Work safety program: what it is, what OSHA requires, and how to build one

Last updated 2026-07-09

What is a work safety program, exactly?

A work safety program is a documented, company-specific system for finding workplace hazards, controlling them, training workers to handle them, and tracking whether the controls actually work. Think of it as the operating manual for how your business handles physical risk.

It's not a single OSHA form. It's not a poster. It's a set of written policies, assigned roles, training records, inspection schedules, and incident response procedures that together describe how safety gets managed at your specific worksite.

OSHA's own Recommended Practices for Safety and Health Programs put it this way: "A safety and health program is a proactive process to help employers find and fix workplace hazards before workers are injured or become ill." ^[1] That word "proactive" matters. Reactive programs, the ones that only kick in after somebody gets hurt, don't meet what OSHA expects and don't cut injury rates.

The scale of your program should match your business. A 5-person electrical shop needs something different from a 200-person warehouse. Both need something in writing. The word to hold onto is proportionate, not minimal.

Does OSHA actually require a written safety program?

Here's where people get confused. OSHA has no single general-industry standard that says "every employer must have a written safety program." That does not mean you're off the hook.

OSHA's General Duty Clause, Section 5(a)(1) of the OSH Act, requires every employer to provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm. ^[2] Failing to document your hazard controls is one of the easiest ways to lose a General Duty Clause case.

More directly, a large number of specific OSHA standards spell out a written program in the text. Here are the ones most small businesses hit:

Standard	29 CFR Number	Written Program Required
Hazard Communication	29 CFR 1910.1200	Yes, written HazCom program
Lockout/Tagout	29 CFR 1910.147	Yes, written energy control program
Respiratory Protection	29 CFR 1910.134	Yes, written respiratory protection program
Emergency Action Plan	29 CFR 1910.38	Yes, written plan (10+ employees)
Personal Protective Equipment	29 CFR 1910.132	Yes, written hazard assessment certification
Bloodborne Pathogens	29 CFR 1910.1030	Yes, written Exposure Control Plan
Confined Spaces	29 CFR 1910.146	Yes, written permit program
Fire Prevention Plan	29 CFR 1910.39	Yes, written plan (10+ employees)

If your business touches any of these hazards, you legally need written documentation. Most businesses touch at least three of them. ^[3]

For construction, 29 CFR 1926.20 goes further. It requires employers to initiate and maintain safety programs with frequent and regular inspections of job sites and equipment. ^[4] That's about as close to a universal written-program mandate as OSHA gets.

Read more about the written-program obligations for chemicals in our guide to hazardous communication.

What are the core elements every work safety program needs?

OSHA's Recommended Practices name seven core elements. They aren't legally required as a package under one CFR number, but they're what OSHA compliance officers look for when they size up a company's safety management during an inspection. ^[1]

1. Management leadership. A named person owns safety. They have authority, budget, and accountability. Programs without a named owner drift. Assign it explicitly in writing.

2. Worker participation. Workers have to be involved in identifying hazards and reviewing procedures. This is how you find hazards before they injure someone. The people closest to the work see risks that management misses.

3. Hazard identification and assessment. You need a regular process to find hazards: walk-through inspections, job hazard analyses (JHAs), near-miss reports, and review of your OSHA logs. Document the frequency, then actually follow it.

4. Hazard prevention and control. Once you find hazards, you work the hierarchy of controls: elimination first, then substitution, then engineering controls, then administrative controls, then PPE. Writing down which controls you chose and why creates your compliance record.

5. Education and training. Workers must know the hazards they face and how to protect themselves. See section 5 below for the specifics. Our guide on workplace safety training covers what records you need to keep.

6. Program evaluation and improvement. You review the program at least annually, after any serious incident, and after any significant change in work processes. Document the review and any changes made.

7. Communication and coordination. When multiple employers share a worksite (contractors, staffing agencies), each employer's safety responsibilities have to be spelled out. This comes up constantly on construction sites and in warehouses that use temp labor.

A well-built program for what a safety and health program should be covers all seven. Most programs small businesses buy off the internet cover maybe three.

How do injury rates actually change when you have a formal safety program?

The Bureau of Labor Statistics reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, a rate of 2.4 cases per 100 full-time workers. ^[5] That number has fallen for decades, and the research keeps pointing at formal safety management as a driver of the drop.

OSHA's own analysis of Voluntary Protection Program (VPP) participants, companies that built full safety programs and passed a hard OSHA evaluation, found that VPP sites average injury and illness rates 50% below their industry peers. ^[6] That's not a rounding error.

For small businesses specifically, the evidence is harder to pin down, because fewer small businesses show up in formal studies. Nobody has perfectly clean data here. The closest controlled studies come from manufacturing, where documented programs track with 25-40% injury rate reductions within three years of rollout. The National Safety Council's data points the same direction: companies without documented programs run incident rates well above peers of similar size that have them.

The money case is plain. OSHA estimates employers pay $1 billion per week in direct workers' compensation costs. ^[7] A single lost-time injury in manufacturing averages over $38,000 in direct costs alone, before you count lost productivity, training a replacement, or OSHA penalties.

How you reward safety matters too. The principles of effective safety incentive programs come down to this: rate-based incentives (rewarding low incident counts) can quietly suppress reporting. Behavior-based incentives tied to participation and hazard identification work better.

What training does a work safety program require?

Training requirements vary by hazard, but the pattern holds: OSHA standards that require a written program almost always require documented training to match.

Hazard Communication (29 CFR 1910.1200) requires training at initial assignment and whenever a new hazard shows up. Workers have to read Safety Data Sheets, recognize hazard labels, and know the protective measures for the chemicals in their area. ^[3]

Lockout/Tagout (29 CFR 1910.147) requires training for authorized employees who perform lockout, affected employees who work around locked-out equipment, and other employees who might wander into a lockout situation. Retraining is required when there's reason to believe a worker doesn't understand the procedures.

Respiratory Protection (29 CFR 1910.134) requires training before the respirator is ever used, and annually after that. It has to cover why the respirator is necessary, its limits, how to don and check it, and what to do if it fails.

A few practical notes. Training records have to show who was trained, on what, and when. If you can't prove it happened, OSHA treats it as if it didn't. Keep records for the duration of employment plus three years as a default (some standards specify longer). Our breakdown of workplace safety training covers record retention by standard.

New-hire orientation is where most small businesses fall short. Don't assume a worker from another company learned your procedures. Your site, your equipment, your hazards, your training records.

How do you actually write a work safety program from scratch?

Most safety consultants charge $2,000 to $8,000 to write a basic safety program package for a small business, and the result is often a stack of generic templates with your company name pasted in. That's not worthless. It's also not what you actually need.

Here's how to do it yourself.

Step 1: Inventory your hazards. Walk through every job your employees do. List every piece of equipment, every chemical, every confined space, every elevated work surface, every electrical panel. This is your hazard inventory. You can't write a program for what you haven't found.

Step 2: Match hazards to OSHA standards. For each hazard, find the CFR standard that covers it. OSHA's website has a plain standard lookup tool. The table in section 2 is a good starting point for the common ones.

Step 3: Write or adapt the required programs. For each applicable standard, write the program around your actual procedures, not a template. A lockout/tagout program that describes your actual machines beats a generic one every time.

Step 4: Assign responsibilities. Every procedure needs a named role. Not "supervisor," but whoever actually does that job at your company. Unnamed responsibilities don't get done.

Step 5: Build your training schedule. For each program, document when initial training happens and how often refreshers run. Put it in writing and put it on a calendar.

Step 6: Create your inspection and review cycle. At minimum, an annual program review plus a post-incident review. Build a simple inspection checklist for each major hazard area.

Step 7: Test it before you need it. Run through your emergency action plan. Check that your lockout procedures match the machines. Find the gaps before an OSHA inspection or an injury does.

Want a faster path? SafetyFolio's safety program generator builds a custom, OSHA-aligned written program for your specific business in about 15 minutes, drawing from the same CFR requirements covered here. It's a real shortcut for the documentation step. You still have to add your site-specific details and run the training.

The full from-scratch process, done right, takes 10 to 30 hours depending on how many hazards you have. Plan for it.

What does OSHA look for when it inspects your safety program?

OSHA compliance officers don't grade on a curve. When they show up, in response to a complaint, after a serious injury, or as part of a programmed inspection, they want documentation, consistency, and proof that workers actually know what's in the program.

Here's what typically gets checked.

First, your written programs. They'll ask for the ones tied to whatever prompted the visit. If someone got hurt in a lockout/tagout incident, they want your written energy control program right then. No program, that's a citation.

Second, worker interviews. A compliance officer pulls aside three to five workers and asks what they do if they hit a chemical spill, how they shut down that machine, what the evacuation route is. Blank stares mean your written program doesn't matter.

Third, training records. Dated records showing who was trained, on what, by whom, and when. No records, no proof.

Fourth, your OSHA 300 log. Are you recording injuries and illnesses correctly? Do the rates track with your industry? Unusually low rates can draw more scrutiny, not less, because they hint at underreporting.

OSHA penalty amounts for 2024 (adjusted annually for inflation): serious violations up to $16,131 per violation, willful or repeated violations up to $161,323 per violation. ^[8] A single serious citation for a missing required program adds up fast when you're missing several.

One more thing. OSHA citations travel in packs. If an inspector finds one missing written program, they usually check whether the rest are in place too. One gap rarely stays one gap.

How much does it cost to set up and maintain a work safety program?

The range is wide, because it depends on whether you're buying templates, hiring a consultant, or building it in-house.

Approach	Typical Cost Range	What You Get
DIY with free OSHA resources	$0 + your time (10-30 hrs)	OSHA template programs, guidance documents
Online generator/platform	$50-$300/year	Customizable written programs, updates
Safety consultant, basic package	$2,000-$5,000 one-time	Written programs tailored to your site
Safety consultant, full-service	$8,000-$25,000/year	Ongoing compliance management
Full-time safety manager (staff)	$65,000-$95,000/year salary	In-house expertise, all compliance tasks

For a business under 50 employees, a solid online tool for the written programs plus internal time for training and inspections is usually the smart path. A full-time safety manager makes financial sense when your OSHA recordable rate is high enough that injury costs top the salary, or when your industry requires it (some federal contracts do).

Training costs are separate and ongoing. Using third-party training providers, expect $25 to $150 per worker per topic for standard subjects like forklift, first aid, or HAZWOPER. Annual safety training for a 20-person shop might run $2,000 to $5,000 depending on your hazard profile.

The ROI math is short. OSHA data shows that for every $1 invested in a safety program, employers save $4 to $6 in workers' compensation, lost productivity, and administrative costs. ^[7] That ratio comes from OSHA's own analysis and gets cited in economic literature, though the exact number moves by industry.

What are the most common work safety program mistakes small businesses make?

These show up over and over in OSHA inspection reports and incident investigations.

Generic templates with no site-specific content. The lockout/tagout procedure that says "see attached machine-specific procedures" with nothing attached. The HazCom program that lists chemicals as "TBD." Compliance officers recognize a boilerplate template on sight and start probing whether anyone knows it.

Training records that are missing or half-done. No date, no signature, no description of what got covered. Or training that happened once at hire and never again, despite a rule requiring annual refreshers.

Programs that never get reviewed after an incident. Nearly every OSHA standard with a written program requirement also tells you to review and update after incidents or near-misses. Most businesses skip it, or do it and never write it down.

PPE listed as the first control instead of the last. The hierarchy of controls puts PPE at the bottom because it protects the worker from the hazard rather than removing the hazard. A program that says "wear gloves" without asking whether you can substitute a safer chemical or engineer out the exposure is weak, legally and practically.

No employee sign-off. Workers need to acknowledge they got the training and understood it. Without signatures and dates, you have no defense if a worker later says nobody told them.

Programs that live in a drawer. The program exists, but nobody knows where, nobody reads it, and supervisors make calls that contradict it. A safety program that isn't used isn't a safety program. It's a liability document proving you knew the right answer and skipped it.

For a reference point on what a well-built program looks like, what a safety and health program should be walks the full framework.

Do state plan states have different requirements for safety programs?

Yes, and it matters. Twenty-nine states and territories run their own OSHA-approved state plans covering private sector employers. ^[9] State plans have to be "at least as effective" as federal OSHA, but they can and do go further.

California's Cal/OSHA is the big example. It requires every employer to have an Injury and Illness Prevention Program (IIPP) under California Labor Code Section 6401.7. That's a statutory written-program requirement that applies to every employer in the state, regardless of size or industry. The IIPP has to include: identified responsible persons, hazard identification procedures, employee communication procedures, hazard correction procedures, training, and recordkeeping. ^[10]

Washington's L&I requires an Accident Prevention Program (APP) for most employers, with requirements that run past federal minimums for construction and manufacturing.

Michigan's MIOSHA has its own Construction Safety Standards that reference written program requirements in several rules with no exact federal counterpart.

The practical move: if you're in a state plan state, check your state plan's website for written program requirements that exceed federal OSHA. The state agency will have an employer guide. Don't assume federal CFR compliance is enough.

The federally covered states use the same CFR standards described throughout this article. The fastest way to see which applies to you is OSHA's state plan map at osha.gov. ^[9]

How do you measure whether your safety program is working?

You can't manage what you don't measure. Here are the metrics that actually tell you something.

Lagging indicators look backward at what already happened: total recordable incident rate (TRIR), days away from work rate (DART rate), workers' compensation costs, and OSHA citations. Easy to calculate. They only describe failures that already occurred.

TRIR formula: (number of recordable incidents x 200,000) divided by total hours worked. The 200,000 stands for 100 full-time workers at 40 hours a week for 50 weeks. ^[11] Compare your TRIR to your industry's BLS benchmark and you'll know whether you sit above, at, or below average for your sector.

Leading indicators predict future performance: hazards identified and corrected per month, percentage of employees with current training, percentage of equipment inspections done on schedule, near-miss reports filed. Harder to track. They actually tell you whether the program works.

A realistic timeline: most businesses that put in a solid program see meaningful TRIR reduction within 12 to 18 months, with full effects taking two to three years. The first year usually goes to getting documentation and training current. The injury numbers move once the culture shifts.

Set a baseline before you start. Without one, you can't show improvement, and you can't tell which parts of the program drove the change.

A simple leading-indicator dashboard for a small shop: track open corrective actions from inspections each month. If that number climbs, your hazard identification is outrunning your hazard correction, and that gap eventually surfaces in your TRIR.

Where can you get free templates and OSHA resources to build your program?

OSHA publishes a large library of free resources, and knowing where they actually live saves real time.

OSHA's Safety and Health Program Management Guidelines (published in the Federal Register, 54 FR 3904) are the foundational document for voluntary safety program structure. Available at osha.gov. ^[1]

OSHA's small business handbook, "OSHA Assistance for the Small Business Employer," is a practical intro to compliance without the legal weight of reading CFR standards cold. ^[12]

For specific templates: OSHA's website has sample written programs for Hazard Communication, Lockout/Tagout, Respiratory Protection, and Emergency Action Plans. Search osha.gov for "sample written programs" or go to the standard's compliance page directly.

NIOSH (the National Institute for Occupational Safety and Health) publishes industry-specific health hazard evaluations and training resources at cdc.gov/niosh. ^[13] Especially useful for chemical exposure limits and ergonomics programs.

State consultation programs are a resource many small businesses have never heard of. Every state has an OSHA-funded consultation service, separate from enforcement, where a consultant visits your site, finds hazards, and helps you build programs at no cost. This is not an inspection. The consultant won't cite you. It's funded through OSHA cooperative programs and state consultation agreements. ^[12]

Want to skip the build-from-scratch grind? SafetyFolio's safety program generator takes your business type and hazard profile and produces a full, CFR-aligned written program set in about 15 minutes. Use it as a starting frame and fill in your site-specific procedures.

Run a food business? There are program requirements beyond OSHA, and our food safety certification program guide covers the overlapping obligations.

Frequently asked questions

Is a work safety program required by law for small businesses?

No single OSHA standard universally mandates one written safety program. But if your business involves chemicals, lockout/tagout, respirators, confined spaces, or several other common hazards, you're legally required to have a written program for each under specific CFR standards. California and some other state plan states require an Injury and Illness Prevention Program for all employers regardless of size. Gaps in any required written program can bring OSHA citations up to $16,131 per violation.

What is the difference between a safety program and a safety plan?

In practice the terms get used interchangeably, but safety practitioners usually split them this way: a safety plan is a project-specific document (common in construction) describing hazard controls for one job site or project. A safety program is the ongoing, company-wide management system that governs how all safety activities happen across every project and location. A program governs many plans.

How long does it take to write a work safety program?

Building a full set of written programs from scratch takes 10 to 30 hours for a small business, depending on how many OSHA standards apply. A template library or generator can cut document creation to under an hour per program. The slow parts are the site-specific customization (your actual machine procedures, your actual chemical list) and the initial training rollout.

What happens if an employee is injured and you don't have a written safety program?

Several things at once. OSHA may open an inspection, and the absence of required written programs is itself a citable violation separate from the injury. Your workers' compensation carrier may scrutinize whether safety standards were followed, which can affect your experience modification rate. If the case becomes a lawsuit, a missing safety program reads as evidence of negligence. The program's purpose isn't only compliance. It's your paper trail showing you took reasonable steps.

Does a work safety program need to be updated every year?

Most OSHA standards that require written programs also require periodic review and a review after any incident. An annual review is the standard benchmark, and OSHA recommends it in its Recommended Practices. You should also update whenever you add new equipment, chemicals, or processes, or when a role changes hazard exposure. Document every review, even one with no changes, with a date and the reviewer's name.

Can you use a generic OSHA template as your safety program?

A generic template gives you a structural starting point, but it won't satisfy OSHA alone. Standards like Lockout/Tagout (29 CFR 1910.147) explicitly require machine-specific procedures. HazCom (29 CFR 1910.1200) requires your actual chemical inventory. If a compliance officer finds a template with placeholder text or chemicals listed as 'TBD,' that's evidence the program isn't implemented. Start with a template, then customize every section with your actual operations.

What is a total recordable incident rate (TRIR) and what is a good score?

TRIR measures OSHA-recordable injuries or illnesses per 100 full-time employees in a year. Formula: (recordable incidents x 200,000) divided by total hours worked. The national average across private industry is about 2.4 per BLS 2023 data. A TRIR below your industry benchmark is the goal. Construction averages around 2.9; finance and insurance averages around 0.4. Compare your number to your specific NAICS code, not the national average.

Do employees have to sign the safety program?

OSHA doesn't universally require signatures on the program document itself. But training records, which are part of your overall documentation, should carry dated employee signatures confirming they received and understood training. For programs like Bloodborne Pathogens and Hazard Communication, documenting that each employee got training is an implied requirement enforced through inspection. Signatures are your defense. Document them.

What is the General Duty Clause and how does it relate to safety programs?

Section 5(a)(1) of the Occupational Safety and Health Act, the General Duty Clause, requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA uses it to cite employers for hazards no specific standard covers. A documented safety program showing hazard identification and control is your evidence you met the clause. Without it, you have no documented defense.

How do you involve employees in a safety program without it becoming a box-checking exercise?

Make hazard reporting easy and consequence-free. Employees who fear discipline for reporting near-misses stop reporting them, which kills your early-warning system. Build a simple reporting channel (paper, app, or straight to a supervisor), follow up on every report with a documented response, and give public credit when a report leads to a fix. Worker participation in the annual review, more than leadership signing off, is what OSHA's guidance actually envisions.

Are there industry-specific safety program requirements beyond the general standards?

Yes. Construction has its own Part 1926 standards with extra written program requirements. Healthcare employers face Bloodborne Pathogens and workplace violence prevention requirements. Maritime has Part 1915 and 1917 standards. Agriculture has Part 1928. Some industries also carry EPA, DOT, or state rules layered on top of OSHA. Start by identifying your primary NAICS code, then check both the applicable OSHA part and any other federal or state programs that govern your sector.

What is OSHA's Voluntary Protection Program and is it worth pursuing?

VPP is OSHA's recognition program for companies with strong safety management systems. Accepted sites get public recognition and are generally exempt from programmed inspections. VPP sites average injury and illness rates 50% below industry peers, per OSHA data. The application is rigorous and takes one to two years for most companies. It fits mid-to-large businesses with mature programs. It's overkill for a 10-person shop still building baseline documentation.

Does a work safety program cover remote or work-from-home employees?

OSHA's enforcement policy, clarified in a 2000 letter of interpretation, generally does not hold employers responsible for the home office of home-based employees the way it does for traditional worksites. But employees who do hazardous work remotely (field technicians, home health aides, delivery workers) are covered by applicable standards at the locations where they work. Your program should address any off-site hazards those workers face, even if the home office itself sits largely outside your control.

Sources

1. OSHA, Recommended Practices for Safety and Health Programs (2016): OSHA defines a safety and health program as a proactive process to help employers find and fix workplace hazards before workers are injured or become ill; identifies seven core elements
2. OSHA, OSH Act of 1970, Section 5(a)(1) General Duty Clause: The General Duty Clause requires every employer to provide a workplace free from recognized hazards causing or likely to cause death or serious physical harm
3. OSHA, Hazard Communication Standard 29 CFR 1910.1200: 29 CFR 1910.1200 requires a written Hazard Communication program and training at initial assignment and whenever a new hazard is introduced
4. OSHA, Construction Safety and Health Standards 29 CFR 1926.20: 29 CFR 1926.20 requires employers to initiate and maintain safety programs with frequent and regular inspections of job sites and equipment
5. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: BLS reported 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023, a rate of 2.4 cases per 100 full-time workers
6. OSHA, Voluntary Protection Programs: VPP sites average injury and illness rates 50% below the rates of their industry peers
7. OSHA, Business Case for Safety and Health: Employers pay $1 billion per week in direct workers' compensation costs; for every $1 invested in safety programs employers save $4 to $6
8. OSHA, Penalties: 2024 OSHA penalty maximums: serious violations up to $16,131 per violation, willful or repeated violations up to $161,323 per violation
9. OSHA, State Plans: Twenty-nine states and territories operate OSHA-approved state plans covering private sector employers; state plans must be at least as effective as federal OSHA
10. California Department of Industrial Relations, Cal/OSHA Injury and Illness Prevention Program: California Labor Code Section 6401.7 requires every employer to have a written Injury and Illness Prevention Program with responsible persons, hazard identification, communication, correction, training, and recordkeeping
11. OSHA, Injury and Illness Recordkeeping and Reporting Requirements: TRIR formula uses 200,000 as the base representing 100 full-time workers at 40 hours per week for 50 weeks; formula is (recordable incidents x 200,000) divided by total hours worked
12. OSHA, Consultation Services for Small Business: All 50 states have OSHA-funded consultation services separate from enforcement where consultants visit sites and help build programs at no cost to the employer
13. NIOSH, CDC National Institute for Occupational Safety and Health: NIOSH publishes industry-specific health hazard evaluations, chemical exposure limits, and training resources for occupational safety programs