or centralized control system, pulling power at a single disconnect may not be enough. You may need a group lockout procedure that treats the control power circuit separately from the drive power circuit ^[1].

For each machine, record the energy type, the location of each isolation point, the method of isolation (breaker, valve, block, vent), and whether residual energy needs a specific release step before work begins.

How do you write a machine-specific lockout/tagout procedure for a bakery mixer?

Start with the floor-standing commercial spiral or planetary mixer. It's the machine most likely to cause an amputation at a small bakery, so it's the one worth getting right first. Here's what a compliant written procedure includes, following the elements in 29 CFR 1910.147(c)(4):

Header information:

• Machine name and ID number (e.g., "Hobart HL600 60-qt Planetary Mixer, Unit 2")
• Location in the facility
• Equipment manufacturer and model
• Procedure number and date last revised

Steps in order:

1. Notify affected employees (bakers waiting to use the machine) that the machine is going down for service. 2. Identify all energy sources: typically 480V 3-phase electrical supply through a disconnect switch on the machine body, plus the stored kinetic energy of the rotating hook. 3. Shut down the machine using the normal stop controls. 4. Move the machine disconnect switch to OFF. 5. Apply your personal lock to the disconnect switch hasp. Write your name on the tag. Attach the tag to your lock. 6. Wait for the dough hook or beater to stop completely. This is the release of stored kinetic energy. Do not reach into the bowl until all movement stops. 7. Attempt to restart using the normal start button to verify zero energy state. 8. Perform the service task. 9. Remove tools and materials from the bowl. Confirm no workers are in contact with the machine. 10. Remove your lock and tag from the disconnect. 11. Notify affected employees that the machine is back in service.

For a mixer with a bowl lift, add a step to block the bowl in the raised position before working under it, or lower it completely before service begins.

For a tilt mixer (the kind where the head tilts back), the procedure has to address blocking the head so it can't drop.

Laminate the procedure and mount it near the machine. Not in a binder in the office. Workers should confirm the steps without hunting for a document.

The lockout tagout standard's Appendix A gives you a non-mandatory template for energy control procedures that you can adapt directly ^[1].

What does a group lockout procedure look like when multiple bakery workers service the same machine?

Group lockout comes up when a mechanic and a sanitation worker both need to be in or around the same machine at once, say during a deep clean of a conveyor line after a production shift. The rule is in 29 CFR 1910.147(f)(3): each worker who might be exposed to hazardous energy has to be protected by their own lock.

In practice a hasp does the work. It's a multi-lock device that lets several workers clamp their individual locks onto a single lockout point. The machine can't re-energize until every lock comes off, which means every worker has removed their own lock, which means every worker has personally confirmed they're clear.

Your written program should spell out:

• Which machines require group lockout based on your task analysis
• What hasps are stocked and where they live
• Who is the primary authorized employee (coordinator) for each group procedure
• How to handle a shift change when the work isn't done (the outgoing worker's lock comes off and the incoming worker's lock goes on before the outgoing worker leaves)

Shift change is where bakeries blow it. If the night sanitation crew locks out a mixer and leaves before the morning baker arrives, you need a documented procedure for that handoff. Some bakeries run a shadow board: a visible board near the machine where workers hang their key while they're in the hazard zone, so it's instantly obvious who still has a lock applied.

Who needs lockout/tagout training at a bakery, and what does that training have to cover?

The standard splits employees into three groups with different training ^[1]. Authorized employees apply and remove locks. Affected employees run the machines but don't service them. Everyone else just works nearby. Each group gets a different depth of training.

Authorized employees are the workers who actually apply and remove locks: your maintenance technician, the lead baker who clears jams, the sanitation lead. Their training covers the energy control procedures for each machine they'll touch, how to identify and isolate each energy source, and how to verify zero energy state.

Affected employees run equipment that gets locked out but don't do the service themselves: your line bakers on the mixer and the slicer. They need to understand the purpose of the program and know never to restart a locked-out machine.

Other employees work in an area where lockout is used but don't operate or service the equipment. They get awareness-level training: if you see a lock and tag on a machine, don't touch it, and know who to notify if someone removes a lock without authorization.

Training happens before initial assignment and again whenever there's reason to think a worker doesn't understand the procedures, which covers new equipment, changed procedures, or observed deviations ^[1].

Document it: who attended, what date, what was covered, who delivered it. A sign-in sheet works. A quiz with a passing score is better, because it's harder for an inspector to argue the training wasn't substantive.

Hands-on demonstration is the bar for authorized employees. Watching a video and signing a sheet is not enough for the worker who will actually apply a lock. They physically walk through the procedure on the real machine, under supervision, before working alone.

For a broader view of how OSHA defines and audits safety training, see OSHA training.

What hardware do you need to buy for a small bakery lockout/tagout program?

Cheap and simple. You need enough gear that no authorized employee is ever asked to share a lock. That's the whole design goal.

A basic bakery kit includes:

Item	Purpose	Approx. cost per unit
Keyed-different padlocks (one per authorized employee, plus spares)	Personal lockout device	$8 to $15
Multi-lock hasps (2-6 lock capacity)	Group lockout on shared equipment	$5 to $12
Electrical disconnect lockout devices (breaker lockouts, plug lockouts)	Isolate electrical energy sources	$3 to $10
Gate valve lockout devices	Isolate pneumatic or hydraulic lines	$8 to $20
Lockout tags	Identify who applied the lock and why	$0.50 to $2
Lockout station or shadow board	Central storage, visibility	$40 to $120

For a bakery with four authorized employees and a dozen machines, a complete starter kit typically runs $150 to $400. That is not a line worth cutting. A single hospitalization from a caught-in incident costs far more in workers' compensation alone.

Padlocks must be keyed-different: each worker's lock has a unique key that only that worker holds. Never use master-keyed locks for a lockout program. The whole point is that only the person who applied the lock can remove it ^[1].

Bright-colored locks (red is the industry standard) make a locked-out machine visible from across the room. Not a legal requirement, but genuinely useful in a busy production floor.

How do annual periodic inspections of your energy control program work?

Once a year, someone other than the person who normally runs a procedure has to inspect it and certify it in writing. OSHA calls this a "periodic inspection" ^[1]. That inspector is usually your safety officer, a senior maintenance employee, or an outside consultant if you have no qualified internal staff.

The inspection has two parts. First, a review of the procedure itself to confirm it still matches the machine (no modifications, no added energy sources). Second, a direct observation of at least one worker running the procedure on the actual machine.

At the end, you create a written certification with:

• The machine or equipment covered
• The date of the inspection
• The name of the employees included in the inspection
• The name of the person who performed the inspection

A one-page form per machine is fine. Keep those certifications at least a year so they're on hand if OSHA shows up.

The common failure is treating the inspection as paperwork. If the inspector certifies without watching a worker actually perform the procedure, and an OSHA inspector later asks follow-up questions the certifier can't answer, that document hurts more than it helps.

Schedule the annual inspection to land on your preventive maintenance schedule. The mechanic doing the PM is already running lockout procedures, which makes the observation requirement easy to satisfy.

What are the most common OSHA violations for bakeries under the lockout/tagout standard?

The pattern violations in food manufacturing are predictable, and most bakeries hit two or three of them at once ^[2][3]. Here's the list, in the order OSHA tends to find them:

1. No written program at all. Smaller facilities assume a few warning signs cover it. They don't.

2. No machine-specific procedures. A generic lockout policy without step-by-step procedures for each machine is a separate violation from having no program at all. OSHA cites both ^[1].

3. Training not documented. The employer told workers verbally what to do but has no records. OSHA's position: if it wasn't documented, it didn't happen.

4. Employees near a locked-out machine but not protecting themselves. If a baker works near a machine a mechanic has locked out, and the baker could be hurt if it re-energized, the baker needs their own protection. Standing close to the mechanic's lock isn't protection.

5. Using tagout alone when lockout is feasible. Tags are secondary to locks. If the machine has a hasp that accepts a lock, you use a lock. Tags are for situations where the equipment design makes lockout physically impossible ^[1].

6. Skipping stored energy steps. Procedures that handle electrical disconnection but ignore spring tension, gravity, or hydraulic pressure are incomplete. This is the most dangerous gap, because workers think they've controlled the hazard when they haven't.

7. Annual inspections not done or not certified in writing.

The median penalty for a serious OSHA violation in fiscal year 2023 was $4,313 per violation ^[5]. A full 1910.147 inspection at a bakery with multiple machines and multiple procedural gaps can generate five or more citations, each assessed separately.

What does the complete written program document look like from start to finish?

One master document a new employee or an OSHA inspector could pick up and understand without help. Here's the structure that covers every regulatory requirement:

Section 1: Purpose and scope. States that the program meets 29 CFR 1910.147. Lists all covered equipment. Identifies the facility location.

Section 2: Roles and responsibilities. Names (or titles) of who maintains the program, who can be an authorized employee, who is an affected employee, and how those designations get updated when people change roles.

Section 3: Types of hazardous energy at this facility. Every energy type present and the machines tied to each.

Section 4: Lockout/tagout hardware. What hardware you use, where it's stored, who has access, and the keyed-different policy.

Section 5: General sequence for lockout. The generic eight-step sequence (notify, identify, shut down, isolate, apply lock, release stored energy, verify, perform work) that applies across all equipment before the machine-specific procedure takes over.

Section 6: Restoration to service. Steps for re-energizing equipment after service.

Section 7: Special situations. Group lockout, shift change, contractor coordination, outside repair technicians.

Section 8: Training requirements. Frequency, documentation method, who delivers training.

Section 9: Annual inspection. Who conducts it, how it's documented, where certifications live.

Appendix A: Machine-specific energy control procedures. One procedure per machine, following the format described earlier.

Appendix B: Training log template and inspection certification template.

The whole document for a small bakery with eight to twelve machines usually runs 15 to 25 pages. Sounds like a lot. Most of it is the machine-specific procedures in the appendix, and those are largely fill-in-the-blank once you've written the first one.

If you want to shortcut the drafting without losing compliance, the SafetyFolio program generator walks you through the equipment inventory and produces a facility-specific draft in about 15 minutes. You still verify each machine-specific procedure against your actual equipment before signing off.

OSHA's own sample program in the standard's non-mandatory appendix (29 CFR 1910.147 Appendix C) is a legitimate starting point and worth reading before you write your own ^[1].

How do you handle outside contractors and repair technicians who service bakery equipment?

This comes up constantly. The oven manufacturer sends a technician. The conveyor maintenance company sends a crew. The refrigeration contractor shows up to work on the walk-in compressor. These people aren't your employees, but they're working on your equipment in your facility, and 29 CFR 1910.147(f)(2) is direct: "When outside servicing personnel (contractors, etc.) are to perform activities covered by the scope and application of this standard, the on-site employer and the outside employer shall inform each other of their respective lockout or tagout procedures. The outside employer shall ensure that his/her employees follow the provisions of the appropriate energy control procedure." ^[1]

In practice, that means you:

1. Ask any contractor, before they start, whether they have their own written lockout/tagout program. Reputable service companies do. 2. Review their procedure against yours. If there's a conflict (they use tagout-only and you require lockout wherever feasible), resolve it before work starts. 3. Brief them on your specific energy isolation points for the equipment they'll service. 4. Require the same hardware standards: their own keyed-different locks, not borrowed locks from your station. 5. If your employees work alongside the contractor, use group lockout with a hasp so your worker and the contractor's worker each have independent protection.

Don't wave contractors through to the equipment room. A short pre-work meeting and a written record of the exchange is what OSHA wants to see, and it's what actually prevents injuries.

How should you connect your hazardous energy program to your other written safety programs?

A lockout/tagout program doesn't stand alone. It ties directly to at least three other written programs a bakery should already have.

Hazard communication (29 CFR 1910.1200). Cleaning chemicals used during sanitation lockouts need proper handling procedures. The hazard communication program covers the chemical side of what's happening around the same machines your LOTO program covers ^[10].

Machine guarding (29 CFR 1910.212). Lockout/tagout kicks in when the guard comes off for service. Your machine guarding program describes when guards can be removed and what protection replaces them. The two standards run in sequence: guards prevent contact during normal operation, lockout prevents contact during servicing ^[12].

Emergency action plan (29 CFR 1910.38). If a worker is caught in a machine, first responders need to know how to de-energize it to free the victim without creating a second one. Your energy control program should cross-reference the emergency action plan for that scenario.

If you've had a caught-in incident or a near-miss, it also goes into your OSHA injury recordkeeping. For how that works, see how to file an incident report.

Some bakeries also connect their LOTO program to a written permit-to-work system for higher-hazard maintenance. That's not an OSHA requirement under 1910.147, but for a facility that does annual deep maintenance on a large conveyor oven, a formal permit adds a useful checkpoint.

How do you roll out the program to your bakery team without it becoming a forgotten binder?

A written program that lives in a filing cabinet fails. The steps that actually produce compliance are simpler than most people expect.

Start with a physical audit before you write a single word. Walk every machine with a notepad. Photograph each energy isolation point. Note whether a lockout device is physically possible at each point. That walk takes two hours at a small bakery and saves you from writing procedures that don't match reality.

Train authorized employees on the actual equipment, not in a conference room. The hands-on walkthrough is what the standard envisions and what actually builds competence. Run each authorized employee through the full lockout sequence on their highest-risk machine before you sign off their training record.

Post laminated procedures at each machine. On the wall, in a sheet protector, next to the disconnect switch. Bakery air is hard on paper, so laminated isn't optional.

Build the annual inspection into your calendar before the year starts. Set a reminder at the 11-month mark. The most common reason annual inspections don't happen is that nobody scheduled them.

Do a quick refresher any time you add equipment, modify existing equipment, or see someone bypass a lockout. Those are the moments when a five-minute conversation prevents a serious incident.

For small bakeries that want to check their program against the OSHA basics before going live, the SafetyFolio generator can flag gaps in your equipment list and produce machine-specific procedure drafts you review against your actual machines.

Frequently asked questions

Does a small bakery with only two employees need a written lockout/tagout program?

Yes. The 29 CFR 1910.147 standard has no minimum employee threshold. If any employee services or maintains equipment where unexpected energization could cause injury, the written program, machine-specific procedures, and training documentation are all required regardless of company size. The only exemptions cover employers in agriculture, mining, and construction, which fall under separate standards.

Does unplugging a mixer count as lockout/tagout?

Sometimes, but not always. OSHA allows an unplugged cord to serve as a lockout device if the worker keeps exclusive control of the plug for the entire task. That means holding it personally or storing it in a lockable box. If the worker walks away from the plug, sets it down, or leaves it where someone could re-insert it, the plug method fails the exclusive control test and you need a lock on the disconnect.

Can I use a tag instead of a lock on my bakery mixer?

Only if the equipment cannot be locked out, meaning no hasp or locking mechanism exists on the energy isolation point. Most commercial mixers have a lockable disconnect switch, so lockout is feasible and required. Tags without locks are permitted only when lockout is physically impossible, and even then you must add enhanced tag measures to prove the tagout provides protection equal to a lock [29 CFR 1910.147(c)(3)].

How long does it take to write a lockout/tagout program for a small bakery?

Realistically four to eight hours from scratch if you do it properly: two hours for the equipment walk and energy source documentation, one to two hours drafting the master program, and one to two hours writing individual machine procedures. Annual reviews of an existing program run 30 to 60 minutes per machine for the physical inspection plus documentation. A structured template or generator cuts drafting time a lot.

What is the OSHA penalty for not having a lockout/tagout program?

A serious OSHA violation currently carries a maximum penalty of $16,550 per violation, adjusted for inflation annually ^[5]. Each missing element, no written program, no machine-specific procedures, no training records, is a separate violation. Small employers may get a reduction of 60 to 70 percent based on size, but a multi-violation citation can still reach five figures.

Who can perform the annual inspection of a lockout/tagout procedure?

An authorized employee other than the one using the procedure being inspected. In a small bakery with one maintenance technician, that person could inspect procedures used by the sanitation worker and vice versa. If you're a sole proprietor doing all your own maintenance, you may need a qualified outside resource for the annual certification. The inspection cannot be self-certified by the person whose procedure is under review.

Do I need separate lockout procedures for my oven and my proofer?

Almost certainly yes. A proofer has fan motors, steam lines, and sometimes a gas connection, each needing its own isolation step beyond the main power disconnect. A deck or rack oven may have gas shutoffs, electrical disconnects for the control panel, and thermal energy that requires a cool-down step before interior work. Those different isolation sequences mean different procedures. One generic procedure for both would leave gaps an inspector flags.

What happens if an OSHA inspector visits and asks to see my lockout/tagout program?

The inspector asks for your written program, your machine-specific procedures, your training records, and your annual inspection certifications. They may also check whether procedures are posted at machines and interview workers to confirm training. If you cannot produce those documents on the spot, expect citations. Documents stored only on a personal laptop or offsite are treated the same as not having them.

Does the lockout/tagout standard apply to cleaning and sanitation tasks at a bakery?

Yes, and this is one of the most common gaps in food manufacturing. OSHA's definition of servicing and maintenance includes cleaning inside a machine if a worker could be injured by unexpected energization during that cleaning. Reaching into a mixer bowl to wipe down the agitator is servicing under 1910.147. The standard's minor tool-change exception is narrow and requires the machine stay continuously under the operator's direct control to apply.

Can bakery employees refuse to work if lockout/tagout hardware is not available?

Yes. Under OSHA's protections, workers can refuse work they reasonably believe poses imminent danger of death or serious injury. A worker asked to service a running mixer without lockout hardware in place has a defensible basis for refusal. Employers who discipline workers for refusing unsafe work with no lockout hardware face both the original 1910.147 violation and a potential Section 11(c) retaliation complaint.

Do I need to include my natural gas shutoffs in the lockout/tagout program?

Yes, where a gas line is an energy source for equipment being serviced. A deck oven with a gas burner needs the gas supply isolated as part of any procedure that involves working inside the oven. Gas valves that accept a lockout device should be locked; those that cannot should get a tag plus a physical block or documented alternative measure per 29 CFR 1910.147.

How do I handle a bakery machine with multiple energy sources and no single lockout point?

Write a sequence that handles each energy source in order, with a separate isolation and verification step for each. Complex machines sometimes need a lockout kit: a labeled bag or box holding all the specific devices for that machine (breaker lock, valve lockout, pneumatic line plug) stored at the machine. The procedure references which kit to use and confirms every source is controlled before the worker enters the hazard zone.

Is there a free template I can use to start writing my bakery lockout/tagout program?

OSHA's 29 CFR 1910.147 includes a non-mandatory sample program in Appendix C and a sample procedure template in Appendix A. Those are genuinely free and OSHA-accurate starting points available at osha.gov ^[11]. Several state-plan agencies (California, Michigan, Washington) also publish free templates. These are sound frameworks, but you have to customize them to your specific machines and energy sources to be compliant.

Sources

1. OSHA, Control of Hazardous Energy (Lockout/Tagout) Standard, 29 CFR 1910.147: Written energy control program, machine-specific procedures, training, group lockout, contractor coordination, and annual inspection requirements
2. OSHA, Top 10 Most Cited Standards FY2023: 29 CFR 1910.147 was the fourth most-cited OSHA standard in fiscal year 2023 with over 2,600 citations
3. OSHA, Lockout/Tagout eTool: Common violations and compliance guidance for the lockout/tagout standard in general industry
4. OSHA, Control of Hazardous Energy (Lockout/Tagout) Fact Sheet: OSHA estimates that compliance with the LOTO standard prevents approximately 50,000 injuries and 120 fatalities annually
5. OSHA, Penalties: Maximum penalty for a serious OSHA violation and annual inflation adjustments; median serious violation penalty FY2023
6. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program: Food manufacturing injury and illness data including caught-in and amputation incidents
7. OSHA, Hazard Communication Standard, 29 CFR 1910.1200: Requirements for written hazard communication programs covering chemical hazards that co-exist with lockout/tagout during sanitation tasks
8. OSHA, Small Business Resources: OSHA resources for small employers including the free on-site consultation program
9. OSHA, Machine Guarding Standard, 29 CFR 1910.212: Machine guarding requirements that interface with lockout/tagout during guard removal for service tasks