How to write a safety policy statement as a small business owner

Last updated 2026-07-11

Does OSHA actually require a safety policy statement?

No single OSHA rule says "every employer must have a written safety policy statement." What OSHA has instead is a web of standards that, taken together, make one close to mandatory in practice.

General industry employers fall under 29 CFR 1910.132, which requires a documented hazard assessment. Standards like 29 CFR 1910.147 (lockout/tagout) and 29 CFR 1910.1200 (hazard communication) require written programs of their own. Those programs have to flow from somewhere, and that somewhere is a safety policy. OSHA's Recommended Practices for Safety and Health Programs treats a signed policy statement as the base the rest of your program sits on ^[1].

Construction is more direct. 29 CFR 1926.20 tells employers to "initiate and maintain" a safety and health program. A signed policy statement is the cleanest way to document that you did exactly that ^[9].

State-plan states can be stricter. California's Cal/OSHA requires a written Injury and Illness Prevention Program under Title 8, Section 3203, and a policy statement is a named element of that program ^[2].

Here's the practical answer. If you have any written safety program at all, inspectors expect a policy statement at the front of it. Skipping it is a small thing that makes everything else look sloppy.

What are the required elements of a safety policy statement?

OSHA does not publish a mandatory template, but its guidance and enforcement history show what a policy statement needs to hold up during an inspection or after an incident. Five elements matter.

A clear commitment statement. This is the core sentence. Something like: "[Company Name] is committed to providing a workplace free from recognized hazards that cause or are likely to cause death or serious physical harm." That language tracks the General Duty Clause, Section 5(a)(1) of the OSH Act, almost word for word. Using it is not an accident ^[3].

Named accountability. The statement has to say who is responsible for safety. At a small business that is usually the owner. Add a safety coordinator or operations manager if you have one. A name or a title needs to appear, not a vague reference to "management."

Employee responsibilities. Workers are not passive. Say that employees are expected to follow safe work practices, report hazards, and use the PPE you provide. A sentence or two covers it.

A signature and date. This is the piece most small businesses skip, and it matters most. An unsigned policy statement is a draft. Sign it, date it, and reissue it at least yearly or whenever your operations change hard. The date tells an inspector (and a plaintiff's attorney) that you reviewed it recently.

Goals or measurable intent. You do not need specific numbers on day one, but the statement should express intent: fewer injuries, compliance with the standards that apply to you, steady improvement. Vague but sincere is fine. Vague and obviously copy-pasted is not.

That is the whole list. One page. No legal jargon required.

How is a safety policy statement different from a written safety program?

A safety policy statement is a declaration of intent. A written safety program is the set of procedures that make good on it. Those are two different documents, and mixing them up trips up a lot of owners.

The policy statement is one page, signed by leadership. It says: we take safety seriously, here is who is responsible, here is what we expect from everyone.

The written program describes exactly how you deliver on that. It covers specific hazard controls, emergency procedures, training requirements, and recordkeeping. A hazard communication plan or a lockout/tagout procedure are pieces of that written program ^[10][11].

Think of the policy statement as the cover letter and the written program as the resume. An inspector who shows up will usually ask for both, and the policy statement is where they start.

Even the smallest shops benefit. Bureau of Labor Statistics data for 2022 shows private industry employers with 1 to 10 employees had a recordable injury rate of about 2.1 cases per 100 full-time workers, which is not nothing ^[4]. A policy statement costs nothing to write and tells employees from day one that safety is real.

What should a safety policy statement actually say? (with sample language)

Write it in plain English. Inspectors have read thousands of boilerplate statements copied off the internet, and they can smell one from across the room. A statement written in your own voice, naming your actual operation, reads as credible and gets used.

Here's a framework you can adapt. The bracketed sections are where your specifics go.

---

Safety Policy Statement [Company Name] | [Date]

It is the policy of [Company Name] to provide a safe and healthful workplace for all employees, visitors, and contractors. We are committed to complying with all applicable federal and state safety and health regulations, including those issued by OSHA under 29 CFR 1910 and 29 CFR 1926 as applicable to our operations.

[Owner's Name], as owner and highest-ranking manager, is responsible for the overall direction of this safety program. [Safety Coordinator's Name or Title, if applicable] is responsible for day-to-day implementation.

All employees are expected to follow established safe work practices, use personal protective equipment as required, report unsafe conditions or near misses immediately, and participate in safety training.

We will regularly inspect our workplace, investigate incidents, and correct hazards as quickly as practicable. Safety performance will be reviewed [quarterly / annually] and this policy will be updated as our operations change.

Signed: ___________________________ Title: Owner / President Date: ___________________________

---

That runs about 160 words and covers every required element. Add industry-specific language if you need it, but more words do not make it more compliant.

One thing to avoid: do not make promises you cannot keep. Write "all injuries will be investigated within 24 hours," then investigate one three days later, and that document can be turned against you. Use "as quickly as practicable" instead.

Who should sign the safety policy statement?

The highest-ranking person in your company. Full stop.

At a sole proprietorship or single-location LLC, that is you, the owner. At a company with a CEO or president, that person signs. A safety manager or HR director can sign too, but their signature accompanies the owner's, it does not replace it.

The reason is not ceremony. A signature from the top tells employees that safety decisions come from the top, and that drives behavior more than any procedure does. OSHA's Recommended Practices for Safety and Health Programs states plainly that "management leadership is the cornerstone of an effective safety and health program" ^[1].

For multi-location businesses, each site's program references the company-level policy statement, and local managers can sign a statement affirming their commitment at the site level. You do not need a separate policy for each location, but every location's employees should have seen the signed statement.

Change ownership or bring in a new CEO? Reissue the policy with the new signature within 90 days. An inspector who sees a policy signed by someone long gone will notice.

How often do you need to update your safety policy statement?

Once a year at minimum, and sooner when something real changes.

The triggers that should prompt a reissue: you add a new line of work or new equipment that brings different hazards, you have a serious incident or a near miss, you hire your first employee after running owner-only, OSHA issues a new standard that hits your industry, or you move to a state with a different state plan.

The annual review is not a full rewrite. Read it, confirm it still matches your operation, update the date, sign again. Ten minutes. Keep every old signed version on file. If OSHA investigates an incident from two years back, dated copies prove you had a current policy in place at the time.

California's IIPP rule (which includes the policy statement) requires review "whenever the employer receives notification of a new or previously unrecognized hazard" ^[2]. Even if your state has no such language, follow it anyway. It is good practice and it is cheap.

How do you communicate the safety policy statement to employees?

Writing it is step one. Communicating it is step two, and that is where most small businesses drop the ball.

Start by posting it where employees will actually see it. The break room, by the time clock, at the entrance to the shop floor. Put it next to the OSHA "Job Safety and Health: It's the Law" poster, which every covered employer must display under 29 CFR 1903.2 ^[5].

Go over it during new employee orientation. This is not a lecture. Read it together, take questions, and have the new hire sign an acknowledgment form that lives in their personnel file. That signature is your proof the employee saw the policy before starting work.

Employees who speak a language other than English need it in a language they understand. OSHA has said in multiple letters of interpretation that a language barrier does not excuse an employer from the communication requirement ^[6]. Have Spanish-speaking employees? Translate the statement. A bilingual employee or a free translation tool handles a 160-word document in minutes.

Deeper safety training is a related but separate step. The osha training requirements for your industry layer on top of this baseline communication.

What mistakes do small business owners make with safety policy statements?

The most common mistake is treating it as a one-time checkbox. Owners write it (or copy it off a Google search), file it, and never look again. An inspector can tell a policy has not been touched in three years. The date gives it away.

Second: no signature. An unsigned policy is legally indistinguishable from a draft. Sign it every time you update it.

Third: too abstract. "We are committed to safety" with no named responsibilities is a bumper sticker, not a policy. Name names or titles. Say what you will actually do.

Fourth: writing it in a vacuum. The policy statement has to line up with the rest of your written program. If the policy promises monthly safety inspections but your written program has no inspection procedure, you built a conflict that can be used against you.

Fifth: ignoring your state. Operate in a state-plan state like California, Michigan, Washington, or Oregon and the state requirements may run stricter than federal OSHA. A policy built only around 29 CFR 1910 can miss state-specific elements ^[7].

Sixth, and this one surprises people: safety goals so ambitious they become untrackable. "Zero injuries ever" sounds inspiring. It is a wish, not a program goal. A better one: "Reduce our recordable incident rate by 15% compared to last year, as measured by our OSHA 300 log." Now you have something you can track.

Does a safety policy statement protect you from OSHA citations?

Not on its own. But it helps, and its absence makes things worse.

General Duty Clause citations under Section 5(a)(1) turn heavily on whether an employer recognized a hazard and addressed it ^[3]. A policy statement that names relevant hazards and commits to controlling them is evidence of both recognition and commitment. It will not make a citation vanish, but it supports the argument that you ran a good-faith safety program.

What it does not do: excuse specific standard violations. If 29 CFR 1910.147 requires a written lockout/tagout program and you have none, no amount of general policy language fixes that ^[10]. The policy statement is the foundation. You still need the specific written programs sitting on top.

OSHA's penalty reduction for good faith is codified in its Field Operations Manual. Employers who show good-faith efforts toward compliance, including documented safety programs, can earn up to a 25% penalty reduction ^[8]. A signed, current policy statement is part of that documented good faith.

Want to know how inspections actually run and what officers look for when they arrive? The osha overview walks through the inspection process and what to expect.

How long should a safety policy statement be for a small business?

One page. Seriously, one page.

When you are nervous about compliance, more feels safer. It is not. A ten-page "policy statement" is usually a badly organized mash of a policy statement and pieces of a written program, and it does neither job well.

Keep the policy short and signed. Put the detailed procedures in your written program, which is a separate document or set of documents. When an OSHA compliance officer asks for your safety policy, you hand over one page. When they ask for your written hazard communication program, you hand that over separately ^[11].

The one exception: a specific standard in your industry requires elements in the policy itself. Some state-plan states want the policy to list the employer's specific workplace hazards. In those cases you may run to two pages, and that is fine. Add only what the standard requires, not everything you can think of.

If holding all of this in your head at once feels like a lot, a tool like SafetyFolio's safety program generator walks you through building the policy statement and the supporting written programs in order, so nothing slips and you are not staring at a blank page.

Do you need a safety policy statement if you have no employees?

If you are a sole proprietor with zero employees, federal OSHA does not cover you. The OSH Act applies to employers with one or more employees ^[3]. So technically, no.

The moment you hire your first employee, that changes, and it changes with no grace period. From day one of that person's employment you are subject to the OSHA standards that apply to your industry.

Plenty of owners write a basic policy statement before they hire, so it is ready the day they need it. Smart move. It also forces you to think through your workplace hazards before someone else is standing in the middle of them.

Work as a sole-proprietor subcontractor on a construction site and the general contractor's safety requirements may bind you even where OSHA technically does not. Read your subcontractor agreement. Most general contractors require every sub to carry a written safety program, and some ask for a signed policy statement as part of prequalification.

Where does a safety policy statement fit in your overall written safety program?

It goes first. Always first.

Your written safety program is a collection of documents: the policy statement, the specific written programs OSHA standards require (hazard communication, lockout/tagout, emergency action plan, PPE hazard assessment, and so on), training records, and inspection logs. Picture a binder, or a folder on your company server.

The policy statement is the first thing in that binder. It sets the tone and the authority for everything after it. It says: this company cares about safety, this is who runs it, and what follows are the procedures we use to back that up.

For a small business starting from scratch, build in this order: (1) write the policy statement, (2) figure out which OSHA standards apply to your operations using OSHA's standards pages by industry, (3) write the required written programs one at a time ^[12].

You do not need it all done at once. A policy statement plus one compliant written program beats nothing. Build from there. Your incident report process and OSHA recordkeeping are downstream steps that get much easier once the policy and programs exist.

SafetyFolio's generator follows this same sequence, walking small businesses through each applicable standard and producing a program matched to their industry, state, and employee count.

Frequently asked questions

Is a safety policy statement legally required by OSHA?

No single OSHA rule says "you must have a safety policy statement." But multiple standards (including 29 CFR 1926.20 for construction and state-plan rules like California's Title 8 Section 3203) effectively require one as part of a written safety program. OSHA inspectors expect to see it, and its absence signals a weak program. Treat it as required for practical purposes.

What is the difference between a safety policy and a safety plan?

A safety policy statement is a one-page declaration of commitment, signed by leadership, naming who is responsible for safety and what the company commits to doing. A safety plan (or written safety program) is the detailed operational document covering specific procedures, hazard controls, training, and recordkeeping. The policy statement belongs at the front of the safety plan. They are not the same document.

Can I use a template for my safety policy statement?

Yes, a template is a reasonable starting point. The trouble starts when owners copy one word for word and never customize it. An inspector spots generic boilerplate instantly. Use a template to get the structure right, then replace the generic language with specifics: your company name, your named manager, your actual hazards. Sign and date it. That turns a template into a real policy.

How do I write a safety policy statement for a small construction company?

Start with the general framework: commitment statement, named responsibilities, employee obligations, signature. Then add language for the construction hazards that apply to you, like fall protection, excavation, or tool safety. Reference 29 CFR 1926 as your governing standard. OSHA's 29 CFR 1926.20 requires construction employers to maintain a safety and health program, so your policy statement should address that requirement directly.

Does my safety policy statement need to be reviewed by a lawyer?

For most small businesses, no. A safety policy statement is not a contract and needs no legal review. Keep the language plain and factual, avoid promises you cannot document keeping, and do not include anything that waives employee rights. If you are in a high-hazard industry or have prior OSHA citations, a short review by an OSHA attorney is cheap insurance, but it is not standard practice for most operations.

Can a safety policy statement be digital or does it need to be printed?

OSHA allows digital records for most written programs, but the policy statement still needs to be physically posted in your workplace under 29 CFR 1903.2 posting requirements. Keep a digital master and print it for posting. Employee acknowledgment forms can be electronic if your system timestamps them and you can produce them on request. Do not rely only on a file sitting on someone's laptop.

What happens if OSHA finds I don't have a safety policy statement?

In most cases an absent policy statement is not itself a citable offense unless a specific standard requires it in your industry or state. What it does is signal to the compliance officer that your program may be weak throughout, which invites closer scrutiny of everything else. If violations turn up, the missing policy undercuts any good-faith penalty reduction. The result is usually higher penalties and more citations.

How do I get employees to actually read the safety policy statement?

Cover it during new hire orientation as a conversation, not a lecture. Have employees sign an acknowledgment form stating they received and read it. Post it where they can see it. Review it briefly in an annual safety meeting. For employees who do not read English fluently, provide a translated version. The signed acknowledgment is your documentation that the communication happened, which matters if an incident ever leads to an investigation.

Should the safety policy statement mention specific OSHA standards?

You can, but you do not have to. Referencing applicable standards (29 CFR 1910 for general industry, 29 CFR 1926 for construction) shows awareness of the regulatory framework and strengthens your good-faith posture. The risk of getting too specific is that if a standard changes or you cite one that does not apply, you create confusion. Naming the framework generally is usually enough at the policy level.

Do I need a separate safety policy statement for each job site?

No. One company-level policy statement covers all your operations. For construction, where work happens across sites, the policy travels with your written program. Some general contractors require you to submit it during prequalification, so keep a current signed copy ready. If a site has hazards your general policy does not cover, address those in site-specific written procedures, not by rewriting the policy for each job.

What should I do if my company has grown and my old safety policy statement no longer fits?

Rewrite it. If you started at five employees and now run fifty, or if you added new equipment or new types of work, the policy needs to reflect where you actually are. Growth is one of the most common reasons a policy goes stale. Update the named responsibilities to match your current management structure, revise the commitment language for your current operations, resign, and redate it. File the old version for your records.

Is a safety policy statement the same as a mission statement?

No. A mission statement describes what a company does and why. A safety policy statement is a regulatory document focused only on workplace safety commitments, named accountabilities, employee obligations, and compliance intent. Some companies try to fold safety language into a general mission statement, which rarely satisfies OSHA. Keep them separate. The safety policy statement needs to stand alone as a safety document.

How does the safety policy statement connect to OSHA recordkeeping?

The policy statement sits upstream of recordkeeping. It establishes that you have a safety program, which sets the expectation that incidents get recorded and investigated. Your OSHA 300 log, 301 incident reports, and 300A annual summary are the recordkeeping outputs of a working program. Inspectors often look at all of these together. A policy that commits to incident investigation should be backed up by actual investigation records.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs: OSHA guidance describes management leadership, including a signed policy statement, as the cornerstone of an effective safety and health program
2. California Department of Industrial Relations, Title 8 Section 3203 IIPP: California requires a written Injury and Illness Prevention Program including a policy statement, reviewed whenever a new or previously unrecognized hazard is identified
3. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: The General Duty Clause requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm; the OSH Act applies to employers with one or more employees
4. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2022: Private industry employers with 1 to 10 employees had a recordable injury and illness rate of approximately 2.1 cases per 100 full-time equivalent workers in 2022
5. OSHA, 29 CFR 1903.2 Posting of Notice: Every employer covered by OSHA must display the OSHA poster (Job Safety and Health: It's the Law) in a conspicuous place where employees report to work
6. OSHA, Letters of Interpretation (Standard Interpretations): OSHA has stated in interpretation letters that employers must communicate required safety information in a language and vocabulary employees can understand
7. OSHA, State Plans Overview: Twenty-two states and two territories operate OSHA-approved state plans that may set requirements stricter than federal OSHA standards, including specific written program and policy statement requirements
8. OSHA, Field Operations Manual (FOM), Penalty Adjustment Factors: OSHA's Field Operations Manual allows up to a 25% penalty reduction for employers who demonstrate good faith, including having documented safety programs in place at the time of inspection
9. OSHA, 29 CFR 1926.20 General Safety and Health Provisions (Construction): 29 CFR 1926.20 requires construction employers to initiate and maintain a safety and health program for all work covered by the construction standards
10. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147 requires employers to establish a written energy control program as part of a lockout/tagout procedure
11. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: 29 CFR 1910.1200 requires employers to have a written hazard communication program covering labeling, safety data sheets, and employee training
12. OSHA, 29 CFR 1910.132 Personal Protective Equipment: 29 CFR 1910.132 requires employers to conduct a documented hazard assessment to determine appropriate PPE for each task