How to write a workplace safety plan that actually holds up

Last updated 2026-07-10

What is a workplace safety plan and do you legally need one?

A workplace safety plan is a written document that describes how your business identifies hazards, controls them, responds to emergencies, trains workers, and tracks injuries. Think of it as the operating manual for keeping people safe at your specific worksite.

Here's the honest legal picture. OSHA does not have a single regulation that says "every employer must have one written safety plan." What OSHA has is a patchwork of standards, each requiring a written program for a specific hazard, plus the General Duty Clause (Section 5(a)(1) of the OSH Act) that covers hazards those standards don't explicitly address ^[1]. So in practice, if your workplace has chemical hazards, you need a written Hazard Communication Program under 29 CFR 1910.1200 ^[2]. If you have lockout/tagout work, you need a written energy control program under 29 CFR 1910.147 ^[3]. If workers face fall hazards, 29 CFR 1926.502 requires a fall protection plan.

The result is that almost every employer ends up needing several written programs. Bundling them into one coherent workplace safety plan is the practical move. OSHA inspectors don't penalize you for being organized.

One distinction matters here. Companies with 10 or fewer employees in a low-hazard industry are exempt from certain OSHA recordkeeping requirements under 29 CFR 1904.1, but they are NOT exempt from having required written programs ^[4]. Size doesn't get you out of the written program requirements.

Fourteen states plus Puerto Rico and the Virgin Islands run their own OSHA-approved State Plans that can be stricter than federal OSHA. If you operate in California, Michigan, Washington, or any other State Plan jurisdiction, check those rules too. California's Injury and Illness Prevention Program (IIPP) requirement under Title 8, CCR 3203, for example, applies to every employer in the state with no size exemption.

What are the required elements of a workplace safety plan?

OSHA's voluntary guidelines on Safety and Health Programs (published in the Federal Register in 1989 and still referenced in enforcement) describe eight core elements that a good safety program addresses ^[5]. These aren't regulatory mandates in the same way a specific 29 CFR standard is, but they map onto what inspectors look for and what courts have used to judge whether an employer exercised reasonable care.

Here are the eight elements and what each one asks of you in practice:

Management leadership. A named person is accountable for safety at your worksite. Someone's performance review actually includes safety outcomes. If the answer is "everyone is responsible," nobody is.

Worker participation. Employees help identify hazards and review procedures. This isn't a suggestion box. Workers can report hazards without fear, and there's a documented way for them to do it.

Hazard identification and assessment. You run regular workplace inspections, analyze injury records, and review job tasks for risk. Walk the floor. Talk to workers. Pull your OSHA 300 log and read the pattern.

Hazard prevention and control. Use the hierarchy of controls: elimination first, then substitution, then engineering controls, then administrative controls, then PPE as the last resort ^[6]. Your plan should say why you chose the controls you did.

Education and training. Workers must know the hazards they face and how the controls protect them. Training has to be in a language and vocabulary the worker understands, per multiple OSHA standards including 29 CFR 1910.1200(h) ^[2].

Program evaluation and improvement. Review the plan at least annually, after any serious incident, and when a new process or chemical shows up. A safety plan that hasn't been touched in three years is a liability, not a protection.

Communication and coordination. If you share a worksite with contractors or other employers, your plan needs to spell out who is responsible for what. Multi-employer worksites have specific OSHA guidance on this.

Emergency response. Every plan needs an Emergency Action Plan (EAP) under 29 CFR 1910.38, covering evacuation routes, emergency contacts, and procedures for fires, chemical spills, medical emergencies, and severe weather ^[7].

Which OSHA standards require a written program?

This is where a lot of small business owners get tripped up. They assume a general safety policy covers them. It doesn't. Several major OSHA standards each require their own written program, and an inspector will ask to see them separately.

Standard	Written program required	Triggers
29 CFR 1910.1200	Hazard Communication Program	Any workplace with hazardous chemicals
29 CFR 1910.147	Energy Control Program (LOTO)	Any machine that requires service or maintenance
29 CFR 1910.132	PPE Hazard Assessment	Any workplace where PPE is used
29 CFR 1910.134	Respiratory Protection Program	Any use of respirators, even voluntary
29 CFR 1910.38	Emergency Action Plan	Employers with 10+ employees (written); all employers (oral OK under 10)
29 CFR 1910.157	Fire Prevention Plan	Required when specific standards reference it
29 CFR 1910.1030	Bloodborne Pathogen Exposure Control Plan	Any occupational exposure to blood or OPIM
29 CFR 1910.119	Process Safety Management Plan	Highly hazardous chemicals above threshold quantities

The Hazard Communication standard alone, 29 CFR 1910.1200, covers just about every business that uses cleaning products, adhesives, paints, fuels, or industrial chemicals ^[2]. The written program doesn't have to be long. OSHA's sample HazCom program runs about four pages. But it has to exist, be site-specific, and be reachable by workers during their shift.

For companies doing maintenance and repair work, the lockout/tagout plan under 29 CFR 1910.147 is one of the most frequently cited standards in OSHA history. You need machine-specific written procedures, more than a general statement that workers should de-energize equipment.

The hazard communication plan template requirements under 1910.1200 are often the right starting point for first-time plan writers, because the standard itself gives a clear list of what the written program must contain. If respirators are in play at your shop, the respiratory protection program under 1910.134 has its own written and medical-evaluation requirements you'll want to handle separately.

How do you conduct a workplace hazard assessment?

The hazard assessment is the foundation the rest of the plan sits on. Skip it or rush it, and every section that follows is built on guesswork.

Start with a physical walkthrough. Go through every area where employees work, including storage areas, parking lots, loading docks, and any remote or field locations. Look for conditions that could hurt someone: unguarded machinery, poor lighting, cluttered walkways, badly stored chemicals, electrical hazards, ergonomic problems at workstations.

Then pull your injury and near-miss data. Your OSHA 300 log, if you're required to keep one, is a map of where your hazards cluster. Even if you're not required to keep the 300 log, track incidents internally anyway. The Bureau of Labor Statistics reported 2.8 million nonfatal workplace injuries and illnesses in private industry in 2022, with falls, slips, and trips as the leading event type, followed by overexertion and contact with objects ^[8]. Those categories belong on your assessment checklist by default.

For each hazard you find, write down three things: what the hazard is, who is exposed and how often, and what controls are in place now. That documentation becomes the core of your written hazard assessment, which 29 CFR 1910.132(d) requires you to certify in writing when PPE decisions are involved ^[6].

Job Hazard Analysis (JHA), also called Job Safety Analysis (JSA), breaks a specific task into steps and names the hazard at each step. OSHA publishes a free guide on the method (OSHA 3071) ^[13]. Doing it for every job is tedious, so prioritize: start with tasks that have caused injuries before, tasks with high consequences if something goes wrong, and tasks that are new or rarely performed.

Don't lean only on your own walkthrough. Talk to the people doing the work. Workers almost always know where the real risks are. They also know which safety rules get ignored because they're impractical, which is exactly the information you need to write a plan people will actually follow.

What should a workplace safety plan actually look like?

There's no OSHA-mandated format. Write it in Word, put it in a binder, or store it digitally, as long as employees can get to it. Content is what matters, not presentation.

A working plan for a small to mid-size employer usually has these sections:

Policy statement. A short statement from the owner or senior manager committing to safe working conditions and naming who is accountable for the program. One paragraph is enough.

Scope. Which locations, employees, and operations the plan covers.

Responsibilities. Who does what. Owner, supervisors, workers, and any designated safety coordinator each get a specific list.

Hazard identification process. How you inspect, how often, who conducts inspections, and what happens with findings.

Hazard controls. The specific controls in place for your identified hazards, organized by hazard or by work area.

Required written programs. Either built into the main plan or referenced as attached documents. Your HazCom program, LOTO program, respiratory protection program, and others go here.

Training plan. What training each job role needs, when it happens (new hire, annual, after incident), and how you document it.

Incident reporting and investigation. How workers report injuries and near misses, how you investigate, and what you do with findings.

Emergency Action Plan. Evacuation procedures, emergency contacts, assembly points, and special procedures for the emergencies you can foresee at your location.

Program review schedule. When you'll review the whole plan, who signs off, and what triggers an unscheduled review.

Keep it specific to your workplace. Generic template language that doesn't match your actual operations is worse than useless, because it creates a false sense of compliance while real hazards go unaddressed. OSHA inspectors are trained to spot plans that were downloaded and never touched.

If writing all of this from scratch feels like too much, SafetyFolio's safety program generator walks you through the key decisions and produces site-specific documents in roughly 15 minutes, which is faster than most owners spend hunting for templates.

How do you train employees on the safety plan?

A written plan nobody has read protects no one and won't impress an OSHA inspector.

Training requirements live inside the specific standards that apply to your workplace. For hazard communication, 29 CFR 1910.1200(h) requires training at the time of initial assignment and whenever a new hazard is introduced ^[2]. For lockout/tagout, 29 CFR 1910.147(c)(7) requires authorized employees, affected employees, and other employees to each get appropriate training, with retraining when there's reason to believe they don't understand the procedure ^[3]. For PPE, 29 CFR 1910.132(f) requires training before an employee uses PPE, covering when PPE is necessary, what type to use, how to put it on and take it off, and its limits ^[6].

A few things that trip up small employers:

Documentation matters. For almost every training requirement, OSHA expects you to prove training happened. The floor is a dated sign-in sheet with the topic covered and the trainer's name. Some standards, like respiratory protection (29 CFR 1910.134), require more detailed records ^[12].

Language matters. If workers don't speak English as their primary language, training in English doesn't satisfy the requirement. OSHA's letter of interpretation from March 2002 states that training must be presented "in a manner and language that the employee can understand" ^[9].

Training has to go both ways. Reading a policy at people doesn't count. Workers need the chance to ask questions and show they understood.

New hires need training before they start the work, not at the end of their first week. The standard language in most training requirements is "prior to initial assignment" or "before performing the task."

For forklift operators, 29 CFR 1910.178(l) requires formal instruction, practical training, and an evaluation. If you're in Washington State, check the extra state-level rules through the forklift certification requirements before you put anyone on a powered industrial truck.

How do you write an emergency action plan as part of your safety plan?

The Emergency Action Plan (EAP) is required under 29 CFR 1910.38 for any employer with more than 10 employees, and it must be in writing ^[7]. Employers with 10 or fewer can communicate the plan out loud, but putting it in writing is better practice no matter your size.

At minimum, your EAP must include:

• Procedures for reporting a fire or other emergency
• Procedures for emergency evacuation, including exit routes and assignments
• Procedures for employees who must stay to run critical equipment before evacuating
• Procedures to account for all employees after evacuation
• Rescue and medical duties for any employees assigned to perform them
• Names or job titles of people to contact for more information about the plan

The EAP has to match your actual building. Post the evacuation map. Name specific assembly points. Assign floor wardens if you have multiple floors or large areas. Run a drill at least once a year. Document the drill.

Think through your real foreseeable emergencies. A restaurant faces different scenarios than a cabinet shop. Chemical releases, power outages, severe weather, active threat situations, and medical emergencies each deserve a written procedure if they're realistic risks at your location.

One thing most EAPs miss: coordination with local emergency services. Know your fire department's non-emergency line. If you have hazardous chemicals on site, OSHA's Process Safety Management standard (29 CFR 1910.119) and EPA's Risk Management Program may require you to share information with local emergency planners. Even below those thresholds, calling your local fire station to walk them through your building once is a good idea.

What records do you need to keep for your safety plan?

Recordkeeping shows up in two places: the general injury and illness rules (29 CFR Part 1904) and the documentation requirements buried inside specific standards.

Under Part 1904, employers with more than 10 employees in non-exempt industries must keep an OSHA 300 Log, complete an OSHA 301 Incident Report within seven calendar days of each recordable injury or illness, and post the OSHA 300A Summary from February 1 through April 30 each year ^[4]. Certain high-hazard industries must submit their 300A data to OSHA electronically every year.

Beyond Part 1904, here are the retention rules baked into common standards:

Record type	Retention period	Standard
OSHA 300 Log	5 years	29 CFR 1904.33
Training records (LOTO)	Duration of employment + 1 year	29 CFR 1910.147
Respiratory protection fit test records	Until next fit test	29 CFR 1910.134
PPE hazard assessment certification	Not specified (keep indefinitely)	29 CFR 1910.132
Medical records (exposure-related)	30 years after employment ends	29 CFR 1910.1020
Bloodborne pathogens training records	3 years	29 CFR 1910.1030

The 30-year retention rule for medical records under 29 CFR 1910.1020 catches many employers off guard. If you exposed workers to asbestos, lead, or other regulated substances, those records need a formal retention and transfer protocol even if your business closes.

For the safety plan itself, no single OSHA standard says how long to keep it, but the practical answer is five years for current and prior versions. If OSHA investigates an incident from two years ago, they'll want to see what the plan said back then.

What does OSHA look for when they inspect your safety plan?

OSHA inspectors don't grade you on how thick your binder is. They check whether your written programs match what's actually happening on the floor.

The common citation patterns tied to safety programs:

Missing required written programs. If the standard says you need a written program and you don't have one, that's a citation. Hazard communication, lockout/tagout, and respiratory protection are the most frequently cited.

Written programs that aren't site-specific. A generic template with placeholder text that doesn't reflect your chemicals, your machines, or your procedures gets cited as inadequate. Inspectors ask workers about the program and notice fast when nobody's seen it.

Inadequate or undocumented training. The inspector asks workers how they were trained, on what topics, and when. If workers can't answer, or their answers contradict the records, that's a problem.

Machine-specific LOTO procedures that don't exist. 29 CFR 1910.147 requires written procedures for each piece of equipment unless a single procedure clearly covers multiple similar machines. Generic "lock it out" instructions don't satisfy this.

No proof the plan is being reviewed. If the plan is dated 2019 and nothing has changed since, the inspector will wonder whether you're managing safety or just storing paperwork.

OSHA inspections come from programmed inspections in high-hazard industries, employee complaints (which can be anonymous), referrals from other agencies, and fatalities or severe injuries (which trigger mandatory inspections under 29 CFR 1904.39). You don't always get advance notice.

The average OSHA penalty for a serious violation in FY2023 was around $15,625, and willful violations can reach $156,259 per violation ^[10]. A well-kept written safety plan cuts your citation risk and gives you something to point to as good faith if a citation does land.

How often should you update your workplace safety plan?

The baseline answer is annually. But several specific events should trigger a review right away, schedule or no schedule.

Update your plan when you bring in new equipment, chemicals, or work processes. This isn't just good practice. Some standards demand it. The hazard communication standard requires you to update your chemical inventory and keep Safety Data Sheets current when new chemicals arrive ^[2].

Update after any serious incident or near miss. An incident investigation that produces no change to the plan is probably incomplete. If the controls were adequate and followed, the incident shouldn't have happened. Either the controls failed or they weren't followed, and either finding points to a revision.

Update when regulations change. OSHA revises standards, and State Plans can adopt stricter rules on their own timeline. Sign up for OSHA's free QuickTakes newsletter and follow your state plan's update notices.

Update when your workforce shifts a lot. High turnover means your training documentation needs steady upkeep. New job classifications or new contractors on site can add hazards your current plan doesn't cover.

Update when a walkthrough shows the plan doesn't match reality. Compare what workers are actually doing against what the plan says they should. Gaps there are the most common source of OSHA violations.

Document every review with a date and the name of whoever did it. Even if the review finds nothing to change, write that down. It shows the plan is alive, not a filing cabinet trophy.

Can a small business build a safety plan without hiring a consultant?

Yes. Most small businesses in low-to-moderate-hazard industries can build a compliant safety plan without outside help. The process takes time, not expertise you're missing.

OSHA offers free resources that are genuinely useful:

• OSHA's On-Site Consultation Program provides free, confidential safety consultations funded through OSHA but run separately from enforcement. The consultant walks your facility, identifies hazards, and helps you prioritize. Requesting this visit cannot trigger an enforcement inspection ^[11]. This is one of the most underused programs OSHA runs.
• OSHA's website has free sample written programs for hazard communication, respiratory protection, lockout/tagout, and several other standards. Search osha.gov for "sample written program."
• OSHA 3071 (Job Hazard Analysis), OSHA 3132 (Process Safety Management), and similar publications are free PDF downloads from osha.gov ^[13].

Where consultants earn their fee: highly hazardous operations (PSM-covered processes, confined space entry, high-fall-risk construction), multi-employer worksites with complex coordination, and businesses already sitting on citations they need to correct. For a 20-person manufacturing or retail operation, you can do this yourself.

If you want to skip the formatting and structure work without paying consultant rates, SafetyFolio's program generator asks about your specific hazards, operations, and workforce and produces the written documents you need, organized by standard.

The honest time estimate: four to eight hours for a first-time plan at a small business, spread over a couple of sessions. The hazard assessment walkthrough and the training records review eat the most time. The writing itself, once you know what to say, goes fast.

Frequently asked questions

Is a workplace safety plan required by OSHA?

OSHA doesn't require one single document called a "workplace safety plan," but it does require written programs for specific hazards, including chemicals (29 CFR 1910.1200), energy control (29 CFR 1910.147), emergency action (29 CFR 1910.38), and others. In practice, almost every employer needs multiple written programs, and combining them into one plan is the sensible approach.

What is the difference between a safety plan and a safety program?

The terms get used interchangeably in most contexts. OSHA's own guidance uses "Safety and Health Program" as the umbrella term for the full system covering hazard identification, controls, training, and recordkeeping. A "plan" usually means either the same thing or a specific component, like an Emergency Action Plan or a Fall Protection Plan. The document titles matter less than what's inside them.

How long does it take to write a workplace safety plan?

For a small business in a low-to-moderate-hazard industry, expect four to eight hours total across multiple sessions. The hazard assessment walkthrough takes the most time. Using OSHA's free sample programs as starting points, or a structured generator tool, cuts the writing time a lot. Don't rush the hazard identification step. That part needs real time on the floor.

Does a business with fewer than 10 employees need a written safety plan?

Businesses with 10 or fewer employees are exempt from OSHA's injury and illness recordkeeping requirements under 29 CFR 1904.1, but they are NOT exempt from written program requirements in standards like hazard communication or lockout/tagout. The Emergency Action Plan can be communicated verbally (not in writing) for employers under 10 employees, per 29 CFR 1910.38(e)(3). Size exemptions are narrow.

What is the General Duty Clause and how does it relate to a safety plan?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm. OSHA uses this clause to cite hazards not covered by a specific standard. A documented safety plan that identifies and controls hazards is your primary defense against General Duty Clause citations, because it shows you recognized the hazard and acted on it.

What are the most commonly cited OSHA violations related to safety programs?

In recent years, the top citation categories consistently include fall protection (29 CFR 1926.501), hazard communication (29 CFR 1910.1200), respiratory protection (29 CFR 1910.134), lockout/tagout (29 CFR 1910.147), and powered industrial trucks (29 CFR 1910.178). Most of these cite either missing written programs or programs that exist but don't match actual workplace conditions or training records.

Do state OSHA plans have different safety plan requirements?

Yes. The 22 states and territories with OSHA-approved State Plans can have requirements stricter than federal OSHA. California's IIPP requirement under Title 8 CCR 3203 applies to every employer in the state with no size exemptions, and Washington State has its own Division of Occupational Safety and Health (DOSH) rules. Always check your state plan's requirements in addition to federal OSHA standards.

Can I use a free template for my workplace safety plan?

Free templates from osha.gov are a legitimate starting point, especially for standard-specific programs like hazard communication. The step that counts is customizing them to your actual workplace: your specific chemicals, machines, job tasks, and emergency scenarios. An uncustomized template with placeholder text can hurt you in an inspection because it signals the plan isn't actively managed. Replace generic language with site-specific detail.

What should a safety plan include for a small retail or office business?

Even low-hazard workplaces need an Emergency Action Plan (evacuation routes, emergency contacts), a Hazard Communication Program if any cleaning chemicals are used, a general safety policy with named accountability, and a basic incident reporting procedure. If employees use ladders, carry heavy items, or run any powered equipment, add the relevant controls. The plan can be short. Five to ten pages covers most retail and office operations.

How do you conduct a Job Hazard Analysis (JHA)?

A JHA breaks a job task into discrete steps, names the hazard at each step, and documents the control. Start by listing every step in sequence for a specific task. For each step, ask what could go wrong and who could be hurt. Then assign a control from the hierarchy: eliminate, substitute, engineer out, add an administrative procedure, or require PPE. OSHA's free publication OSHA 3071 gives a step-by-step guide with example worksheets.

What records do you need to keep as part of a workplace safety plan?

At minimum: OSHA 300 Log and 300A for five years (if required by your size and industry), training records showing who was trained, on what, and when, incident investigation reports, hazard assessment certifications, and the written programs themselves. Exposure-related medical records under 29 CFR 1910.1020 must be kept 30 years after the employee's last day. Keep prior versions of your safety plan for at least five years.

What is OSHA's free On-Site Consultation Program?

OSHA funds a network of state-run consultation programs that send safety professionals to small and mid-size businesses for free, confidential hazard assessments. These visits are separate from OSHA enforcement, and requesting one cannot trigger an inspection. The consultant identifies hazards, helps you prioritize fixes, and reviews your written programs. You can find your state's program through osha.gov/consultation.

How do you write a safety plan for a construction site?

Construction safety plans are governed mainly by 29 CFR Part 1926 rather than Part 1910. Key required written programs include a fall protection plan (29 CFR 1926.502 where required), a hazard communication program, an excavation/trenching plan if applicable, a respiratory protection program, and an Emergency Action Plan. The plan needs to be site-specific because construction hazards change as the project moves. Update it as phases change.

What happens if OSHA finds your safety plan is inadequate during an inspection?

An inadequate or missing written program usually draws a Serious citation, with penalties up to $15,625 per violation as of FY2023. Willful or repeated violations can reach $156,259 per instance. OSHA sets an abatement period requiring you to fix the deficiency. Beyond the fine, an inadequate program weakens your legal position in any injury lawsuit, because it's evidence you failed to exercise reasonable care.

Sources

1. OSHA, OSH Act of 1970 Section 5(a)(1) General Duty Clause: The General Duty Clause requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm
2. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: 29 CFR 1910.1200 requires a written Hazard Communication Program and training in a language workers can understand
3. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147 requires a written energy control program and machine-specific procedures
4. OSHA, 29 CFR Part 1904 Recording and Reporting Occupational Injuries and Illnesses: Employers with 10 or fewer employees in low-hazard industries are exempt from OSHA injury and illness recordkeeping but not from written program requirements
5. OSHA, Safety and Health Program Management Guidelines (54 Federal Register 3904, January 26, 1989): OSHA's Safety and Health Program guidelines describe eight core elements including management leadership, worker participation, hazard identification, and program evaluation
6. OSHA, 29 CFR 1910.132 Personal Protective Equipment General Requirements: 29 CFR 1910.132(d) requires a written hazard assessment certification when PPE decisions are made; 29 CFR 1910.132(f) requires training before use
7. OSHA, 29 CFR 1910.38 Emergency Action Plans: 29 CFR 1910.38 requires a written Emergency Action Plan for employers with more than 10 employees, covering evacuation routes, emergency contacts, and employee accounting procedures
8. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2022: BLS reported 2.8 million nonfatal workplace injuries and illnesses in private industry in 2022, with falls, slips, and trips as the leading event type
9. OSHA, Letter of Interpretation, Training in a Language Workers Understand, March 2002: OSHA confirmed that training must be conducted in a manner and language non-English-speaking workers can understand
10. OSHA, Penalties and Citation Policy (OSHA Penalty Schedule FY2023): Serious violations carry penalties up to $15,625 per violation and willful or repeated violations up to $156,259 per violation as of FY2023
11. OSHA, On-Site Consultation Program: OSHA's On-Site Consultation Program provides free, confidential safety visits to small and mid-size businesses; requesting a consultation cannot trigger an enforcement inspection
12. OSHA, 29 CFR 1910.134 Respiratory Protection: 29 CFR 1910.134 requires a written respiratory protection program and fit test records retained until the next fit test
13. OSHA, Job Hazard Analysis (OSHA 3071, 2002 revised): OSHA publication 3071 provides a methodology for conducting Job Hazard Analysis with step-by-step worksheets