Home/ Workplace Safety (OSHA)/ Guide № 42

Building a Safety Program: OSHA's Recommended Practices

OSHA's Recommended Practices distill decades of enforcement into seven elements — management leadership, worker participation, hazard identification, prevention, training, evaluation, and multi-employer coordination. The build order that works for small businesses.

LegalWorkplace.com Staff Reviewed Sep 2026 · 9 min read

Building a Safety Program: OSHA's Recommended Practices

The payoff

A real program earns good-faith penalty reductions, defends against willful classification, and is the substance behind lower injury and comp costs.

The core loop

Find hazards → fix them on a dated record → verify the fix — an open hazard log with no close dates is discovery material, not a program.

The hierarchy

Controls rank: elimination, substitution, engineering, administrative, PPE — PPE is the last resort, not the plan.

Not legal advice. Educational guide to general U.S. employment law. Rules vary by state — consult an employment attorney for specific cases.

Why a program, legally

A safety and health program isn't federally mandated as such — but it's the connective tissue of everything that is. It earns good-faith penalty reductions up to 25% under the penalty rules, rebuts willfulness (plain indifference is hard to prove against a documented, functioning program), organizes the written programs specific standards require, and drives the injury numbers that set workers' comp premiums. California and several other state plans go further and mandate one. OSHA's Recommended Practices — the framework below — is the agency's own statement of what it considers a functioning program, which makes it the natural template.

The seven elements

Management leadership

A written policy, named responsibilities, and budget — safety goals that appear in management evaluations, not just posters.

Worker participation

Hazard reporting without fear, involvement in inspections and investigations, visible follow-through — protected by anti-retaliation rules with real teeth.

Hazard identification

Routine inspections, incident and near-miss investigation, review of the 300 log and comp data for patterns, SDS review for chemical hazards.

Hazard prevention and control

The hierarchy of controls — elimination, substitution, engineering, administrative, PPE — applied on a dated corrective-action log that closes.

Training

Standard-required training plus program training, in languages workers understand, documented per session.

Evaluation and improvement

Annual review: are hazards being found, fixed, and staying fixed? Injury trends, action-item aging, training coverage.

Multi-employer coordination

Host and staffing/contractor employers align on who protects whom — temp workers are cited to the supervising employer.

The written programs standards require

Whatever the umbrella looks like, specific standards mandate written documents wherever their hazards exist: hazard communication (any workplace chemicals — the most-cited paperwork violation in general industry), emergency action and fire prevention plans, PPE hazard assessments (written certification required), lockout/tagout procedures for equipment maintenance, bloodborne pathogens exposure control where first-aid duties exist, and respiratory protection where respirators are used. Inventory which apply — most offices need two or three; most shops need six — and build them from OSHA's templates rather than from scratch. These are the documents the inspector requests by name.

The 90-day build

Month one: policy signed, responsibilities assigned, the applicable written programs identified, and a wall-to-wall hazard inspection producing the first corrective-action log. Month two: fix the log's top items through the hierarchy of controls, stand up the reporting channel, and deliver the standard-required training with sign-in records. Month three: run one incident or near-miss investigation end to end, brief management on the metrics (hazards found/closed, training coverage, log trends), and calendar the annual cycle — program review, 300A posting, refresher training. Small employers should also know OSHA's free On-Site Consultation Program: confidential, separate from enforcement, and it visits, finds hazards, and helps build exactly this — the rare free lunch in compliance.

Frequently asked questions

Is a written safety program legally required?

The umbrella program is recommended, not federally mandated — but specific standards require written programs where their hazards exist: hazard communication (any workplace chemicals), lockout/tagout, PPE hazard assessments, emergency action plans, bloodborne pathogens, respiratory protection. Most businesses are legally required to have several without knowing it. Some state plans (California's IIPP foremost) do mandate a comprehensive written program.

What does 'worker participation' mean concretely?

Employees report hazards without fear, join inspections and incident reviews, and see their reports acted on. The legal edge: OSHA's anti-retaliation rules protect safety reporting, and programs that discipline or disincentivize injury reporting — safety bonuses that pay for low reported numbers — can themselves violate the rules.

How do we run incident investigations that help rather than hurt?

Investigate for root causes, not blame: 'why did the guard come off' beats 'who removed it.' Document the causal chain and the corrective actions, complete them on dates, and verify. What hurts: findings that identify hazards which then sit uncorrected — the recognition evidence for a later willful or General Duty citation.

What safety training does OSHA require?

Training obligations attach to dozens of standards — hazard communication, PPE, lockout/tagout, forklifts, fall protection among the most common — in a language and vocabulary workers understand. Document everything: topic, date, trainer, attendees, and comprehension verification. Undocumented training is untrained employees, evidentially.