OSHA written program requirements checklist for small manufacturers

Last updated 2026-07-09

What does OSHA actually require in writing for manufacturers?

OSHA has no rule that says "write a safety manual." Instead, roughly 16 individual 29 CFR 1910 standards each carry their own written program requirement, and a handful of 29 CFR 1926 construction standards apply if you do any facility work. The trigger is the hazard existing at your facility, not your headcount.

Some requirements hit almost every manufacturer: hazard communication, lockout/tagout, emergency action, and a fire prevention plan once you pass 10 employees. Others are conditional. If nobody at your facility wears a respirator, you do not need a written respiratory protection program. No forklifts, no powered industrial truck program. So the first step in building your checklist is an honest hazard inventory, not a template download.

Federal OSHA enforces these rules for most private-sector employers, but 22 states and territories run their own OSHA-approved plans that can pile requirements on top of federal minimums ^[1]. California, Washington, Michigan, and others go further, sometimes requiring injury and illness prevention programs (IIPPs) with extra written elements. Check whether your state has a state plan before you finalize your list.

For a plain-English overview of the agency and what it covers, see our guide to what does osha stand for.

Which OSHA standards require a written program (the full checklist)?

The table below covers every standard in 29 CFR 1910 that explicitly uses the words "written program," "written plan," or "written procedures" for General Industry. A checkmark in the "Almost All Mfg" column means the hazard is common enough that most small manufacturers should assume it applies unless they can document otherwise.

Standard	Topic	Written Requirement	Almost All Mfg?
29 CFR 1910.132	Personal Protective Equipment	Written hazard assessment certification	Yes
29 CFR 1910.134	Respiratory Protection	Written program when respirators are required	Conditional
29 CFR 1910.146	Permit-Required Confined Spaces	Written program	Conditional
29 CFR 1910.147	Lockout/Tagout (Control of Hazardous Energy)	Written energy control program + machine-specific procedures	Yes (most)
29 CFR 1910.157	Portable Fire Extinguishers	Written program if employees are designated to use them	Yes
29 CFR 1910.178	Powered Industrial Trucks	Written training program	Conditional
29 CFR 1910.212	Machine Guarding	No standalone written plan, but ties into LOTO procedures	Yes
29 CFR 1910.1000	Air Contaminants / PELs	Written compliance program when engineering controls alone are insufficient	Conditional
29 CFR 1910.1020	Access to Employee Exposure Records	Written access procedure	Yes
29 CFR 1910.1030	Bloodborne Pathogens	Exposure Control Plan	Conditional (first aid designees)
29 CFR 1910.1200	Hazard Communication	Written HazCom program	Yes
29 CFR 1910.38	Emergency Action Plan	Written plan (>10 employees)	Yes
29 CFR 1910.39	Fire Prevention Plan	Written plan (>10 employees)	Yes
29 CFR 1910.95	Occupational Noise Exposure	Written hearing conservation program (if TWA ≥ 85 dBA)	Conditional
29 CFR 1910.119	Process Safety Management	Written PSM program	Conditional (highly hazardous chemicals)
29 CFR 1910.1450	Hazardous Chemicals in Labs	Written Chemical Hygiene Plan	Conditional

"Conditional" means the standard applies only when the specified hazard or process is present. Do not skip the conditional rows without checking. Plenty of small shops have confined spaces (tanks, pits, hoppers) and never realize it ^[2].

The standard cited most against small manufacturers is 29 CFR 1910.1200, hazard communication. OSHA cited HazCom violations more than 2,300 times in fiscal year 2023, making it the third most cited standard agency-wide ^[3]. A written hazard communication program is not optional if you use chemicals, and almost every manufacturer does.

What must a hazard communication written program include?

The hazard communication standard at 29 CFR 1910.1200(e) spells out the minimum contents. Your written HazCom program has to describe how your workplace handles Safety Data Sheets, how you label incoming containers, and how you train employees on chemical hazards ^[4].

Specifically, the program must include the list of hazardous chemicals present (the chemical inventory), where SDSs live and how employees reach them during every shift, your labeling system for containers you fill or relabel in-house, and your employee training plan. It also has to address non-routine tasks with unusual chemical exposure and how you communicate hazards to outside contractors.

One thing the standard does not require: a perfect binder. OSHA letters of interpretation confirm the written program can live electronically as long as employees can reach it during their shifts without a supervisor's help ^[4]. A locked PDF on a manager's computer does not clear that bar.

For specific chemical SDS questions, our hcl safety data sheet article walks through how to read and use an SDS correctly.

What goes into a lockout/tagout written program?

29 CFR 1910.147 requires two separate written documents: the energy control program (the facility-level policy) and individual energy control procedures for each machine or piece of equipment with a hazardous energy source ^[5].

The energy control program describes the purpose, rules, and techniques for locking out equipment. It covers who authorizes lockouts, what hardware is used, how group lockouts work, how contractors are handled, and when tagout alone is permitted (only if lockout is not feasible). This is the policy document.

The machine-specific procedures are where most small manufacturers fall short. OSHA requires a separate written procedure for each machine unless the employer can demonstrate that a general procedure provides the same protection. That exemption is narrow in practice. Each procedure must list the steps to shut down the equipment, the location and type of each energy source, the type and magnitude of energy (voltage, hydraulic pressure, stored spring tension), and the steps to verify energy is isolated before work begins ^[5].

LOTO is the second most commonly cited serious violation against manufacturers. See our full guide on lockout tagout for a step-by-step on writing machine-specific procedures.

Review cycles matter too. 29 CFR 1910.147(c)(6) requires an annual review of energy control procedures. That review must be certified in writing, signed by the authorized employee who performed it.

When is a written respiratory protection program required?

29 CFR 1910.134(c)(1) requires a written respiratory protection program any time you require employees to use respirators, or any time employees voluntarily use respirators other than filtering facepieces (dust masks) during work ^[6]. If you only allow voluntary dust-mask use, you still have to hand employees Appendix D of the standard, but you skip the full written program.

The written program must cover procedures for selecting respirators, medical evaluations, fit testing (required annually for tight-fitting respirators), training, use, maintenance, cleaning, inspection, storage, and program evaluation. Each element needs to be addressed for your specific workplace. A generic internet template may leave out procedures specific to your respirator type or your contaminants.

The medical evaluation piece catches many small employers off guard. Before any employee does a fit test or wears a tight-fitting respirator, a physician or licensed health care professional (PLHCP) must clear them medically using at minimum the OSHA Medical Evaluation Questionnaire (Appendix C of 1910.134). That is a written record you have to keep.

Fit test records and medical clearances must be retained and available to employees on request.

Does a small manufacturer with fewer than 10 employees need all these programs?

Size exemptions in OSHA are narrower than most small business owners expect. The only written plans with an explicit employee-count threshold are the emergency action plan and the fire prevention plan: employers with 10 or fewer employees may communicate those plans orally instead of in writing, per 29 CFR 1910.38(b) and 1910.39(b) ^[7].

Every other written program requirement applies regardless of company size. A manufacturer with 3 employees who uses hazardous chemicals, runs equipment with lockout/tagout energy sources, and has a permit-required confined space still needs written programs for all three.

OSHA does weigh size when it sets penalty amounts. Under current penalty calculation guidelines, small employers (usually defined as fewer than 26 employees) get a 60% reduction in proposed penalties, and very small employers (10 or fewer) get a 70% reduction ^[8]. That matters for citations, but it does not shrink your obligation to have the programs in the first place.

For a broader look at what inspectors look for, see our overview of osha requirements and how inspections work.

What is the emergency action plan requirement for manufacturers?

29 CFR 1910.38 requires every employer to have an emergency action plan. Pass 10 employees and it has to be in writing. The plan must cover procedures for reporting emergencies, evacuating (including routes and procedures), accounting for employees after evacuation, rescue and medical duties if you have designated employees for those tasks, names or job titles of people employees can contact for more information, and procedures for employees who must stay to operate critical equipment before evacuating ^[7].

OSHA does not ask you to plan for every conceivable emergency, but inspectors expect you to address the ones reasonably foreseeable at your facility: fire, chemical spill, medical emergency, severe weather if you sit in a tornado or flood zone, and active threats if your location warrants it.

The fire prevention plan under 29 CFR 1910.39 is a companion document, not the same thing. It must list major fire hazards in your facility, proper handling and storage procedures for those hazards, the types of fire protection equipment you have, and the name or job title of the person responsible for controlling fuel source hazards and maintaining equipment. Employers often combine the two into one document, which OSHA permits.

How do you write a PPE hazard assessment and certification?

29 CFR 1910.132(d) requires employers to assess the workplace to determine if hazards are present that call for PPE. That assessment must be certified in writing ^[9]. The certification is short. It identifies the workplace assessed, the person who performed it, the date, and a document title that proves it is a PPE hazard assessment certification.

The practical content behind the certification, your actual assessment notes, should describe each work area or job task, the hazards present (impact, penetration, compression, chemical, heat, harmful dust, radiation), and the PPE selected for each hazard. OSHA's compliance directive CPL 02-01-050 makes clear the certification document itself is what inspectors check first, but they will also look for evidence the assessment was real and task-specific, not a one-page checkbox with no job-specific detail.

Select PPE based on the hazard analysis, not what employees prefer or what you had lying around. ANSI/ISEA standards for eye protection (Z87.1), head protection (Z89.1), and foot protection (ASTM F2413) are the benchmarks OSHA references. Buying compliant PPE and documenting it in your program closes the loop.

How often do OSHA written programs need to be updated?

Most OSHA standards do not name an exact update interval. What they require is that programs match current conditions. Add a new chemical, you update the HazCom program and chemical inventory. Install new equipment with energy sources, you write a new LOTO procedure before anyone services it. Change a process that affects confined space entry, you update the permit program.

The standards that do name review periods: 29 CFR 1910.147 requires an annual LOTO procedure review and certification. 29 CFR 1910.134 requires an annual program evaluation (and annual fit testing for tight-fitting respirators). 29 CFR 1910.95 requires an annual audiogram for employees in the hearing conservation program.

Good practice, whatever the standard says or does not say, is to review every written program at least annually and after any significant incident, near-miss, or process change. Date your revisions. An undated program is nearly useless to an inspector trying to judge whether you kept up with regulatory changes. OSHA amended the HazCom standard to align with GHS in 2012, and many small manufacturers are still running programs written to the old MSDS-based standard. That is a citation waiting to happen ^[4].

What records do you need to keep alongside the written programs?

Written programs are the policy. Records prove you followed them. OSHA sets retention periods for many of the associated records.

OSHA 300 logs, 300A summaries, and 301 incident reports must be retained for 5 years after the calendar year they cover ^[10]. Exposure records (air monitoring, biological monitoring) must be kept 30 years under 29 CFR 1910.1020. Medical records must be kept for the duration of employment plus 30 years. Fit test records and training records for respiratory protection are generally kept for the duration of employment. LOTO training records have no specified retention period, but keeping them as long as the employee works for you is reasonable practice.

For serious injuries, you file an incident report on Form 301 and enter it on the OSHA 300 log within 7 calendar days of learning about the recordable incident. Any single in-patient hospitalization, amputation, or loss of an eye must be reported to OSHA within 24 hours. A fatality must be reported within 8 hours ^[10].

Store records where employees and their designated representatives can reach them on request. "In a locked file cabinet in the owner's car" does not meet the access requirement.

What is the fastest legitimate way to build these programs?

The honest answer: there is no shortcut that skips the hazard inventory. You cannot write a real lockout/tagout machine-specific procedure without physically walking to each machine and documenting its energy sources. That part cannot be templated. A consultant or a software tool gives you the structure. Only you can fill in the machine-specific facts.

The program-level policies (the facility HazCom program, the respiratory protection framework, the emergency action plan) are heavily templatable, though. OSHA publishes free guidance documents and model programs for several standards, including respiratory protection and hazard communication, available through OSHA.gov ^[11]. These are legitimate starting points.

If you want a faster path through the written-policy layer, SafetyFolio's safety program generator walks you through facility-specific questions and produces written programs matched to your actual operations in about 15 minutes. You still add machine-specific LOTO procedures and do the physical hazard walk, but it gets the policy framework done without paying a consultant $2,000 to $5,000 to write what amounts to a customized template.

OSHA training for your supervisors pays off alongside program development. A supervisor who understands why each program element exists writes and enforces it better than one who just got handed a binder.

How does OSHA determine penalties if a written program is missing?

Missing or inadequate written programs are typically cited as "serious" violations, meaning OSHA has reason to believe the violation could cause death or serious physical harm. As of January 2024, the maximum penalty for a serious violation is $16,131 per violation ^[8]. Each missing written program is a separate violation.

The Bureau of Labor Statistics reports that manufacturing consistently posts one of the highest rates of nonfatal occupational injuries and illnesses among private industry sectors, at 3.3 cases per 100 full-time workers in 2022 ^[12]. That injury rate is part of why OSHA targets manufacturing for programmed (scheduled) inspections and why compliance matters beyond avoiding fines.

Willful violations, where the employer knew about the requirement and chose to ignore it, carry penalties up to $161,323 per violation as of January 2024 ^[8]. In practice, inspectors upgrade a serious violation to willful when they find evidence a prior inspection or warning existed. If OSHA visited three years ago and cited you for a missing HazCom program and it is still missing, the next citation will be willful.

Abatement matters too. After a citation, OSHA sets an abatement deadline. Blow that deadline and you trigger a "failure to abate" penalty of up to $16,131 per day the violation continues.

Are there free OSHA resources to help small manufacturers write these programs?

OSHA's On-Site Consultation Program is one of the most underused resources in manufacturing. It gives free, confidential safety and health consultations to small and medium-sized businesses (generally fewer than 250 employees at a site and fewer than 500 company-wide) ^[11]. Consultants are separate from OSHA enforcement staff. A consultation visit does not trigger an inspection, and citations are not issued. The consultant identifies hazards, reviews your written programs, and hands you a prioritized list of what to fix.

The consultation program runs through state agencies under OSHA funding. You can find your state's consultation office through OSHA.gov. In fiscal year 2022, the program served more than 27,000 establishments and identified over 139,000 hazards ^[11]. That is not a trivial resource.

OSHA also publishes free Small Business Compliance Guides for many standards, including HazCom and LOTO, written specifically for employers without safety staff. The National Institute for Occupational Safety and Health (NIOSH) publishes industry-specific exposure and control guidance. OSHA's Safety and Health Program Management Guidelines (published in the Federal Register, 54 Fed. Reg. 3904) lay out a voluntary framework that maps well to the written program requirements even though it is not itself mandatory ^[13].

For supervisors who want deeper training, the osha 30 course covers many of these written program topics in a structured format. It is not required by regulation for manufacturing, but it builds the knowledge base that makes writing and managing these programs much easier. The osha 30 training is available in classroom and online formats.

What should you do first if you have no written programs at all?

Start with the three programs that carry the highest citation frequency and the highest injury risk: hazard communication (1910.1200), lockout/tagout (1910.147), and the emergency action plan (1910.38). These three alone cover the bulk of OSHA citations against small manufacturers and the hazards most likely to cause serious injury.

Do the hazard walk before you write anything. Walk the floor with a notepad. Identify every chemical you use or store (HazCom), every piece of equipment that must be de-energized for service (LOTO), every space that might be a permit-required confined space, and every emergency scenario your floor could face. This 2-to-3-hour investment tells you exactly which programs you need and hands you the facility-specific facts to fill them in.

Next, use OSHA's free model programs as structural templates and drop in your facility details. Get the PPE hazard assessment done and certified on paper. Then work through the conditional programs: respiratory protection if you use respirators, hearing conservation if noise monitoring shows a time-weighted average at or above 85 dBA, confined space if you have permit spaces.

Set calendar reminders for annual reviews. A written program nobody reviews goes stale and turns into a liability. The program that has sat in a binder since 2018 with the old MSDS language, old employee names, and old machine inventory will not protect you at an inspection.

SafetyFolio's safety program generator moves you quickly through the written-policy layer so you can spend your time on the site-specific details that actually require your knowledge of your own facility. The goal is programs that reflect how your workplace runs, not generic language that a judge and an inspector both know was never tailored to anyone.

Frequently asked questions

How many written safety programs does a small manufacturer actually need?

It depends on your operations, but most small manufacturers need between 6 and 12 written programs under 29 CFR 1910. At minimum, expect programs for hazard communication, lockout/tagout, emergency action, fire prevention, and PPE hazard assessment certification. Add respiratory protection, confined space, hearing conservation, bloodborne pathogens, and powered industrial trucks if those hazards or equipment are present.

Does OSHA have a required format for written safety programs?

No. OSHA specifies the content each written program must contain, not the format. A program can be a Word document, a binder, or a digital file, as long as it covers all required elements and employees can access it during their shifts without a supervisor's approval. Electronic programs are acceptable; OSHA has confirmed this in multiple letters of interpretation.

What is the difference between a written program and a written procedure?

A written program is the facility-wide policy describing how your company manages a hazard class: who is responsible, what the rules are, how training is conducted. A written procedure is the step-by-step instructions for a specific task or piece of equipment. Lockout/tagout requires both: a program (policy) and machine-specific procedures for each piece of equipment.

Can I use a template I found online for my OSHA written programs?

Templates are a legitimate starting point for the policy-level sections. The catch is that OSHA requires site-specific content. A HazCom program template becomes compliant when you add your actual chemical inventory and your actual SDS storage location. A LOTO template is not compliant until you add machine-specific energy control procedures based on your actual equipment. Inspectors read for facility-specific detail.

How does a written program affect an OSHA inspection?

Inspectors ask for written programs early in the opening conference. A missing or inadequate program is itself a citable violation, separate from any on-the-floor hazard they find. Having a written program does not automatically protect you if practices on the floor contradict it, but a thorough, current program is evidence of good faith, which affects penalty amounts and litigation outcomes.

Is forklift training required to be documented in writing?

Yes. 29 CFR 1910.178(l) requires that forklift operator training be conducted and that the evaluation of each operator's performance be certified in writing, including the operator's name, the date of training, and the name of the evaluator. A verbal conversation does not satisfy this requirement. See our guide on forklift certification for the full training requirements.

What OSHA written programs are required for chemical manufacturers specifically?

Chemical manufacturers need everything on the general manufacturer list plus additional requirements. If you produce a hazardous chemical at or above the threshold quantities defined in 29 CFR 1910.119 (for example, more than 10,000 pounds of a flammable liquid), you trigger Process Safety Management requirements, which include a written PSM program with 14 separate elements. That is a significant compliance undertaking.

Do written safety programs have to be translated into Spanish or other languages?

OSHA does not have a blanket rule requiring translation, but employees must be able to understand training. If a significant portion of your workforce is more proficient in another language, OSHA inspectors may cite a failure to provide effective training if materials are English-only. Practically, translating your written programs and training materials into the languages your workers read is the defensible approach and the right thing to do.

What is a written confined space program and when is it required?

29 CFR 1910.146 requires a written permit-required confined space program any time your facility has one or more permit-required confined spaces. A permit-required confined space has limited entry and exit, is not designed for continuous occupancy, and has at least one serious hazard (atmospheric, engulfment, entrapment, or other recognized serious hazard). Tanks, pits, boilers, silos, and manholes are common examples in manufacturing.

How long do I have to create written programs after starting a new manufacturing operation?

OSHA standards apply on the first day you have employees exposed to the covered hazard. There is no grace period. Before you put an employee in front of a chemical, a machine with energy sources, or a confined space, the written program must exist, training must be complete, and the required controls must be in place. Starting a business does not create a temporary exemption.

Do I need a written hearing conservation program if my shop is loud?

Yes, if noise exposure reaches a time-weighted average of 85 decibels or higher over an 8-hour shift (the OSHA action level under 29 CFR 1910.95). At that level, you need a written program covering monitoring, audiometric testing, hearing protection, training, and recordkeeping. At a TWA of 90 dBA (the permissible exposure limit), hearing protection is mandatory. Noise monitoring is required to know where you stand.

What happens if an employee is injured and OSHA discovers I had no written program?

A missing written program found during a post-incident inspection is cited as a serious violation and can be elevated to willful if investigators find evidence you knew the requirement existed. Beyond the penalty (up to $16,131 per violation as of 2024), it affects workers' comp claims, civil litigation, and your ability to contest other citations. Courts and insurers both treat a missing program as evidence of inadequate management.

Are there written program requirements specific to 29 CFR 1926 construction standards that affect manufacturers doing their own facility maintenance?

Yes. If your maintenance crew does construction-type work (roofing repairs, excavation, scaffolding), the 29 CFR 1926 construction standards apply to that work. Fall protection plans, excavation safety, and scaffold use have their own written documentation requirements. Many manufacturers who self-perform facility maintenance do not realize they have crossed from General Industry (1910) into Construction (1926) jurisdiction for that activity.

Sources

1. OSHA.gov, State Plans page: 22 states and territories operate OSHA-approved state plans that may exceed federal minimums
2. OSHA, 29 CFR 1910.146, Permit-Required Confined Spaces: Permit-required confined space program must be in writing when permit spaces are present
3. OSHA, Top 10 Most Frequently Cited Standards FY2023: Hazard Communication (1910.1200) was cited more than 2,300 times in FY2023, making it the third most cited standard
4. OSHA, 29 CFR 1910.1200, Hazard Communication Standard: Written HazCom program requirements including chemical inventory, SDS access, labeling, and training; electronic access is permitted per OSHA letters of interpretation
5. OSHA, 29 CFR 1910.147, Control of Hazardous Energy (Lockout/Tagout): Requires written energy control program and machine-specific procedures; annual review and certification required under 1910.147(c)(6)
6. OSHA, 29 CFR 1910.134, Respiratory Protection: Written respiratory protection program required when respirators are mandated or when employees voluntarily use respirators other than filtering facepieces
7. OSHA, 29 CFR 1910.38, Emergency Action Plans: Written emergency action plan required for employers with more than 10 employees; fewer than 10 may communicate the plan orally
8. OSHA, Penalties page: Maximum penalty for a serious violation is $16,131 per violation as of January 2024; small employers (fewer than 26 employees) receive a 60% reduction; very small employers (10 or fewer) receive 70% reduction
9. OSHA, 29 CFR 1910.132, Personal Protective Equipment: Written certification of PPE hazard assessment required under 1910.132(d)
10. OSHA, 29 CFR 1904, Recordkeeping Requirements: OSHA 300 logs must be retained 5 years; fatalities must be reported within 8 hours; in-patient hospitalizations, amputations, and eye loss within 24 hours
11. OSHA, On-Site Consultation Program: Free confidential consultations for small and medium businesses; in FY2022 served more than 27,000 establishments and identified over 139,000 hazards
12. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses, 2022: Manufacturing nonfatal occupational injury and illness rate was 3.3 cases per 100 full-time workers in 2022
13. OSHA, Safety and Health Program Management Guidelines, 54 Fed. Reg. 3904 (1989): OSHA's voluntary Safety and Health Program Management Guidelines provide a framework aligned with written program requirements