OSHA Compliance Checklist
For United States workplaces. Which standards apply to you, what has to be written down, what has to be on the wall, what has to be reported and by when, and how long every record has to be kept.
- Nine postings, including the 300A window of 1 February to 30 April
- The two reporting clocks: 8 hours and 24 hours, from when you learn of it
- Fifteen written programs, each with its standard number
- Retention from five years to thirty, per record type
OSHA Compliance Checklist
What has to be true, all the time
| # | What must be on the wall | Posted | Where | Checked |
|---|---|---|---|---|
| 1 | OSHA 'It's the Law' poster, current version | |||
| 2 | OSHA 300A summary, posted 1 February to 30 April | |||
| 3 | 300A signed by a company executive |
The document you will get. Download for the full, editable file.
Who this OSHA compliance checklist is for
This is a self-audit rather than a form filled in during an event, so it tends to be run by one person and signed by another.
Whoever runs the review
Usually EHS or the safety lead. Section one decides how much of the rest applies, so headcount, industry and jurisdiction come first and everything after is scoped by them.
The owner of an individual program
Hazard communication, respiratory protection, hearing conservation. Each has a named owner, a written document, a review date and training attached, and the register is what makes that ownership explicit.
The establishment manager
Duties attach per establishment rather than per company, including a separate injury log for each one. If you run several sites, this document is run several times.
The executive who signs the 300A
The annual summary has to be certified by a company executive, which makes this the one safety document a senior manager signs personally. The gap summary is what should be in front of them when they do.
Which section matters the most in your sector
The standards are federal, but which of them bite depends on what you do and where. State plan jurisdictions can be stricter than federal, and that is decided in section one rather than assumed. If you run one of these, the sector page goes further than the template does.
- FM service providers
Contractors and temporary workers. Multi-employer duties mean the creating, exposing, correcting and controlling employers can each be cited, so who records whose injury needs writing down.
FM service provider software - Healthcare
Bloodborne pathogens and respiratory protection. Both carry medical surveillance and fit testing obligations, which means records with thirty year retention rather than five.
Healthcare maintenance software - Retail and malls
Partial exemption. Some low hazard retail sits outside routine recordkeeping, and knowing whether you do is section one rather than an assumption inherited from a previous manager.
Retail maintenance software - Data centres
Electrical safe work practices and lockout. Both are written program obligations with training attached, and both are the first thing asked for when the work is electrical.
Data centre maintenance software - Commercial real estate
Per establishment duties. A separate injury log for each establishment rather than one for the company is the requirement portfolios most often get wrong.
Portfolio maintenance software - Corporate facilities
Emergency action plans and postings. Office environments have fewer applicable standards, which makes the ones that do apply more conspicuous when they are missing.
Corporate facilities software
What an OSHA compliance checklist should contain
An OSHA compliance checklist is a self audit of what a United States workplace is required to have in place at all times. It establishes which standards apply, then works through what must be posted, what must be recorded and reported, which written programs and training are required, and how long each type of record must be retained.
A. Fields specific to an OSHA compliance review
| Field | What goes in it | Why it earns its place |
|---|---|---|
| Establishment details | Legal entity, NAICS code, peak headcount, jurisdictions | This section decides how much of the rest applies. Peak headcount and industry classification determine routine recordkeeping duties, so getting them wrong scopes the whole review wrongly. |
| Partial exemption status | Whether the industry is partially exempt, and whether under eleven employees | Both affect routine recordkeeping only. Neither affects the duty to report a fatality or a severe injury, which is the distinction this section exists to make explicit. |
| What must be on the wall | Nine postings, each with a location and a date checked | Including the 300A between 1 February and 30 April and any current citation at the location it refers to. A posting is either up or it is not, which makes this the fastest section to fail. |
| Injury and illness recordkeeping | Ten lines covering the 300, 301 and 300A | A 301 within seven calendar days of each recordable case, the annual summary certified, recordability decisions documented, privacy cases handled, and a separate log per establishment. |
| Recordability decisions | Which cases were recordable, and the reasoning written down | The line that most often goes wrong. First aid is not recordable, medical treatment beyond first aid is, and a log that under-records is a worse problem than one that over-records. |
| The two reporting clocks | Eight hours for a fatality, twenty four for three other outcomes | Hospitalization, amputation and loss of an eye share the twenty four hour clock. Both start when you learn of the event and run through nights and weekends, so the out-of-hours route matters. |
| Written program register | Fifteen programs, each with its standard, review date and training | From hazard communication and lockout to confined space, machine guarding and process safety. Marked complete, gap or not applicable, and not applicable needs a reason written against it. |
| Training register | Topic, standard, frequency, who needs it, last done and next due | With a countdown, because expired training is the same as training that never happened and it is the single easiest gap for an inspector to find. |
| Exposure monitoring and surveillance | Eight lines on assessment, notification and medical surveillance | Where a standard sets a permissible limit, exposure has to be assessed, employees told their own results, and surveillance provided where the standard triggers it. |
| Records retention register | Eight record types, each with its period and the oldest held | Periods vary enormously, from five years for injury logs to thirty for exposure records. Disposing of exposure records early is not a recoverable mistake. |
| Contractors and temporary workers | Who records whose injury, and how duties are split in writing | The host employer usually records workers under its day to day supervision. Multi-employer duties mean several employers can be cited for one situation. |
| Gap summary and actions | Counts by status, a compliance rate, then gaps with owners and dates | The rate is measured against the programs that apply to you rather than against all fifteen, which is the only way the number means anything. |
Two lines on this form are worth more than the rest put together, and both are about reporting rather than paperwork. The first is the distinction in section one: being partially exempt from routine recordkeeping, or having fewer than eleven employees, does not exempt anybody from reporting a fatality or a severe injury. Sites read the exemption, conclude the whole area does not apply to them, and discover otherwise at the worst possible moment. The second is that the reporting clocks start when you learn of the event rather than when it occurred, and they run overnight and at weekends. An amputation reported thirty hours after the site found out about it is late even if the injury happened the previous week. That is why the form asks for the actual number to ring, who is authorized to ring it and the out of hours route, in advance. This is a self audit template rather than legal advice, and a gap you find here is worth putting in front of your own counsel.
B. What it looks like filled in
The gap summary from one half yearly review at an eighty four person establishment. Thirteen of the fifteen programs applied, and the two gaps were the ones an inspection would have found first.
| Program | Standard | Written | Training | Status |
|---|---|---|---|---|
| Hazard communication | 1910.1200 | Yes | Current | Complete |
| Emergency action plan | 1910.38 | Yes | Current | Complete |
| Lockout / tagout | 1910.147 | Partial | Current | Gap |
| Hearing conservation | 1910.95 | Yes | Expired | Gap |
| Permit-required confined space | 1910.146 | n/a | n/a | Not applicable |
| Process safety management | 1910.119 | n/a | n/a | Not applicable |
Two gaps, and they are the two an inspection reaches first. The lockout entry says written but partial, which in practice meant a general policy and no procedure for six specific machines. That is the difference between having a program and meeting the standard, and it is why the register asks about the written document and the training separately rather than as one tick. The hearing conservation row is worse in one respect: the program is written and complete, and the training has lapsed. Expired training is treated exactly as training that never happened, and it is the easiest thing in the building to find, because it is a date. The last two rows are doing real work too. Marking confined space and process safety as not applicable with a reason recorded is a legitimate answer, and it is what makes the compliance rate honest: thirteen applied, eleven complete, eighty five percent. Marking things not applicable to lift that percentage is the one way to make it worthless.
Word to adapt the program register and add the standards specific to your operation, Excel for the training countdowns, the retention register and the Review Log tab that trends your compliance rate between reviews, PDF for the copy you walk the building with. Free, and yours to rebrand.
How do you run an OSHA compliance review?
Work section one before anything else, because it decides how much of the rest applies to you. Then it goes wall, records, programs, retention. Six steps.
Establish what applies to you
Legal entity, establishment name and address, NAICS code, employees at peak, and the jurisdictions you operate in, since state plan states may be stricter than federal. Then whether the industry is partially exempt and whether you had fewer than eleven employees all year, and which standards apply.
Walk the building and check the wall
Nine postings, each with where it is and the date you checked: the current 'It's the Law' poster, the 300A between 1 February and 30 April signed by a company executive, any current citation at the location it refers to, emergency numbers, the action plan and evacuation maps, first aid, AED and eyewash locations, any state plan poster, and the records access notice.
Work the recordkeeping lines, and write down the recordability reasoning
The 300 log maintained, a 301 within seven calendar days of each recordable case, the 300A certified, electronic submission where required, privacy cases handled without names, day counts capped correctly, five year retention, logs available to employees, and a separate log per establishment.
Fill in the reporting clocks and the out of hours route
Eight hours for a fatality, twenty four for an inpatient hospitalization, an amputation or the loss of an eye. Write the actual number to ring, name who is authorized to make the report, and set out the route when it happens at two in the morning at a weekend.
Run the fifteen programs and the training register
Each program marked complete, gap or not applicable with a reason, and each with its written document, review date and training. Then the training register with topic, standard, frequency, who needs it and a countdown to the next due date.
Set retention, then score the gap honestly
Eight record types with their periods and the oldest record held, remembering that exposure records run to thirty years rather than five. Then the gap summary and the compliance rate measured against what applies to you, and every gap given a standard, a risk, an owner and a date.
A compliance checklist versus an inspection checklist
These two documents are a pair, and reaching for the wrong one wastes an afternoon. The difference is not detail or seniority, it is whether anything is happening right now.
| Aspect | This compliance checklist | The inspection checklist |
|---|---|---|
| When you use it | On your own schedule, quarterly or half yearly | The day a compliance officer arrives |
| The question it asks | What has to be true here all the time | What do we do, right now, in the next hour |
| Time frame it works in | Months and years, including retention periods | Minutes, hours and then fixed deadlines |
| The clocks inside it | Eight hours for a fatality, twenty four for an amputation | Six months to issue, fifteen working days to contest |
| What it produces | A gap list with owners, standards and dates | A contemporaneous record and a citation tracker |
| If you only keep one | You will meet the standards and mishandle the visit | You will handle the visit and still fail the standards |
This is the document you are measured against; the other one is how the measuring goes. Everything an inspection asks for is on this page: whether the programs exist in writing, whether the training is current, whether the 300A went up on 1 February, whether exposure records have been kept for thirty years rather than five. Working this list is how you change the outcome of an inspection, because it changes the facts an officer finds. The inspection checklist changes none of those facts. What it changes is whether the visit is conducted on a defensible record: a named representative, parallel notes, matching photographs, a document request log, and the fifteen working day contest deadline noticed rather than missed. A site that runs this review honestly every six months and closes its gaps will collect very few citations. A site that runs it and marks half the register not applicable to keep the percentage high will collect them, and will have written down its own reasoning for the officer to read.
When the template starts to feel limiting
A half yearly review on a spreadsheet tells you the truth on the day you run it. The rest of the six months is where it struggles, in four ways.
Two kinds of date, neither self enforcing
Training expiries per person per topic, and a fixed calendar posting that goes up on 1 February. A review run in March finds the 300A that never went up, six weeks after the window opened.
The answer is only true on the day you asked
Compliance is a state, and this measures it at a point. Between reviews people leave, training lapses and substances arrive, and none of that reaches the document until somebody sits down with it again.
Programs and training live apart from people and plant
The lockout program applies to specific machines and specific authorized persons. On a spreadsheet it is a row, so the question of whether procedures exist for every machine in scope has to be answered by hand.
Several establishments mean several documents
Duties attach per establishment, including a separate injury log for each. Rolling several sites into one view means opening several files and hoping they were all completed to the same standard.
What running this in Facilio looks like
The template is the paper version of this review. The sections are the same ones; the difference is that training expiry and program coverage become things the system tracks continuously rather than facts established twice a year.
Work Completion Validator
A gap cannot be closed without evidence
On paper a gap closes when somebody changes its status. Work Completion Validator holds the closure against what was actually produced, so a program marked complete with nothing written behind it stays a gap.
Ops Performance Intelligence
Training expiry stops being a twice yearly discovery
Every training item carries its own frequency and next due date per person, so the ninety day view is live and the hearing conservation refresher surfaces before it lapses rather than at the next review.
Audit Report Intelligence
The compliance rate becomes a trend across establishments
Programs that apply, gaps open and postings verified are held per establishment, so a portfolio reads as one picture and a site drifting between reviews is visible rather than averaged away.
Contractor Work Tracker
Multi-employer duties have a documented answer
Which agency supplied a temporary worker, how training duties were split in writing and whose hazards were communicated to whom sits against the contractor record instead of being reconstructed after an incident.
Hallucination-free by design. Atom AI answers from the records in your tenant rather than generating plausible text, so an empty field reads as empty rather than filled in for you.
Frequently asked questions
What is an OSHA compliance checklist?
An OSHA compliance checklist is a self audit of what a United States workplace has to have in place all the time. It starts by establishing which standards apply to you, based on industry, headcount and jurisdiction, then works through what must be posted, what must be recorded and reported, which written programs and training are required, what exposure monitoring applies, and how long each type of record must be kept.
It ends with a gap list: each shortfall against the standard it relates to, the risk if you were inspected, and an owner and a date to fix it. It is distinct from an inspection checklist, which is the procedure for the day an officer actually arrives.
What has to be posted in the workplace?
Nine things in this register. The current OSHA 'It's the Law' poster, the 300A annual summary posted from 1 February to 30 April and signed by a company executive, any current citation posted at or near the location it refers to, emergency telephone numbers, the emergency action plan with evacuation route maps, the locations of first aid, AED and eyewash, a state plan poster where the state requires its own, and the notice of employee access to exposure and medical records.
Postings are the quickest section to fail because there is no partial credit: a poster is either up and current or it is not. The 300A window is a fixed calendar date rather than an anniversary of anything, so it goes up on 1 February whether anybody has remembered it.
When do you have to report a fatality or an amputation?
A fatality is reportable within eight hours. An inpatient hospitalization of one or more employees, an amputation, or the loss of an eye are each reportable within twenty four hours.
Two details matter more than the numbers. The clocks start when you learn of the event, not when the event happened, so a hospitalization you find out about on Monday is timed from Monday. And they run through nights and weekends. That is why this section asks for the actual number to ring, who is authorized to ring it, and the out of hours route, all filled in before you need them.
Which written programs does OSHA require?
The register in this template lists fifteen with their standard numbers: hazard communication, emergency action plan, fire prevention plan, PPE hazard assessment, respiratory protection, hearing conservation, lockout and tagout, permit required confined space, bloodborne pathogens, powered industrial trucks, electrical safe work practices, machine guarding, walking working surfaces and fall protection, process safety management, and emergency response to spills.
Not all of them apply to every workplace, and not applicable is a legitimate status as long as the reason is written down. Each one is assessed on two things separately: whether the written document exists, and whether the training attached to it is current. A written program with lapsed training is still a gap.
How long do OSHA records have to be kept?
It varies enormously by record type, which is why retention has its own register here. Injury and illness logs are kept for five years following the year they cover. Exposure monitoring records run to thirty years. Employee medical records run for the duration of employment plus thirty years.
The retention register asks for the oldest record you currently hold against each type, which is the quickest way to find out that something has already been disposed of too early. Getting rid of exposure records ahead of time is not a recoverable mistake, so it is worth checking before a filing clear out rather than after one.
Is my business exempt from OSHA recordkeeping?
Possibly, for routine recordkeeping. Some low hazard industries are partially exempt, and establishments with fewer than eleven employees throughout the year are exempt from routine recordkeeping. Section one of this checklist establishes whether either applies to you, because it scopes how much of the rest you need.
The important qualification is that neither exempts you from reporting. A fatality or a severe injury such as an amputation must be reported whatever your industry or your headcount. Reading the exemption and concluding that the whole area does not apply is one of the more consequential mistakes on this form.
What is the difference between an OSHA compliance checklist and an inspection checklist?
This one is about a standing state: what has to be true in your workplace at all times, whether or not anybody is looking. You run it on your own schedule, and it produces a list of gaps with owners and dates.
The inspection checklist is about an event: a compliance officer is at reception, and it tells you what to do and record over the next hours and the following weeks, including the fifteen working day contest deadline. Working this compliance list changes the facts an inspection finds. The inspection checklist changes how well the visit is handled. Most sites need both, and each page links to the other.
Can I edit and rebrand this template?
Yes. It is free to use, edit, rename and put your own logo on, internally or for clients. No attribution required.
The Word version is the one to edit if you want to add standards specific to your operation or match your own program names. The Excel version is the one to use if you want the training register to count down to each due date, the gap summary and compliance rate to calculate themselves, and the Review Log tab that trends the rate, the gaps and the postings from one review to the next.
In one paragraph
An OSHA compliance review starts with scope, because industry, peak headcount and jurisdiction decide how much of the rest applies, and state plan jurisdictions can be stricter than federal. Note the distinction that catches people out: partial exemption and fewer than eleven employees affect routine recordkeeping only, never the duty to report a fatality or a severe injury. Check the nine postings, remembering the 300A goes up on 1 February and comes down on 30 April. Work the recordkeeping lines and write down the reasoning behind each recordability decision, since first aid is not recordable and medical treatment beyond it is. Fill in both reporting clocks with the real phone number and the out of hours route, because eight and twenty four hours run from when you learned of the event and through weekends. Then work the fifteen written programs and their training separately, set retention per record type from five years to thirty, and score the compliance rate against what genuinely applies to you.
The template is the floor, not the ceiling
Take the checklist; it will give you an honest gap list and a rate worth reporting. When a twice yearly spreadsheet stops keeping up, a connected CMMS holds compliance continuously: training expiry tracked per person and topic, written programs tied to the machines and areas they cover, postings and records verified on a schedule, and every establishment in one picture rather than one file each.
