How to write a corrective action tracking system for safety findings

Last updated 2026-07-11

What is a corrective action tracking system and why does OSHA care about it?

A corrective action tracking system (CATS) is a written record that follows a safety finding from the moment you spot it to verified closure. It answers four questions: what was the hazard, who is fixing it, by when, and how do we know it's actually fixed?

OSHA has no standard called 'corrective action tracking system.' The duty to find, fix, and document hazards runs through dozens of CFR citations anyway. Under 29 CFR 1910.119 (Process Safety Management), employers must establish a system to promptly address the findings and recommendations from a process hazard analysis ^[1]. Under 29 CFR 1904 recordkeeping, employers must document injuries and illnesses, and the fix is the obvious next step. OSHA's Recommended Practices for Safety and Health Programs describes a corrective action log as a core element of any working safety program ^[2].

Compliance officers look for these records during inspections. If they find a hazard and you can't show a documented, closed-out action for a prior similar finding, that history hurts you at the penalty phase. Show a documented, open action with a realistic due date and interim controls, and the same officer often reads it as active hazard management, which can soften a citation. The paper trail is not bureaucracy. It's protection.

Small businesses miss this the same way every time. They fix the hazard and never write it down. Then the hazard recurs, the injury report gets filed (see incident report), and OSHA shows up with no evidence that anyone ever tried to prevent it.

What are the required elements of a corrective action tracking system?

There is no federal template. Combine the requirements in 29 CFR 1910.119, OSHA's Recommended Practices for Safety and Health Programs, and standard quality-management practice (ISO 45001 uses nearly identical fields) and you get a defensible minimum field set.

Every row in your log needs these fields:

Field	What to put in it	Why it matters
Finding ID	Sequential number, e.g. CAR-2025-001	Lets you cross-reference to inspection reports or incident reports
Date found	Calendar date	Starts the clock on response time
Source	Inspection, near-miss, OSHA citation, audit, employee report	Shows which source generates the most findings
Location / equipment	Specific area, machine, or task	Required for trend analysis
Hazard description	Plain language: what could hurt someone	Readable by anyone, more than the person who wrote it
Severity rating	High / Medium / Low (or a risk matrix)	Drives due-date priority
Root cause	Why the hazard existed, more than what it was	Prevents recurrence
Corrective action	The specific fix, not 'retrain employees'	Measurable and verifiable
Responsible person	First and last name, not a department	Accountability
Target completion date	A real calendar date	Enforces follow-through
Actual completion date	Filled in when done	Creates your closure record
Verification method	How you confirmed the fix works	Closes the loop
Verified by	A different person than the one who did the fix	Segregation of duties
Status	Open / Overdue / Closed	Lets management see it at a glance

That's thirteen fields. Add more if you want (cost, corrective vs. preventive type, linked OSHA standard), but these thirteen are the floor.

The root cause field is where most small businesses cut corners. 'Employee didn't follow procedure' is not a root cause. It's a symptom. The real cause might be that the procedure was unreadable, wasn't posted where the work happens, or was written for a machine model you replaced two years ago. A shallow root cause produces a shallow fix, and the hazard comes right back. OSHA's own program guidance points to weak root cause analysis as a leading reason corrective actions fail to prevent recurrence ^[2].

How do you set realistic due dates for corrective actions?

Match the due date to three things: how bad the hazard is, how hard the fix is, and what your team can actually get done. A blanket policy of 'all findings closed in 30 days' sounds rigorous and breeds paper closure. People type 'closed' to beat the deadline while the real fix sits half done.

A tiered approach that holds up:

Severity	Example	Target completion
Imminent danger	Exposed live electrical panel	Same shift, or take the equipment out of service now
High	Missing machine guard, unlabeled hazardous chemical	7 calendar days
Medium	Worn floor marking, missing SDS for a low-toxicity product	30 calendar days
Low	Ergonomic improvement, housekeeping, non-critical signage	90 calendar days

Complex engineering controls often blow past 90 days. That's fine. What matters is that you document the interim protection (administrative controls, temporary guarding, closer supervision), set a realistic milestone, and update it formally if it slips. An overdue finding with a documented extension and interim controls reads completely differently to an OSHA officer than an overdue finding with nothing behind it.

Running a high-hazard operation covered by lockout tagout under 29 CFR 1910.147? Any finding that involves an energy-control failure is imminent danger by definition. Shut it down first, then track it.

What format should a corrective action log actually be in?

Spreadsheet, purpose-built software, or a paper binder: OSHA doesn't care which you pick. What matters is that the log is easy to reach, backed up, and actually used.

Run a business with fewer than 25 employees and maybe 10 to 20 findings a year? A shared Google Sheet or Excel file is plenty. Name the file something obvious, keep it on a shared drive that everyone with safety duties can open, and add a tab for closed items so the active tab stays readable.

At 25 to 100 employees, or across multiple locations, a basic safety management platform starts to earn its keep. Most run $50 to $200 a month and fire off automatic email reminders to the responsible person as due dates approach. For a lot of operations managers, that reminder feature alone justifies the subscription.

Paper binders are legal and painful. You can't sort by due date, filter by location, or email a reminder from a three-ring binder. If you're set on paper, at least assign someone to review the log weekly and flag anything overdue.

Whatever the format, keep the records. OSHA's recordkeeping rule under 29 CFR 1904.33 requires injury and illness records for five years ^[3]. There's no separate federal retention period for corrective action logs outside of PSM facilities, which have their own rules under 29 CFR 1910.119 ^[1]. Match your injury-record retention as a floor, since the two are usually linked.

If you need a written safety program that ties the corrective action process to the rest of your OSHA obligations, SafetyFolio's safety program generator builds the policy framework in about 15 minutes. That gives you a document you can hand an inspector to show the corrective action process is an official part of your program, not an improvised spreadsheet.

How do you write a root cause analysis for a safety finding?

Root cause analysis (RCA) sounds intimidating. For most workplace findings it doesn't need a formal methodology. The 5-Why technique handles the large majority of small-business findings on its own.

Start with the finding. Ask why it happened. Take that answer, ask why again, and keep going until you hit something you can actually control: a policy gap, a training gap, an equipment deficiency, or a design flaw.

Example: a worker slips on a wet break room floor.

• Why? The floor was wet.
• Why? The sink drain was slow.
• Why? The drain hasn't been cleaned in six months.
• Why? No maintenance schedule exists for non-production areas.
• Why? The preventive maintenance program only covers production equipment.

Root cause: the PM program skips common areas. Corrective action: add the break room drain to the PM schedule, set a frequency, assign a name.

That's a fixable root cause. 'Employee failed to mop up water' is not, because no system guarantees every worker mops every spill the second it happens.

For serious incidents, especially anything that triggers an incident report or OSHA recordability under 29 CFR 1904.7, reach for a formal method (fault tree analysis, a fishbone diagram). For routine findings from inspections and audits, 5-Why is enough.

Document the RCA in the log. Even two sentences beats a blank field. Empty root cause fields are a red flag during OSHA inspections and internal audits alike.

How do you verify that a corrective action actually worked?

This step gets skipped more than any other. The responsible person marks the action done, the log says closed, and nobody checks whether the fix actually killed the hazard.

Verification means a person other than the one who did the fix confirms the hazard is gone. That's the minimum. Better verification also checks whether the fix created a new hazard.

Three methods, in order of rigor:

1. Direct observation. A supervisor or safety person physically inspects the corrected condition. Works for most physical hazards: guards, housekeeping, signage, storage.

2. Testing or measurement. For exposure hazards (noise, air quality, chemical concentration), take a reading after the control goes in. This is built into standards like 29 CFR 1910.95 for hearing conservation ^[4] and 29 CFR 1910.1000 for air contaminants ^[10] whenever you claim engineering controls dropped exposures below the action level.

3. Procedure or record review. For training-based fixes, confirm the training happened (sign-in sheet, LMS record) and that the revised procedure is posted or distributed.

Write down who verified, what they checked, and when. That three-part record closes the loop.

One practical rule: if the same finding recurs within 12 months of being closed, the verification was weak or the corrective action was wrong. Reopen it, write a fresh root cause analysis, and track it as a repeat. Repeat findings get their own flag in the log so patterns surface fast.

What OSHA standards require a corrective action process?

OSHA has no single 'corrective action' standard. The obligation shows up in several places, and one of them is explicit.

29 CFR 1910.119(e)(5) (Process Safety Management) is the most direct. It requires the employer to establish a system to promptly address the team's process hazard analysis findings and recommendations, resolve them in a timely manner, and document the resolution and completion dates ^[1]. That is a corrective action tracking requirement in everything but name.

29 CFR 1910.147 (Control of Hazardous Energy, better known as lockout tagout) requires periodic inspections of energy control procedures at least annually and documentation that deficiencies were corrected ^[5].

29 CFR 1910.217 (Mechanical Power Presses) requires a certification record for inspections, which effectively builds a corrective action trail.

29 CFR 1904 (Recordkeeping) doesn't spell out corrective action, but OSHA's enforcement policy treats repeated injuries from the same exposure as evidence of a willful or repeat violation, which drags a corrective action duty along with it ^[3].

OSHA's Recommended Practices for Safety and Health Programs (2016) lists tracking corrective actions to completion as a core program element ^[2]. It's guidance, not a regulation, but compliance officers use it as a yardstick when they size up your overall program.

High-hazard industries carry more. See 29 CFR 1926 (Construction) and 29 CFR 1915 (Shipyard Employment), each with its own inspection and abatement documentation rules.

Had an OSHA citation? The abatement documentation you submit to close it is functionally a corrective action record. Keep it with your CATS, not off in a separate folder.

How do you connect safety findings to your overall safety program?

A corrective action log that lives alone improves nothing. It has to feed back into the program: revising procedures when they turn out to be wrong, driving hazard communication updates when new chemical hazards surface, and triggering training when a knowledge gap is the root cause.

The connection points worth building:

Findings feed procedure updates. When a finding shows that a written procedure is incomplete or wrong, the corrective action should include revising it and recording the revision date. Keep a revision log on each procedure so you can show an inspector your procedures are living documents.

Findings feed training. A training-based corrective action should link straight to your training records. If the root cause was that workers weren't trained on the revised procedure, the action should include delivering the training, a record of who attended, and an update to your training matrix. OSHA training requirements vary by standard, but they always require documentation.

Findings feed management review. Once a quarter, someone with the authority to spend money reviews the log. How many findings are overdue? What's the most common root cause category? Which location generates the most findings? The review doesn't have to be formal, but it has to happen, and the outcome goes in writing.

Findings feed your OSHA 300 log. A finding that stems from a recordable injury belongs on your OSHA 300 log under 29 CFR 1904.29 ^[11], and the CATS entry should cross-reference the 300 log case number. An inspector who pulls your 300 log and sees several entries for the same body part or the same task should be able to pull your CATS and find a documented, closed corrective action for each one.

Building these links by hand is tedious. That's the real argument for a written safety program that spells out how findings move through the system, instead of leaving it to whoever is holding the clipboard that day.

How do you manage overdue corrective actions without losing credibility?

Overdue items are inevitable. Equipment delivery slips, someone quits, the budget freezes. The real world is not a Gantt chart. How you handle the overdue item is what separates a working system from a liability.

Never just push the due date without a note. Write a short entry explaining why the original date got missed, what interim protection is in place, and what the new realistic date is. That note is your defense if the hazard causes an injury before the permanent fix lands.

Overdue high-severity findings should escalate on their own. Build it in: a High finding not closed by its target date pings the operations manager or owner. In a spreadsheet, that's a conditional-formatting rule or a weekly filter sort. In software, it's an automatic email.

Interim controls are not optional for high-severity overdue items. If the permanent engineering control won't be in by the due date, document the temporary control holding the line: a barricade, a PPE requirement, an administrative restriction. An overdue finding with documented interim controls and an honest new date is a managed risk. An overdue finding with nothing is negligence.

BLS data for 2022 shows workers in the highest-rate industries (agriculture, warehousing, construction) had recordable injury rates of roughly 4 to 6 per 100 full-time workers ^[6]. A lot of those injuries trace back to hazards that got identified and never closed out. The corrective action log is the paper record that shows you took the hazard seriously even on the days you couldn't fix it fast.

What does a good corrective action tracking system look like in practice?

Picture a 40-person metal fabrication shop.

Every Monday morning, the safety lead (here it's also the operations manager) opens the CATS spreadsheet. Three tabs: Active, Overdue, Closed. A formula moves any row past its target date to the Overdue tab unless it's marked closed.

Findings arrive from four sources: the weekly walk-through inspection, near-miss reports on a paper form at each workstation, OSHA 300 log entries, and the monthly toolbox talk, where workers call out hazards and the safety lead writes them down.

Each finding gets a severity rating from a 3x3 risk matrix (likelihood times severity). High findings get a 7-day target and the responsible person gets an email that day. Medium goes to 30 days. Low goes to 90.

Verification is done by whoever didn't do the fix. Physical hazards get a walk-and-look. Training fixes get a sign-in sheet review. The verifier signs and dates the row.

Once a quarter, the owner reads a one-page summary: total open findings, count by severity, count by source, average days to close, and everything overdue. Fifteen minutes, and it produces a short list of items that need more money or more hands.

None of this is elaborate. A spreadsheet, a paper form, a weekly habit, a quarterly review. Average time to close a Medium finding in this shop runs 18 days, well inside the 30-day target. That documented track record has twice helped the owner argue down an OSHA penalty by proving active, written hazard management.

If your written safety program doesn't formalize this yet, SafetyFolio's program generator writes the corrective action policy language as part of a complete program, so you get the documented framework without building it from scratch.

How do you train employees to report findings that feed the system?

A corrective action system is only as good as the findings that enter it. If workers don't report hazards, you're tracking the fraction your safety person happens to catch on inspection day, not the hazards people see every shift.

Workers stay quiet for two reasons: they don't think anything will happen (learned from past silence on the company's part), or they fear retaliation. Section 11(c) of the OSH Act prohibits retaliation against employees who report safety concerns ^[7]. A written anti-retaliation policy plus OSHA's 'It's the Law' poster, required under 29 CFR 1903.2 ^[9], covers the legal side. A culture where reports get answered covers the practical side.

The single most effective move is to close the loop out loud. When someone reports a hazard and you fix it, tell them. A two-line email or a line at the next toolbox talk ('we fixed the lighting in Bay 3 after someone flagged it last month') teaches people that reporting works. Do that consistently and you build a reporting habit that makes the CATS genuinely useful instead of a compliance artifact.

For supervisors, put it in the job. Write 'timely reporting and tracking of safety findings' into job descriptions and performance reviews. When it's an expectation, it happens.

Managers who finish OSHA 30 training tend to grasp corrective action duties better than those who haven't. The 30-hour curriculum covers hazard recognition and abatement in enough depth to make the CATS workflow feel obvious.

Frequently asked questions

Does OSHA require a corrective action log by name?

No single OSHA standard mandates a document called a corrective action log. The duty to document findings, assign fixes, and verify completion appears in 29 CFR 1910.119 (PSM), 29 CFR 1910.147 (lockout tagout inspection records), and OSHA's Recommended Practices for Safety and Health Programs. For PSM-covered facilities the requirement is explicit. For everyone else it's implied by the enforcement framework around repeat violations.

How long do you need to keep corrective action records?

There's no universal federal retention period outside of PSM facilities, which must keep process hazard analysis records for the life of the process under 29 CFR 1910.119. Best practice is to match injury-record retention: five years, per 29 CFR 1904.33. Keep records longer if a finding links to a serious injury, an OSHA citation, or a workers' compensation claim, since litigation timelines can run well past five years.

What is the difference between a corrective action and a preventive action?

A corrective action fixes a known, existing hazard. A preventive action heads off a potential hazard before it causes harm, based on trend analysis, near-miss data, or industry incident reports. Both belong in a CATS. ISO 45001, which many larger companies follow, treats them as separate but related. For small businesses, tracking both in one log with a 'type' field (corrective vs. preventive) is enough. The distinction matters most during audits and management reviews.

Can a small business use a spreadsheet instead of safety software?

Yes. OSHA has no requirement to use specific software. A shared spreadsheet with the thirteen core fields, consistent naming, and a weekly review habit is fully defensible. Safety software mainly adds automated reminders, mobile data entry, and trend dashboards. For a business under 25 employees and under 20 findings a year, the ROI on paid software is marginal. Above 50 employees or multiple locations, it usually pays for itself in saved administrative time.

What happens if an OSHA inspector finds open corrective actions during an inspection?

Open findings are not automatically a violation. An inspector who sees open findings with documented interim controls, realistic due dates, and visible progress treats that very differently from open findings with no documentation and no interim protection. The point is to show hazard management is a real process, not a paper exercise. A well-kept CATS can turn a potential willful citation (penalties up to $161,323 per violation as of 2024 ^[8]) into a lesser citation or a reduced settlement.

How often should you review the corrective action log?

Weekly for the safety lead or responsible manager (check overdue items, review new entries), quarterly for ownership or senior management (trend review, resource allocation). The weekly check takes 15 minutes once the system is running. The quarterly review should produce a short written summary so you have a record that management oversight actually happened. OSHA's Recommended Practices list periodic management review as a program element.

What is a risk matrix and should I use one for severity ratings?

A risk matrix plots the likelihood of harm against the severity of harm to produce a combined score. A simple 3x3 matrix (Low/Medium/High on each axis) gives nine cells that collapse into three priority levels. OSHA doesn't require a specific format, but any consistent, documented method beats rating severity by feel. The matrix makes your due-date tiers defensible and points resources at the findings that matter most.

How do you handle a corrective action that turns out to be technically impossible or prohibitively expensive?

Document the barrier plainly. Write down the original action, why it isn't feasible (cost estimate, engineering assessment, whatever you have), and the alternative control you're putting in instead. The alternative has to actually reduce the hazard; swapping in a weaker measure just to close the finding is worse than an honest extended timeline with interim controls. If the action came from an OSHA citation, contact your OSHA area office before the abatement deadline to discuss alternatives. Missing an abatement deadline without notice generates additional penalties.

Should corrective actions from near-miss reports be tracked the same way as injury-based findings?

Yes, and near-miss findings are often more valuable because you fix the hazard before anyone gets hurt. Track them with the same fields, the same severity process, and the same closure requirements. Near-miss data also helps you demonstrate proactive safety management to OSHA, workers' compensation carriers, and customers. BLS data consistently shows establishments with structured near-miss reporting carry lower recorded injury rates over time, though the causal research is complex.

What root cause categories work best for a small business CATS?

Keep it short: Equipment/Tool Failure, Procedure Missing or Inadequate, Training Gap, Environmental Condition (lighting, housekeeping, layout), Supervision Gap, Design Flaw. Six categories cover most small-business findings. What matters is that you fill in the field and don't default to 'human error,' which is almost never a root cause on its own. Tracking categories over time tells you whether your problem is equipment, procedures, or training, which tells you where to invest.

Do corrective actions for OSHA citations need to be tracked separately from other findings?

Track them in the same system, but flag them clearly. Add a Citation Number field and an Abatement Deadline field separate from your internal due date. OSHA abatement deadlines are legal obligations; miss them and you generate additional daily penalties. Keep your abatement letters and any correspondence with the OSHA area office attached to or cross-referenced from the relevant CATS entry. A citation is closed with OSHA only after you submit abatement documentation, so the loop has external components too.

How do corrective actions connect to the OSHA 300 log?

Every recordable injury or illness logged on the OSHA 300 under 29 CFR 1904.29 should link to at least one corrective action entry. Add an OSHA 300 Case Number field to your CATS. An inspector who pulls your 300 log and sees several entries for the same exposure (say, back injuries at the shipping dock) will look for matching corrective actions. If none exist, that's evidence of a known hazard with no management response, which supports a willful classification and higher penalties.

What is the right way to close out a corrective action?

Closure takes three things: documentation that the action was implemented (photo, work order, training record, whatever fits), verification by a second person that the hazard is actually gone, and a signed, dated entry in the log. 'Closed' means the hazard is gone, not that someone updated the spreadsheet. If the fix was a temporary control pending a permanent engineering solution, close the temporary action and open a new one for the permanent fix with its own due date.

Sources

1. OSHA, 29 CFR 1910.119 Process Safety Management of Highly Hazardous Chemicals: 29 CFR 1910.119(e)(5) requires employers to establish a system to promptly address and resolve PHA findings and recommendations, document resolution and completion dates, and retain records for the life of the process.
2. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA's Recommended Practices list tracking progress on corrective actions and periodic management review as core elements of an effective safety and health program.
3. OSHA, 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses: 29 CFR 1904.33 requires employers to retain OSHA 300 log records for five years following the end of the calendar year those records cover.
4. OSHA, 29 CFR 1910.95 Occupational Noise Exposure: 29 CFR 1910.95 requires audiometric testing and exposure monitoring to verify that engineering and administrative controls reduce worker noise exposures, creating a measurement-based verification requirement for corrective actions.
5. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147(c)(6) requires periodic inspections of energy control procedures at least annually and documentation of the inspection, including deficiencies corrected.
6. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2022: BLS 2022 data shows total recordable incidence rates in agriculture, construction, and warehousing of approximately 4 to 6 cases per 100 full-time equivalent workers.
7. OSHA, Section 11(c) of the OSH Act, Worker Rights: Section 11(c) of the Occupational Safety and Health Act prohibits employers from retaliating against employees who report safety and health concerns or exercise other rights under the Act.
8. OSHA, Penalties: As of 2024, OSHA's maximum penalty for willful or repeat violations is $161,323 per violation, adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act.
9. OSHA, 29 CFR 1903.2 Posting of Notice; Availability of the Act, Regulations and Applicable Standards: 29 CFR 1903.2 requires every covered employer to post the official OSHA informational notice (the 'It's the Law' poster) in a conspicuous place in each establishment.
10. OSHA, 29 CFR 1910.1000 Air Contaminants: 29 CFR 1910.1000 sets permissible exposure limits for air contaminants and requires engineering or administrative controls to reduce exposures below PELs, implying post-control measurement to verify effectiveness.
11. OSHA, 29 CFR 1904.29 Forms: 29 CFR 1904.29 specifies the OSHA 300 Log form requirements for recording work-related injuries and illnesses, which creates the documented injury history that corrective action records must address.