How to develop a workplace safety program that actually works

Last updated 2026-07-10

What is a workplace safety program and do you legally need one?

A safety program is a documented system, not a binder on a shelf. It tells workers what the hazards are, how those hazards get controlled, who owns what, and what happens when something goes wrong. Done right, people actually reference it.

Here's the honest answer on the law. OSHA has no single general-industry rule saying "every employer must have a written safety program." What OSHA has is roughly 100 specific standards that each require their own written plan. Hazard communication requires a written program under 29 CFR 1910.1200(e). Lockout/tagout requires one under 29 CFR 1910.147(c)(1). Respiratory protection requires one under 29 CFR 1910.134(c). If any of those hazards exist in your workplace, you already have a legal duty to put something in writing. ^[1]

Some states go further. California's Injury and Illness Prevention Program (IIPP) law requires nearly every employer in the state to have a written safety program. Washington, Oregon, Hawaii, and a handful of other state-plan states have similar mandates. ^[2]

Then there's OSHA's General Duty Clause, Section 5(a)(1) of the OSH Act, which requires employers to keep workplaces "free from recognized hazards that are causing or are likely to cause death or serious physical harm." OSHA has cited employers under this clause for lacking a safety management system even when no specific standard applied. ^[12]

So the practical answer is simple. Almost every business with employees doing physical work, handling chemicals, running machinery, or working at height needs some written safety documentation. The real question isn't "do I need a program." It's "which parts am I already required to have, and what should I build around them."

What are the core elements every safety program should include?

OSHA published its Recommended Practices for Safety and Health Programs in 2016, and it's the closest thing to a universal blueprint the agency has produced. The document names seven core elements. ^[3]

Management leadership. Someone at the top has to actually care. OSHA's guidance says management should "establish, implement, and maintain the overall program." In plain terms: sign the policy, fund it, and be visible about it.

Worker participation. Your workers know the hazards better than you do. Programs that shut employees out of hazard identification fail faster and cost more to fix. Participation means workers help write procedures, report hazards without retaliation, and sit on any safety committee you form.

Hazard identification and assessment. This is the engine. You need a systematic way to find hazards before they hurt someone. Job hazard analysis (JHA) is the common method. OSHA gives away a JHA worksheet in publication 3071, and most insurance carriers will help you build one for your highest-risk jobs. ^[4]

Hazard prevention and control. Find a hazard, control it. The hierarchy of controls runs elimination, then substitution, then engineering controls, then administrative controls, then PPE. PPE sits at the bottom because it's the least reliable, not because it's the most convenient. Most small businesses lean too hard on PPE and skip the engineering fixes.

Education and training. Workers need to know the hazards, how the controls work, and what to do in an emergency before they start the job. Requirements vary by standard. Hazard communication under 29 CFR 1910.1200 requires documented training on specific topics. Others are less prescriptive but still demand competency. Our guide to workplace safety training breaks it down by hazard type.

Program evaluation and improvement. A program that never changes is failing silently. OSHA recommends an annual review at minimum, and an immediate one after any serious incident.

Communication and coordination on multiemployer worksites. If contractors work on your site, or your crew works on someone else's, you need a system for sharing hazard information. Small businesses miss this constantly, and it's an easy citation.

Not every element carries equal weight. A ten-person landscaping crew needs a different emphasis than a fifty-person machine shop. But all seven categories deserve at least a paragraph in your written program describing how you handle them.

How bad is the injury problem that safety programs are supposed to solve?

The numbers are sobering. The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, at a rate of 2.4 cases per 100 full-time workers. ^[5] Fatal work injuries hit 5,283 in 2022, the most recent complete year of BLS Census of Fatal Occupational Injuries data at the time of writing.

Small businesses carry more than their share. Establishments with fewer than 50 employees run higher injury rates than larger employers in the same industry, partly because they're less likely to have a formal program or dedicated safety staff.

The cost case is real. Liberty Mutual's 2023 Workplace Safety Index found that the most disabling nonfatal workplace injuries cost U.S. employers $58.6 billion a year in direct workers' compensation costs. ^[6] A single disabling injury commonly runs an employer $38,000 to $150,000 once you count medical costs, lost productivity, replacement labor, and administrative time. That's all before OSHA fines, which as of 2025 reach $16,550 per serious violation and $165,514 per willful or repeated violation. ^[7]

One task, one bad lift, one uncorrected wet floor. That's the arithmetic a written program is meant to change.

What written programs does OSHA actually require for my business?

It depends entirely on what hazards live in your workplace. This is the single biggest point of confusion for small business owners. People ask "do I need a safety program" when the useful question is "which specific written plans am I required to have, given what we do."

Here's a plain-English map of the most commonly required written programs and the standards behind them:

Hazard or Activity	Required Written Program	CFR Reference
Chemicals (any hazardous substance)	Hazard Communication Program	29 CFR 1910.1200(e)
Lockout/tagout of machinery	Energy Control Program	29 CFR 1910.147(c)(1)
Respiratory protection	Respiratory Protection Program	29 CFR 1910.134(c)
Bloodborne pathogens (healthcare, first responders)	Exposure Control Plan	29 CFR 1910.1030(c)
Emergency exit and response	Emergency Action Plan	29 CFR 1910.38
Confined spaces	Confined Space Entry Program	29 CFR 1910.146(c)
Fall protection (construction)	Fall Protection Plan	29 CFR 1926.502(k)
Hearing hazards	Hearing Conservation Program	29 CFR 1910.95(c)
Forklifts and powered industrial trucks	Operator Training Program	29 CFR 1910.178(l)
Fire prevention	Fire Prevention Plan	29 CFR 1910.39

That's not the full list. OSHA keeps a searchable standards database at osha.gov if you need to check your specific industry. The construction standards in 29 CFR Part 1926 carry their own written-program requirements that often differ from the general industry versions.

For hazard communication, see our full breakdown of hazardous communication requirements. That's the one standard almost every business with any chemicals on site triggers.

In a state-plan state, check your state agency too. California's IIPP, Washington's Accident Prevention Program, and Oregon's safety plan rules add obligations federal OSHA doesn't impose. ^[2]

How do you actually write a safety program from scratch?

Start with a hazard inventory, not a template. Every template-first program I've seen looks complete and describes nobody's actual workplace. Templates are a skeleton. Your job is the flesh.

Step 1: Walk the workplace with fresh eyes. Bring a legal pad. Cover every area where work happens, including storage, parking, and break rooms. Write down every hazard you see: wet floors, unlabeled containers, blocked exits, missing machine guards, extension cords in walkways. This isn't a formal audit. It's a first pass. ^[4]

Step 2: Match your hazards to OSHA standards. Take the list from your walkthrough and run it against the table above. Chemicals mean a HazCom program. Machinery with moving parts probably means lockout/tagout. Be honest. Don't skip a standard because the writing sounds like work.

Step 3: Write the required programs for each applicable standard. Each one has a minimum content list inside the standard itself. The lockout/tagout standard at 29 CFR 1910.147(c)(1) spells out exactly what your energy control program must cover. So does the respiratory protection standard. Start there. Don't guess.

Step 4: Write a general company safety policy. This is the one-to-two page document that states your commitment, names who owns safety (usually the owner or ops manager in a small business), and lays out the basic rules. It doesn't need to be long. It does need a signature from whoever runs the company.

Step 5: Write your emergency action plan. Even a five-person office needs one. Cover evacuation routes, assembly areas, who calls 911, who does the headcount, and what to do for the likely emergencies (fire, severe weather, a medical event). 29 CFR 1910.38 lists the minimum required content. ^[1]

Step 6: Document your training plan. List which employees need which training, by what date, and how often it repeats. Some training (hazard communication, bloodborne pathogens) needs an annual refresher. Others require training before the employee touches the job the first time.

Step 7: Set up incident reporting. Employees need to know how to report injuries, near misses, and hazards without fearing retaliation. Write a short, plain procedure. Post where the OSHA 300 log lives. Make sure someone knows how to fill out Forms 300, 300A, and 301, and when to call OSHA for a severe injury. ^[8]

That whole process takes one to two full workdays if you already know your hazards. If you want to cut the time hard, SafetyFolio's safety program generator walks you through the questions and produces a customized written program in about 15 minutes, pulling in the specific standards for your industry and hazard mix. It won't replace a qualified safety professional for complex or high-hazard work, but for most small businesses it gets you from zero to compliant faster than anything else I know of.

Step 8: Get a lawyer or HR pro to review anything unusual. Chemical manufacturers, demolition contractors, and healthcare facilities carry layers of obligation past the basics. Standard small businesses can self-build this. High-hazard industries should get expert eyes on it.

How do you get employees to actually follow the safety program?

This is where most programs die. A beautiful written program sitting in a drawer protects nobody.

The most effective move is also the dullest: make safety part of the daily rhythm, not a separate event. That means a quick hazard check at the start of each shift, supervisors who correct unsafe behavior on the spot instead of at a quarterly meeting, and a reporting system where paperwork isn't the barrier to flagging a hazard.

Training has to be specific and hands-on. The classic failure is an annual slide deck nobody remembers. Train on the actual procedure for the actual job, have workers demonstrate competency, and keep it short enough to be real. A 15-minute hands-on lockout/tagout demo beats a two-hour video every time.

The principles of effective safety incentive programs matter here. OSHA has been clear that incentives tied to injury-rate outcomes, where workers win prizes for not reporting injuries, are a problem because they suppress reporting. Incentives that reward safe behaviors, hazard reporting, and training completion are fine. The line is reporting an injury versus performing a safe behavior.

Accountability runs both ways. Hold supervisors accountable for safety in their areas the same way you hold them accountable for output. If safety shows up in a performance review as one bullet point, nobody takes it seriously.

Three things move the needle in small shops, based on the research and case data: visible owner commitment, a no-blame reporting system, and consistent correction of violations with no exceptions for senior or high-performing workers. None of those cost money. All of them take discipline.

What records do you need to keep and for how long?

Recordkeeping is where small businesses stumble during inspections. Here's what you actually need.

Injury and illness records. Employers with 10 or more employees in most industries must keep OSHA Form 300 (the injury log), Form 300A (the annual summary), and Form 301 (the incident report) for five years. Form 300A must be posted in a common area every year from February 1 to April 30. ^[8] Certain low-hazard industries (retail, finance) are partially exempt from the 300 log, but they still have to produce records if OSHA asks.

Electronic reporting. Under the 2023 final rule, establishments with 100 or more employees in designated high-hazard industries must electronically submit Form 300 and Form 301 data every year through OSHA's Injury Tracking Application. Establishments with 20 to 249 employees in certain industries must submit Form 300A data. ^[8]

Training records. OSHA sets no universal retention period, but individual standards sometimes do. The bloodborne pathogens standard, 29 CFR 1910.1030, requires training records for three years. Under respiratory protection, medical evaluation records stay for the duration of employment. A safe default is three years for all completed training.

Hazard communication records. Safety data sheets for every hazardous chemical must stay accessible to workers throughout each shift, and the standard requires exposure and SDS-linked records to be kept for 30 years because some health effects surface late. ^[9]

Program documents. Keep your written programs current and accessible. When you revise one, keep the prior version with the dates it was in effect. That protects you if an incident ever raises a question about which procedures were in place at a given time.

Medical records. If your program triggers medical surveillance, as hearing conservation under 29 CFR 1910.95 does, those records must be kept for the duration of employment plus 30 years.

How much does it cost to build and run a safety program?

It varies enormously with the size and complexity of your operation. Here's an honest breakdown.

For a basic written program at a low-to-moderate-hazard small business (say, an office with a small warehouse, under 25 employees), the build cost can be almost nothing. Do it yourself with free OSHA resources and your state consultation program's templates, and your out-of-pocket cost lands near zero. You'll spend real time instead. OSHA's free on-site consultation program, funded by OSHA but run separately from enforcement, will visit your workplace, help identify required programs, and help you build them, with no enforcement visit triggered. ^[10]

Hire a consultant to build a custom program and expect $1,500 to $10,000 for the initial development, depending on their rate and your hazards. The range is wide because independent safety consultants charge roughly $75 to $250 per hour and program complexity swings hard.

Ongoing costs include training time (the biggest one for most small businesses, in lost productivity), PPE, engineering controls, and periodic audits. If you designate an internal safety coordinator, maintenance for a small business with moderate hazards typically runs 2 to 5 hours a month.

The return holds up. OSHA's analysis says employers typically see $4 to $6 back for every dollar invested in safety and health programs, from fewer injuries, lower workers' comp premiums, less turnover, and avoided penalties. ^[3] That number comes with caveats (it's hard to measure and studies vary), but the direction is solid.

What happens during an OSHA inspection and how does your safety program affect it?

OSHA inspections start three ways: a complaint, a reported severe injury or fatality, or a programmed inspection in a high-hazard industry. Programmed inspections target establishments with high injury rates in their NAICS code. If your recordable injury rate sits above your industry average, you're statistically more likely to get a visit.

When an inspector arrives, they'll usually ask for your written safety programs first. Specifically the ones required for your industry and the hazards they observe. They'll also want training records, the OSHA 300 log, and any inspection or audit records you've kept.

A well-documented program doesn't make you immune to citations, but it does real work. It shows good faith, which matters for penalty reduction. It proves training happened, which can be a defense when training is the required control. And it demonstrates a systematic approach to hazard identification, which is relevant to General Duty Clause cases. ^[12]

OSHA can reduce penalties for small employers (fewer than 250 employees, with larger reductions under 10), for good-faith effort, and for quick correction. The small-employer reduction alone can reach 60 to 80 percent. ^[7] Your documented programs and training records are the evidence you use to claim those reductions.

One thing inspectors zero in on: whether your program is current. A lockout/tagout program listing machines you sold, or missing machines you added two years ago, is worse than useless. It proves you wrote it once and forgot it. Update your programs when your operations change.

How do you maintain and improve a safety program over time?

Most programs get built and then gather dust. Maintenance is the harder discipline.

Set a calendar reminder for an annual review of every written program you keep. It doesn't have to eat a week. For most programs, a two-hour walk-through of the document against any changes in your operations, equipment, chemicals, or workforce is enough. Ask three questions. Is what's written still accurate? Did any incident or near miss reveal a gap? Did any standard that applies to us change?

After incidents, run a root cause analysis, not a blame assignment. Root cause asks what in the system failed, not who slipped up. A worker who bypassed a machine guard did something wrong, sure, but the root cause might be that the guard made the job take 40 percent longer and nobody ever fixed that. Fix the system.

Near misses are gold. A near miss tells you a hazard exists and nothing bad happened yet. Workers who report them without fear are handing you free information. Investigate every near-miss report, even briefly.

Bring workers into the annual review. Thirty minutes with your highest-risk crew, asking "what's the most dangerous thing you do regularly, and do we have a procedure for it," surfaces more real hazards than any desk review.

For a wider view of what a program should accomplish, our article on what a safety and health program should be covers the practical expectations in more depth.

Use your workers' comp loss runs. Your carrier produces them yearly. They break down injury costs by type, body part, and cause over three to five years, and the patterns tell you where your program isn't working. If back strains from one task drive 40 percent of your injury costs over five years, that task needs an engineering control or a procedure change, no matter what your written program says.

Are there free resources to help build a safety program?

Yes, and they're genuinely good. OSHA's free consultation program is the most underused resource in small business safety. Funded by OSHA but walled off from enforcement, it sends trained professionals to your site to identify hazards and required programs, at no cost and with no citation risk from the visit itself. Find your state's consultation office through osha.gov. ^[10]

OSHA's own site posts model written programs for many common standards. The HazCom model, the lockout/tagout model, and others download for free. They aren't plug-and-play (you still customize for your workplace), but they're a solid start, written by the agency that will inspect you.

State-plan states run their own libraries. Cal/OSHA, Washington L&I, and Oregon OSHA all keep free template programs, e-tools, and consultation services. ^[2]

NIOSH publishes sector-specific guidance on hazard control. Their materials on ergonomics, chemical exposures, and noise are free and evidence-based. ^[11]

For businesses that want a faster path without the research overhead, SafetyFolio's safety program generator is built for exactly this. Answer questions about your industry, size, and hazards, and it produces a customized written program you can review, edit, and use. It's not a substitute for understanding what your program needs, but it kills the blank-page problem.

Call your industry association too. NFIB, the National Association of Manufacturers, food industry groups, and construction trade bodies often keep member safety resources, template programs, and referrals to consultants who know your sector.

Frequently asked questions

Is a written safety program required by OSHA for all employers?

OSHA has no single rule requiring every employer to keep one written safety program. It has roughly 100 individual standards that each require their own written plan when the matching hazard exists. If your workplace has chemicals, machinery, confined spaces, fall hazards, or respiratory hazards, you almost certainly trigger at least one written-program requirement. State-plan states like California, Washington, and Oregon impose broader written-program mandates on all employers.

How long does it take to write a safety program?

A basic program for a small business with moderate hazards (five to ten required written plans) takes one to two full workdays if you know your workplace and use the OSHA model programs as a starting point. More complex or high-hazard operations take longer. An online generator or a consultant can compress the writing to a few hours, but you still need time to review and customize the output for your actual situation.

What is the difference between a safety program and a safety plan?

The terms get used interchangeably, but in OSHA usage a safety plan usually means a specific document required by a specific standard, like a fall protection plan under 29 CFR 1926.502(k). A safety program means the broader management system that ties multiple plans together with policy, training, incident reporting, and review. Your overall safety program contains several individual safety plans.

What are the most common OSHA citations related to missing safety programs?

The most frequently cited OSHA standards consistently include hazard communication (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), respiratory protection (29 CFR 1910.134), powered industrial trucks (29 CFR 1910.178), and fall protection in construction (29 CFR 1926.501). Most citations involve a missing written program, weak training documentation, or a program that exists but isn't followed. All are preventable with a basic written program and documented training.

Do I need a safety program if I have fewer than 10 employees?

Yes, though some paperwork is lighter. OSHA's recordkeeping rules partially exempt employers with 10 or fewer employees from the OSHA 300 log. But the duty to have written programs for applicable hazards applies regardless of size. A five-person shop that uses hazardous chemicals still needs a written HazCom program. A three-person electrical crew still needs lockout/tagout procedures. Size affects some paperwork; it never waives hazard-control obligations.

How often does a safety program need to be updated?

OSHA recommends an annual review at minimum, plus an immediate review after any serious incident, near miss, or major operational change. Some written programs, like lockout/tagout procedures, require review and revalidation whenever equipment or processes change. Adding a new chemical, hiring workers for a new job type, or moving facilities are all triggers to update the relevant sections rather than wait for the annual cycle.

Can I use a template for my safety program or does it have to be custom?

Templates are fine as a starting point but never the finish line. OSHA model programs meet each standard's minimum required content, but they don't include your equipment, your procedures, or your specific hazardous materials. An inspector reviewing a template that still reads 'Company Name Here' or lists generic machines you don't own will note that the program was never implemented. Customize every template to your actual workplace.

What is OSHA's Recommended Practices for Safety and Health Programs?

It's a non-mandatory guidance document OSHA published in 2016 that lays out a seven-element framework for managing a safety and health program: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and coordination on multiemployer worksites. It isn't a regulation, so OSHA can't cite you for violating it, but it's the framework most inspectors and consultants use to judge whether a program is substantive.

What records do I need to keep as part of my safety program?

At minimum: the OSHA 300/300A/301 injury logs for five years (if you have 10 or more employees in a covered industry), training records for each applicable standard (retention varies, three years is a safe default), safety data sheets for hazardous chemicals for 30 years after last use, medical surveillance records per the relevant standard, and dated copies of all written programs including prior versions. Organize records by standard; it makes inspections much simpler.

Does a small business need a dedicated safety officer to run a safety program?

No, but someone has to own it. In most small businesses that's the owner, a senior operations manager, or a designated employee who takes on safety as part of a broader role. A full-time safety professional is generally only necessary above 50 to 100 employees in higher-hazard industries. Below that, a part-time safety coordinator with good written resources, OSHA's free consultation program, and clear management support can run an effective program.

How does a safety program affect workers' compensation insurance costs?

A documented program influences your experience modification rate (e-mod) over time by cutting injuries and claims. An e-mod below 1.0 means lower premiums. Many carriers also offer upfront premium credits for employers with formal, auditable safety programs. The effect isn't instant, since your e-mod reflects three prior years of claims. But a well-run program that reduces injuries over two to three years shows up as lower premiums, often substantially.

What is the OSHA free consultation program and how do I use it?

OSHA's On-Site Consultation Program sends trained safety professionals to your workplace at no cost to identify hazards, explain which written programs you must have, and help you set priorities. It's fully separate from enforcement: consultants issue no citations or fines, and the visit can't become the basis for an enforcement inspection. Priority goes to small and medium businesses in high-hazard industries. Find your state's consultation office through osha.gov.

What's the difference between a federal OSHA safety program requirement and a state-plan state requirement?

Twenty-two states and two territories run OSHA-approved state plans, which must be at least as protective as federal OSHA. Several, notably California, Washington, and Oregon, are stricter. California's IIPP law requires nearly all employers to keep a written Injury and Illness Prevention Program, which federal OSHA doesn't mandate. If you operate in a state-plan state, check your state agency directly; it may require written programs for hazards where federal OSHA only offers guidance.

How do I know if my safety program is actually working?

Lagging indicators (injury rates, recordables, workers' comp costs) tell you the program already failed. Leading indicators tell you whether it's working: hazards reported and corrected, percentage of required training done on time, near-miss reports per month, and the share of audited procedures workers can demonstrate correctly. Track both. Good leading indicators with a bad injury year might be bad luck; bad leading indicators with no injuries this quarter is one incident away from a bad year.

Sources

1. OSHA, 29 CFR Part 1910 General Industry Standards index: Specific OSHA standards including 1910.1200, 1910.147, 1910.134, and 1910.38 each require written programs when applicable hazards exist
2. OSHA, State Plans: 22 states and 2 territories operate OSHA-approved state plans; California, Washington, and Oregon require broader written safety programs than federal OSHA
3. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA identifies seven core elements of an effective safety and health program, and states employers typically see $4-$6 return per dollar invested in safety
4. OSHA, Job Hazard Analysis (Publication 3071): OSHA provides a free job hazard analysis worksheet and methodology for systematic hazard identification
5. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: Private industry recorded 2.6 million nonfatal workplace injuries and illnesses in 2023, at an incidence rate of 2.4 per 100 full-time workers
6. Liberty Mutual, 2023 Workplace Safety Index: The most disabling nonfatal workplace injuries cost U.S. employers $58.6 billion annually in direct workers' compensation costs
7. OSHA, Penalties page: OSHA civil penalties as of 2025 reach up to $16,550 per serious violation and $165,514 per willful or repeated violation; small employer penalty reductions of 60-80% apply
8. OSHA, Injury and Illness Recordkeeping and Reporting: OSHA 300/300A/301 records must be retained five years; Form 300A must be posted February 1 to April 30; high-hazard establishments with 100+ employees must submit 300 and 301 data electronically each year under the 2023 rule
9. OSHA, Hazard Communication: Safety data sheets for hazardous chemicals must be accessible to workers at all times, and exposure-related records must be retained for 30 years under 1910.1200
10. OSHA, On-Site Consultation Program: OSHA's free consultation program provides on-site hazard identification and program assistance to small businesses, separate from enforcement with no citation risk
11. NIOSH, Workplace Safety and Health Topics: NIOSH publishes sector-specific guidance on hazard control including ergonomics, chemical exposures, and noise at no cost
12. OSHA, OSH Act Section 5 Duties: The General Duty Clause requires employers to keep workplaces free from recognized hazards likely to cause death or serious physical harm; OSHA has cited employers under this clause for lacking safety management systems