How to write a lockout tagout plan that actually passes OSHA

Last updated 2026-07-11

What is a lockout tagout plan and what does OSHA actually require?

Lockout tagout is a set of practices for controlling hazardous energy before workers service or maintain equipment. That energy includes electrical, hydraulic, pneumatic, mechanical, thermal, and gravitational sources. The idea is simple: isolate the energy, prove it's isolated, then work. The paperwork behind that idea is more involved.

OSHA's governing standard is 29 CFR 1910.147, the Control of Hazardous Energy standard. It applies to general industry. Construction uses 29 CFR 1926.417 instead, and maritime has its own rules under 29 CFR 1915. If you run a general industry shop, 1910.147 is your standard.

The standard requires two distinct documents. First, a written energy control program: the facility-wide policy that describes your procedures, training approach, inspection schedule, and rules for contractors and outside personnel ^[1]. Second, machine-specific energy control procedures for each piece of equipment with hazardous energy sources, unless you can document that the equipment meets the "general procedure" exception (more on that below).

OSHA also requires annual inspections of the procedures themselves, documented training for authorized and affected employees, and coordination rules when contractors come on site. Skip any of these and you've created a citable violation.

Why does lockout tagout matter? What are the injury and penalty numbers?

OSHA estimates that failure to control hazardous energy causes roughly 10% of serious industrial accidents ^[2]. The agency credits LOTO compliance with preventing an estimated 120 fatalities and 50,000 injuries every year. Those figures come from OSHA's own regulatory impact analyses and get cited often in enforcement guidance, though they're projections rather than tracked outcomes.

29 CFR 1910.147 violations have landed on OSHA's top-ten most-cited list every year for over a decade. In fiscal year 2023, OSHA issued 2,924 citations under the standard, making it the fifth most cited standard overall ^[3]. The average penalty per serious citation runs in the range of $4,000 to $7,000 for small businesses after typical reductions. Willful violations can reach $161,323 each as of 2024 ^[4].

The injury cost angle matters too. A single worker caught in machinery and hospitalized triggers workers' comp claims, an OSHA recordable injury, and possible 29 CFR 1904 recordkeeping obligations. Lost-time injuries cost small employers an average of $41,000 in direct and indirect costs, according to OSHA's Safety Pays estimates ^[8]. A written LOTO plan and real training cost a fraction of that.

What goes in the written energy control program (the facility-wide document)?

The written energy control program is the policy document. It doesn't describe individual machines. It describes how your company handles LOTO across all equipment. OSHA lays out required content in 29 CFR 1910.147(c)(1) through (c)(9).

Your program must cover at minimum:

Scope and purpose. State that the program applies to servicing and maintenance of machinery where unexpected energization or startup could cause injury. Reference the standard.

Roles and responsibilities. Define who is an "authorized employee" (the person who locks out), who is an "affected employee" (someone who operates the equipment and must stay clear), and who is "other" (everyone else). These aren't job titles. They're functional roles that can overlap.

Energy isolation procedures. Describe the steps employees must follow, in sequence: notify affected employees, shut down the equipment, identify all energy sources, isolate each source, apply personal locks and tags, release or restrain stored energy, verify isolation.

Hardware rules. Specify that each authorized employee gets their own personal lock and that the key stays with that employee. Describe what lockout devices (hasps, lockout stations) and tagout tags look like and where they're stored.

Tagout-only provisions. If you use tags instead of locks on any equipment, explain why locks can't be applied and what extra precautions you take. Tags alone are considered less protective than locks ^[1].

Contractor and outside personnel coordination. When outside contractors do maintenance, you must inform them of your energy control procedures and get information about theirs, per 29 CFR 1910.147(f)(2).

Annual inspection requirement. The program must describe how you perform annual inspections of energy control procedures and document those inspections with the machine name, date, employees involved, and the person who conducted the review.

Training and retraining triggers. Specify when initial training happens (before anyone performs LOTO duties) and what causes retraining: new job assignments, new equipment, changed procedures, observed deficiencies.

Write the program in plain language. Employees read it during training. Inspectors read it during audits. If it's 12 pages of legalese, it's functionally useless even when it covers every required element.

What does a machine-specific lockout tagout procedure look like?

This is the document that lives at the machine or in a binder near it. One procedure per machine, or per group of machines that are identical in configuration and energy sources. This is where most small businesses fall short.

OSHA specifies at 29 CFR 1910.147(c)(4)(ii) that the procedure must include the intended use of the procedure, steps for shutting down and isolating the machine, steps for placing, removing, and transferring lockout devices, requirements for testing or verifying isolation, and any specific safety requirements for that machine.

A real machine-specific procedure covers:

Machine identification. Equipment name, ID number, location.

Authorized employees. Who is trained to work on this machine.

Energy sources table. List every energy source: voltage/amperage for electrical, PSI for pneumatic, stored spring pressure for mechanical, fluid type and pressure for hydraulic, temperature range for thermal. Don't guess at these. Measure them or pull the equipment manual.

Isolation steps, in sequence. Step 1: turn off machine using the on/off switch at the control panel. Step 2: open the main electrical disconnect at the panel labeled MCC-3. Step 3: apply your personal lock to the disconnect hasp. And so on, for every energy source.

Stored energy release. For most machines, turning off power doesn't eliminate stored energy. Capacitors hold charge. Pneumatic lines hold pressure. Springs stay compressed. The procedure must describe how to bleed pressure, discharge capacitors, and block gravity-loaded parts.

Verification step. After isolation, the employee must attempt to start the machine using the normal start controls. Nothing should happen. Document this step explicitly.

Restoration sequence. How to remove locks in order and restore power safely.

Here's an example energy source table in the format that works:

Energy Source	Location	Isolation Method	Lock Point
120V electrical	Main disconnect, east panel	Open and lock disconnect	Hasp, personal lock
Pneumatic (90 PSI)	Air supply valve, rear of machine	Close ball valve, bleed pressure via relief valve	Valve lockout device
Mechanical (spring tension)	Press ram assembly	Block ram with wooden block before releasing spring	N/A, block must stay in place

Procedures don't have to be long. A single-energy-source machine might have a one-page procedure with a photograph of the lockout point. A large CNC machining center with five energy sources might take three pages. The length isn't the point. Accuracy is.

Does every machine need its own written procedure, or is there an exception?

Yes, there's an exception, and it's narrower than most people think.

OSHA's 1910.147(c)(4)(i) says that if an employer can demonstrate that a general energy control procedure gives full employee protection, the standard doesn't require additional machine-specific procedures. To qualify, all of the following must be true: the equipment has no potential for stored or residual energy after shutdown, the equipment has a single energy source that can be readily identified and isolated, isolating that source completely de-energizes the equipment, the equipment stays isolated and locked out during servicing, a single lockout device achieves lockout, the device is under the exclusive control of the authorized employee, and working on unlocked equipment presents no hazard.

In practice, most powered industrial equipment doesn't meet all of these conditions. A conveyor motor with pneumatic brakes, a pump with pressurized fluid downstream, a machine with capacitors, a press with a loaded spring: none of these qualify. The exception genuinely applies to something like a simple electric bench grinder with one plug and no stored energy once unplugged.

OSHA has issued letters of interpretation making clear the exception is meant to be narrow. If you're not absolutely sure a machine qualifies, write the specific procedure. An unnecessary procedure costs you an hour. A missing required procedure costs you a citation.

Who needs LOTO training, and how often does it have to happen?

Training requirements under 29 CFR 1910.147(c)(7) apply to three groups, each with different scope.

Authorized employees (those who apply lockout devices) must be trained to recognize hazardous energy sources, know the type and magnitude of energy at their machines, and understand the methods for isolation and control. This is the most thorough training category.

Affected employees (those who operate equipment being locked out) must be trained to understand the purpose of LOTO and know not to restart or reenergize equipment under lockout.

Other employees who work in areas where LOTO is used must understand that they must not try to restart or re-energize locked-out equipment.

OSHA doesn't specify a minimum number of training hours for LOTO. The standard requires that employees demonstrate proficiency. For authorized employees, that usually means classroom instruction, procedure review, and observed practice on actual machines. In my view, online-only training for authorized employees isn't enough. An employee who can ace a quiz but fumbles at a real lockout point isn't trained in any meaningful sense.

Retraining is required when an inspection reveals deficiencies, when a change in job assignments or equipment creates new hazards, or when there's reason to believe an employee doesn't understand the procedure. "Annual training" isn't required by the standard, but annual inspections often surface retraining needs, and some state-plan states have stricter rules.

Documentation of training (who was trained, what was covered, and when) isn't explicitly required by 1910.147, but OSHA inspectors ask for it, and you'll need it to defend against a citation. Keep records.

What are the annual inspection requirements for LOTO procedures?

Section 29 CFR 1910.147(c)(6) requires an annual inspection of each energy control procedure. This is a procedural audit more than a training check. The person conducting the inspection must be an authorized employee other than the one using the procedure being reviewed ^[9].

The inspection must be conducted with each authorized employee who uses that procedure. The purpose is to find gaps between the written procedure and what employees actually do.

You must certify in writing that the inspection took place. The certification must include the machine or equipment on which the procedure was used, the date of the inspection, the employees included, and the name of the person who performed the inspection ^[1].

A common mistake is treating this as a paper exercise. An inspector who visits your facility will ask to see inspection certifications and then ask employees to demonstrate the procedure. If the employee does something different from the written procedure, or if the procedure hasn't been updated to reflect a machine modification, you have a violation even when the paperwork looks clean.

For a shop with 20 machines, this is 20 annual inspections. Building them into a quarterly schedule (five machines per quarter) is more manageable than doing all 20 in December.

How do you handle group lockout situations?

Group lockout happens when more than one authorized employee works on a single machine or system at the same time. The rule: each employee must be able to protect themselves independently. One lock per person.

OSHA addresses this in 29 CFR 1910.147(f)(3). The procedure must give each authorized employee the same level of protection as if they were working alone ^[10]. In practice, this means using a hasp at each lockout point so each worker's personal lock goes directly on the device controlling the energy.

For complex equipment with multiple lockout points and multiple workers, you may use a group lockout box. All isolating locks for the equipment go on the box, the box is locked, and then each authorized employee working on the equipment puts their personal lock on the box. When each worker finishes and leaves, they remove their lock. The equipment can only be re-energized once the box is empty of all personal locks and the primary isolation locks are removed.

Group lockout procedures need to appear in the written program and in the machine-specific procedure when group work is foreseeable for that equipment. Designate a primary authorized employee for group lockouts, someone responsible for coordinating the overall procedure and confirming that all personal locks are removed before restoration.

Shift changes during ongoing lockout work need specific handling too. The outgoing employee can't simply remove their lock at shift end. Use a shift change procedure: either the oncoming employee applies their lock before the outgoing employee removes theirs, or you transfer a group box with documentation.

What should a small business do first when building a LOTO program from scratch?

Start with the equipment inventory. Walk the facility and list every machine that has hazardous energy sources. For each one, note whether it has a single easily isolated energy source (potential general procedure exception) or multiple sources requiring a specific procedure. Most shops find they have more specific-procedure machines than they expected.

Prioritize by risk. The hydraulic press, the three-phase electrical panel, the conveyor with pneumatic components: these get written procedures first. The simple bench grinder might qualify for the general procedure exception.

Then write the facility-wide program. If you're doing this without a consultant, the OSHA Small Business Handbook and the agency's compliance assistance resources on OSHA.gov are good starting points ^[6]. The program language doesn't need to be elaborate. Clear, specific, accurate: that beats long every time.

After the documents exist, train. Don't train before the procedures are written, because training to a procedure that doesn't exist yet is training to nothing.

Then inspect the procedures with each authorized employee within the first year and document those inspections.

If you want to move faster, a tool like SafetyFolio's safety program generator can produce a compliant written energy control program in about 15 minutes by asking you questions about your equipment and workforce. You still need to write the machine-specific procedures yourself (no tool can substitute for a site walk), but having the program document done correctly from the start saves real revision time.

A workplace safety plan that covers LOTO alongside your other written programs is more coherent and easier to maintain than a pile of standalone documents. Consider how your LOTO program connects to your hazard communication plan if chemical energy is involved in your processes.

What do OSHA inspectors look for during a LOTO audit?

OSHA compliance officers follow the inspection procedure in the Compliance Directive for 29 CFR 1910.147, which is CPL 02-00-147 ^[7]. Knowing what they check is genuinely useful.

Document review first. They'll ask for your written energy control program and a sample of machine-specific procedures. They'll check whether the procedures exist, whether they're current, and whether they cover all energy sources.

Employee interviews. Inspectors talk to employees without supervisors present. They ask authorized employees to explain the steps they take to lock out a specific machine. They ask affected employees what they know about LOTO. Gaps between what employees say and what the procedure says are violations.

Observation. If maintenance or servicing is happening during the inspection, the officer may watch the actual lockout. If an employee skips verification or leaves a line pressurized, that's a citation regardless of what the procedure says.

Annual inspection certifications. Inspectors ask for the certifications for every machine with a specific procedure. Missing certifications are a citable violation.

Training records. No formal training record requirement exists in the standard, but being unable to show that training happened weakens an employer's citation defense. In practice, having training sign-in sheets and dates is necessary.

Common citation patterns: missing machine-specific procedures, procedures that don't address stored energy, no annual inspections, authorized employees who can't demonstrate the procedure, and tagout-only programs without documented justification.

How does LOTO interact with other safety programs in your facility?

LOTO doesn't stand alone. It overlaps with several other regulatory requirements in ways that create compliance obligations you may not expect.

Electrical safety. OSHA's 29 CFR 1910.331 through 1910.335 cover electrical safe work practices. Qualified electrical workers performing work on live circuits fall under the electrical standards, not 1910.147. The interaction matters when a maintenance worker performs some tasks under LOTO and an electrician performs others on the same system under arc flash procedures.

Machine guarding. 29 CFR 1910.212 requires machine guards. LOTO doesn't replace guarding. It controls energy when guards must come off for servicing.

Confined space. If a machine requires entry into a permit-required confined space during servicing, 29 CFR 1910.146 applies alongside 1910.147. Both sets of requirements must be met at the same time.

Contractor management. As noted, 1910.147(f)(2) requires host employers to coordinate with outside contractors. If a contractor has their own LOTO program that differs from yours, you need a bridging procedure before work starts.

If your facility operates in California, Washington, Michigan, or another state-plan state, check state requirements. Some state plans have adopted stricter rules. Michigan OSHA, for example, has requirements that go beyond the federal standard in some areas. You can find state-specific guidance in your state's OSHA plan resources.

What does a compliant LOTO program cost to build and maintain?

The honest answer: very little in direct cost, but real in time.

For a small shop with 10 to 20 machines, writing the facility-wide program from scratch takes a competent safety person 4 to 8 hours if they understand the standard well. Writing machine-specific procedures takes roughly 1 to 2 hours per machine for a thorough first pass, including the equipment walk-down to identify all energy sources. That's 14 to 48 hours total for the documents.

Annual inspections per machine run 30 to 60 minutes each when done properly. Training for a new authorized employee takes 2 to 4 hours of real instruction plus time at the machine.

Hardware costs are low. A basic LOTO kit with a hasp, several padlocks, tags, and a lockout station runs $50 to $200 per workstation. If you have 5 authorized employees and 15 machines with multiple lockout points, budget $500 to $2,000 for hardware.

The penalty for a serious violation of 1910.147 runs from around $1,000 to $15,625 per violation for small employers (after reduction factors) as of 2024 ^[4]. Willful violations, where OSHA determines you knew about the requirement and didn't comply, can run $16,131 to $161,323 per instance. The time investment in a correct program pays for itself after exactly one avoided citation.

SafetyFolio is built for situations like this. Rather than spending hours reading the standard and reverse-engineering a compliant program document, the generator walks you through the questions the standard requires you to answer and produces a document you can put in front of an inspector. You still own the machine-specific procedures, but the written program is handled.

Frequently asked questions

Does OSHA's lockout tagout standard apply to small businesses?

Yes. 29 CFR 1910.147 applies to all general industry employers regardless of size. There is no small-business exemption. OSHA does offer free, confidential on-site consultation visits to small businesses with fewer than 250 employees through its OSHA Consultation Program, which can help you build a compliant program without triggering an enforcement action.

Can I use tags instead of locks in my LOTO program?

You can, but tagout-only programs require more justification. OSHA considers locks more protective than tags because tags can be removed without a key. If your equipment can't physically accommodate a lockout device, you can use tags, but your written program must document why locks can't be applied and what extra precautions you're taking to provide equivalent protection.

What is the difference between an authorized employee and an affected employee?

An authorized employee is the person who applies the lockout or tagout device and performs the servicing work. An affected employee is someone who normally operates the equipment being locked out and must stop using the machine during the lockout. One person can be both depending on the situation. The distinction matters for training requirements.

How often do lockout tagout procedures need to be reviewed and updated?

OSHA requires an annual inspection of each energy control procedure, but the standard doesn't mandate a full rewrite annually. You must update a procedure whenever the equipment changes, when the procedure is found deficient during inspection, or when a new energy source is added. Document the review each year even if no changes are needed.

What happens if a contractor comes in to do maintenance on our equipment?

Under 29 CFR 1910.147(f)(2), the host employer and outside employer must inform each other of their respective lockout tagout procedures and ensure employees understand and comply with the restrictions. You can't simply hand a contractor your procedure and walk away. You need to verify they have their own compliant program or that they're working under yours.

Is there a free lockout tagout procedure template I can use?

OSHA provides sample programs and templates through its website at OSHA.gov, including within the Small Business Safety and Health Handbook. These are starting points, not finished products. A template that doesn't reflect your actual machines and their specific energy sources won't satisfy the standard. Always customize for each piece of equipment.

What is stored energy and why does it matter for LOTO?

Stored energy is energy that remains in equipment after the primary power source is shut off. Examples include hydraulic pressure trapped in lines, pneumatic pressure in receivers, electrical charge in capacitors, spring tension in mechanical systems, and gravity loads from elevated parts. LOTO procedures must include steps to release or restrain all stored energy before work begins, beyond just shutting off the main power.

Can the same person who writes the lockout tagout procedure also perform the annual inspection?

No. 29 CFR 1910.147(c)(6)(i) requires that the annual inspection be performed by an authorized employee other than the one using the procedure being inspected. The purpose is independent verification. If you have only one authorized employee for a machine, you need someone else who is qualified to conduct that inspection.

What's the penalty for not having a written lockout tagout program?

A missing written program is typically cited as a serious violation under 29 CFR 1910.147(c)(1). As of 2024, serious violation penalties run up to $15,625 per violation. Small employers generally receive reductions based on size, good faith, and history, but 'we didn't know we needed one' isn't accepted as good faith after a certain number of employees.

Does lockout tagout apply to plug-in equipment like power tools?

Generally, 29 CFR 1910.147(a)(2)(ii)(A) exempts work on cord-and-plug connected electric equipment when the plug is under the exclusive control of the employee doing the work and unplugging provides complete de-energization. If the plug could be re-energized by someone else, or if there's stored energy beyond the plug connection, the exemption doesn't apply.

How should we handle lockout tagout during a shift change?

Your written program must address shift changes. The safest approach is continuity of lock: the oncoming authorized employee applies their lock before the outgoing employee removes theirs. Using a group lockout box during extended maintenance tasks also works. The machine must never be in a state where no lock is applied while work is ongoing, even for a brief overlap period.

Do forklift maintenance procedures require lockout tagout?

Yes, forklift maintenance typically requires LOTO. A forklift has multiple hazardous energy sources: electrical systems (especially in electric forklifts), hydraulic systems for the mast, and stored mechanical energy. If you're in Washington State, forklift-related training requirements may have additional specifics covered under the state plan. See our guide to forklift certification in Washington State for state-specific context.

Can an employee refuse to perform a LOTO procedure they believe is incorrect?

Yes, and they're protected if they do. OSHA's Section 11(c) prohibits retaliation against employees who raise safety concerns. If an authorized employee believes a written procedure doesn't account for a hazard they've observed, that's a signal to update the procedure through the annual inspection process, or through immediate correction if the hazard is imminent.

What records do I need to keep for lockout tagout compliance?

The standard explicitly requires keeping annual inspection certifications, which must include the machine name, date, employees covered, and inspector's name. Training records aren't explicitly mandated, but OSHA expects you to demonstrate that training occurred. Keep training sign-in sheets and a summary of what was covered. There's no required retention period in 1910.147 specifically, but three to five years is a defensible practice.

Sources

1. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Written energy control program requirements including procedures, training, inspection, and contractor coordination under 29 CFR 1910.147(c)(1) through (c)(9)
2. OSHA, Lockout/Tagout Overview: OSHA estimates that failure to control hazardous energy causes approximately 10% of serious industrial accidents and that compliance prevents roughly 120 fatalities and 50,000 injuries per year
3. OSHA, Top 10 Most Cited Standards FY2023: 29 CFR 1910.147 was cited 2,924 times in FY2023, making it the fifth most cited standard
4. OSHA, Penalties: Willful OSHA violations can reach $161,323 per violation and serious violations up to $15,625 per violation as of 2024
5. OSHA, Small Business Safety and Health Handbook: OSHA provides sample programs, templates, and compliance assistance resources for small businesses including LOTO guidance
6. OSHA, Compliance Directive CPL 02-00-147: Inspection Procedures for the Control of Hazardous Energy: OSHA compliance officers follow CPL 02-00-147 when inspecting for compliance with 29 CFR 1910.147
7. OSHA, Safety Pays Program: OSHA's Safety Pays program estimates direct and indirect costs of lost-time injuries average approximately $41,000 for small employers
8. OSHA, 29 CFR 1910.147(c)(6) Annual Inspection: Annual inspection of each energy control procedure must be certified in writing with machine name, date, employees included, and name of inspector per 29 CFR 1910.147(c)(6)
9. OSHA, 29 CFR 1910.147(f)(3) Group Lockout/Tagout: Group lockout procedures must give each authorized employee the same level of protection as individual lockout under 29 CFR 1910.147(f)(3)
10. OSHA, OSHA Consultation Program: OSHA offers free confidential on-site consultation to small businesses with fewer than 250 employees without triggering enforcement
11. OSHA, 29 CFR 1910.147(a)(2)(ii) Scope and Application: Cord-and-plug connected equipment is exempt from 1910.147 when the plug is under exclusive control of the employee and unplugging provides complete de-energization