OSHA written safety program requirements: what you actually have to document
Key takeaways
- There is no single "OSHA safety manual" requirement — written-program obligations are scattered across individual standards.
- A written plan must be available to employees and, on request, to OSHA. "We do it but never wrote it down" is a citable gap.
- Most written-program standards also require employee training and periodic review, not just a document on a shelf.
- The fastest audit finding is a plan that names equipment, chemicals, or job titles that no longer exist on site.
Which OSHA standards actually require a written program?
OSHA written-program obligations are standard-specific. The ones that catch the most employers are Hazard Communication (29 CFR 1910.1200(e)), which requires a written hazard communication program; the Control of Hazardous Energy / Lockout-Tagout standard (29 CFR 1910.147(c)(4)), which requires documented energy-control procedures; and the Emergency Action Plan standard (29 CFR 1910.38), which requires a written plan for any employer with more than 10 employees.
Respiratory Protection (29 CFR 1910.134(c)) requires a written program administered by a suitably trained program administrator whenever respirators are required or voluntarily used. Bloodborne Pathogens (29 CFR 1910.1030(c)) requires a written Exposure Control Plan reviewed at least annually. Permit-Required Confined Spaces (29 CFR 1910.146(c)(4)) requires a written permit-space program.
What must each written plan actually contain?
A written plan is not a statement of intent — each standard specifies its contents. The Hazard Communication program, for example, must describe how the employer meets the requirements for labels, safety data sheets, and employee training, and must include a list of the hazardous chemicals known to be present.
The Lockout/Tagout energy-control procedures must spell out the scope, purpose, and specific steps for shutting down, isolating, blocking, and securing machines, plus the steps for placement, removal, and transfer of lockout devices. Generic boilerplate that does not reference your actual equipment is a recurring citation driver.
How often do written programs have to be reviewed?
Several standards set explicit review cadences. The Bloodborne Pathogens Exposure Control Plan must be reviewed and updated at least annually and whenever new tasks or procedures affect occupational exposure. Lockout/Tagout requires a periodic inspection of energy-control procedures at least annually under 1910.147(c)(6).
Even where a standard is silent on frequency, OSHA expects programs to reflect current conditions. The practical rule: review whenever you add equipment, change a process, introduce a new chemical, or reorganize the people responsible for the program.
What happens if the program exists in practice but not on paper?
When a standard uses language like "establish and implement a written program," the absence of the document is itself the violation, independent of whether the underlying practice is sound. Compliance officers routinely open inspections by asking for the written plan; an inability to produce it converts a paperwork gap into a documented serious violation.
This is why the highest-leverage compliance work is often not new controls but reconciling existing documents with the current workplace — confirming the chemical list, equipment, and named responsibilities still match reality.
Referenced standards
Frequently asked questions
Does OSHA require a single written safety manual? +
No. OSHA does not mandate one combined manual. Instead, individual standards each require their own written plan — Hazard Communication, Lockout/Tagout, Emergency Action Plans, Respiratory Protection, and others. Many employers consolidate them into one binder for convenience, but the legal obligations are per-standard.
How many employees trigger the written Emergency Action Plan requirement? +
Under 29 CFR 1910.38, an employer with more than 10 employees must keep the Emergency Action Plan in writing and available for employees to review. An employer with 10 or fewer employees may communicate the plan orally.
Does OSHA require written programs to be reviewed annually? +
Some do explicitly. The Bloodborne Pathogens Exposure Control Plan (1910.1030) must be reviewed at least annually, and Lockout/Tagout (1910.147) requires an annual periodic inspection of energy-control procedures. Other standards expect programs to be kept current even without a stated frequency.
Marcus is a Certified Safety Professional with 14 years building compliance programs for general industry and construction employers. He reviews Cairn’s regulatory guidance against the current Code of Federal Regulations and OSHA enforcement record.