TL;DR
OSHA has no single rule requiring one master safety program. Instead, OSHA written program requirements are scattered across more than 35 individual standards in 29 CFR 1910 (general industry) and 20+ in 29 CFR 1926 (construction). Each standard specifies its own written documentation requirements, and a missing program is a standalone citable violation, even if no one got hurt. Penalties reach $16,550 per serious violation and $165,514 per willful or repeated violation.
Somewhere between “we have a safety binder” and “we’re fully compliant,” most companies discover an uncomfortable truth: they’re missing written programs they didn’t know they needed.
The confusion is understandable. OSHA doesn’t publish a single checklist titled “Here Are All the Written Programs You Need.” Instead, written program requirements are buried inside dozens of individual standards across general industry and construction regulations. Miss one, and a compliance officer can write a citation for it during an inspection, regardless of whether your workplace practices are otherwise sound.
This gap matters beyond OSHA enforcement. General contractors increasingly require written safety programs as a contract condition. Prequalification platforms like ISNetworld and Avetta use written programs as the foundation of their verification processes. A missing program doesn’t just risk a fine; it can cost you bids.
If your company needs help building or auditing written OSHA programs, starting with a clear understanding of what’s actually required is the first step.
Key Takeaways: OSHA Written Safety Program Requirements
Master Rule Myth: OSHA does not require one single master safety program. Requirements are spread across 35+ standards in 29 CFR 1910 (General Industry) and 20+ standards in 29 CFR 1926 (Construction).
Standalone Violations: A missing written program is a standalone citable infraction—even if no workplace injuries or physical accidents have occurred.
2026 Penalty Caps: Maximum fines are capped at $16,550 per serious or other-than-serious violation and $165,514 per willful or repeated violation.
Small Business Exception: Only the Emergency Action Plan (1910.38) and Fire Prevention Plan (1910.39) allow oral communication for employers with 10 or fewer employees. All other programs require written documentation regardless of company size.
Commercial Impact: Missing written programs routinely cause failed ISNetworld (RAVS), Avetta, and contractor prequalification reviews, blocking companies from bidding on jobs.
What Are OSHA Written Program Requirements?
OSHA written program requirements are the specific provisions within OSHA standards that mandate employers document their approach to controlling a workplace hazard. When a standard uses language like “the employer shall establish and implement a written program,” the written document itself is a compliance requirement. Verbal communication or informal practices won’t satisfy an inspector.
The total count of required written programs depends on how you count. One widely cited figure puts the number at over 35 written plan, program, procedure, or manual requirements across 29 CFR 1910 for general industry alone, with more than 20 additional requirements in 29 CFR 1926 for construction. Other counts identify at least 26 specific standards that explicitly require written documentation. The numbers vary because some standards require a “program” without using the exact word “written,” yet OSHA’s enforcement posture still expects documentation.
Plan vs. Program vs. Procedure: The Terminology Trap
OSHA uses the words “plan,” “program,” and “procedure” in ways that seem interchangeable but carry slightly different meanings.
Plans and programs document your company’s overall approach to protecting employees from a safety or health hazard. OSHA calls for a written exposure control plan for bloodborne pathogens (29 CFR 1910.1030) but requires a written hazard communication program (29 CFR 1910.1200). In practice, the agency treats these terms similarly.
Procedures are step-by-step instructions for safely performing a specific task. OSHA has many requirements for procedures, but not all of them must be in writing. The distinction matters because an employer might have solid procedures communicated verbally but still get cited for lacking the written program those procedures should live inside.
The practical rule: if an OSHA standard says “written,” it means written. If a standard is silent on format but requires a program, put it in writing anyway. You’ll never be penalized for documenting too much.
General Industry Written Programs (29 CFR 1910)
The following table covers the written programs most general industry employers encounter. Your specific obligations depend on which hazards exist in your workplace.
CFR Citation | Program Name | Trigger Condition | Key Required Elements |
|---|---|---|---|
1910.1200 | Hazard Communication Program | Employees may be exposed to hazardous chemicals | Written program, chemical inventory, SDS access, labeling system, employee training |
1910.147©(4) | Lockout/Tagout (LOTO) Energy Control Program | Employees service or maintain machines with hazardous energy | Written energy control procedures for each machine, periodic inspection at least annually per 1910.147©(6) |
1910.134 | Respiratory Protection Program | Employees required to use respirators | Nine required elements including medical evaluations, fit testing, procedures for selection, cleaning, maintenance, and training |
1910.1030 | Bloodborne Pathogens Exposure Control Plan | Potential exposure to blood or other body fluids during normal duties | Written exposure control plan, engineering controls, PPE, training, laundry controls, waste disposal, hepatitis B vaccination |
1910.38 | Emergency Action Plan | Most employers (see small employer exception below) | Evacuation procedures, reporting procedures, employee alarm systems, designated contacts, rescue/medical duties |
1910.39 | Fire Prevention Plan | Most employers (see small employer exception below) | List of major fire hazards, handling/storage procedures for flammable materials, names of responsible personnel |
1910.146 | Permit-Required Confined Space Program | Workplace contains permit-required confined spaces | Written program covering entry procedures, attendant duties, rescue provisions, permit system, atmospheric testing |
1910.95 | Hearing Conservation Program | Employee noise exposure equals or exceeds 85 dB TWA (8-hour) | Monitoring, audiometric testing, hearing protector selection, training, recordkeeping |
1910.1450 | Chemical Hygiene Plan (Laboratories) | Laboratory use of hazardous chemicals | Written chemical hygiene plan, employee monitoring, medical surveillance, hazard identification, recordkeeping |
1910.119 | Process Safety Management | Covered processes with highly hazardous chemicals above threshold quantities | Written plan covering process hazard analysis, operating procedures, management of change, emergency planning |
For a deeper look at what the hazard communication standard requires, including SDS management and labeling, that program alone affects virtually every employer with chemicals in the workplace.
The Small Employer Exception
The emergency action plan and fire prevention plan each include a narrow exemption. Employers with 10 or fewer employees may communicate these two plans orally rather than in writing. Those are the only two programs with that option. Every other applicable written program requirement applies to employers with one or more employees.
Construction Written Programs (29 CFR 1926)
Construction employers face their own set of OSHA written program requirements, many of which overlap with general industry standards but carry construction-specific provisions.
CFR Citation | Program Name | Trigger Condition | Key Required Elements |
|---|---|---|---|
1926.502 / Subpart M | Fall Protection Plan | Construction activities where conventional fall protection is infeasible | Written plan including fall hazard assessment, policy and procedures, appropriate hazard control measures, training requirements, rescue procedures |
1926.59 / 1910.1200 | Hazard Communication Program | Hazardous chemicals on the construction site | Same as general industry HazCom: written program, chemical inventory, SDS access, employee training |
1926.62 | Lead Compliance Program | Employee exposure to lead at or above the action level | Written program describing work operations, engineering controls, PPE, hygiene practices, air monitoring |
1926 Subpart AA | Confined Space Program (Construction) | Construction work in confined spaces | Written program covering entry procedures, atmospheric monitoring, rescue provisions, permits |
1926.24 / 1910.39 | Fire Prevention Plan | Fire hazards present on the construction site | Written plan listing major fire hazards and names of responsible personnel (oral if 10 or fewer employees) |
1926.752(e) | Steel Erection Plan | Multi-story steel erection | Written erection plan covering sequence of erection, procedures for safely connecting members |
1926.550/552 | Crane/Hoisting Safety | Use of cranes and hoisting equipment | Inspection procedures, operator qualification documentation |
1926.651 | Excavation Competent Person Requirements | Excavation and trenching operations | Soil classification documentation, protective system design |
Five of the top 10 OSHA violations in recent fiscal years occurred in areas where a written plan is required. Fall protection alone generated 5,914 total violations in FY 2025, and hazard communication added 2,546. These aren’t obscure requirements. They’re the standards OSHA cites most often. For the full breakdown of top OSHA construction violations, the pattern is consistent year after year.
Federal OSHA Written Program Checklist at a Glance
Program / Standard | CFR Citation | Trigger Condition | Small Employer Exemption? |
Hazard Communication | 29 CFR 1910.1200 / 1926.59 | Any site with chemical exposure risk | No (Always written) |
Lockout/Tagout (LOTO) | 29 CFR 1910.147 | Servicing/maintaining equipment with hazardous energy | No (Always written) |
Respiratory Protection | 29 CFR 1910.134 | Required use of respirators or tight-fitting facepieces | No (Always written) |
Bloodborne Pathogens | 29 CFR 1910.1030 | Anticipated contact with blood or body fluids | No (Always written) |
Emergency Action Plan | 29 CFR 1910.38 / 1926.35 | Facilities requiring evacuation procedures | Yes (Oral if 10 or fewer employees) |
Fire Prevention Plan | 29 CFR 1910.39 / 1926.24 | Facilities with high flammable/combustible risks | Yes (Oral if 10 or fewer employees) |
Permit-Required Confined Space | 29 CFR 1910.146 / 1926 Subpart AA | Workplaces containing permit-required confined spaces | No (Always written) |
Fall Protection Plan | 29 CFR 1926.502 | Construction tasks where standard fall protection is infeasible | No (Always written) |
Hearing Conservation | 29 CFR 1910.95 | Noise exposure equal to or exceeding 85 dB TWA | No (Always written) |
How OSHA Cites Missing or Deficient Written Programs
Here’s the highest-stakes insight most employers miss: a missing written program is a standalone violation. The absence of the document is itself the citation, independent of whether the underlying workplace practice is sound.
OSHA’s enforcement directive CPL 02-00-111 specifically addresses how compliance officers should classify written-program violations. The classification logic works like this:
Serious violation: When a written program is missing and a related physical hazard also exists in the workplace, OSHA classifies the missing program as a serious violation.
Other-Than-Serious violation: When the only problem is the missing paperwork and no related physical hazard is present, OSHA classifies it as other-than-serious.
In practice, compliance officers routinely ask for written programs early in the walkaround. An inability to produce the document immediately converts a paperwork gap into a documented violation. If you want to know exactly what happens during that process, the OSHA inspection opening conference checklist covers the sequence step by step.
2026 OSHA Penalty Schedule & Citation Enforcement
OSHA civil penalties operate under statutory maximums. For calendar year 2026, maximum penalty amounts remain capped at the following levels:
Violation Type | Maximum Penalty (2026) |
Serious Violation | $16,550 per violation |
Other-Than-Serious Violation | $16,550 per violation |
Willful or Repeated Violation | $165,514 per violation |
These penalties apply per individual violation, not per total inspection. An inspector finding 10 distinct missing written programs during a single walkthrough can cite each missing program as a separate serious violation, compounding penalties rapidly into six figures.
Written Programs Beyond OSHA: GC Contracts and Prequalification
OSHA compliance is the floor, not the ceiling. For contractors, written safety programs serve a second function that often carries more immediate financial consequences than regulatory penalties.
General Contractor Requirements
Contract clauses routinely require written safety programs even where OSHA doesn’t explicitly mandate them. A typical clause reads something like: “Contractor shall at all times abide by Contractor’s written Safety Program, which shall at minimum comply with applicable Federal OSHA regulations as well as any pertinent state and local safety laws.” In practice, GCs interpret “at minimum” broadly. They expect to see written programs covering hazards specific to the scope of work, and they’ll reject subcontractors who can’t produce them.
ISNetworld RAVS and Avetta Verification
When contractors set up an ISNetworld account and connect with a hiring client, ISNetworld generates a custom list of written safety programs required for RAVS (Review and Verification Services) verification. That list depends on your scope of work, your trade, and the hiring client’s specific requirements.
Practitioners consistently report that most failed RAVS reviews trace back to written programs. The reviewer compares each submitted program against a checklist of required elements drawn from OSHA regulations and industry best practices. If a program is missing, incomplete, or doesn’t address the specific elements the standard requires, it fails.
Hiring clients generally require an update every two years, and ISNetworld typically requires RAVS revalidation on the same cycle. A program that passed review two years ago may fail today if your operations have changed.
For contractors navigating this process, ISNetworld RAVS help explains what reviewers actually look for, and an ISNetworld consultant can help ensure programs pass on the first submission.
The bottom line: a missing written program doesn’t just risk an OSHA fine. It can disqualify you from bidding on projects entirely.
Common Mistakes with Written Safety Programs
Having written programs on file doesn’t guarantee compliance. The following mistakes account for the majority of citations and failed prequalification reviews.
1. Using Generic Templates Without Customization
A template downloaded from the internet covers the general requirements of a standard. It doesn’t describe your workplace, your processes, your chemicals, or your people. OSHA expects written programs to be site-specific. An inspector who sees boilerplate language with no connection to your actual operations will treat that program as deficient.
2. The Stale Program Problem
Consider a company with a hazard communication program created five years ago. Employee names listed as responsible parties have left. The chemical inventory doesn’t reflect new products introduced last year. New processes have been added. During an inspection, OSHA discovers the program no longer reflects actual workplace conditions. The company technically has a written program, but it isn’t effective, and it won’t satisfy a compliance officer.
The lockout/tagout standard provides explicit guidance here: 29 CFR 1910.147©(6) requires a periodic inspection of energy control procedures at least annually. Even where a standard is silent on review frequency, OSHA expects programs to reflect current conditions. The practical rule: review whenever you add equipment, change a process, introduce a new chemical, or reorganize the people responsible for the program.
3. Shelf Binders Nobody Reads
A written program that employees haven’t been trained on is a program that exists only on paper. Most OSHA standards that require written programs also require employee training on the contents of those programs. An inspector will ask frontline workers whether they know what the program says. If they don’t, the program fails its purpose. For context on which standards carry specific training mandates, OSHA required training provides an overview.
4. Not Knowing Which Programs Apply
Many employers, especially growing companies, have never conducted a formal assessment of which OSHA written program requirements apply to their operations. They know they need a HazCom program because everyone talks about it. They may not realize they also need a confined space program, a respiratory protection plan, or a hearing conservation program based on the specific hazards in their workplace.
To check whether your current documentation is OSHA compliant, the answer usually starts with a gap analysis against applicable standards.
How to Determine Which Written Programs Your Company Needs
There’s no shortcut here, but there is a logical process.
Step 1: Conduct a hazard assessment. Walk your facility or jobsite and identify every hazard category present: chemical exposure, noise, fall hazards, confined spaces, hazardous energy, respiratory hazards, bloodborne pathogen exposure, and so on.
Step 2: Match hazards to applicable standards. For each hazard category, identify the corresponding OSHA standard. Determine whether that standard requires a written program, plan, or procedure.
Step 3: Identify trigger conditions. Not every standard applies to every employer. Some trigger at specific exposure thresholds (noise at 85 dB TWA, lead at the action level). Others apply whenever the hazard exists at all (HazCom applies to any employer with hazardous chemicals in the workplace).
Step 4: Check state-plan requirements. Several State-Plan states add written program mandates that go well beyond federal OSHA. If your facility or jobsite operates in one of the 22 states running approved state plans for private-sector workers, review local regulations carefully:
California (Cal/OSHA): Requires a written Injury and Illness Prevention Program (IIPP) under 8 CCR §3203 for virtually every employer, regardless of size or hazard level.
Washington (DOSH): Mandates a written Accident Prevention Program (APP) under WAC 296-800-140 tailored specifically to site-level hazards.
North Carolina (NC OSH) & Virginia (VOSH): Enforce stricter state-specific hazardous chemical communication, safety committee mandates, and inspection documentation.
Texas: Does not operate a state plan for private employers, meaning federal OSHA rules apply directly.
Step 5: Review GC and prequalification requirements. Pull your current contracts and ISNetworld or Avetta profiles. Hiring clients often require written programs that go beyond what OSHA mandates for your scope of work.
Step 6: Document and assign ownership. For each required program, assign a responsible person, set a review schedule, and build the training component into your calendar.
For employers who realize they need help assembling or auditing these programs, OSHA compliance consulting provides the expertise to identify gaps and build compliant documentation efficiently.
Written Programs Are Living Documents
OSHA written program requirements exist for a reason that goes beyond paperwork: they force employers to think through hazard controls systematically before an incident happens. A well-written program reflects how your company actually operates. A stale or missing program signals that nobody is paying attention.
The programs that matter most are the ones that get used, reviewed, updated, and trained on. They’re not binder filler. They’re operational tools that protect employees, reduce citation risk, and keep you qualified to bid on work.
If your company needs to build, update, or audit written safety programs, ESR’s safety program development services cover the full lifecycle from gap analysis through ISNetworld-ready documentation.
Frequently Asked Questions
How many written programs does OSHA require?
There is no single number because requirements are spread across individual standards. General industry (29 CFR 1910) contains over 35 written plan, program, or procedure requirements. Construction (29 CFR 1926) adds more than 20. The programs your company actually needs depend on which hazards are present in your workplace.
Can OSHA cite me just for not having a written program, even if nobody was injured?
Yes. A missing written program is a standalone violation. Under OSHA’s enforcement directive CPL 02-00-111, a missing program is classified as serious if a related physical hazard exists, or other-than-serious if the only deficiency is the missing documentation. Penalties apply either way.
What is the penalty for a missing written safety program?
As of 2025-2026, OSHA’s maximum penalty for a serious or other-than-serious violation is $16,550 per violation. A willful or repeated violation can reach $165,514. Because penalties are assessed per violation, missing multiple written programs can compound quickly in a single inspection.
Do small businesses need written safety programs?
Almost always, yes. The only exemption is for the emergency action plan and fire prevention plan, which employers with 10 or fewer employees may communicate orally. Every other written program requirement applies regardless of company size if the triggering hazard is present.
How often should written safety programs be updated?
Some standards specify a review cadence. The lockout/tagout standard (29 CFR 1910.147) requires an annual inspection of energy control procedures. For other programs, OSHA expects documentation to reflect current workplace conditions. Best practice is to review programs whenever you add equipment, change processes, introduce new chemicals, or change the personnel responsible for the program. ISNetworld and similar platforms typically require revalidation every two years.
What’s the difference between an OSHA written program and a site-specific safety plan?
A written OSHA program addresses a specific standard’s requirements across your company (for example, your hazard communication program or respiratory protection program). A site-specific safety plan addresses all applicable hazards and controls for a particular project or jobsite. GCs and owners often require both. Many written OSHA programs feed into the broader site-specific safety plan.
Do I need written programs for ISNetworld or Avetta?
Yes. When you connect with a hiring client on ISNetworld, the platform generates a custom list of written safety programs required for RAVS verification. Avetta has a similar process. Most failed reviews are caused by missing, incomplete, or outdated written programs. Programs must address the specific elements each OSHA standard requires, not just general safety policy language.