OSHA Doesn't Require a Written Safety Program — But Your State Might

A small manufacturer in Sacramento gets a knock from a Cal/OSHA compliance officer after a neighbor's complaint about noise. The inspector walks the floor, finds nothing alarming about the equipment, and then asks for the written Injury and Illness Prevention Program. There isn't one. The owner has run the shop for eleven years without a single recordable injury and assumed that record was the point. It isn't. The citation that follows has nothing to do with how the shop actually operates and everything to do with a binder that was never assembled.

This mix-up is common because the premise most owners start with — "OSHA doesn't make small businesses write safety programs" — is half true. Federal OSHA does not require one overarching program document from every employer. But that federal baseline is not the only rulebook in play, and several of the states with their own OSHA-approved plans require exactly what this shop didn't have.

What federal OSHA actually requires in writing

Federal OSHA's structure is standard-by-standard, not blanket. There is no regulation titled "written safety program" that applies to every workplace regardless of hazard. Instead, specific standards trigger specific written documents once a condition is met.

If employees work with hazardous chemicals, 1910.1200(e)(1) requires a written hazard communication program describing how labels, safety data sheets, and training are handled at that location. If anyone services equipment where stored energy could injure them, 1910.147(c)(4) requires a written energy control program for lockout/tagout, specific enough to cover each piece of equipment's procedure. If there's reasonably anticipated exposure to blood or other potentially infectious materials, 1910.1030(c)(1) requires a written exposure control plan, reviewed annually. If respirators are provided or required, 1910.134(c) requires a written respiratory protection program. None of these apply because a business is a certain size — they apply because a hazard is present, and once one is, the paperwork isn't optional.

That's a real list, and a shop with any of those hazards already owes OSHA something in writing. But it's a hazard-triggered list, not a universal one. A small office, a retail store, or a shop with no chemical hazards, no lockout points, and no respirator use can genuinely have zero written program obligations under federal OSHA. That's the fact the Sacramento shop owner had half right.

Where the states go further

Roughly half the states run their own OSHA-approved occupational safety and health plans, and federal law only requires those plans be "at least as effective" as the federal program — which leaves room for a state to add requirements the federal program never imposed. A written, general safety program is one of the more common additions.

California is the clearest example. Title 8 of the California Code of Regulations, Section 3203, requires nearly every employer in the state to maintain a written Injury and Illness Prevention Program, independent of what hazards are present. It doesn't matter whether the workplace has chemicals, machinery, or neither. The obligation is structural, not hazard-triggered, and it existed well before any of the standard-specific federal programs would apply.

Washington runs a similar requirement through its own state plan: WAC 296-800-140 obligates covered employers to maintain a written Accident Prevention Program addressing how the employer identifies and corrects hazards, and how employees are trained and involved. Oregon OSHA requires safety committees or safety meetings under OAR 437-001-0765 for most employers above a small headcount threshold, built around a documented process rather than a one-time policy. Minnesota's OSHA-approved plan carries its own version, commonly referred to by employers there as an AWAIR program, again a written document rather than a stated intention.

The pattern across all of these: the requirement doesn't ask what hazards exist at a specific workplace. It asks whether a written program exists at all. A business that would owe nothing under the federal standards-by-standard approach can still owe a complete document under its state's plan, purely because of where it operates.

What the document actually has to contain

California's IIPP is worth walking through in some detail because its structure is representative of what these state programs generally expect, even where the exact regulation differs.

The program has to identify who is responsible for implementing it — a specific person or role, not "management." It has to describe how the employer ensures employee compliance with safe work practices. It needs a system for communicating with employees about hazards, in a form employees can understand, including a way for them to report hazards without fear of reprisal. It requires a process for identifying and evaluating hazards, done on a schedule, not just once at startup. It requires a method for investigating occupational injuries and illnesses when they occur. It requires a procedure for correcting hazards once identified, on a timeline tied to severity. It requires training, both when the program is first established and when new hazards are introduced. And it requires records: of the inspections performed, the training given, and the hazards corrected.

None of that describes a document a business can write once and file away. An IIPP that hasn't been touched since 2019 is not meaningfully different, from an inspector's perspective, than no IIPP at all — the recordkeeping requirement exists specifically to demonstrate the program is a live process.

Why this catches businesses that are otherwise doing fine

The Sacramento shop's actual safety record — eleven years, no recordables — is a genuinely good outcome, and it's tempting to treat that as proof the paperwork doesn't matter. But a missing written program is a distinct violation from a hazard violation, and inspectors cite it independently. It also tends to compound: a citation for the missing IIPP invites closer scrutiny of everything else, because the absence of the foundational document raises the question of what else was assumed rather than documented. A shop that would otherwise have walked away from an inspection with nothing can end up with a citation whose only real finding is an administrative gap.

It's also a gap that's easy to fall into precisely because a business is doing well. The written-program requirement doesn't scale with incident history. A spotless record lowers the odds of an inspection triggered by an injury, but it does nothing about an inspection triggered by a complaint, a referral, or random selection — and once an inspector is on-site for any reason, the program document is one of the first things requested.

Where to start if you don't have one

The first question is jurisdictional: does the state where you operate run its own OSHA-approved plan, and does that plan include a general written program requirement independent of hazard type? California, Washington, Oregon, and Minnesota are the clearest examples, but plan details vary by state and change over time, so the state plan's own published requirements are the authoritative source, not a general assumption either way.

If the answer is yes, the document doesn't need to be elaborate to satisfy the requirement — it needs to be specific to the workplace, assigned to a named person, and actually followed. A generic template downloaded and left unsigned fails the same way no document does: it doesn't reflect what actually happens on the floor, and a few pointed questions from an inspector will surface that quickly. Building it around the real hazard assessment process already in place, rather than treating it as a separate compliance exercise, is what keeps it from becoming exactly the kind of dead document the recordkeeping requirement was written to catch.