Guides
Building a workplace safety program that cuts claims
How to build a written workplace safety program with OSHA's seven core elements and the hierarchy of controls, and what insurers and state credits look for.
A workplace safety program is a written, owned and measured system for finding hazards and fixing them before someone is hurt. The structure OSHA recommends has seven core elements, and the thing that actually changes claims is what happens after the binder is written: inspections that get done, hazards that get fixed, and supervisors who stop work when something is wrong. Workers' comp underwriters and loss control engineers judge the program on that evidence, not on the policy manual.
What the law requires and what it does not
No single federal rule says every employer must have one document called a safety program. What exists is a layered set of duties:
- The General Duty Clause. Section 5(a)(1) of the OSH Act requires every covered employer to provide a workplace free of recognized hazards likely to cause death or serious physical harm.
- Standard-specific written plans. Many OSHA standards require a written program for a particular hazard. Typical examples are hazard communication (29 CFR 1910.1200), lockout/tagout energy control procedures (1910.147), respiratory protection (1910.134), emergency action plans (1910.38) and bloodborne pathogens exposure control (1910.1030). Which ones apply depends on your operations, so a plumber and a machine shop will carry different lists.
- State programs. California requires nearly every employer to maintain a written Injury and Illness Prevention Program under 8 CCR 3203. It must name the person responsible, set up a way for employees to report hazards without reprisal, schedule periodic inspections, require investigation of injuries, correct hazards in a timely way, and provide training (Cal/OSHA text). Other states require safety committees or accident-prevention programs for some employers. Check your state agency and workers' comp and benefits requirements by state; do not assume the California rule is national.
OSHA's heat illness rule is still a proposal as of October 2026 (the proposed rule was published August 30, 2024 and OSHA's rulemaking page shows no final rule), so outdoor and hot-indoor employers rely on the General Duty Clause and state rules. See heat illness, workplace heat rules and workers' comp.
The seven core elements
OSHA's Recommended Practices for Safety and Health Programs, written to fit small and medium-sized businesses, name seven core elements (OSHA). Here is what each means on the ground and what a loss control engineer looks for.
| Element | In practice | The evidence an underwriter asks to see |
|---|---|---|
| Management leadership | A named owner of the program, safety on the agenda of every management meeting, budget for fixes | Signed policy, minutes, who approves capital for guards or lifts |
| Worker participation | Employees report hazards, join inspections and sit on the committee | Hazard reports, committee roster, follow-up on suggestions |
| Hazard identification and assessment | Scheduled inspections, job hazard analyses, incident and near-miss review | Dated inspection checklists with open and closed items |
| Hazard prevention and control | Fixes ranked by the hierarchy of controls, tracked to completion | Work orders and completion dates |
| Education and training | Orientation, task-specific training, supervisor training, refreshers | Sign-in sheets by employee and date |
| Program evaluation and improvement | Annual review of results, goals reset | Trend of incidents, near misses, closed actions |
| Communication and coordination for host employers, contractors and staffing agencies | Written expectations for outside workers; shared hazard information | Contracts, orientation records for temps and subs |
The last element matters more than most small employers expect. If you bring in temps through a staffing firm or hire subcontractors, their injuries are partly your problem, both for safety and for coverage. See managing subcontractor insurance and certificates and contractual risk transfer: shifting liability by contract and insurance.
Fix hazards in the right order
The National Institute for Occupational Safety and Health ranks controls from most to least effective (NIOSH hierarchy of controls): elimination, substitution, engineering controls, administrative controls and personal protective equipment. Training and PPE are at the bottom because they depend on people behaving correctly every time.
Hypothetical example. Say a 25-employee fabrication shop's hazard walk finds an unguarded press brake that has already produced two near misses. Telling operators to be careful and issuing gloves (administrative control and PPE) is the weakest answer. Installing a light curtain or guard (engineering) is stronger. Moving the part to a pre-bent supplier component would remove the hazard altogether (elimination or substitution). The shop may not be able to eliminate the process, but the ranking forces the question before the money is spent on a laminated sign.
Building the program in 90 days
- Assign an owner and set the goal. Pick someone with authority, usually the operations manager in a small company, and write down two or three measurable goals.
- Collect what you already have. Pull three to five years of loss runs, your OSHA logs (see OSHA recordkeeping, injury rates and insurance), first reports of injury and any inspection reports from your carrier. Sort by cause: strains, falls, cuts, vehicle incidents.
- Walk the site with employees. Use a written checklist, include night and weekend shifts, and rank findings by severity and likelihood.
- Write job hazard analyses for the top tasks. One page each: steps, hazards, controls, training needed.
- Fix the cheap items now and schedule the capital items. Put a name and a date on every action.
- Train and document. New-hire orientation, task training and supervisor training, with sign-in records that show the date, topic and trainer.
- Set the incident process. Every injury and near miss gets reported the same shift, investigated for root cause (not blame), and closed with a corrective action. Pair it with a return-to-work program so injured employees come back to appropriate duty sooner.
- Review quarterly. Check open actions, trends and training gaps, then reset the goals each year.
Measure leading indicators, not only injuries
TRIR and DART tell you what already happened. The OSHA incident rate calculator computes them, but one case can swing a small company's rate. Add leading indicators you control: percent of inspections completed on schedule, hazards closed within the target days, near misses reported per month, training completion and supervisor field audits. A rising near-miss count in the first year usually means reporting is improving, not that the workplace got more dangerous.
For perspective, the Bureau of Labor Statistics recorded 5,070 fatal work injuries in the United States in 2024. Transportation incidents caused 1,937 of them, falls, slips and trips caused 844, and violent acts 733 (BLS Census of Fatal Occupational Injuries, released February 19, 2026). Vehicle exposure is covered in building a fleet safety program that insurers notice.
How the program connects to insurance
- Premium and mod. Fewer and smaller claims flow into your experience mod over the next few years. Because the mod looks back at policies roughly 21 to 57 months before its effective date under the NCCI plan, safety work today shows up in pricing later. See The experience modification rate (EMR) explained and how to lower your workers' comp costs.
- Carrier loss control. Insurers send engineers to larger and higher-hazard accounts, and they will ask for your written program, inspection records, training logs and incident investigations. What to expect on the visit is in insurance loss control inspections: what to expect.
- State incentives. Some states give formal credits. Pennsylvania's Department of Labor and Industry reports that employers with a certified workplace safety committee receive a 5 percent discount on their workers' comp premium. The committee must have been operating at least six full months, have at least four members split evenly between employer and employee representatives, and complete training in four required topics (Pennsylvania L&I FAQs). Ask your broker whether your state has a similar program, since credits vary by state and by insurer.
- Prequalification. Contract owners judge contractors and vendors on safety programs, mods and TRIR. A well-documented program is often a bid requirement, especially for a general contractor or an industrial manufacturer.
Common mistakes
- Buying a template manual and filing it. Auditors can tell from the training records.
- Treating the program as the safety person's job rather than management's.
- Putting rate-based bonuses on zero reported injuries, which pushes reporting underground and can draw an anti-retaliation citation (see the discussion in OSHA recordkeeping, injury rates and insurance).
- Closing an incident with "employee retrained" without asking what in the task, tool or schedule made the injury likely.
- Ignoring non-employees on site: temps, subs, delivery drivers and visitors.
Key takeaways
- OSHA has no single program mandate for all employers, but the General Duty Clause, standard-specific written plans and some state rules (California's IIPP, for example) add up to a duty to have a documented system.
- The seven core elements in OSHA's recommended practices, from management leadership to coordination with contractors and staffing agencies, are a workable skeleton for a small business.
- Rank fixes by the hierarchy of controls: eliminate or substitute first, then engineering controls, with administrative controls and PPE last.
- Underwriters, loss control engineers and prequalification services ask for evidence: dated inspections, closed actions and training sign-in sheets.
- Track leading indicators next to TRIR and DART; some states, such as Pennsylvania, pay for a certified safety committee with a premium discount.