Minimum required written OSHA programs for a small manufacturer

Last updated 2026-07-11

Does OSHA actually require written programs, or is that a myth?

Written programs are a real, enforceable requirement. Not a consultant upsell. OSHA uses the phrase 'written program' or 'written procedures' dozens of times across 29 CFR Part 1910, the General Industry standards that cover most manufacturing work. When a standard says you need one, an inspector can cite you for not having it, and that citation is hard to fight.

The confusion comes from a handful of narrow places where OSHA gives small employers partial relief. A workplace with 10 or fewer employees is exempt from maintaining OSHA 300 injury logs under 29 CFR 1904.1 ^[1]. But that exemption covers recordkeeping, not written safety programs. The Hazard Communication standard (29 CFR 1910.1200) applies no matter how many people you employ ^[2].

Some written programs are triggered by specific hazards, not by industry category. Put a worker in a respirator and you need a written Respiratory Protection Program under 29 CFR 1910.134(c)(1). No respirators, no program required.

So here is the honest answer. Your required list depends on what hazards live in your building, but a core group of programs applies to nearly every manufacturer by default.

Which written programs apply to almost every small manufacturer?

Seven programs show up at essentially every manufacturing site regardless of what you make. Treat these as your baseline.

Hazard Communication Program (29 CFR 1910.1200) If any chemical, solvent, lubricant, cleaning product, or raw material in your facility has a Safety Data Sheet, you need a written Hazard Communication Program. The standard requires the program to address how you label containers, how SDSs are maintained and accessible, and how employees are trained ^[2]. Our hazard communication guide breaks down the underlying standard.

Lockout/Tagout Program (29 CFR 1910.147) Any facility with machinery that can release stored energy during servicing needs a written energy control program. That means machine-specific procedures for every piece of covered equipment, not a generic policy. LOTO violations sit in OSHA's top ten most-cited standards year after year ^[11]. Our lockout tagout guide walks through what those machine-specific procedures need to include.

Emergency Action Plan (29 CFR 1910.38) Required for any employer with more than 10 employees. It has to be written, available to employees, and cover evacuation routes, how you account for people after evacuation, procedures for anyone who stays to run critical equipment, and contact information. Facilities with 10 or fewer employees can communicate the plan orally, but most small manufacturers cross that line.

PPE Hazard Assessment and Program (29 CFR 1910.132) You must conduct a written hazard assessment to determine what PPE each work area requires, then certify that you did it. The certification must identify the workplace evaluated, the date of the assessment, and the person who performed it ^[4]. Employers miss this constantly because they hand out safety glasses without ever documenting why.

Recordkeeping Program (29 CFR 1904) If you have 11 or more employees and work in a covered industry (most manufacturing NAICS codes qualify), you must keep OSHA 300 logs, 300A annual summaries, and 301 incident reports. The 300A gets posted from February 1 through April 30 every year ^[1]. Our incident report guide shows what a proper report looks like and what makes an injury recordable.

Respiratory Protection Program (29 CFR 1910.134) Required if any employee is required to wear a respirator, or if you allow voluntary use of respirators other than filtering facepieces. The written program covers how you select respirators, medical evaluations, fit testing, maintenance, and training ^[5].

Bloodborne Pathogens Exposure Control Plan (29 CFR 1910.1030) Required only if employees have occupational exposure to blood or other potentially infectious materials ^[13]. For most manufacturers that means first-aid responders, or anyone whose job includes treating injured coworkers. Keep a designated first-aid person on shift and you probably need this plan.

What written programs are required based on specific equipment or processes?

Past the baseline seven, your hazard profile drives the rest. Here is a practical checklist organized by what you have in the building.

If you have this...	You likely need this written program	Standard
Permit-required confined spaces	Confined Space Entry Program	29 CFR 1910.146
Forklifts or powered industrial trucks	Forklift Operator Training and Evaluation records (written procedures required)	29 CFR 1910.178
Hot work (welding, cutting, brazing)	Hot Work Permit Program	29 CFR 1910.252 / NFPA 51B
Flammable liquids stored above threshold quantities	Flammable Liquids storage procedures	29 CFR 1910.106
Hearing hazards above 85 dBA TWA	Hearing Conservation Program	29 CFR 1910.95
Cranes, hoists, or rigging	Crane Inspection and Maintenance Program	29 CFR 1910.179
Process chemicals above threshold quantities	Process Safety Management Program	29 CFR 1910.119
Bloodborne pathogen exposure via first aid	Exposure Control Plan	29 CFR 1910.1030
Fall hazards (elevated work platforms, mezzanines)	Fall Protection Plan	29 CFR 1910.28

The forklift certification requirement under 29 CFR 1910.178(l) deserves special attention because it demands written records of operator training and evaluation, more than the training itself. Plenty of small shops train people informally and never write it down, which is exactly what inspectors go looking for.

Hearing Conservation is another one that slips through. OSHA's standard at 29 CFR 1910.95(c) requires a written program whenever employee noise exposures equal or exceed an 8-hour time-weighted average of 85 decibels ^[6]. Stamping presses, CNC routers, and packaging lines routinely blow past that. A sound level meter reading costs almost nothing and tells you whether the program applies.

How detailed does each written program actually need to be?

This is where most online templates fall apart. They spit out 40-page documents that nobody reads and that describe a facility other than yours.

OSHA's standards spell out what each program must contain, and the requirements swing widely by program. The Emergency Action Plan (29 CFR 1910.38) can run short because the standard lists only six required elements. The Lockout/Tagout Program (29 CFR 1910.147) is heavier because it needs a separate energy control procedure for every piece of equipment, each with its own isolation points, energy magnitudes, and steps ^[3].

The core rule is simple. Your programs must match your actual workplace. A Hazard Communication Program that lists chemicals you don't use, or describes labeling you don't do, is worse than useless. During an inspection, a compliance officer holds your written program up against what they see on the floor. Every gap between the two is a fresh citation.

Write short, accurate programs first. Add detail only where the standard demands it. For most small manufacturers a Hazard Communication Program runs two to four pages. A LOTO program with machine-specific procedures might run fifteen to thirty pages once you include a procedure for each covered machine, and that length is earned because each procedure documents real steps.

The written program has to be available to employees during their shift. OSHA does not require paper copies if electronic access genuinely reaches every worker. But if half your crew has no computer access during the day, a binder in the break room is still the right call.

Are small businesses with fewer than 10 or 25 employees exempt from any of these?

The only clear size-based exemptions in 29 CFR Part 1910 involve recordkeeping. Employers with 10 or fewer employees at all times during the previous calendar year are exempt from OSHA 300/300A/301 requirements under 29 CFR 1904.1, with a partial exception if OSHA or BLS tells them to keep records for a specific survey ^[1].

Under OSHA's electronic reporting rule (29 CFR 1904.41), establishments with 20 to 249 employees in high-hazard industries, including most manufacturing NAICS codes, must submit their 300A summary data electronically each year. Establishments with 250 or more employees must submit 300, 300A, and 301 data ^[1].

There is no size exemption from the written program requirements for Hazard Communication, LOTO, Respiratory Protection, or Emergency Action Plans. A compliance officer applies the same standards to a five-person machine shop as to a five-hundred-person plant. Inspection priority and enforcement focus differ in practice, but that is not a legal exemption.

One nuance worth knowing. OSHA's On-Site Consultation Program, which is separate from enforcement, prioritizes small employers with fewer than 250 employees on-site and fewer than 500 company-wide ^[7]. Using that free program to find your gaps before an inspection is a smart move, and the visit stays confidential from enforcement.

What does OSHA's General Duty Clause add to these requirements?

Section 5(a)(1) of the OSH Act, the General Duty Clause, requires employers to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[8]. OSHA uses this clause to cite hazards that don't fall neatly under any specific standard.

In a manufacturing setting, this matters because OSHA can cite you for a written-program-type failure even when no specific standard commands a written program. If you have a recognized ergonomic hazard and no documented plan for it, a General Duty Clause citation is possible, and OSHA never finalized an ergonomics standard.

The takeaway is direct. Your written programs should cover your highest-severity hazards even if a specific 1910 standard never uses the words 'written program.' A documented hazard assessment, a written procedure for a high-risk task, or a written inspection checklist all become your evidence that you saw a hazard and dealt with it.

How often do these written programs need to be reviewed or updated?

The standards vary, and most small manufacturers track no update schedule at all. Here is what the major standards actually say.

The Lockout/Tagout standard at 29 CFR 1910.147(c)(6) requires a periodic inspection of the energy control procedure for each machine at least annually ^[3]. That inspection must be done by an authorized employee and certified in writing with the machine identification, the date, and the names of employees involved.

The Respiratory Protection Program under 29 CFR 1910.134(c)(2) must be updated whenever changes in workplace conditions, respirator types, or other factors affect how well the program works ^[5].

The Hearing Conservation Program requires annual audiometric testing for exposed employees under 29 CFR 1910.95(g), so you end up reviewing the program every year by default ^[6].

For the Emergency Action Plan or Hazard Communication, OSHA sets no fixed interval, but the standards say the programs must stay current and accurate. A solid working rule: review every program annually and after any incident, near-miss, new equipment purchase, or process change. Then date the review inside the program document itself.

How do I figure out which written programs my specific facility needs?

Start with a written hazard assessment. Walk every area of your facility and list every process, machine, chemical, and physical hazard you find. You need this assessment anyway for PPE compliance under 29 CFR 1910.132, so you knock out two things at once.

Then map your hazard list against the 29 CFR 1910 standards. If the list includes 'noise from stamping press,' look up 29 CFR 1910.95. If it includes 'propane forklift,' look up 29 CFR 1910.178. The OSHA standards index at osha.gov makes this easy to work through.

OSHA's free On-Site Consultation Program earns its reputation here. A consultant visits your facility, tells you which standards apply, and does not share findings with enforcement ^[7]. Wait times vary by state, sometimes weeks, sometimes months, but it costs nothing and the consultants tend to know their stuff.

If you want to move faster, tools like SafetyFolio's safety program generator walk you through a guided hazard inventory and generate first drafts of required programs in a fraction of the time it takes to build them from scratch. Worth a look if you're staring at a blank page with an inspection on the calendar.

Either way, the output you want is one thing: a written list of which programs your facility requires, based on documented hazards, not someone else's generic template.

What happens if OSHA finds a missing or inadequate written program?

A missing required written program is usually cited as a Serious violation when a hazard exists and an employee could be badly hurt. Serious violations carry penalties up to $16,550 per violation as of 2024 ^[9]. Willful or repeated violations can hit $165,514 per violation.

OSHA adjusts penalties based on employer size, good faith, and history. Small employers with fewer than 25 employees can get up to a 60% reduction on initial penalties, employers with 26 to 100 employees get up to 40% off, and employers with 101 to 250 employees get up to 20% off ^[9]. Even after reductions, a small shop cited for three missing programs can face $15,000 to $25,000 in total penalties.

The fine is only part of it. OSHA also issues an Abatement Notice giving you a deadline to fix the problem. Miss that deadline and failure-to-abate penalties run up to $16,550 per day. Initial fines, abatement costs, and per-day penalties stacked together are where small manufacturers get into real financial trouble.

Civil litigation risk sits on top of all that. If an employee is injured and you lacked a required written program for that hazard, your insurance carrier and a plaintiff's attorney both notice. The written program isn't only an OSHA box to check. It's your documented proof that you ran a responsible workplace.

Can I use a template I find online, or does OSHA require custom programs?

Templates are a legitimate starting point. OSHA's own website offers model Emergency Action Plans, Hazard Communication Programs, and other templates. Using them is not cheating.

The problem is that a generic template is almost never adequate on its own. OSHA's Hazard Communication standard requires your program to list the chemicals in your workplace and describe your specific labeling practices ^[2]. A template that says 'insert chemical list here' and never gets filled in fails the standard.

The LOTO standard requires equipment-specific procedures. A template that says 'follow manufacturer lockout instructions' is not compliant unless you've actually documented each machine's energy sources, isolation points, and verification steps. An inspector will ask to see the procedure for one specific machine and expect a document that matches what's bolted to the floor.

So the realistic answer: use templates for structure, then customize every section to match your actual facility. If your program references chemicals, equipment, or procedures that don't exist in your building, it can hurt you during an inspection by proving nobody ever really applied it.

The same rule governs OSHA training tied to these programs. Training has to match the actual hazards and procedures at your facility, not a generic outline.

How do state-plan states affect which written programs a manufacturer needs?

Twenty-two states and two territories run their own OSHA-approved State Plans that cover private-sector employers ^[10]. If your facility sits in California, Michigan, Washington, Oregon, or another state-plan state, you follow state standards instead of federal OSHA, and those state plans must be "at least as effective as" federal OSHA.

In practice, state plans sometimes require extra written programs. California's Cal/OSHA requires every employer to have a written Injury and Illness Prevention Program (IIPP) under California Code of Regulations Title 8, Section 3203. Federal OSHA has no equivalent mandatory IIPP requirement for most employers. Michigan OSHA also requires a written safety and health management system.

If you're in a state-plan state, check your state plan's website before you assume federal 29 CFR 1910 is your whole requirement. The OSHA state plans page lists every state plan and links to the state agency ^[10].

Federal OSHA covers workplaces in the remaining states plus federal workers everywhere. For federal contractors, additional requirements can apply under OSHA's construction standards (29 CFR 1926) even for manufacturing-related site work.

Frequently asked questions

Is a written Hazard Communication Program required even if I only use common chemicals like WD-40 and oil?

Yes. 29 CFR 1910.1200 applies to any hazardous chemical in the workplace, and most lubricants, cutting fluids, and cleaning products have Safety Data Sheets, which means they qualify as hazardous chemicals under the standard. You need a written program covering labeling, SDS access, and employee training no matter how routine the chemicals seem.

Do I need separate written programs for each OSHA standard, or can I combine them into one safety manual?

You can combine them. OSHA doesn't require separate binders. What it requires is that each standard's mandatory elements are present and findable. Many small manufacturers keep everything in one Safety Manual with clearly labeled sections. The risk of one giant document is that it gets unwieldy and people stop using it. Short, separate program documents tend to stay more current in practice.

What is the first written program I should create if I'm starting from scratch?

Start with Hazard Communication (29 CFR 1910.1200). It applies to nearly every facility, and its elements, specifically your chemical inventory and SDS binder, feed directly into your PPE hazard assessment and other programs. Getting HazCom right first gives you a foundation to build on. Lockout/Tagout is the close second priority if you have any machinery.

Does a written emergency action plan need to include tornado or severe weather procedures?

29 CFR 1910.38 does not specifically require a tornado procedure. It requires procedures for emergencies the employer anticipates, including fire. Whether severe weather counts depends on your location and your history of such events. Including it is good practice and costs you nothing. Many insurers and local fire codes require it independently of OSHA anyway.

How do I document that employees have been trained on my written programs?

Keep a dated sign-in sheet or training record for each program, listing employee names, the topic covered, and the trainer's name. OSHA doesn't mandate a format, but during an inspection a compliance officer will ask to see training records. No records means OSHA can assume the training never happened, even if it did. Digital recordkeeping works fine as long as it's backed up.

Can my written programs be stored electronically rather than on paper?

Yes, OSHA allows electronic storage. The requirement is that employees can access the programs during their work shift. If your production floor workers have no computer access during the day, a shared terminal, a tablet in a common area, or a paper copy in the break room all satisfy this. Storing programs only on a manager's locked office computer does not.

Does a small manufacturer need a written forklift safety program, or just training records?

29 CFR 1910.178(l) requires formal written training and evaluation records for each operator, including the date, the trainer's name, and certification that the operator was found competent. It does not mandate a separate forklift safety program document, but the training and evaluation must be documented in writing. Many facilities also write a short forklift operating rules document as supporting evidence.

What's the penalty for not having a required written OSHA program?

A missing written program where a related hazard exists is usually a Serious violation, with penalties up to $16,550 per violation as of 2024. Small employers under 25 employees can get up to a 60% size reduction on that penalty, but a facility cited for several missing programs at once can still face total penalties in the tens of thousands before abatement costs.

Is a written Fire Prevention Plan required for manufacturers?

29 CFR 1910.39 requires a written Fire Prevention Plan if 29 CFR 1910.38 (Emergency Action Plan) requires one and fire hazards exist. For most manufacturers, both apply. The Fire Prevention Plan must list major fire hazards, proper storage and handling procedures, ignition sources, and the names of employees responsible for fuel source housekeeping and heat-producing equipment maintenance.

Does OSHA require a written drug and alcohol policy for manufacturers?

No specific 29 CFR 1910 standard mandates a written drug and alcohol policy. OSHA's General Duty Clause could theoretically apply if impairment creates a recognized hazard, but in practice this lands as a Department of Transportation issue for certain driver roles, a workers' compensation and insurance issue, or a state law issue. It's good practice to have one, but it's not an OSHA written program requirement the way HazCom or LOTO are.

How does OSHA's On-Site Consultation Program work for small manufacturers?

OSHA's free consultation service, funded through OSHA but run by state agencies, sends a consultant to your facility to identify hazards and missing programs without sharing findings with enforcement. Priority goes to employers with fewer than 250 on-site employees. You schedule the visit, agree to fix identified hazards, and get a written report. It's a legitimate way to find gaps before an inspector does.

Do I need a written program for machine guarding?

29 CFR 1910 Subpart O covers machine guarding but does not explicitly require a separate written machine guarding program the way LOTO does. However, your LOTO procedures should reference guarding requirements, and your PPE hazard assessment should note where guarding is the primary protection. Some facilities add a written machine guarding inspection checklist, which is good practice but not explicitly mandated.

What written programs are most commonly cited in OSHA manufacturing inspections?

Based on OSHA's published Top 10 Most Cited Standards data, Hazard Communication (1910.1200), Lockout/Tagout (1910.147), Respiratory Protection (1910.134), and Powered Industrial Trucks (1910.178) consistently sit near the top. All four require specific written program elements. Machine guarding (1910.212) is also frequently cited, though it doesn't require a standalone written program.

Sources

1. OSHA, 29 CFR 1904 Recordkeeping Rule Overview: Employers with 10 or fewer employees are exempt from OSHA 300 log requirements; 300A must be posted February 1 through April 30 annually
2. OSHA, Hazard Communication Standard 29 CFR 1910.1200: Hazard Communication requires a written program addressing labeling, SDS maintenance, and employee training and applies regardless of employer size
3. OSHA, Lockout/Tagout Standard 29 CFR 1910.147: LOTO requires a written energy control program with machine-specific procedures and annual periodic inspections certified in writing
4. OSHA, Personal Protective Equipment Standard 29 CFR 1910.132: Employers must certify in writing that a PPE hazard assessment was performed, including workplace evaluated, date, and name of assessor
5. OSHA, Respiratory Protection Standard 29 CFR 1910.134: A written Respiratory Protection Program is required when employees are required to wear respirators, covering selection, medical evaluation, fit testing, and training
6. OSHA, Occupational Noise Exposure Standard 29 CFR 1910.95: A written Hearing Conservation Program is required when employee noise exposures equal or exceed 85 dBA as an 8-hour time-weighted average
7. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program prioritizes small employers with fewer than 250 on-site employees and keeps findings confidential from enforcement
8. OSHA, OSH Act Section 5(a)(1) General Duty Clause: Section 5(a)(1) requires employers to provide a workplace free from recognized hazards causing or likely to cause death or serious physical harm
9. OSHA, OSHA Penalty Policy and Civil Monetary Penalties: Serious violations carry penalties up to $16,550 per violation as of 2024; small employers with fewer than 25 employees may receive up to a 60% size reduction
10. OSHA, State Plans: Twenty-two states and two territories operate OSHA-approved State Plans covering private-sector employers; state standards must be at least as effective as federal OSHA
11. OSHA, Top 10 Most Cited Standards: Hazard Communication, Lockout/Tagout, Respiratory Protection, and Powered Industrial Trucks are consistently among OSHA's most-cited standards in manufacturing
12. OSHA, Bloodborne Pathogens Standard 29 CFR 1910.1030: An Exposure Control Plan is required for any employer whose workers have occupational exposure to blood or other potentially infectious materials