Safety program gap analysis for small manufacturers: a practical guide

Last updated 2026-07-11

What is a safety program gap analysis and why do small manufacturers need one?

A gap analysis is a structured comparison. On one side sits what OSHA requires. On the other sits what you actually have in place today. The space between those two things is your legal and physical risk.

That space is usually wider than owners expect. The Bureau of Labor Statistics reported 373,300 recordable injuries in manufacturing in 2022, a rate of 3.4 per 100 full-time workers, compared to 2.7 across all private industry ^[1]. Small shops are not immune. OSHA data consistently shows that workplaces with fewer than 50 employees have lower rates of formal safety programs and higher per-employee injury costs.

The analysis does not need to be expensive or complicated. It does need to be honest. You are asking one question for every OSHA requirement that touches your operation: do we have this, is it current, and does anyone actually follow it? Three yes answers means you are covered. Anything else is a gap.

You do not need a consultant to run this. You need a clear list of applicable standards, a few hours of focused time, and the willingness to write down what you find rather than what you wish were true.

Which OSHA standards apply to a small manufacturing facility?

Most small manufacturers fall under OSHA's General Industry standards, codified at 29 CFR 1910 ^[2]. If you do construction work on your own facility, some 29 CFR 1926 rules also apply, but for a typical shop floor the 1910 series is your primary target.

The standards most likely to produce violations in small manufacturing are:

Standard	Topic	Requires Written Program?
29 CFR 1910.119	Process Safety Management	Yes (if covered chemicals)
29 CFR 1910.132	PPE hazard assessment	Yes (certification in writing)
29 CFR 1910.134	Respiratory protection	Yes
29 CFR 1910.146	Permit-required confined spaces	Yes
29 CFR 1910.147	Lockout/Tagout (LOTO)	Yes
29 CFR 1910.178	Powered industrial trucks (forklifts)	Yes (training records)
29 CFR 1910.1200	Hazard Communication	Yes
29 CFR 1904	Recordkeeping	Yes (300 log, 300A summary)

Not every standard applies to every shop. A facility with no permit-required confined spaces does not need a confined space program, but it does need documentation showing you evaluated and determined that no spaces meet the definition. That written determination is itself a requirement ^[3]. This is a gap many small manufacturers miss entirely.

State-plan states (like California, Michigan, Washington, and about 24 others) may have standards stricter than the federal baseline ^[4]. If you are in a state-plan state, pull your state agency's standard list alongside the federal CFR.

How do you actually run a gap analysis, step by step?

There are five steps. They take a few hours spread over a week for a shop with 10 to 50 employees.

Step 1: Build your applicability checklist. Go through 29 CFR 1910 subparts A through Z and mark every standard that has any plausible connection to your operation. Do not skip a standard because you think you are compliant. You are building the audit list, not the audit result yet.

Step 2: Pull every document you currently have. Collect your safety manual (if you have one), all training records, your OSHA 300 and 300A logs, SDS binder, equipment-specific procedures, and any permits. Put them in one place, physical or digital.

Step 3: For each applicable standard, ask three questions. First, do you have a written program or documented procedure? Second, is it current (reviewed within the last year, or after any change in process or personnel)? Third, do training records prove workers have been trained and understand it? If the answer to any of those is no, you have a gap.

Step 4: Score each gap by risk level. Not all gaps are equal. A missing lockout/tagout procedure on a press is a life-safety gap. A 300A that was posted two weeks late is a paperwork gap. Rank gaps as high (imminent danger or frequently cited), medium (compliance gap with moderate injury potential), or low (administrative). Fix high gaps first.

Step 5: Write a corrective action plan with dates and owners. A gap analysis with no corrective action plan is just a list of problems. Assign each gap a responsible person, a target completion date, and a verification method. The plan itself becomes evidence of good faith if OSHA visits before you finish.

This process mirrors what OSHA compliance safety and health officers (CSHOs) do during inspections ^[5]. Running it yourself before they show up is purely practical.

What are the most common safety program gaps in small manufacturing?

OSHA publishes its top 10 most-cited standards every fiscal year. In FY 2023, the list for General Industry included hazard communication, respiratory protection, lockout/tagout, powered industrial trucks, and machine guarding in the top positions ^[6]. For small manufacturers specifically, four gaps show up again and again.

Missing or generic written programs. Many small shops have a safety manual they downloaded years ago. It names chemicals they do not use and references equipment they do not own. A generic program that does not match your actual operation does not satisfy 29 CFR 1910.1200(e)(1), which requires the hazard communication program to be specific to the workplace ^[7]. OSHA inspectors read your program and walk your floor. If the two do not match, you have a violation.

No machine-specific lockout/tagout procedures. 29 CFR 1910.147 requires documented, equipment-specific energy control procedures for each piece of machinery where unexpected energization could cause injury ^[3]. A general "we lock out machines" policy does not satisfy this. You need a procedure for each machine, posted at or near the machine, with specific steps, specific energy sources, and specific lockout points.

Incomplete SDS management. Under hazard communication (29 CFR 1910.1200), you need an SDS for every hazardous chemical in the workplace, accessible to workers during every shift, not only during business hours. Shops that keep the binder locked in the office fail this test. So do shops with SDS sheets for chemicals they no longer use but missing sheets for new ones.

Recordkeeping errors. Under 29 CFR 1904, employers with 10 or more employees in manufacturing must keep OSHA 300 logs, complete 301 incident reports within seven calendar days of learning of a recordable injury, and post the 300A summary from February 1 through April 30 each year ^[8]. Common errors: recording cases that are not recordable, failing to record cases that are, and not posting the 300A on time. Learn more about how to properly document incidents with an incident report.

Forklift training records. Forklift certification under 29 CFR 1910.178(l) requires evaluation of each operator before they operate unsupervised, and re-evaluation every three years or after any observed unsafe operation ^[9]. A lot of shops train employees verbally with no written record. Verbal training with no documentation is the same as no training in an OSHA inspection.

What does a gap analysis checklist for OSHA written programs look like?

Below is a condensed checklist organized by whether a written program is required. For each item, mark your current status: have it and current, have it but outdated, in progress, or missing.

Requirement	CFR Reference	Written Program Required	Status
Hazard Communication	1910.1200	Yes
Lockout/Tagout	1910.147	Yes (+ machine-specific procedures)
Respiratory Protection	1910.134	Yes
PPE Hazard Assessment	1910.132	Certification required
Emergency Action Plan	1910.38	Yes (10+ employees)
Fire Prevention Plan	1910.39	Yes (if required by other standards)
Permit-Required Confined Spaces	1910.146	Yes (or written determination of none)
Bloodborne Pathogens	1910.1030	Yes (if exposure possible)
Hearing Conservation	1910.95	Yes (if 85 dBA TWA or above)
Forklift Operator Training Records	1910.178	Training records required
OSHA 300 Log & 300A Summary	1904	Log + annual summary required

For each standard you mark as "missing" or "outdated", that is a confirmed gap. Pull the actual CFR text and compare it to what you have. OSHA's standards pages at osha.gov let you read the regulatory text for free ^[2].

Generating all those written programs from scratch is real work. Tools like SafetyFolio's safety program generator build compliant, facility-specific programs in about 15 minutes rather than 15 hours, which is worth knowing if your corrective action plan runs long.

How do you prioritize gaps once you find them?

Prioritization is where a lot of gap analyses fall apart. People find thirty gaps, feel overwhelmed, and fix nothing. A simple three-tier system keeps this manageable.

Tier 1: Fix within one week. These are gaps where a worker could be seriously injured or killed before your next inspection. Any machine without a lockout/tagout procedure that workers are currently using falls here. Any confined space entry happening without a permit falls here. Any forklift operator with zero documented training falls here. Stop the hazardous activity or fix the gap immediately.

Tier 2: Fix within 30 days. These are compliance gaps with real injury potential but not immediate life-safety risk. Missing written hazard communication program. No PPE hazard assessment. Respiratory protection program that has not been reviewed in over a year. These gaps can get you citations in the $1,000 to $15,625 per-violation range for serious violations ^[10].

Tier 3: Fix within 90 days. Administrative gaps where no one is getting hurt today but you are technically out of compliance. 300A not posted at exactly the right time last year. Training records with incomplete dates. Emergency action plan that still names an employee who left two years ago.

The dollar stakes are real. OSHA's maximum penalty for a willful or repeated violation is $156,259 per violation as of 2024 ^[10]. A serious violation (where death or serious injury is substantially probable) runs up to $15,625 per violation. Finding and fixing gaps before an inspection is about more than safety. It is about not paying penalties that could shut a small shop down.

What training gaps should you look for specifically?

Written programs mean nothing if workers have not been trained. Training gaps are often the fastest to confirm and the most expensive to overlook.

For each written program, ask: is there a training record with the employee's name, the date, the topics covered, and the trainer's name? OSHA standards do not specify a single format for training records, but you need something that proves training occurred and covered the required content.

Common training gaps in small manufacturing:

Lockout/Tagout training. 29 CFR 1910.147(c)(7) requires training for authorized employees (those who do the lockout), affected employees (those in the area), and other employees. Each category gets different training content. Many shops train everyone the same way, which does not satisfy the standard.

Hazard Communication / GHS. All employees who work with or near hazardous chemicals must be trained on the GHS label elements, SDS format, and hazards of chemicals in their work area. Employees hired before GHS was updated in 2012 should have received updated training. New employees must be trained before initial assignment.

Forklift operators. As noted, 29 CFR 1910.178(l) requires pre-operation evaluation and documented refresher training triggers. See our guide on osha training for more on documenting training records correctly.

First aid and emergency response. If your facility is not in close proximity to a medical facility, 29 CFR 1910.151(b) requires that someone trained in first aid be available. OSHA has interpreted "close proximity" in various letters of interpretation to mean a response time of roughly three to four minutes, though the standard itself does not specify a time ^[5].

For supervisors and safety leads who want deeper grounding in OSHA standards, OSHA 30 training is worth considering. The OSHA 30 hour online course covers both construction and general industry versions and gives supervisors a systematic framework that maps directly onto gap analysis work.

How does a gap analysis differ from an OSHA inspection?

An OSHA inspection is adversarial by nature. An inspector arrives (with or without notice, though most inspections are unannounced), walks your facility, reviews records, and interviews workers. Any violation found can result in a citation and penalty. You cannot undo a gap during an inspection.

A gap analysis is self-directed. You find the same things an inspector would find, but you find them first and you fix them. There is no legal requirement to share your gap analysis document with OSHA, though a corrective action plan can demonstrate good faith and reduce penalties if you are cited for something you were already in the process of fixing.

OSHA's On-Site Consultation Program is a useful middle ground ^[11]. It is a free service, completely separate from enforcement, where a state-run consultant visits your facility and identifies hazards. Participation does not trigger inspections and citations cannot result from a consultation visit. For a small manufacturer that wants outside eyes without legal risk, this program is underused. OSHA data shows that in FY 2022, over 28,000 consultation visits were completed, finding and helping employers correct about 110,000 hazards ^[11].

One distinction matters. The On-Site Consultation program is not a substitute for a gap analysis. Consultants focus on physical hazards they can see. They may not catch every written program deficiency or recordkeeping error. You still need to do the document-by-document review yourself.

What records should you gather before starting a gap analysis?

Gathering records first saves time and prevents the embarrassing realization mid-analysis that you cannot find your own documentation. Here is what to collect.

First, every written safety program and procedure you currently have. Put them in one folder, physical or digital. Date each document. If you cannot find a program for a required standard, that is already a gap.

Second, all training records for the past three years. Group by topic. You are looking for employee names, dates, topics covered, and trainer signatures or names. Gaps in training records are almost as bad as no training.

Third, your OSHA 300 logs and 300A summaries for the last five years. OSHA requires you to keep 300 logs for five years ^[8]. If you cannot produce them for that window, that is a recordkeeping violation.

Fourth, equipment documentation: forklift inspection logs, machine maintenance records, and any permits (confined space, hot work). Under 29 CFR 1910.146, completed confined space permits must be retained for at least one year ^[3].

Fifth, your SDS binder or digital SDS library. Cross-reference it against every chemical product in your facility. A useful resource for understanding SDS format is the hcl safety data sheet guide, which walks through all 16 GHS sections in plain language.

Once you have all of this, the gap analysis goes faster because you are comparing documents to requirements rather than trying to remember what you have.

How often should you run a gap analysis?

Once a year is the minimum. Most safety professionals recommend tying it to a fixed calendar event so it does not slip. Many manufacturers do it in January, right after the OSHA 300A posting period ends (February 1 through April 30), because the recordkeeping process prompts a natural review of the full program ^[8].

You should also run a targeted gap analysis any time a significant change occurs. New equipment, new chemicals, a new process, a facility expansion, a big workforce change, or a near-miss or recordable injury all call for a partial re-analysis of the affected areas. Waiting until the annual cycle after a serious incident is a mistake.

After an OSHA inspection or citation, do a full re-analysis. The citation tells you exactly where you had gaps. A re-analysis tells you whether similar gaps exist elsewhere.

The corrective action plan from your previous analysis becomes the starting point for the next one. If items from last year are still listed as "in progress", that is a red flag worth addressing before the next inspection cycle, not after.

Can a small manufacturer use free tools or templates for a gap analysis?

Yes. Several free resources exist and they are genuinely good.

OSHA's e-Tools and expert systems at osha.gov cover specific industries and hazards ^[2]. The OSHA Small Business Handbook, available free on their site, provides checklists organized by industry type. OSHA's On-Site Consultation Program (mentioned above) is free for small and medium businesses ^[11].

The National Safety Council and NIOSH also publish inspection checklists, though you have to confirm they are current with the latest CFR amendments.

The catch with free templates is that they are generic. A checklist that covers every possible manufacturing operation will have dozens of items that do not apply to your shop and may miss items specific to your processes. A template for a machine shop is not the same as one for a food manufacturer or a plastics extruder.

When free templates fall short (usually because you also need the written programs to fill the gaps, not only a list of what is missing), SafetyFolio's generator builds programs specific to your answers about your facility, which cuts the time from gap to corrected document considerably.

For companies considering a formal OSHA 30 certification for their safety lead, that training also covers hazard identification methodology, which makes future gap analyses faster and more accurate.

Frequently asked questions

Do I need a consultant to run a safety program gap analysis?

No. A gap analysis is a comparison of your documents and practices against the applicable CFR standards. You can do this yourself if you know which standards apply to your operation, gather your existing records, and work through the checklist honestly. OSHA's free On-Site Consultation Program can provide outside eyes without enforcement risk if you want backup.

How long does a gap analysis take for a small manufacturing shop?

For a shop with 10 to 50 employees and a typical mix of equipment and chemicals, expect four to eight hours spread over a few days. The record-gathering step takes longest if your documentation is scattered. The analysis itself, once you have everything in front of you, usually takes two to three hours. Writing corrective actions adds another hour or two.

What is the most commonly cited OSHA violation in small manufacturing?

Hazard Communication (29 CFR 1910.1200) has appeared in OSHA's top 10 most-cited standards list every year for over a decade. In FY 2023, it was among the top violations for General Industry. Lockout/Tagout (1910.147) and Respiratory Protection (1910.134) are persistent top-five entries for manufacturing specifically.

What is the difference between a gap analysis and a hazard assessment?

A hazard assessment identifies physical or chemical hazards in your workplace, such as noise levels, chemical exposures, or fall risks. A gap analysis checks whether you have the required programs, written procedures, and training records to control those hazards. They complement each other. A hazard assessment feeds into your written programs; a gap analysis checks whether those programs exist and are current.

Does OSHA require a written safety program for manufacturers with fewer than 10 employees?

Some written programs are required regardless of size. Lockout/Tagout (29 CFR 1910.147), Hazard Communication (29 CFR 1910.1200), and Respiratory Protection (29 CFR 1910.134) apply based on hazard presence, not headcount. The recordkeeping exemption for employers with 10 or fewer employees exempts them from keeping OSHA 300 logs, but not from other written program requirements.

How do I know if my lockout/tagout program is compliant?

You need three things: a written energy control program covering the scope and purpose; machine-specific procedures for each piece of equipment where unexpected energization could cause injury (29 CFR 1910.147(c)(4)(i)); and training records showing authorized, affected, and other employees received the appropriate level of training. Annual inspections of each procedure are also required under 1910.147(c)(6).

What happens if OSHA finds gaps during an inspection that I had already identified?

Having a corrective action plan in progress before an inspection does not eliminate a citation, but it can reduce the penalty classification. OSHA considers good faith efforts in penalty calculations. An employer who identified a gap, has a written corrective plan, and is actively working it is in a stronger position than one who knew about the problem and did nothing. Document your gap analysis and corrective actions with dates.

How do I handle gaps in training records for employees who were trained years ago but have no documentation?

You cannot retroactively create records. What you can do is re-train employees and document it going forward. Note in the corrective action plan that prior records were not available and that re-training occurred on a specific date. For OSHA purposes, the clock resets to the re-training date. This is better than reconstructing records from memory, which can look like falsification.

Does a gap analysis protect me from OSHA penalties?

Not automatically. Finding gaps does not make them go away. But a completed gap analysis with a dated corrective action plan is evidence of good faith, which OSHA considers when calculating penalties. More practically, fixing the gaps before an inspection means there is nothing to cite. The protection comes from actually closing the gaps, not from having done the analysis.

What records do I need to keep from my gap analysis?

Keep the gap analysis checklist, your corrective action plan with dates and assigned owners, and documentation showing each gap was closed (updated program, new training records, etc.). There is no OSHA requirement to keep a gap analysis document, but retaining it is evidence of a systematic safety process and helps you track progress from year to year.

How does state plan OSHA affect what I need to check in a gap analysis?

The 26 state-plan states and territories run their own OSHA programs and must be at least as effective as federal OSHA, but they can be stricter. California's Cal/OSHA, for example, has additional requirements for injury and illness prevention programs. If you are in a state-plan state, check your state agency's standards alongside 29 CFR 1910. Your gap analysis must cover both federal and state requirements.

Is a gap analysis the same thing as an Injury and Illness Prevention Program (IIPP)?

No. An IIPP (or I2P2) is a formal written safety management program. About a dozen state-plan states require it by regulation; federal OSHA does not currently mandate one for most employers. A gap analysis is the process of checking whether your programs (including an IIPP if required) exist and are compliant. Think of the gap analysis as the audit and the IIPP as one of the programs being audited.

How much does it cost to fix a typical set of gaps found in a small manufacturing gap analysis?

It depends heavily on what gaps you find. Writing missing programs costs mostly time, not money. Replacing inadequate machine guarding can cost hundreds to thousands per machine. Procuring lockout/tagout hardware (locks, tags, hasps, lockout stations) for a small shop typically runs $200 to $1,000. Fixing administrative gaps like recordkeeping errors is nearly free. The cost of not fixing them, given OSHA serious violation penalties up to $15,625 each, makes the investment straightforward.

Sources

1. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2022: Manufacturing recorded 373,300 recordable injuries in 2022 at a rate of 3.4 per 100 full-time workers, compared to 2.7 across all private industry.
2. OSHA, General Industry Standards 29 CFR 1910: Most small manufacturers fall under OSHA's General Industry standards at 29 CFR 1910; standards text is publicly accessible at osha.gov.
3. OSHA, 29 CFR 1910.147 The Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147(c)(4)(i) requires documented, machine-specific energy control procedures; 1910.146 requires a written determination if no permit-required spaces exist; confined space permits must be retained at least one year.
4. OSHA, State Plans: 26 state-plan states and territories run their own OSHA programs that must be at least as effective as federal OSHA and may be stricter.
5. OSHA, Letters of Interpretation: OSHA compliance safety and health officers use structured walkthroughs and document reviews during inspections; OSHA has interpreted 'close proximity' to a medical facility under 1910.151(b) in letters of interpretation.
6. OSHA, Top 10 Most Frequently Cited Standards FY2023: In FY 2023, the most frequently cited standards for General Industry included hazard communication, respiratory protection, lockout/tagout, powered industrial trucks, and machine guarding.
7. OSHA, 29 CFR 1910.1200 Hazard Communication: 29 CFR 1910.1200(e)(1) requires the hazard communication program to be specific to the workplace; all employees working with or near hazardous chemicals must be trained on GHS label elements and SDS format.
8. OSHA, Recordkeeping Rule 29 CFR 1904: 29 CFR 1904 requires employers with 10 or more employees in manufacturing to keep OSHA 300 logs, complete 301 incident reports within seven calendar days, post the 300A summary from February 1 through April 30, and retain 300 logs for five years.
9. OSHA, 29 CFR 1910.178 Powered Industrial Trucks: 29 CFR 1910.178(l) requires evaluation of each forklift operator before unsupervised operation and re-evaluation every three years or after any observed unsafe operation.
10. OSHA, Penalties: As of 2024, OSHA's maximum penalty for a willful or repeated violation is $156,259 per violation; a serious violation is up to $15,625 per violation.
11. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program completed over 28,000 consultation visits in FY 2022, helping employers identify and correct approximately 110,000 hazards; participation does not trigger enforcement inspections.