How to write a written safety program for a cleaning company

Last updated 2026-07-09

Does OSHA require a cleaning company to have a written safety program?

Yes. The requirement is not one rule but a stack of them. OSHA's General Duty Clause (Section 5(a)(1) of the OSH Act) requires every employer to provide a workplace free from recognized hazards ^[9]. On top of that, several specific standards require written programs by name. The ones that almost always apply to cleaning companies are hazard communication ^[1], personal protective equipment ^[2], bloodborne pathogens if you clean medical or body-fluid-contaminated areas ^[3], and the emergency action plan standard ^[4].

Small does not get you out of it. If you have 10 or fewer employees, OSHA exempts you from keeping the injury and illness log (OSHA 300) under normal circumstances, but that exemption does not touch your obligation to have written programs for the standards above ^[5]. Size gives you no relief on hazard communication or PPE documentation.

Here is the practical answer. If your crew uses any cleaning chemical, mops floors where someone could slip, or enters occupied commercial spaces, you need a written safety program. The good news: a program for a small cleaning company does not need to run 80 pages. A tight 12-to-20-page document covers everything OSHA looks for.

What are the biggest hazards OSHA sees in the cleaning industry?

Slips, overexertion, and chemical exposure. The Bureau of Labor Statistics tracks injury and illness rates by industry, and janitorial and building cleaning services (NAICS 5617) consistently posts total recordable incident rates above the national average for private industry, driven mostly by those three ^[6].

Here is what OSHA citations actually hit cleaning companies for, based on enforcement patterns across the standards that govern this work:

Hazard / Standard	Why it triggers citations
Hazard communication (29 CFR 1910.1200)	Missing SDSs, no written HazCom program, workers not trained on chemicals they use
Slip and fall (29 CFR 1910.22)	Wet floors during cleaning, no wet floor signage, no housekeeping procedures
PPE (29 CFR 1910.132/133/138)	No hazard assessment, no documentation of assessment, missing gloves or eye protection
Bloodborne pathogens (29 CFR 1910.1030)	No exposure control plan for companies cleaning restrooms or medical facilities
Emergency action plan (29 CFR 1910.38)	No written plan, no designated assembly point, workers not drilled
Electrical safety (29 CFR 1910.303)	Damaged cords on vacuums and floor machines, no inspection program

This list tells you exactly which sections of your written program need the most muscle. Slips and chemical exposure are where workers get hurt. HazCom and PPE are where OSHA writes the most tickets. Your program has to hit both the real hazard and the paperwork requirement, because those are two different failure points.

What sections does a cleaning company safety program need to include?

Think of a written safety program as a stack of shorter programs bound together. Each hazard category gets its own section with a policy, procedures, training requirements, and recordkeeping. Here is the structure I use for a cleaning company, in order:

1. Company safety policy statement (management commitment and employee responsibilities) 2. Hazard communication program (29 CFR 1910.1200) 3. PPE program and written hazard assessment (29 CFR 1910.132) 4. Slip, trip, and fall prevention procedures (29 CFR 1910.22) 5. Chemical handling and storage procedures 6. Bloodborne pathogen exposure control plan (29 CFR 1910.1030), if applicable 7. Emergency action plan (29 CFR 1910.38) 8. Electrical safety and equipment inspection procedures 9. Ergonomics and safe lifting guidance 10. Incident reporting and investigation procedures 11. Training documentation and recordkeeping

If you do floor stripping with buffing machines, add a machine guarding or equipment safety section. If you ever work at heights (window washing, pressure washing elevated surfaces), you need a fall protection section under 29 CFR 1926.502 (construction standard) or 29 CFR 1910.28 (the general industry walking-working surfaces standard, rewritten in 2017).

Skip lockout/tagout unless you earn it. You do not need a lockout/tagout program (29 CFR 1910.147) unless workers service or maintain equipment where unexpected energization could occur. Cleaning around machinery does not trigger it. Servicing that machinery does. If your crews ever unplug and clean inside commercial dishwashers or HVAC equipment, add a basic lockout/tagout section. You can read more about lockout tagout requirements if you are on the fence.

How do you write the hazard communication section?

HazCom is the most cited OSHA standard in the country, and cleaning companies get tagged for it constantly ^[1]. The rule (29 CFR 1910.1200) requires three things in writing: a list of all hazardous chemicals used, a system for maintaining and accessing Safety Data Sheets (SDSs) for each one, and documented training for every employee who may be exposed.

Start with the inventory. Your chemical list should name every product your crews touch: disinfectants, degreasers, toilet bowl cleaners, glass cleaners, floor strippers, carpet shampoos, and any specialty items. Pull the SDSs from each manufacturer's website. They are free. Keep them in a binder every worker can reach at every job site, or in a digital system workers can actually open on their phones mid-shift.

Your written HazCom program has to state, in plain terms, how you maintain the SDS library, how a new chemical gets added to the inventory before workers use it, and how you label secondary containers (the spray bottles you fill from bulk). OSHA's GHS-aligned standard requires labels on all containers that identify the product, hazard pictograms, the signal word (Danger or Warning), and hazard statements ^[1].

Write the training section around what workers learn, more than that training happened. OSHA wants to see that employees can read an SDS, know the health and physical hazards of their specific chemicals, and know how to protect themselves. See the hazard communication guide for SDS section-by-section breakdowns, including what an hcl safety data sheet looks like as a worked example.

One line is worth quoting directly. The HazCom standard requires that the written program describe "the methods the employer will use to inform employees of the hazards of non-routine tasks." ^[1] That covers mixing chemicals for a specialty job or using a new product for the first time. Your program needs to say, explicitly, that you brief workers before non-routine chemical tasks.

How do you write the PPE section and complete the required hazard assessment?

The PPE standard (29 CFR 1910.132) requires two things in writing: a documented hazard assessment and a signed certification that it was done ^[2]. The assessment is a task-by-task look at the physical, chemical, and biological hazards workers face, and the PPE you picked to control each one.

Build it as a table. List the tasks (toilet cleaning, floor stripping, glass cleaning, trash removal, cleaning up blood or body fluids), name the hazards in each (caustic chemicals, splash, slip risk, bloodborne pathogens), then specify the required PPE (nitrile gloves rated for the chemical, safety glasses or a face shield, non-slip footwear, disposable gown and N95 where applicable).

The certification is four elements on one page. It needs the workplace evaluated, the name of the person who did the evaluation, the date, and a statement that the evaluation was performed. That is the whole requirement. A single signed page from the owner or safety manager satisfies it.

For eye and face protection (29 CFR 1910.133) and hand protection (29 CFR 1910.138), the standard requires that PPE fit properly and stay in sanitary, reliable condition ^[2]. Your program should say how often gloves get replaced, how goggles are cleaned between uses, and who restocks supplies. A worker showing up to a job with no gloves because the supply ran out is a real and common failure in cleaning operations. Your written program is where you kill it, with a clear restocking procedure and a named owner.

What should a bloodborne pathogen exposure control plan cover for cleaning companies?

If your company cleans restrooms, removes trash that may contain sharps, or cleans up after accidents, crimes, or medical events, 29 CFR 1910.1030 requires a written Exposure Control Plan ^[3]. The standard covers any employer whose workers have "occupational exposure," which it defines as reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials.

For most commercial cleaning companies, that exposure exists. OSHA does not make you prove a worker was actually exposed. It asks whether exposure is reasonably anticipated given the tasks performed, and restroom cleaning alone usually clears that bar.

Your Exposure Control Plan must include:

• A determination of which job classifications and tasks involve occupational exposure
• The schedule and method of implementation for each requirement in the standard (universal precautions, engineering controls, work practice controls, PPE)
• Procedures for post-exposure evaluation and follow-up
• A hepatitis B vaccination program, offered to exposed workers at no cost within 10 days of assignment
• An annual review and update of the plan

The plan has to be accessible to employees and updated annually or whenever tasks change. Add a medical facility contract? Update the plan before workers set foot in the building.

Bloodborne pathogen training runs at initial assignment and every year after, and it must be documented with dates, content covered, and worker signatures ^[3]. This is one of the spots OSHA reads closely when it inspects a cleaning company, so do not treat it as a checkbox.

How do you write a slip, trip, and fall prevention section?

Slips and falls are the leading cause of injury in cleaning work, and BLS data shows floor care workers get hurt in falls at rates well above average for service occupations ^[6]. Treat this as your primary operational hazard, not a stray paragraph in a general policy.

Your slip and fall section should cover three things concretely: wet floor signage (when to place signs, how many per work area, who is responsible), footwear (slip-resistant soles are the industry standard, so require them by name), and procedures for working in areas with active foot traffic.

Handle ladders on their own if your crews use step stools or extension ladders for dusting, window cleaning, or light fixtures. OSHA's updated walking-working surfaces standard (29 CFR 1910.28) sets the rules for portable ladders in general industry ^[8]. The short version: never stand on the top two steps of a stepladder, keep three points of contact on extension ladders, and inspect every ladder before use.

Write procedures in the order workers actually do the work. A good mopping procedure reads like this: place wet floor signs at both ends of the hallway before starting; mop in sections and let each section dry before pulling its signs; never leave a wet floor unattended where people walk. That level of detail is what an inspector wants to see. More to the point, it is what actually keeps someone off the floor with a broken wrist.

What training documentation does your written program need to require?

A written program is half the job. OSHA builds training requirements into each standard, and every one specifies who gets trained, when, and on what. Your program should pull all of them into a single training matrix so nothing slips.

For a cleaning company, the minimum required training looks like this:

Standard	Who	When	Frequency
HazCom (1910.1200)	All workers using chemicals	Before first exposure to hazardous chemicals	When new hazards are introduced
PPE (1910.132)	All workers required to use PPE	Before PPE use begins	When PPE or hazards change
Bloodborne pathogens (1910.1030)	Workers with occupational exposure	At hire, before exposure	Annually
Emergency action plan (1910.38)	All employees	When plan is established and when responsibilities change	When plan changes
Walking-working surfaces (1910.28)	Workers exposed to fall hazards	Before exposure	When conditions change

Every training event needs a written record: the date, the topic, who ran it, and the signatures of everyone who attended. Keep general training records for the duration of employment plus three years. Keep any exposure-related training record, like bloodborne pathogens, for the duration of employment plus 30 years ^[3].

For osha training options and what counts as qualified instruction, the point is simple: whoever delivers the training has to understand the material. OSHA does not require a certified trainer for most cleaning topics. It requires a trainer who knows the content cold.

How do you handle incident reporting in a cleaning company safety program?

Your program needs an incident reporting procedure a worker can follow without stopping to ask a manager. Make it specific: who to call, when (immediately, or within 24 hours for a recordable incident), and what information to collect on the spot.

Keep two things separate. Reporting is the immediate notification chain. Recordkeeping is the OSHA 300 log obligation, which applies once you pass 10 employees ^[5].

Companies with 11 or more employees must maintain OSHA Form 300 (the injury and illness log), Form 300A (annual summary), and Form 301 (incident report or equivalent), and hold them for five years ^[5]. Post the 300A summary somewhere visible from February 1 through April 30 each year. Plenty of small cleaning operations get cited not for the injuries themselves but for blowing that posting window.

The reporting timelines do not bend for company size. Report any work-related fatality to OSHA within 8 hours. Report any in-patient hospitalization, amputation, or loss of an eye within 24 hours. These deadlines apply no matter how small you are ^[5].

Your procedure should also spell out how you investigate. A one-page form asking what happened, what the root cause was, what corrective action was taken, and who owns completing it by when covers what an inspector expects to see about follow-up. You can find a full walkthrough of what goes on an incident report in our related guide.

How long does it take to write a cleaning company safety program, and can you do it yourself?

You can write a complete, OSHA-compliant program for a small cleaning company yourself. Most owners who sit down with a clear outline and their chemical list finish a working draft in three to five hours. The bottleneck is almost always gathering SDSs and building the chemical inventory, not the policy writing.

Two sections eat the most time: the PPE hazard assessment (you have to actually think through each task) and the bloodborne pathogen exposure control plan (it carries the most regulatory detail). Give both extra attention and the rest goes fast.

Want a faster start? SafetyFolio's safety program generator asks a series of questions about your operation and produces a document tailored to cleaning work in about 15 minutes. You still review it and drop in your specific chemical inventory and job site details, but the structure and the regulatory citations are already in place.

Do not buy a generic safety manual template and assume it fits. Generic templates miss cleaning-specific hazards (chemical mixing, restroom sanitation, occupied-building protocols) and bolt on sections you will never use (confined space entry, forklift operation) that muddy what your program actually requires. A focused 15-to-20-page program built around your real hazards is more useful, and more defensible in an inspection, than a 60-page binder of boilerplate that does not describe your company.

How do you keep a written safety program current once you have written it?

A program that never gets updated is a liability, not a shield. OSHA's bloodborne pathogen standard requires annual review outright ^[3]. The HazCom standard requires you to update the chemical list whenever you add a product ^[1]. Your PPE hazard assessment has to be redone when tasks change in any meaningful way.

Build a review calendar into the program itself. Most small cleaning companies do best with one full review a year (January works, before the new year's routes settle in) plus a standing rule: any new chemical triggers an SDS update and a check of whether training needs to change, before anyone uses the product.

When OSHA updates a standard, you update your program. The 2017 rewrite of the walking-working surfaces standard (29 CFR 1910.28 and 1910.29) changed ladder safety and fall protection requirements that hit cleaning operations directly ^[8]. Plenty of programs written before 2017 still cite the old numbers.

Keep a revision log at the front of the document: the date of each revision, what changed, who approved it. Two minutes of work, and it tells an inspector the program is alive, not a folder created once and forgotten. If you get inspected and your program shows a single date from three years back with no updates, that raises questions even when the content is technically fine.

For more on what OSHA looks for and how inspections work, the osha overview covers the agency's inspection priorities and what triggers a visit.

What does an OSHA inspection of a cleaning company actually look like?

OSHA usually inspects cleaning companies after a worker complaint or a reported injury. Programmed inspections, where OSHA picks employers based on high-hazard industry designation, also happen in this sector.

When a compliance officer shows up, the sequence runs: opening conference (they explain why they are there and what they want), document review (your written program, training records, OSHA 300 log, SDS binder), walkaround (a physical look at work in progress or the facility), and closing conference (they lay out what they found and the likely outcome).

Document review is where the written program earns its keep. If the inspector says "show me your HazCom program" and you hand over a current, signed document that lists your chemicals, describes your SDS system, and points to your training records, that question closes on the spot. If you cannot produce it, that is a citation.

The penalties are not small. OSHA's structure as of 2024 sets serious violations at up to $16,550 per violation and willful or repeated violations at up to $165,514 per violation ^[7]. For a small cleaning company, a single inspection with four or five HazCom and PPE violations can produce $30,000 to $60,000 in proposed penalties before any informal settlement. A written program, maintained training records, and an accessible SDS library are the three things that stop most of those citations before they start.

Frequently asked questions

Is a written safety program required for a cleaning company with only 2 employees?

Yes, for specific programs. OSHA's size exemptions only reach the OSHA 300 injury log (exempt if you have 10 or fewer employees). The written HazCom program (29 CFR 1910.1200), PPE hazard assessment (29 CFR 1910.132), bloodborne pathogen exposure control plan (29 CFR 1910.1030), and emergency action plan (29 CFR 1910.38) are all required regardless of company size, as long as the hazards they cover exist in your operation.

What chemicals in cleaning products trigger OSHA hazard communication requirements?

Any product classified as hazardous under OSHA's GHS-aligned HazCom standard (29 CFR 1910.1200) triggers it. In cleaning work, that covers most disinfectants, bleach-based products, acid-based toilet bowl cleaners, ammonia-containing glass cleaners, solvent-based degreasers, and floor strippers. Consumer products used in the manner and frequency a consumer would use them are exempt, but products used in commercial quantities or concentrations are not.

Do I need a written bloodborne pathogen program if my cleaning company only does office buildings?

Probably yes. OSHA's definition of occupational exposure under 29 CFR 1910.1030 is "reasonably anticipated" contact, not confirmed contact. Office restrooms, trash removal, and cleanup after accidents all create reasonably anticipated exposure to blood or other potentially infectious materials. Most compliance officers will find that office cleaning workers have occupational exposure. The safest move is to have an exposure control plan.

How do I get Safety Data Sheets for all the cleaning products my company uses?

Go straight to each manufacturer's website. Manufacturers are required by 29 CFR 1910.1200 to provide SDSs free to customers. Search the product name plus 'SDS' or 'safety data sheet.' If you cannot find it online, call the manufacturer's customer service line. Keep a dated copy for every product in both your main office binder and a job-site-accessible format (a physical binder or a cloud folder workers can open by phone).

What PPE is typically required for commercial cleaning workers?

Your written PPE hazard assessment sets the exact requirements for your tasks, but most commercial cleaning operations need at least: chemical-resistant nitrile gloves for chemical contact, safety glasses or goggles for splash risk, slip-resistant footwear for wet-floor work, and disposable gowns or aprons for heavy soil or biological cleanup. Face shields may be required for acid-based or corrosive chemicals. Document the task-by-task assessment in writing as required by 29 CFR 1910.132.

How often do I need to update or review my cleaning company's safety program?

At minimum, annually. The bloodborne pathogen standard (29 CFR 1910.1030) requires annual review explicitly. Your chemical inventory and SDS library must be updated whenever you add a product, before workers use it. Your PPE hazard assessment should be reviewed when tasks, locations, or work conditions change in any meaningful way. Keep a revision log with dates and approver signatures at the front of the document.

Can I use a free online safety program template for my cleaning company?

You can use one as a starting frame, but treat it as a draft, not a finished product. Generic templates routinely miss cleaning-specific hazards like chemical mixing and restroom biological risks, include irrelevant sections like forklift safety, and may reference outdated standard numbers. Any template you use needs your actual chemical inventory, your specific tasks, your PPE selections, and your company's contact names and procedures before it is legally defensible.

What happens if an OSHA inspector visits and I don't have a written safety program?

You will likely get citations for each required written program you are missing. Serious violations under OSHA's current structure run up to $16,550 per violation. A cleaning company with no HazCom program, no PPE hazard assessment, and no bloodborne pathogen exposure control plan could face three separate serious citations from that list alone. Citations can be reduced through informal settlement, but that costs time and legal attention a written program avoids entirely.

Do cleaning company workers need OSHA 30 training?

OSHA 30 is a voluntary program; no OSHA standard requires it specifically for cleaning workers. What OSHA does require is training on the specific hazards workers face, documented to the content and frequency each standard specifies. That said, supervisors who complete OSHA 30 usually run better training programs and spot hazards faster. See the osha 30 training overview for what the course covers and whether it fits your operation.

What is the emergency action plan requirement for a cleaning company?

If you have 10 or fewer employees, your emergency action plan (29 CFR 1910.38) may be communicated orally instead of in writing, though a written plan is still smart. With 11 or more employees, the plan must be written. It needs to cover: evacuation procedures and routes, procedures for employees who stay to run critical operations before evacuating, a way to account for everyone after evacuation, rescue and medical duties, and how employees report fires and emergencies.

What records do I need to keep and for how long?

Training records: duration of employment plus 3 years for general safety training; duration of employment plus 30 years for bloodborne pathogen exposure-related records. OSHA 300 injury logs: 5 years. SDS records: keep them while the chemical is in use, plus 30 years for any chemicals with exposure records. Your written safety program itself has no set retention period, but keep every prior version with its revision date in case a historical incident is investigated.

Does my cleaning company need a lockout/tagout program?

Only if workers service or maintain equipment where unexpected energization, startup, or release of stored energy could injure them (29 CFR 1910.147). Cleaning around equipment does not trigger it. Cleaning inside commercial dishwashers, replacing parts on floor buffers, or clearing machinery jams does. If your workers do those tasks, you need a written energy control program and documented training. If your crews only clean and never service equipment, lockout/tagout does not apply.

How should I handle chemical storage and mixing hazards in the written program?

Your HazCom program and your chemical handling section should both address it. Incompatible chemicals (bleach and ammonia, bleach and acids) must be stored separately, and workers must be trained never to mix them. The HazCom standard's requirement to address 'non-routine tasks' covers situations where a worker might improvise a mixture. Name the specific incompatible combinations in your written procedures. Do not assume workers already know them.

Sources

1. OSHA, Hazard Communication Standard (29 CFR 1910.1200): HazCom requires a written program, chemical inventory list, SDSs for each hazardous chemical, and documented worker training including methods for informing employees of hazards of non-routine tasks
2. OSHA, Personal Protective Equipment Standards (29 CFR 1910.132, 1910.133, 1910.138): PPE standard requires a written hazard assessment, a signed certification of that assessment, and documented training before PPE use begins
3. OSHA, Bloodborne Pathogens Standard (29 CFR 1910.1030): Bloodborne pathogen standard requires a written Exposure Control Plan, hepatitis B vaccination offer within 10 days of assignment, annual training, and annual review of the plan for all workers with occupational exposure
4. OSHA, Emergency Action Plans Standard (29 CFR 1910.38): Emergency action plans must be in writing for employers with more than 10 employees and cover evacuation routes, employee accountability, and how employees report emergencies
5. OSHA, Recordkeeping Rule (29 CFR 1904): Employers with 10 or fewer employees are partially exempt from OSHA 300 log requirements; fatalities must be reported within 8 hours and hospitalizations, amputations, or eye loss within 24 hours regardless of company size; 300A must be posted February 1 through April 30
6. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities (NAICS 5617 Building Cleaning Services): Janitorial and building cleaning services show total recordable incident rates driven by slips, trips, falls, overexertion, and chemical exposures, above the national average for private industry
7. OSHA, Penalties (civil penalty adjustments current as of 2024): OSHA serious violation penalties are up to $16,550 per violation; willful or repeated violations are up to $165,514 per violation as of 2024 penalty adjustments
8. OSHA, Walking-Working Surfaces Standard (29 CFR 1910.28 and 1910.29): Updated 2017 standard sets requirements for portable ladder use, fall protection, and walking surface maintenance in general industry including cleaning operations
9. OSHA, OSH Act Section 5(a)(1) General Duty Clause: Every employer must provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm regardless of whether a specific standard applies
10. OSHA, Housekeeping and Walking-Working Surfaces (29 CFR 1910.22): General industry housekeeping standard requires workplace floors to be kept clean, dry, and in good repair; wet surfaces require appropriate warnings