What a safety policy statement needs to include: OSHA best practice

Last updated 2026-07-11

What is a safety policy statement and why does OSHA care about it?

A safety policy statement is a short, signed document that says, in plain language, what your company believes about safety, who is accountable for it, and what you promise to do. It sits at the front of your written safety program. Think of it as the constitution for everything else.

OSHA does not have a single general industry regulation at 29 CFR 1910 that says "you must have a written safety policy statement." That surprises a lot of people. What OSHA does have is a long record of using the absence of a coherent safety management system as evidence of willful or repeat violations when something goes wrong ^[1]. The agency's Recommended Practices for Safety and Health Programs, published in 2016 and updated since, lists management leadership as element one and says leadership should "establish a safety and health policy that demonstrates commitment to worker safety and health" ^[2].

State-plan states sometimes go further. California's IIPP standard (8 CCR 3203) and Oregon OSHA's 437-001-0744 both require a written injury and illness prevention program that includes an explicit management commitment statement ^[3]. If you operate in a state-plan state, check your state's specific language, more than federal OSHA.

The practical reason inspectors care: when a compliance officer walks into your facility after an incident, the first thing they ask for is your written program. A vague or missing policy statement signals that safety management is informal. That perception shapes everything that follows.

What are the required elements of a safety policy statement?

No single CFR section lists a checklist, but OSHA's Recommended Practices for Safety and Health Programs ^[2] and the agency's letters of interpretation give a clear picture of what a defensible statement contains. Here are the six elements inspectors and safety professionals consistently look for.

1. A statement of management commitment This says, without hedging, that leadership considers worker safety at least as important as production and profit. It does not need to be eloquent. "The safety and health of our employees is our first priority" is fine. What matters is that it is sincere enough to be backed up by what you actually do.

2. The scope of coverage Who does this policy apply to? Employees only? Contractors? Temporary workers? OSHA's multi-employer worksite policy means you can be cited for hazards your contractor creates ^[4]. Your policy statement should name the full population it governs.

3. Defined roles and accountability Name the position (more than a person's name, since people leave) responsible for day-to-day safety oversight. Name who workers go to with hazard reports. Name who investigates incidents. OSHA's incident report requirements under 29 CFR 1904 assume someone is assigned to that task; your policy statement is where you make that assignment explicit.

4. Worker participation OSHA's recommended practices state that "workers are the most important source of information about hazards in their workplaces" ^[2]. Your policy statement should say, in a sentence, that workers are expected and encouraged to report hazards, near-misses, and unsafe conditions without fear of retaliation. This is more than a nice sentiment: 29 CFR 1904.35 prohibits discouraging workers from reporting injuries, and your policy statement is exhibit A if that is ever disputed.

5. A commitment to compliance with applicable standards Your statement should say the company will identify and comply with OSHA standards that apply to your operations. You do not need to list every standard. Referencing "applicable OSHA regulations" is enough. This matters because it signals to inspectors that you have done, or intend to do, a gap analysis against things like hazard communication (29 CFR 1910.1200) or lockout tagout (29 CFR 1910.147).

6. A signature and a date Unsigned, undated policy statements are nearly worthless. The signature should come from the highest-ranking person available, ideally the owner or CEO for a small business. The date matters because OSHA inspectors and courts look at whether a policy was current. A statement from 2009 that has never been reviewed signals neglect.

How long should a safety policy statement be?

One page. Seriously, one page.

The longer a policy statement gets, the less anyone reads it, posts it, or remembers it. Some consultants charge to write six-page safety philosophies. Those documents end up in a binder nobody opens. The goal is something a new hire can read in two minutes and a supervisor can post on the break room wall.

A well-constructed safety policy statement runs between 200 and 400 words. It covers the six elements above. It does not need to describe your specific hazards (that belongs in your hazard assessment), your training schedule (that belongs in your training plan), or your emergency procedures (those belong in their own written programs).

If you find yourself writing more than a page, you are probably writing a program, not a statement. Move the procedural detail to its proper section.

Does OSHA require a written safety policy statement for small businesses?

For most general industry employers under federal OSHA, there is no specific CFR section that mandates a standalone written safety policy statement. This is a genuine distinction that matters for small business owners trying to understand actual legal exposure versus best practice.

However, several specific OSHA standards do require written programs, and those programs are expected to contain, at minimum, a statement of purpose and scope. Examples:

• The Hazard Communication Standard at 29 CFR 1910.1200(e) requires a written hazard communication program.
• The Lockout/Tagout standard at 29 CFR 1910.147(c)(4) requires a written energy control program.
• The Respiratory Protection standard at 29 CFR 1910.134(c) requires a written respiratory protection program.

Each of these written programs benefits from, and in practice usually requires, an introductory statement of management commitment and scope. So while "safety policy statement" as a standalone document is not always literally mandated, the elements of one are woven into the written programs that are mandated.

For construction employers under 29 CFR 1926, the Safety and Health Regulations for Construction do not explicitly require a standalone policy statement either, but OSHA's multi-employer citation policy and the agency's enforcement record make a written safety commitment important for any contractor with employees.

Small businesses with fewer than 10 employees are partially exempt from OSHA's injury recordkeeping requirements under 29 CFR 1904.1, but that exemption does not extend to the requirement to have a safe workplace or to comply with specific standards ^[5]. A safety policy statement costs you nothing to write and creates a record that your safety program is intentional.

What is the difference between a safety policy statement and a full safety program?

The policy statement is the why and who. The full safety program is the how.

Think of it this way. Your safety policy statement says: "This company is committed to worker safety. The operations manager is responsible for safety oversight. Workers will report hazards without fear of retaliation. We will comply with applicable OSHA standards."

Your written safety program then documents the specific procedures that make good on those promises: your hazard identification process, your training calendar, your emergency action plan, your specific written programs for regulated hazards like lockout tagout or hazard communication.

The Bureau of Labor Statistics reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023 ^[6]. Employers with documented, functioning safety programs consistently show lower incident rates than those running on informal practices. The policy statement does not create that outcome by itself, but it anchors everything else.

Here is a simple comparison:

Document	Length	OSHA Status	Updates
Safety policy statement	200-400 words	Best practice, sometimes state-required	Review annually
Written safety program	10-50+ pages	Required for most employers	Review annually + after incidents
Specific written programs (LOTO, HazCom, etc.)	Varies	Required by specific CFR standards	When procedures change

Some employers write a single "safety and health program" document that opens with a one-page policy statement and then flows into the procedural detail. That is a perfectly reasonable approach. The key is that the statement of commitment appears at the front and is signed.

What should a safety policy statement actually say? A template structure

Here is a real-world structure you can follow. Fill in the bracketed portions for your operation.

---

[Company Name] Safety and Health Policy Effective Date: [Date] | Reviewed: [Date]

[Company Name] is committed to providing a safe and healthy workplace for all employees, contractors, and visitors at all locations. The safety and health of our workers is a core business value, not a compliance exercise.

Accountability The [owner / president / general manager] has ultimate responsibility for safety and health at this company. The [safety manager / operations manager / designated person] manages day-to-day safety and health activities. Every supervisor is responsible for implementing safe work practices in their area. Every employee is responsible for following safe work procedures, using required personal protective equipment, and reporting hazards or injuries immediately.

Worker participation Workers are encouraged and expected to report unsafe conditions, near-misses, and injuries. Reports can be made to [supervisor / safety contact / anonymous reporting channel]. No worker will face retaliation for a good-faith safety report. This is a condition of employment for everyone.

Compliance [Company Name] will identify and comply with applicable OSHA standards and regulations. We will conduct hazard assessments, provide required training, and maintain records as required by law.

Continuous improvement We will investigate incidents, identify root causes, and correct hazardous conditions promptly. This safety program will be reviewed at least annually and after any serious incident.

_Signed: _____________________________ Title: __________________ Date: ___________

---

That is it. About 250 words. Every element is there. Post it, hand it to new hires on day one, and review it every year.

Want a version that is pre-formatted, structured for your industry, and ready to drop into a complete written program in about 15 minutes? SafetyFolio's safety program generator builds one from your answers to a short questionnaire.

How often should you update your safety policy statement?

At minimum, once a year. In practice, you should also review it after any of these events: a serious injury or fatality, a significant change in operations or workforce size, an OSHA inspection, a change in ownership or senior leadership, or when a new standard takes effect that affects your operation.

The date on the statement matters. An OSHA compliance officer who sees a policy statement last signed in 2018 will ask whether your safety program has been kept current. A recent date is not proof that you have been doing everything right, but an old date is evidence that you may not have been paying attention.

The review does not have to be elaborate. Read the statement. Does it still reflect what the company actually does? Are the named positions still accurate? Has the scope of your work changed? Make any necessary edits, get a fresh signature, and update the date. That takes twenty minutes.

Do you need a separate safety policy statement for each written program?

No. One company-level safety policy statement covers all your written programs. Each specific written program (your LOTO program, your respiratory protection program, your HazCom program) typically references the company-level statement rather than restating it.

Some employers add a one-paragraph scope statement at the front of each specific written program, something like: "This written program implements the requirements of 29 CFR 1910.147 and supports [Company Name]'s Safety and Health Policy dated [date]." That cross-reference is good practice because it ties each regulatory program back to the umbrella commitment.

If your company has multiple locations with meaningfully different hazards, you may want location-specific addenda that list site-specific hazards and local contacts, while the master policy statement applies company-wide. This is common in retail, food service, and construction where a single employer runs several distinct worksites.

What happens if you don't have a safety policy statement when OSHA inspects?

OSHA cannot cite you directly for lacking a standalone safety policy statement in most general industry settings, because no single CFR section mandates it in that form. But the absence creates real problems during an inspection.

First, when an inspector asks for your written safety program and you hand over a stack of unconnected procedures with no overarching commitment statement, the inspector's notes will reflect that safety management appears informal. That framing influences how subsequent citations are classified. The difference between an "other-than-serious" citation and a "serious" citation often comes down to whether evidence exists of management engagement.

Second, if an inspection follows a fatality or serious injury, OSHA looks hard at whether a genuine safety and health program existed. Under the General Duty Clause, Section 5(a)(1) of the OSH Act, employers must provide employment free from recognized hazards likely to cause death or serious physical harm ^[7]. A documented safety management system, starting with a signed policy statement, is part of showing you took that duty seriously.

Third, workers' compensation insurers in many states use your safety program documentation as one factor in experience modification rates. A strong written program can reduce your mod. A missing or thin program can raise it.

Penalties for serious OSHA violations currently max out at $16,550 per violation, with willful or repeat violations up to $165,514 per violation as of 2024 ^[8]. A one-page signed policy statement costs you nothing.

How does a safety policy statement support worker training and participation?

Your policy statement is the anchor for your training program. When you train new employees, the first thing you should show them is the safety policy statement, because it tells them what the company expects of them and what they can expect from the company.

OSHA's recommended practices say workers should receive training "to the degree necessary for them to perform their jobs safely" ^[2]. That training starts with understanding that safety is a shared responsibility, not something done to workers from above. A signed, posted policy statement communicates that in a way that verbal instruction alone does not.

Particularly important: the no-retaliation clause. 29 CFR 1904.35(b)(1)(iv) prohibits employers from discouraging workers from reporting work-related injuries and illnesses ^[9]. Your policy statement is the place to make that commitment visible and explicit. Workers who see it in writing on day one, rather than hearing it informally, are more likely to report near-misses before they become injuries.

For employees who take OSHA training or complete an OSHA 30 course, the policy statement is the document that connects their training to your actual workplace. It says: here is who is accountable, here is how you participate, here is what to do when something is wrong.

Some employers laminate the policy statement and post it at every entrance and break room. That takes five minutes and costs under a dollar per location. It is one of the highest-value things you can do with a piece of paper.

How do state-plan states change what your safety policy statement needs?

Twenty-two states and two territories operate their own OSHA-approved safety and health plans ^[3]. These state plans must be "at least as effective" as federal OSHA, but many go further.

California's Injury and Illness Prevention Program (IIPP) standard at 8 CCR 3203 requires every California employer to have a written IIPP that includes a statement of management commitment and worker responsibility. Failure to have one is a direct citation.

Oregon OSHA's administrative rule OAR 437-001-0744 similarly requires a written safety and health program with an explicit management commitment component.

Washington State's Safety and Health Core Rules require a written accident prevention program.

If you are in a state-plan state, look up your state's specific IIPP or accident prevention program rule. The six elements described here will satisfy most of them, but your state may add requirements around specific hazard categories, language access for workers whose primary language is not English, or minimum review frequencies.

The OSHA website maintains a list of state plan states with links to each state agency ^[3]. That is the right starting point before you finalize your policy statement.

What are common mistakes employers make in safety policy statements?

After reviewing a lot of these documents, the same problems appear repeatedly.

Generic boilerplate with no accountability names. A statement that says "management is responsible for safety" without naming a position is functionally useless. When an incident happens, everyone points at everyone else.

Production language that contradicts the safety commitment. If your policy statement says "safety first" but your operations procedures routinely allow workers to skip safety steps to meet production targets, the policy statement becomes evidence against you, not for you. Mean what you write.

No worker participation language. Many statements focus entirely on what management will do and say nothing about worker reporting or hazard communication. This is a missed opportunity and a gap that OSHA's recommended practices specifically call out.

No signature or an old signature. An unsigned policy statement has no legal weight and sends the wrong signal to workers.

Covering hazards that belong in specific written programs. Some employers try to describe every procedure in the policy statement. That creates a confusing, unusable document. The policy statement states principles. Procedures go elsewhere.

Writing it for OSHA instead of for workers. The best policy statements are written for the person starting their first day on the job. Simple language, short sentences, clear expectations. If a worker cannot read it and understand what is expected of them, rewrite it.

Want to build a complete written program, including a properly structured policy statement, around your actual operations without hiring a consultant? The SafetyFolio safety program generator walks you through the process in about 15 minutes.

Frequently asked questions

Is a safety policy statement legally required by OSHA?

For most federal OSHA general industry employers, no single CFR section mandates a standalone safety policy statement. However, many state-plan states like California (8 CCR 3203) and Oregon (OAR 437-001-0744) explicitly require one as part of a written IIPP or accident prevention program. Even where not literally required, its absence is used as evidence of inadequate safety management during inspections and after incidents.

Who should sign a safety policy statement?

The highest-ranking person available: owner, CEO, president, or general manager. The seniority of the signature signals to workers and inspectors that safety commitment comes from the top, not from a safety coordinator acting alone. If your operation has multiple sites, a site manager can co-sign for their location, but a company-level signature should still appear on the master document.

How is a safety policy statement different from a safety manual?

A safety policy statement is one page covering your company's commitment, accountability structure, worker participation expectations, and compliance intent. A safety manual is the full collection of written programs, procedures, and standard operating instructions that implement those commitments. The policy statement is the front door; the manual is everything inside. Most employers keep both, with the statement on page one of the manual.

Can I use a template for my safety policy statement?

Yes, templates are a fine starting point as long as you customize them for your actual operation, named positions, and specific scope. Generic templates that are not edited to reflect real accountability structures are nearly useless. OSHA inspectors and workers can both tell when a document was never adapted from a generic form. Fill in every bracketed section, have a real person sign it, and review it annually.

What should a safety policy statement say about worker retaliation?

It should say explicitly that no worker will face discipline or retaliation for reporting a hazard, near-miss, or work-related injury in good faith. This mirrors the language of 29 CFR 1904.35(b)(1)(iv), which prohibits employers from discouraging injury reporting. Putting the anti-retaliation commitment in writing on day one creates a record and sets the right expectation before any incident occurs.

How do I write a safety policy statement for a very small business with no safety staff?

Name the owner or manager as the accountable person. That is honest and correct for a small operation. A five-person company does not need a safety director, but it does need someone whose name appears in the policy as the person responsible for safety oversight, training, and incident response. Keep the statement to one page. The accountability structure can be simple: owner is responsible for everything, every employee reports hazards directly to the owner.

Does a safety policy statement need to cover contractors and temp workers?

It should. OSHA's multi-employer worksite citation policy means you can be held responsible for hazards affecting contractors at your site. Your policy statement should state that it covers all workers on your premises, including contractors and temporary workers, or it should specify what host employer protections apply. This is especially important for employers who use staffing agencies, since OSHA treats both the host and the agency as joint employers under certain conditions.

How does a safety policy statement help with OSHA inspections?

It shows an inspector that safety management is intentional and documented rather than informal. Inspectors note whether a written safety program exists and whether it includes a management commitment statement. While you cannot be directly cited solely for lacking a standalone policy statement in most federal OSHA jurisdictions, its absence influences how inspectors classify the seriousness of other violations they find during the inspection.

Should my safety policy statement mention specific OSHA standards like LOTO or HazCom?

It does not need to list specific standards. A reference to "applicable OSHA regulations" covers it at the policy level. Your specific written programs for lockout tagout (29 CFR 1910.147) and hazard communication (29 CFR 1910.1200) are separate documents that implement the commitment. The policy statement sets the principle; those programs provide the detail. Listing every standard in the policy statement adds length without adding value.

What is OSHA's Recommended Practices for Safety and Health Programs?

It is a voluntary guidance document OSHA published in 2016, updated periodically, that describes a framework for a safety and health management system. It identifies seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and coordination on multi-employer worksites. While not a regulation with citation authority, it represents OSHA's stated model for what a functioning safety program looks like and is widely cited in enforcement context.

Can one safety policy statement cover multiple business locations?

Yes. A company-level policy statement applies across all locations. For sites with meaningfully different hazard profiles, many employers add a one-page site-specific addendum that lists local hazards, local emergency contacts, and the name of the on-site safety lead. The master policy statement and the site addendum together give OSHA inspectors and workers what they need without requiring a full separate program for each location.

How long does it take to write a safety policy statement?

Honestly, about 30 to 60 minutes if you are starting from the structure described here. Fill in your company name, the names of accountable positions, your scope, and the date. The hard part is not the writing; it is making sure the accountability lines match reality. If the document says the operations manager is responsible for safety but that person does not actually know they have that role, the statement creates liability rather than reducing it.

Sources

1. OSHA, Safety and Health Management Systems (general guidance): OSHA uses absence of a coherent safety management system as evidence of inadequate safety culture in enforcement actions
2. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA identifies management leadership and worker participation as core elements; states leadership should establish a safety and health policy; says workers are the most important source of information about hazards
3. OSHA, State Plans: 22 states and 2 territories operate OSHA-approved state plans; California 8 CCR 3203 and Oregon OAR 437-001-0744 require written programs with management commitment statements
4. OSHA, Multi-Employer Citation Policy (CPL 02-00-124): OSHA's multi-employer worksite policy allows citations for hazards affecting contractors and temporary workers at a shared site
5. OSHA, Recordkeeping Rule 29 CFR 1904.1: Employers with 10 or fewer employees are partially exempt from OSHA injury recordkeeping requirements, but the exemption does not extend to compliance with safety standards
6. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: BLS reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023
7. OSH Act of 1970, Section 5(a)(1), General Duty Clause: Employers must provide employment free from recognized hazards likely to cause death or serious physical harm
8. OSHA, Penalties: Serious violations max at $16,550 per violation; willful or repeat violations up to $165,514 per violation as of 2024
9. OSHA, Injury and Illness Recordkeeping and Reporting Requirements (29 CFR 1904.35): 29 CFR 1904.35(b)(1)(iv) prohibits employers from discouraging workers from reporting work-related injuries and illnesses
10. California Code of Regulations, 8 CCR 3203, Injury and Illness Prevention Program: California requires every employer to have a written IIPP including a statement of management commitment and worker responsibility