Written Safety Programs and Plans: What Employers Must Have

Federal and state occupational safety regulations require employers to maintain specific written safety programs and plans as a condition of compliance — not as optional best practice. These documents establish the formal framework through which hazard controls, training requirements, emergency procedures, and employee responsibilities are operationalized and verified. Understanding which written programs are mandated, what each must contain, and how OSHA evaluates them during inspections is essential knowledge for any employer operating under the general framework of workplace safety obligations.

Definition and scope

A written safety program is a formal, documented set of policies, procedures, and responsibilities that describes how an employer will identify, control, and manage a specific occupational hazard or regulatory requirement. Written plans differ from informal practices in that they are required to exist in retrievable form, address defined elements prescribed by regulation, and be made available to employees and OSHA compliance officers on request.

OSHA mandates written programs under specific standards in 29 CFR Part 1910 (general industry), 29 CFR Part 1926 (construction), and related subparts. Not all OSHA standards require written documentation — the obligation arises when a standard explicitly uses language such as "the employer shall establish a written program" or "a written plan is required." The distinction matters: the absence of a required written program is itself a citable violation, independent of whether actual hazard exposures occurred.

The scope of required written programs spans 4 broad regulatory categories:

1. Hazard communication — Written Hazard Communication Programs under 29 CFR 1910.1200 must describe how the employer manages Safety Data Sheets, container labeling, and employee training on chemical hazards.
2. Energy control — Lockout/tagout programs under 29 CFR 1910.147 must document procedures for each piece of equipment with hazardous energy sources.
3. Respiratory protection — Written programs under 29 CFR 1910.134 must cover respirator selection, medical evaluation, fit testing, and maintenance.
4. Emergency preparedness — Written Emergency Action Plans under 29 CFR 1910.38 are required for employers with more than 10 employees in covered workplaces.

Additional standards — including those governing confined space entry, fall protection, and bloodborne pathogens (29 CFR 1910.1030) — carry independent written program requirements.

How it works

Each OSHA standard that mandates a written program specifies the minimum elements that document must contain. A compliant written program functions through 4 operational phases:

1. Scope determination — The employer identifies which OSHA standards apply based on industry classification (SIC/NAICS code), the specific hazards present, and workforce size. For example, the Bloodborne Pathogens standard applies to employers with workers who have occupational exposure to blood or other potentially infectious materials, regardless of industry sector.

2. Document drafting — The program is drafted to include all elements named in the applicable standard. A Hazard Communication Program, for instance, must identify the workplace chemical inventory, describe labeling procedures, specify how SDSs are maintained and accessed, and detail the training program. Generic template programs that omit site-specific procedures are a common citation target.

3. Employee access and training — Written programs generally must be accessible to employees during their shifts. The Respiratory Protection standard (29 CFR 1910.134) specifically requires that the written program be available for employee review. Training records corroborating that employees received instruction on program contents support compliance documentation.

4. Review and update cycles — Most standards require periodic review — annually in the case of the Bloodborne Pathogens Exposure Control Plan — or whenever workplace conditions change in a way that affects the program's accuracy or adequacy.

Written programs feed directly into a broader safety management system, functioning as the documented evidence layer that auditors and compliance officers examine to verify that controls exist in practice, not just in principle.

Common scenarios

Construction employers with multi-trade operations — A construction employer covered under 29 CFR Part 1926 may require written programs for hazard communication, fall protection (29 CFR 1926.502), confined space work, and a site-specific Safety and Health Program. Multi-employer worksites complicate this: the controlling employer is responsible for ensuring all subcontractors comply with applicable written program requirements.

Healthcare facilities — A hospital or outpatient clinic must maintain a written Bloodborne Pathogens Exposure Control Plan under 29 CFR 1910.1030, a written Hazard Communication Program, and typically a written Respiratory Protection Program. The Exposure Control Plan must be reviewed and updated at least annually (OSHA Bloodborne Pathogens standard, 29 CFR 1910.1030(c)(1)(iv)).

Manufacturing operations with chemical processes — A facility using hazardous chemicals in quantities exceeding threshold quantities under OSHA's Process Safety Management standard (29 CFR 1910.119) must produce a written Process Safety Management program — one of the most document-intensive OSHA requirements, encompassing process hazard analyses, operating procedures, mechanical integrity documentation, and management of change protocols.

Small employers with fewer than 11 employees — OSHA's Emergency Action Plan requirement at 29 CFR 1910.38 permits employers with 10 or fewer employees to communicate the plan orally rather than in writing. This is one of the few OSHA exemptions from a written program requirement based on employer size.

Decision boundaries

Determining which written programs apply to a given employer requires answering 3 threshold questions:

1. Does the specific OSHA standard explicitly require a written program?
Not every OSHA standard carries a written documentation mandate. The Personal Protective Equipment standards (29 CFR 1910.132–1910.138) require a hazard assessment and selection process, but the written certification requirement applies specifically to the assessment — not a comprehensive written PPE program. Employers must read the operative language of each standard rather than assuming uniform documentation requirements.

2. Is the employer subject to federal OSHA or a state plan?
28 states and territories operate OSHA-approved State Plan programs that may impose written program requirements beyond federal minimums. California's Cal/OSHA, for example, requires an Injury and Illness Prevention Program (IIPP) under California Labor Code Section 6401.7 — a requirement with no direct federal OSHA equivalent. Employers in state plan jurisdictions must evaluate both the federal standard and the state-specific overlay.

3. Does employer size trigger a threshold modification?
Several standards modulate requirements based on employee count. The Emergency Action Plan oral communication exemption for employers with 10 or fewer employees at 29 CFR 1910.38(b) is the most frequently cited example. The Fire Prevention Plan at 29 CFR 1910.39 contains an identical size-based oral option.

Written programs are distinct from written procedures. A lockout/tagout program establishes the organizational framework; individual machine-specific lockout procedures are separate documents required in addition to the program itself (29 CFR 1910.147(c)(4)). Treating these as interchangeable is a structural error that produces citation exposure even when a program document exists.

The full landscape of safety obligations — including recordkeeping, inspection response, and voluntary program opportunities — is catalogued across the reference resources available on the workplace safety authority home.