Safety program examples: what real written programs look like

Last updated 2026-07-10

What is a written safety program, exactly?

A written safety program is a document, or a set of documents, that describes how your workplace finds a hazard, controls it, trains employees on it, and keeps records to prove you did. That's really it. OSHA has no universal template. What OSHA has is a stack of standards, each one saying "the employer shall establish a written program" for one specific hazard.

Most small business owners trip on the same idea: that a "safety program" means one giant binder. It doesn't. You might have a Hazard Communication Program (required under 29 CFR 1910.1200), a separate Lockout/Tagout Program (29 CFR 1910.147), and a Respiratory Protection Program (29 CFR 1910.134). Those three together make up your "safety program." Each one stands on its own and gets inspected on its own. ^[1]

OSHA's Recommended Practices for Safety and Health Programs, published in 2016, gives a wider frame: management leadership, worker participation, hazard identification, hazard control, training, program evaluation, and communication. That frame isn't mandatory the way an individual standard is. But compliance officers use it to judge whether you run a real system or just print paper. ^[2]

So you need both. The mandatory written programs, which are specific and driven by the CFR. And a general approach that shows you manage safety every day. The examples below cover both.

Which written safety programs does OSHA actually require?

Here are the OSHA general industry standards (29 CFR 1910) that flat-out require a written program. Construction standards (29 CFR 1926) carry their own parallel list. ^[1]

Standard	CFR Citation	Written Program Required For
Hazard Communication	29 CFR 1910.1200	HazCom / GHS program, SDS access, labeling
Lockout/Tagout	29 CFR 1910.147	Energy control procedures for each machine
Respiratory Protection	29 CFR 1910.134	Medical evaluation, fit testing, cleaning, storage
Personal Protective Equipment	29 CFR 1910.132	Hazard assessment, PPE selection documentation
Bloodborne Pathogens	29 CFR 1910.1030	Exposure control plan, updated annually
Emergency Action Plan	29 CFR 1910.38	Evacuation routes, employee roles, alarm systems
Fire Prevention Plan	29 CFR 1910.39	Ignition source control, housekeeping
Permit-Required Confined Spaces	29 CFR 1910.146	Entry program, permit system, rescue procedures
Hearing Conservation	29 CFR 1910.95	Monitoring, audiograms, HPD selection
Process Safety Management	29 CFR 1910.119	Facilities handling highly hazardous chemicals above thresholds
Electrical Safety (NFPA 70E aligned)	29 CFR 1910.333	Energized work, arc flash, approach boundaries
Asbestos	29 CFR 1910.1001	Class III/IV work, O&M programs
Fall Protection (construction)	29 CFR 1926.502	Site-specific fall protection plan for certain work

Trigger any of these standards and you need the matching written program. Period. Inspectors ask for the document first, then ask whether you actually follow it. ^[1]

For a broader frame that isn't tied to one standard, read OSHA's Safety and Health Program Management Guidelines (52 Fed. Reg. 41904, 1989) and the newer Recommended Practices. Neither generates a citation on its own. Both shape how hard OSHA leans on a general duty clause case against you. ^[2]

See a safety and health program should be for a deeper breakdown of the program elements OSHA expects.

What does a Hazard Communication Program look like in practice?

Hazard Communication (HazCom) is the single most-cited OSHA standard, year after year. In fiscal year 2024 it ranked among the top three violations across general industry. ^[3] That tells you two things. It's everywhere, and most small businesses get it wrong.

A compliant HazCom program under 29 CFR 1910.1200 has six core pieces:

1. A written HazCom policy that names a responsible person, usually the owner or a designated employee. 2. A chemical inventory list tied to your Safety Data Sheets. 3. SDSs for every hazardous chemical on site, accessible to employees at all times during their shift. 4. A labeling procedure covering incoming containers and any secondary containers you fill. 5. A training record showing employees learned to read an SDS, understand GHS pictograms, and know where the SDSs live. 6. A process for non-routine tasks (cleaning a tank, say) where chemical exposure runs higher than usual.

Here's what the standard says. 29 CFR 1910.1200(e)(1) states, "Employers shall develop, implement, and maintain at each workplace, a written hazard communication program." That sentence is the legal anchor. The rest of section (e) fills in what the program has to address. ^[1]

A real one-page HazCom policy for a 10-person auto body shop can be a typed document that says who manages the SDSs (the shop foreman), where they live (binder on the north wall), what the labeling rule is (every container gets a label before it goes to a secondary container), and when training happens (at hire and when a new chemical shows up). Lean, but legal.

See hazardous communication for a full walkthrough of SDS requirements and GHS label elements.

What does a Lockout/Tagout program example look like?

Lockout/Tagout (LOTO) sits in OSHA's top-ten citation list nearly every year, and it confuses people because it has two layers. There's the written program itself (the policy), and then there are machine-specific energy control procedures for each piece of equipment.

Under 29 CFR 1910.147(c)(4), the written program has to cover scope and purpose, rules on locks versus tags, how employees get trained, and how procedures get enforced. That's the policy layer. Then under 147(c)(4)(ii), every machine with its own energy source configuration needs its own documented procedure, unless it meets a narrow exception for single-energy-source equipment. ^[1]

A real example for a small metal fabrication shop:

The written LOTO program runs one to two pages. It says every authorized employee uses a personal lock, no employee removes another person's lock, and periodic inspections happen annually. Attached to each press, grinder, and conveyor is a one-page machine-specific procedure listing the equipment name, the energy sources (480V electrical, 90 PSI pneumatic), where each disconnect or valve sits, the shutdown sequence, and how to verify zero energy state.

The machine procedure is what actually protects the employee. The program is what satisfies OSHA's paperwork. You need both. Plenty of small shops write the policy and skip the machine procedures, and that gap is exactly where citations land.

Annual periodic inspections of each energy control procedure are required under 29 CFR 1910.147(c)(6). An authorized employee other than the one using the procedure has to do the inspection, and it has to be documented with the date, the equipment, the employees involved, and the inspector's name. ^[1]

What does a small business safety program look like versus a large company's?

Small businesses are not exempt from OSHA's written program requirements. Most of these standards carry no size cutoff. The one clear exception: Emergency Action Plans. If you have 10 or fewer employees, 29 CFR 1910.38(b) lets you communicate the plan out loud instead of writing it down. ^[1]

The real difference between a 12-person landscaping company's program and a 2,000-person manufacturer's is complexity, not the legal line. Both need a HazCom program if they use hazardous chemicals. Both need LOTO procedures if they service equipment. The small business owner just doesn't have a safety director to write it.

A reasonable minimum package for a small business:

• HazCom program and chemical inventory (29 CFR 1910.1200)
• Emergency Action Plan (29 CFR 1910.38)
• A PPE hazard assessment and certification (29 CFR 1910.132)
• Any standard-specific program your actual work triggers (LOTO, confined space, respiratory protection, bloodborne pathogens)

BLS data from 2023 shows businesses with fewer than 50 employees accounted for roughly 38% of workplace fatalities in private industry, a disproportionately high share. ^[4] Small workplaces have real hazards. The program doesn't have to be long. It has to be honest about what actually happens there.

If the blank page is your problem, SafetyFolio's safety program generator builds a compliant written program for your specific industry and hazards in about 15 minutes, no consultant required. It pulls the right CFR citations and structures each required element automatically.

What are real safety program examples by industry?

The hazards, and so the required programs, swing hard by industry. Here's what a written safety program package looks like for five common small business industries.

Construction (general contractor, under 25 employees) Primary standards: 29 CFR 1926 Subpart C (general safety and health), Subpart E (PPE), Subpart P (excavations), Subpart R (steel erection if applicable), and 1926.502 (fall protection). The minimum package includes a fall protection plan, a HazCom program, LOTO procedures for equipment, a Silica Exposure Control Plan (29 CFR 1926.1153, triggered by cutting, grinding, or drilling silica-containing materials), and a Heat Illness Prevention Plan in state-plan states that require one. ^[5]

Restaurant and food service Primary hazards: slips and falls, cuts, burns, chemical cleaning agents, lifting. Required written programs: HazCom (for cleaning chemicals), an Emergency Action Plan, a PPE assessment. Most kitchens skip LOTO unless the restaurant services its own equipment. A well-run food service program also covers knife handling, wet floor procedures, and a burn protocol. None of those three are standalone written-program requirements, but all of them help you against a general duty clause case. See food safety certification program for how food safety intersects with workplace safety.

Auto body and collision repair High chemical exposure: isocyanates in 2K paints, solvents, body fillers. Required: a HazCom program (with a long chemical inventory), a Respiratory Protection Program (mandatory when spraying isocyanates), a PPE hazard assessment, and an Emergency Action Plan. Shops that do frame pulling or alignment with hydraulic equipment need LOTO procedures for those machines. OSHA runs a National Emphasis Program on isocyanates that makes inspections more likely in this sector. ^[6]

Healthcare and home health Required: a Bloodborne Pathogens Exposure Control Plan (29 CFR 1910.1030), reviewed annually and kept accessible to employees. Staff who handle certain hazardous drugs also need a HazCom program. Written ergonomics programs for patient handling aren't required federally (there's no federal ergonomics standard), but several state OSHA plans, California included, have healthcare-specific ergonomics rules. ^[7]

Warehousing and light manufacturing Usually the broadest package: HazCom, LOTO (for all powered equipment), and Powered Industrial Truck documentation (29 CFR 1910.178 requires operator training records and pre-shift inspection logs, which are documented procedures rather than a separate written program), plus an Emergency Action Plan and a PPE hazard assessment. Add confined space and hearing conservation programs if you have tanks, vaults, or high noise exposure.

What should every written safety program include as baseline elements?

Whatever standard drives your written program, OSHA compliance officers look for the same core elements every time. Miss one and even a technically complete program reads hollow.

1. Purpose and scope. One paragraph that says what hazard the program covers, who it applies to (all employees, or only authorized employees), and when it applies.

2. Responsibilities. Name names, or at least job titles. "The owner" or "the shift supervisor" is responsible for X. If nobody owns it, nothing gets done, and OSHA knows it.

3. Procedures. Step-by-step instructions for the control activity. For LOTO, that's the shutdown sequence. For HazCom, the labeling procedure. For Respiratory Protection, the fit-test and maintenance schedule.

4. Training requirements. Say who gets trained, on what, how often, and who delivers it. Most standards specify initial training before the work assignment and retraining after a change or an incident.

5. Recordkeeping. What records you keep, where they live, how long you keep them. OSHA sets retention periods per standard, from 3 years for most training records to 30 years for certain exposure records under 29 CFR 1910.1020. ^[1]

6. Review and update schedule. A program that says "reviewed annually" beats one with no review clause. After an incident or a rule change, you update it.

OSHA's 2016 Recommended Practices describe the whole idea in one line. The framework, OSHA writes, "centers on finding and fixing hazards before they cause injury or illness." ^[2] That's the simplest description of what a safety program is for. The paperwork follows the purpose. The paperwork isn't the purpose.

For training specifically, see workplace safety training for frequency, documentation, and delivery requirements.

What is the difference between a safety program and a safety plan?

This trips up a lot of people. In OSHA language, "program" and "plan" get used interchangeably across different standards, which doesn't help anyone. There's still a practical split worth holding onto.

A safety program is ongoing. It describes standing policies, who owns them, and how they get maintained year over year. Your HazCom program lives as long as you have hazardous chemicals. Your Bloodborne Pathogens Exposure Control Plan lives as long as employees could touch blood or OPIM.

A safety plan is often project-specific or site-specific. A construction fall protection plan under 29 CFR 1926.502(k) gets written for a job where conventional fall protection (guardrails, safety nets, personal fall arrest) isn't feasible, and it expires when the job ends. A site-specific safety plan for a refinery turnaround has a start date and an end date. ^[1]

At a small business, don't get tangled in the words. What matters: you have the document OSHA requires, it covers what the standard requires, and employees actually know and follow it. A plan labeled a program is still enforceable. A program that lives only on paper isn't.

How does OSHA's VPP or a safety incentive program relate to written safety programs?

OSHA's Voluntary Protection Programs (VPP) recognize worksites with injury and illness rates below their industry average and a strong safety management system. VPP entry demands documentation that goes well past the minimum written programs. ^[8] Worth knowing about. Not a realistic first step for most small businesses. Get your required written programs right first.

Safety incentive programs are a different animal. They're employer-designed programs that reward employees for safety performance, and they're contested. OSHA's 2012 anti-retaliation memorandum and its 2016 electronic recordkeeping rule (29 CFR 1904.35) both flagged rate-based incentive programs, the kind that reward low injury numbers, because those can quietly discourage reporting. ^[9] A program that rewards hazard reporting, near-miss identification, or safety participation is far easier to defend.

See principles of effective safety incentive programs for what OSHA finds acceptable and what gets you into trouble.

An incentive program is a management tool. It is not a substitute for written compliance programs. You can run both, but the written programs come first.

How do you write a safety program without hiring a consultant?

You don't need a consultant for the required written programs. OSHA publishes free model programs, compliance assistance pages, and eTools that walk you through the requirements. What you need is time and honesty about your actual hazards.

Start with your hazard inventory. Walk the workplace and list every task where someone could get hurt or exposed. Don't skip the obvious stuff. Slips, cuts, and burns hurt more people than exotic chemical exposures in most small businesses. ^[4]

Match your hazards to the standards. For each hazard category, find the CFR standard. OSHA.gov has a standard-number search and industry-specific compliance pages. The standards read fine if you go section by section. ^[1]

Use OSHA's free sample programs. OSHA's eTools (osha.gov/etools) and compliance assistance pages include a model Bloodborne Pathogens exposure control plan, model LOTO material, and HazCom guidance. Not plug-and-play templates. Accurate outlines. ^[10]

Fill in the specifics for your workplace. A model program says "[name of chemical]" and you swap in your actual chemicals. It says "[location of SDS binder]" and you write "north wall, by the fire extinguisher." That specificity is what turns a generic document into a real program.

For owners who want a faster path, SafetyFolio's generator asks about your industry, hazards, employee count, and job tasks, then produces a properly structured written program with the right CFR citations and required elements already built in. You review it, add your workplace-specific details, and it's done.

Review the program on a schedule. An annual review catches regulatory changes (OSHA updates standards) and operational changes (new chemicals, new equipment, new tasks). A consultant review every few years is worth considering if your operation grows or your hazard profile shifts. The day-to-day upkeep of a well-structured program is owner-level work.

What happens if OSHA inspects and you don't have required written programs?

OSHA cites a missing or inadequate written program as either "other than serious" or "serious," depending on the standard. A missing HazCom program usually lands as serious when employees are actually exposed to hazardous chemicals, because the missing program directly enables harm. ^[11]

Penalty amounts under the current structure, as of the 2024 inflation adjustments, run up to $16,131 per serious violation and up to $161,323 per willful or repeated violation. ^[11] Those are maximums. OSHA applies reductions for small employer size (typically a 60 to 80 percent cut for employers with 25 or fewer employees), good faith, and history. A small shop that genuinely didn't know it needed a LOTO program usually pays far below the maximum. But "I didn't know" doesn't erase the citation.

The practical part: compliance officers are trained to look at written programs first. If your programs are complete and your employees can describe the procedures out loud, the inspection moves faster and citations get much less likely. The written program is your proof you thought through the hazard before anyone got hurt.

After a serious injury, OSHA checks whether you had the required program. If you didn't, the citation is near certain. If you had it but didn't follow it, you're in a messier spot that can still produce a serious or willful citation under the general duty clause, Section 5(a)(1) of the OSH Act. ^[12]

Are there industry-specific safety program resources beyond OSHA.gov?

Yes, and some beat OSHA's own materials for practical guidance.

National Safety Council (NSC). Publishes the Injury Facts annual report, which gives solid BLS-sourced industry injury data. NSC also offers sample programs and training materials. ^[13]

NIOSH (National Institute for Occupational Safety and Health). Part of CDC. NIOSH publishes science-based recommendations that often land before OSHA standards do, plus industry-specific hazard guides. Its free resources on hearing loss, chemical exposure, and ergonomics are genuinely useful for the substantive parts of your programs. ^[14]

OSHA's free On-Site Consultation Program. One of the most underused resources for small businesses. It's separate from OSHA enforcement. A state-funded consultant visits your workplace, reviews your programs, and flags hazards without triggering citations. Findings stay confidential from enforcement OSHA as long as you fix what they find. Available in all 50 states. ^[10]

State OSHA plans. 29 states and territories run their own OSHA-approved plans. California (Cal/OSHA), Washington (WISHA), Michigan (MIOSHA), and others can set rules that exceed federal OSHA. In a state-plan state, check your state agency's website alongside OSHA.gov. One example: Cal/OSHA requires an Injury and Illness Prevention Program (IIPP) for nearly every California employer, which goes past federal requirements. ^[7]

For businesses that operate vehicles or run transportation programs, see american safety programs and training for fleet and driver safety resources.

Frequently asked questions

What are the most common OSHA written program violations?

Hazard Communication (29 CFR 1910.1200) tops OSHA's annual citation list almost every year, followed by Respiratory Protection (1910.134) and Lockout/Tagout (1910.147). The common problem isn't a missing program. It's a generic program that doesn't match what actually happens in the workplace, or a program employees have never read and can't describe during an inspection.

Does a small business with fewer than 10 employees need a written safety program?

For most OSHA written program requirements, headcount creates no exemption. The one notable exception is the Emergency Action Plan under 29 CFR 1910.38(b): with 10 or fewer employees, you can communicate the plan orally instead of writing it. Every other standard-specific written program applies regardless of size. OSHA does offer penalty reductions for small employers, but that's different from an exemption.

How long does it take to write a basic written safety program?

A single program, like a HazCom program for a small business with a manageable chemical inventory, takes 2 to 4 hours from scratch using OSHA's guidance. A full package for a construction or manufacturing operation (HazCom, LOTO, respiratory protection, confined space, emergency action plan) can run 20 to 40 hours done carefully. A structured template or generator cuts that to a few hours.

What is the difference between a safety program and a safety manual?

A safety manual is a compiled document that gathers all of a company's required written programs plus general safety rules in one place. The individual written programs inside it are what OSHA actually requires. The manual format is optional. Some companies prefer separate standalone documents, one per standard. Either approach works legally as long as each required element is present and employees can reach it.

Does OSHA provide free safety program templates?

OSHA provides model programs and guidance through OSHA.gov and its eTools section, including a model Bloodborne Pathogens exposure control plan and HazCom guidance. These are frameworks, not fill-in-the-blank templates. You still customize them with your workplace-specific chemicals, equipment, job titles, and procedures. NIOSH and the OSHA On-Site Consultation Program are also free resources with practical program guidance.

How often do written safety programs need to be updated?

Some standards set a fixed schedule. Bloodborne Pathogens (29 CFR 1910.1030) requires annual review and update of the Exposure Control Plan. LOTO (29 CFR 1910.147) requires annual periodic inspections of energy control procedures. Most other programs need updates when work tasks, equipment, personnel, or a relevant regulation change. Building an annual review into your calendar is the simplest way to stay current.

What is an Injury and Illness Prevention Program (IIPP) and does federal OSHA require one?

An IIPP is a general safety management program covering hazard identification, corrective action, training, and worker communication as one system. Federal OSHA does not require an IIPP by name. California (Cal/OSHA) requires one for almost all California employers under 8 CCR 3203. About half of the states with OSHA-approved plans have similar general program requirements. Federal OSHA's Recommended Practices describe the same elements but carry no citation authority alone.

Can one person manage a company's entire safety program?

At a small business, yes. One designated person, often the owner or office manager, can manage all the required written programs, coordinate training, keep records, and handle the annual review cycle. The key is clear documentation of who is responsible for what. Once a company grows past 50 to 100 employees, a dedicated part-time or full-time safety coordinator becomes much more practical.

What records do you need to keep for a safety program?

It varies by standard. Training records for most programs should be kept 3 years. Medical and exposure records under 29 CFR 1910.1020 must be kept for the duration of employment plus 30 years. OSHA 300 logs must be kept 5 years. Fit test records under the Respiratory Protection standard must be kept until the next fit test. Always check the specific CFR section, since retention periods are stated there.

What is the OSHA On-Site Consultation Program and is it really confidential?

The On-Site Consultation Program sends a state-funded safety consultant to your workplace to identify hazards and review your programs. It's separate from OSHA enforcement: findings are not shared with enforcement OSHA as long as you fix serious hazards within an agreed timeframe. It's free for small and medium businesses and available in all 50 states. OSHA describes it at osha.gov/consultation. It's one of the most genuinely useful free resources available.

Do construction companies need different safety programs than general industry?

Yes. Construction runs under 29 CFR 1926, not 1910. Many requirements parallel, but the construction standards add unique ones: site-specific fall protection plans (1926.502), excavation competent person requirements (1926.651), and a Silica Exposure Control Plan (1926.1153) for cutting, grinding, or drilling silica-containing materials. A company that does both construction and general industry work has to comply with both sets of standards for the relevant activities.

What is an effective safety incentive program and does OSHA allow them?

OSHA allows safety incentive programs but flags rate-based programs that reward low injury numbers, because those can suppress reporting. OSHA's 2016 anti-retaliation rule under 29 CFR 1904.35 reinforces that employees can report injuries without a disincentive. Acceptable programs reward leading indicators: hazard reports, safety training completion, near-miss reporting, or safety observation participation, rather than simply staying injury-free.

How do state OSHA plans differ from federal OSHA for written program requirements?

The 29 states and territories with OSHA-approved plans must meet or exceed federal OSHA standards. Many go further. California requires an IIPP for nearly all employers. Washington's WISHA has ergonomics requirements for certain industries. If you operate in a state-plan state, your state agency's website is the authoritative source. OSHA.gov has a map and links to every state plan agency. Federal standards are the floor, not the ceiling.

Sources

1. OSHA, 29 CFR 1910 General Industry Standards: Written program requirements cited for HazCom (1910.1200), LOTO (1910.147), Respiratory Protection (1910.134), PPE (1910.132), Bloodborne Pathogens (1910.1030), Emergency Action Plan (1910.38), Confined Space (1910.146), and recordkeeping (1910.1020)
2. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA's Recommended Practices framework covers management leadership, worker participation, hazard identification, hazard controls, education and training, program evaluation, and communication; quote: 'centers on finding and fixing hazards before they cause injury or illness'
3. OSHA, Top 10 Most Frequently Cited Standards FY2024: Hazard Communication ranked in the top three most-cited OSHA violations in fiscal year 2024
4. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries 2023: Businesses with fewer than 50 employees accounted for roughly 38% of all workplace fatalities in private industry in 2023
5. OSHA, 29 CFR 1926 Construction Industry Standards: Construction fall protection plan required under 29 CFR 1926.502(k); Silica Exposure Control Plan required under 29 CFR 1926.1153
6. OSHA, National Emphasis Program on Isocyanates: OSHA has a National Emphasis Program on isocyanates targeting industries including auto body shops that spray 2K paints
7. California Department of Industrial Relations, Cal/OSHA: Cal/OSHA requires an Injury and Illness Prevention Program (IIPP) for virtually all California employers under 8 CCR 3203, and has healthcare-specific ergonomics requirements
8. OSHA, Voluntary Protection Programs (VPP): VPP recognizes worksites with injury and illness rates below industry averages and strong documented safety management systems
9. OSHA, Improve Tracking of Workplace Injuries and Illnesses final rule (29 CFR 1904.35): OSHA's 2012 anti-retaliation memorandum and 2016 electronic recordkeeping final rule under 29 CFR 1904.35 raised concerns about rate-based incentive programs that can discourage injury reporting
10. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program provides confidential hazard assessments and program reviews to small and medium businesses in all 50 states; OSHA also publishes free model programs through its eTools section
11. OSHA, Penalties: As of 2024 inflation adjustments, OSHA serious violation penalties run up to $16,131 per violation; willful or repeated violations up to $161,323
12. OSHA, OSH Act Section 5(a)(1) General Duty Clause: Section 5(a)(1) of the OSH Act requires employers to furnish a workplace free from recognized hazards likely to cause death or serious physical harm
13. National Safety Council, Injury Facts: NSC Injury Facts publishes annual BLS-sourced industry-level injury and fatality data used to benchmark safety program effectiveness
14. NIOSH (CDC), Workplace Safety and Health Topics: NIOSH publishes science-based recommendations and industry-specific hazard guides for hearing loss, chemical exposure, and ergonomics used to build written safety programs