Written safety program: what it is, what OSHA requires, and how to build one

Last updated 2026-07-09

What is a written safety program, exactly?

A written safety program is a document, or set of documents, that describes how your business finds hazards, controls them, trains employees, and responds when something goes wrong. It is not a poster on the wall. It is not a verbal policy you repeat at the morning huddle. OSHA draws a hard line between the two, and inspectors will ask to see the paper (or the file).

The broadest version is sometimes called a Safety and Health Program, an Injury and Illness Prevention Program (IIPP), or a Safety Management System. These terms get used interchangeably, but they mean roughly the same thing: a written framework that covers your whole operation rather than one specific hazard.

Below that umbrella, OSHA requires separate written programs for specific hazards. Hazard communication, lockout/tagout, respiratory protection, bloodborne pathogens, and emergency action plans each carry their own written-program requirement buried in their standards. A company with 12 employees who do maintenance on electrical equipment, spray paint, and work near forklifts could easily owe five or six distinct written documents under federal law.

For a look at what a program should cover at the structural level, see our guide on a safety and health program should be.

Does OSHA actually require a written safety program for my business?

The honest answer is: it depends on your hazards, your state, and your size. For most businesses with more than a handful of employees, the answer is yes, at least for specific hazard-based programs.

Federal OSHA has no single standard saying every employer must keep one written program covering everything. What it has is dozens of individual standards that each require a written program for that hazard. The most commonly triggered ones sit in the table below. If any of those hazards exist at your workplace, the written program is not optional.

OSHA Standard	What Requires a Written Program
29 CFR 1910.119 (PSM)	Full process safety management program
29 CFR 1910.132 (PPE)	Written hazard assessment certification
29 CFR 1910.134 (Respiratory Protection)	Written respiratory protection program
29 CFR 1910.147 (Lockout/Tagout)	Written energy control program
29 CFR 1910.1030 (Bloodborne Pathogens)	Written exposure control plan
29 CFR 1910.1200 (Hazard Communication)	Written hazard communication program
29 CFR 1910.38 (Emergency Action Plan)	Written EAP (11+ employees) [1]
29 CFR 1926.59 (Construction HazCom)	Written hazard communication program

State-plan states add more. California requires every employer, regardless of size, to keep a written Injury and Illness Prevention Program under California Labor Code Section 6401.7. ^[2] If you operate in a state-plan state, check the state rules, because they run broader than federal minimums more often than not. For how New York handles this, see our New York safety program overview.

BLS data from 2023 recorded 2.6 million nonfatal workplace injuries and illnesses in private industry. ^[3] Employers with documented safety programs consistently show lower injury rates, though nobody has clean controlled data on this. The closest large-scale figure OSHA cites is its own analysis of Voluntary Protection Program participants, which found injury and illness rates roughly 50 percent below industry averages. ^[4]

What does a written safety program need to include?

The contents depend on which standard triggers the requirement, but there is a common structure that satisfies most programs and gives you a solid baseline even where no specific standard applies.

Every written safety program should include, at minimum: a management commitment statement (who is responsible, what authority they have, what resources are committed), a hazard identification process (how you find hazards before someone gets hurt), hazard controls (what you do about what you find), employee training requirements (who gets trained, on what, by when, and how often), incident investigation procedures (what happens after a near-miss or injury), and a review schedule (how often the program gets revisited).

For hazard-specific programs, the standard itself spells out what else goes in. Take 29 CFR 1910.134 on respiratory protection. The standard requires the written program to cover procedures for selecting respirators, medical evaluations, fit testing, use, maintenance, and training. ^[5] Copy a generic template and skip the fit-testing section, and the program fails on inspection.

A few things get left out often and cited often:

• Named, specific job titles with safety responsibilities (more than "management")
• A dated signature or approval showing management reviewed it
• Procedures specific to your actual tasks, not generic boilerplate
• Documentation of how employees were told the program exists

That last one catches people off guard. Having the document is half the job. OSHA expects you to show that workers know it exists and know how to find it.

How is a written safety program different from a safety manual or safety policy?

People use these terms as if they mean the same thing. They do not.

A safety policy is a short statement of intent. "This company is committed to employee safety." That is a policy. Useful as a preamble, but it is not a program.

A safety manual is usually a larger reference document, often 50 to 100 pages, that covers many topics in one binder. It can hold your written programs as chapters, or it can be a pile of general guidance with no real procedural content. The manual format is popular with consultants because it looks thorough. It can also be close to useless if workers never open it and managers never enforce it.

A written safety program is procedural. It says what to do, who does it, when, and how. To meet OSHA requirements, the procedures have to match your actual workplace, not a generic file downloaded off the internet and forgotten.

Here is the practical difference. An OSHA inspector asks how employees learn about new chemical hazards in your facility. Your manual says "employees will be trained on chemicals." You cannot describe the actual process. You have a manual, not a program.

Can I use a free written safety program template?

Yes, and a good template is a legitimate starting point. But a template is a frame, not a finished house.

OSHA itself publishes free templates. The agency's website offers sample programs for specific standards, including a model written hazard communication program and a model respiratory protection program. ^[6] These are legally grounded starting points, and there is no reason not to use them.

The problem with generic templates, free or paid, is that they are written to fit everyone. They use placeholder language like "[insert company name]" and "[describe process here]." File them without filling in those blanks with your procedures, your materials, and your job roles, and they are not compliant programs. They are blank forms.

Check a few things before you trust any template:

1. Does it cite the specific CFR standard it is written to comply with? 2. Does it include every required element from that standard? 3. Does it have placeholder fields that force you to describe your operations? 4. Does it include a review and revision date field?

If you want to build multiple programs at once without hiring a consultant, SafetyFolio's safety program generator walks you through each required element for your industry and hazards in about 15 minutes per program. Any approach works, though, as long as you end up with site-specific, documented procedures rather than a binder of unfilled blanks.

For how workplace training connects to the program, see our article on workplace safety training.

How do you write a written safety program step by step?

Here is the sequence that actually works for a small business owner doing this without a consultant.

Step 1: List your hazards first, not your programs. Walk your facility or job sites and write down every hazard category you find. Chemicals, electrical equipment, heights, heavy equipment, confined spaces, blood or bodily fluids, noise, heat. Do not start with a template. Start with your operation.

Step 2: Match each hazard to an OSHA standard. For each hazard, figure out whether a specific OSHA standard governs it and whether that standard requires a written program. OSHA's standards search tool makes this straightforward. ^[7] If a standard requires a written program, that program goes on your to-do list.

Step 3: Draft each program using the standard's required elements. Open the standard. Most have a paragraph that reads something like "the employer shall develop a written program that includes..." followed by a list. Write to that list. Use OSHA's sample programs where they exist. Fill every blank with your company specifics.

Step 4: Get a management signature and a date. This sounds trivial. It matters. An undated, unsigned program looks like it was written the day before the inspection. A signed, dated document shows ongoing management commitment.

Step 5: Train employees and document it. A program employees have never seen is a program that does not work. Train new hires, log attendance, keep the records. For many standards, training documentation is a separate requirement from the written program itself.

Step 6: Set a review date and keep it. Most programs should be reviewed annually or any time your operations, materials, or staffing change in a meaningful way. Write the next review date on the cover page. Put it in your calendar.

For a small business with five to ten hazard categories, the whole process usually takes one to two full days if done honestly. A full safety manual for a 50-person manufacturer might take a week. Neither timeline requires a consultant. Just time and attention to the standard's actual language.

What are the most commonly cited OSHA violations tied to written program failures?

OSHA's top 10 most frequently cited standards list has been stable for years, and written-program deficiencies run right through it. ^[8]

In fiscal year 2023, the top 10 included hazard communication (29 CFR 1910.1200), respiratory protection (29 CFR 1910.134), lockout/tagout (29 CFR 1910.147), and fall protection (29 CFR 1926.501). Nearly all of them have written program components. The most common specific failure is not a missing program. It is a program that exists on paper but does not match actual practice, or one that skips required elements.

Common reasons programs fail inspection:

• The program references chemicals or tasks the facility no longer uses (outdated)
• Responsibilities are listed as "the safety committee" rather than named positions
• Training frequencies required by the standard are not documented as completed
• The program was clearly downloaded without customization (the inspector sees blank fields or generic language)
• The emergency action plan lists a phone number for someone who left the company years ago

OSHA penalty amounts were adjusted for inflation in January 2024. Serious violations carry a maximum penalty of $16,131 per violation. Willful or repeated violations go up to $161,323 per violation. ^[9] For a small business, a single lockout/tagout citation covering multiple machines can turn into a six-figure problem fast.

How often do you need to update a written safety program?

Specific standards set their own review timelines, and those override any general guidance.

For bloodborne pathogens (29 CFR 1910.1030), the exposure control plan must be reviewed and updated at least annually and whenever new tasks or procedures affect occupational exposure. ^[10] For process safety management (29 CFR 1910.119), process safety information and procedures have their own review triggers tied to process changes. Most other programs do not carry an explicit annual requirement in the standard, but OSHA's general guidance and most compliance consultants treat annual review as the baseline.

Beyond annual reviews, update a written program any time:

• You add a new chemical, process, or piece of equipment the current program does not cover
• A regulatory change affects the standard the program is built on
• An incident or near-miss shows your procedures were wrong or incomplete
• Key personnel with named safety responsibilities change roles or leave
• You add a new facility or shift structure

The review does not have to be a full rewrite. Many updates are a single paragraph or a procedure section. What matters is that the document reflects current reality and the revision date is updated.

Do small businesses with fewer than 10 employees need a written safety program?

For some requirements, employee count matters. For most, it does not.

The emergency action plan under 29 CFR 1910.38 is the clearest size-based exception. If you have 10 or fewer employees, you may communicate the plan orally instead of in writing. That carve-out does not extend to other standards. A business with 6 employees using chemicals that require SDS management owes a written hazard communication program. If it has equipment requiring lockout/tagout procedures, those written procedures are required regardless of headcount. ^[1]

State-plan states are often stricter. California's IIPP requirement applies to every employer with at least one employee. No exemption for tiny businesses. ^[2]

Federal OSHA does grant a partial recordkeeping exemption for employers with 10 or fewer employees in low-hazard industries. They do not need to keep OSHA 300 logs. But that exemption is about injury recordkeeping, not written safety programs. The two are separate.

If you run a one-person operation and you are the only worker, OSHA generally does not have jurisdiction over you as a sole proprietor with no employees. Hire even one employee, and the standards apply.

How is a written safety program different in construction vs. general industry?

The standards are different. General industry falls under 29 CFR 1910. Construction falls under 29 CFR 1926. Both include written program requirements, but the hazards and triggers differ.

Construction sites have higher rates of fatal injuries than most general industry settings. BLS reported 1,075 construction fatalities in 2022, accounting for nearly 20 percent of all worker fatalities. ^[3] OSHA's focus in construction reflects that: fall protection plans (29 CFR 1926.502), confined space entry procedures (29 CFR 1926.1204), and site-specific safety and health programs for larger projects all carry written documentation requirements.

One practical difference: construction programs often need to be site-specific and job-specific rather than company-wide. A contractor working five different project types in a year may need to adapt the program for each site. General industry programs tend to be more static because the workplace does not change as often.

Another difference is multi-employer worksite rules, which hit construction more often. When a general contractor and multiple subs share a site, each carries some responsibility for the written programs governing shared hazards. That layering is less common in general industry.

The core structure of a good program, hazard identification through controls, training, incident investigation, and review, holds across both sectors. The specific CFR sections you write to are what change.

What makes a written safety program actually work (more than satisfy OSHA)?

A program that exists only to pass inspection is a waste of paper. The ones that actually cut injuries share a few traits that go past checking regulatory boxes.

First, the people doing the work helped write it. Programs drafted entirely by managers and filed without worker input tend to miss real hazards and describe procedures nobody follows. Even informal input, a 20-minute conversation with the three people who do the job every day, beats a consultant who visits once.

Second, the program is short enough to use. A 90-page safety manual is a reference document. A 4-page lockout/tagout program with a clear machine-by-machine energy control table is something a supervisor pulls out when onboarding a new technician. Short, specific, and procedural beats long and padded every time.

Third, someone has accountability. Not "management" in the abstract. A named person with a job title who knows they own the program and can be asked about it.

Fourth, incidents feed back into the program. When a near-miss or injury happens and the investigation shows the written procedure was wrong, the program gets updated. Programs that never change are programs nobody uses.

For how incentive structures connect to safety outcomes, see our article on principles of effective safety incentive programs.

Where can I find free OSHA-compliant written safety program templates?

Several legitimate free sources exist. Start here before paying anyone anything.

OSHA's website publishes sample programs for specific standards. The model hazard communication program is one of the most downloaded. OSHA's On-Site Consultation Program is a free service in every state where OSHA-trained consultants visit your workplace, help you spot which programs you need, and do it without triggering enforcement. ^[6] The program is genuinely free and genuinely useful, and most small business owners have never heard of it.

NIOSH and state OSHA agencies (Cal/OSHA and Washington's L&I in particular) publish sample programs and IIPP templates. The Cal/OSHA IIPP template for small employers is one of the better general-purpose starting points even outside California, because it covers the major structural elements every OSHA program should have. ^[2]

Trade associations are another underused source. NFIB, the Associated General Contractors, the National Restaurant Association, and dozens of industry groups publish written safety program templates tuned to their members' hazards. These often beat generic OSHA templates because they speak to your industry's actual risk profile.

If you want to move faster and generate programs already structured to your industry and hazards, SafetyFolio's generator produces ready-to-customize written programs in about 15 minutes per program. The output is a starting point you still need to review and sign, not a turnkey document.

For food service businesses, our food safety certification program article covers how written programs intersect with food safety requirements.

Frequently asked questions

Is a written safety program the same as an IIPP?

An IIPP (Injury and Illness Prevention Program) is a specific type of written safety program required by several state-plan states, most notably California under Labor Code Section 6401.7. Federal OSHA does not require an IIPP by name, but it does require written programs for specific hazards. If your state requires an IIPP, it typically functions as the overarching written safety program, with hazard-specific programs sitting underneath it.

Can I write my own safety program or do I need a consultant?

You can absolutely write your own. OSHA does not require a certified consultant to author your programs. What it requires is that the program contain the elements listed in the relevant standard and reflect your actual workplace. Many small business owners write fully compliant programs using OSHA's own sample documents and their knowledge of their operations. A consultant adds value when hazards are complex or when you lack time, not because the law demands one.

How long should a written safety program be?

There is no minimum or maximum length. A lockout/tagout program for a small shop with four pieces of electrical equipment might run six to eight pages including machine-specific procedures. A process safety management program for a chemical facility could run hundreds of pages. Length should follow complexity. The common mistake is padding programs with generic language to look thorough. A short, specific, accurate document outperforms a long, vague one both on inspection and in daily use.

What happens if OSHA finds I don't have a required written safety program?

An inspector can issue a citation for missing or inadequate written programs. These are typically serious violations. As of 2024, serious violations carry penalties up to $16,131 per violation. If the same deficiency was cited in a previous inspection, it becomes a repeat violation with a maximum of $161,323. Penalty amounts adjust annually for inflation. Beyond fines, the inspector will set an abatement deadline requiring you to produce the missing program.

Does a written safety program need to be in writing or can it be digital?

Digital documents satisfy the written requirement. OSHA does not mandate paper. The key is that the program is documented, accessible to employees, and retrievable for inspection. If you store programs in a shared drive or safety management software, make sure employees know how to access them and that you can demonstrate access during an inspection. A program buried in a folder nobody opens is functionally the same as no program.

Do I need a separate written safety program for each OSHA standard that applies to me?

Technically yes, though some employers combine related programs into one document with clearly labeled sections. What matters is that every required element for each standard is present and the document is organized clearly enough for an inspector to verify compliance. Combining a respiratory protection program and a PPE hazard assessment into one document is fine as long as both sets of required elements appear. Do not combine programs if it makes either harder to find or use.

What is a hazard communication written program and who needs one?

A written hazard communication program is required by 29 CFR 1910.1200 for any employer whose workers may be exposed to hazardous chemicals. It must describe how the employer handles labeling, how SDS are maintained and made accessible, and how employees are trained on chemical hazards. Nearly every manufacturing, construction, cleaning, healthcare, and food service employer owes this program. It is consistently one of OSHA's top 10 most cited standards.

How do I document that employees have read my written safety program?

The most common method is a signed acknowledgment form listing the programs employees were oriented to and the date. Keep these in the employee's personnel file or a dedicated safety training binder. For ongoing training tied to program updates, a training log with employee names, dates, topics, and trainer signatures satisfies most standard requirements. Digital records with e-signatures work as long as they are organized and retrievable.

What is the difference between a written safety program and a job hazard analysis?

A job hazard analysis (JHA), also called a job safety analysis (JSA), breaks a specific task down step by step and identifies hazards at each step. A written safety program is broader: it covers policies, responsibilities, training requirements, and procedures for a hazard category. A JHA is often an attachment to or an output of a written safety program, especially for lockout/tagout or confined space entry where task-specific procedures are required.

Are there written safety program requirements specific to the construction industry?

Yes. Construction falls under 29 CFR 1926, which has its own written program requirements. These include fall protection plans (1926.502), confined space programs (1926.1204), and hazard communication programs (1926.59). Larger projects may require site-specific safety and health programs under the construction manager's contract, even beyond OSHA minimums. Multi-employer worksites add complexity because each employer may have independent written program obligations for shared hazards.

How do I know if my state requires an IIPP or other written safety program beyond federal OSHA?

Check whether your state runs its own OSHA-approved state plan. As of 2024, 22 states and two territories have state plans covering private employers. OSHA's website lists all state plan states and links to each state agency. State plan states must meet or exceed federal OSHA requirements, so they often add written program mandates. California, Washington, Oregon, and Michigan are among the states with the most expansive written program requirements beyond federal minimums.

What should a written safety program look like for a small business under 25 employees?

Keep it simple and specific. Start with the hazards you actually have, identify which OSHA standards require written programs for those hazards, and write each program to the elements listed in the standard. For a 20-person shop, you might need a hazard communication program, a lockout/tagout program, a PPE assessment, and an emergency action plan. Four documents, each five to fifteen pages, beats one 60-page manual nobody reads. Name real people, describe real procedures, and date everything.

Sources

1. OSHA, 29 CFR 1910.38 Emergency Action Plans: Emergency action plans must be written for employers with more than 10 employees; employers with 10 or fewer may communicate the plan orally.
2. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: BLS recorded 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023; construction accounted for roughly 20 percent of worker fatalities in 2022.
3. OSHA, Voluntary Protection Programs (VPP) overview: OSHA's analysis of VPP participants found injury and illness rates roughly 50 percent below industry averages.
4. OSHA, 29 CFR 1910.134 Respiratory Protection standard: The written respiratory protection program must cover selection, medical evaluation, fit testing, use, maintenance, and training procedures.
5. OSHA, On-Site Consultation Program for small businesses: OSHA's free On-Site Consultation Program is available in every state and helps small employers identify required written programs without triggering enforcement.
6. OSHA, Standards search tool: OSHA's standards database allows employers to look up specific CFR requirements including written program obligations for each hazard category.
7. OSHA, Top 10 Most Frequently Cited Standards FY2023: OSHA's FY2023 top 10 most cited standards included hazard communication (1910.1200), respiratory protection (1910.134), and lockout/tagout (1910.147), all of which have written program requirements.
8. OSHA, Civil Penalty Adjustments 2024: As of January 2024, OSHA serious violation maximum penalty is $16,131 per violation; willful or repeat violations carry a maximum of $161,323 per violation.
9. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens standard: The exposure control plan under the bloodborne pathogens standard must be reviewed and updated at least annually and whenever new tasks or procedures affect occupational exposure.
10. OSHA, 29 CFR 1910.1200 Hazard Communication standard: Any employer whose workers may be exposed to hazardous chemicals must develop and implement a written hazard communication program covering labeling, SDS access, and employee training.
11. OSHA, 29 CFR 1910.147 Lockout/Tagout standard: Employers must develop, document, and use energy control procedures (written) for each type of machine or equipment requiring lockout/tagout.