Construction safety program and OSHA compliance field guide

What a construction safety program is, and why you need one

A construction safety program is the written plan plus the daily habits that keep people from getting hurt and keep the company out of trouble. It has parts you can see and parts you do: the safety manual on file, the competent person on site, the training records, the toolbox talks, the job hazard analysis before the task, the inspections that find and fix, the incident response when something goes wrong, and the paperwork that proves all of it happened. Pull any one of those out and the program has a hole in it.

People hear program and picture a three-ring binder. The binder is the smallest part. A program that lives only on a shelf does nothing on the roof, and OSHA, your insurer, and the general contractor can all tell the difference between a program that runs and a program that was bought to pass a prequalification form. The test is simple. Walk a job unannounced and see whether the crew can tell you the hazard of the day and show you the harness inspection. That is the program, or the absence of one.

This guide covers the whole program. Falls are the work that kills roofers most, and that subject gets its own treatment in the roof fall protection guide and the roof hatch access guide. Read those for the trigger heights, the systems hierarchy, anchors, and rescue. This one is the structure that holds all of that together: the manual, the people, the training, the records, and the compliance machinery behind them.

Why the program matters: people, citations, the EMR, and the bid

Four reasons, and they stack. The first is the only one that should need saying: people go home. A fall, a trench collapse, a contact with an energized line, these end lives, and the family does not get the worker back because the paperwork was in order. Everything else in this guide is downstream of that.

The second is OSHA. Citations and fines follow a serious injury, and a willful or repeat violation runs into real money per item, with the penalty amounts adjusted for inflation each year. A fatality brings an inspection that goes through your program line by line, and if there is no program, that is its own finding on top of whatever caused the death.

The third is the experience modification rate, the EMR, which sets your workers' compensation premium and follows you onto every bid. An injury history pushes the EMR up, the premium climbs, and the number sits on the prequalification form where every general contractor can see it. A bad mod loses work before you ever submit a price.

The fourth is that safety is a bid requirement now, not a nice-to-have. Owners and general contractors run subcontractors through prequalification platforms that pull your EMR, your citation history, your written program, and your training records. Show up without them and you do not bid. The program stopped being optional the day the GC made it part of the gate.

The written safety program: a living document, not shelf-ware

The written safety program is the document that says what your company does about each hazard and who is responsible. Different names attach to the same thing: a safety manual, a corporate safety plan, an injury and illness prevention program. In California and some other state-plan states, the injury and illness prevention program, the IIPP, is required by regulation, with elements that have to be in it, and Cal/OSHA cites companies that lack one.

Federal OSHA does not impose a single written-program mandate for every employer the way California's IIPP does. What it does require is programs tied to specific hazards: hazard communication, respiratory protection, lockout/tagout, fall protection, confined space, and others each carry their own written-plan requirement, and the construction general provisions at 1926.20 put the duty on the employer to initiate and maintain the programs needed to comply. Add the state plan and the contract, and most trade contractors end up needing a real written program whether or not one umbrella rule names it.

The written program earns its keep only if it matches the work. A manual downloaded off the internet, with another company's name still in the footer and policies for hazards you never touch, is worse than nothing because it shows intent without practice. Write it to your trades, your equipment, your sites. Then keep it current. Revise it when a process changes, when an incident teaches you something, when a standard updates. A program that has not been touched in five years is a program nobody is using.

What is a competent person under OSHA?

A competent person under OSHA is someone who can spot the hazards in the work and has the authority to stop the job and fix them. The definition in the construction standards, at 1926.32(f), is a person capable of identifying existing and predictable hazards in the surroundings or working conditions that are hazardous or dangerous to employees, and who has authorization to take prompt corrective measures to eliminate them. Both halves matter. Knowledge without authority is an observer. Authority without knowledge is a hazard with a title.

Many OSHA standards require a competent person for specific work, and they are not interchangeable. Excavation work under Subpart P needs a competent person for soil classification and protective systems. Scaffolding under Subpart L needs one to oversee erection, alteration, and use. Fall protection, ladders, cranes, and other operations each name the requirement. The person who is competent for trenching is not automatically competent for scaffold. Match the designation to the task.

Here is what trips contractors up: a certificate or a job title does not make someone competent in OSHA's eyes. A 30-hour card is training, not designation. A foreman badge is a title, not authority to spend money stopping the job. The employer has to actually grant the authority, in writing in the program, and put a person there who knows the specific hazard cold. Designate the competent person by name and by task before the crew mobilizes, not after the inspector asks who it is.

Training: OSHA 10 and 30, task-specific, and documented

Train people on the hazards they will face, then prove you did. OSHA's general construction provisions at 1926.21 require the employer to instruct each employee in recognizing and avoiding the conditions on the job and the regulations that apply. That is the floor. On top of it sit the OSHA outreach courses, the 10-hour for workers and the 30-hour for supervisors, which are not a federal requirement for most work but are required by many states, owners, and project labor agreements, so in practice the card is a gate to the site.

Outreach training is awareness, not task qualification. A 10-hour card does not make a worker competent to inspect a harness, classify soil, or operate a lift. Task-specific training is separate and often required by the standard for that equipment or hazard: fall protection, respirators, aerial lifts, powered industrial trucks, silica, lead. Train on the actual gear the crew uses, in a language they understand, when they are hired, when they change tasks, and when something new comes onto the site.

The part that fails audits is documentation. No record means it did not happen as far as OSHA, the GC, and your insurer are concerned, and the time to find the gap is not the morning the compliance officer asks for the roster. Keep the date, the topic, the trainer, and a signature for every session. A field tool like FieldOS lets a foreman capture the sign-in and the certification expiration from a phone on site, so the training record is built as the training happens instead of reconstructed from memory months later. The crew member with an expired fall-protection refresher is the one you want flagged before they clip in, not after.

Toolbox talks: short, daily or weekly, with a sign-in

A toolbox talk is the short safety meeting that puts the day's hazard in front of the crew before the work starts. Five to ten minutes, one topic, run at the truck or the gangbox. Some companies do them daily, many do them weekly with a daily huddle on top, and many GCs and state plans require a documented frequency on their sites. Pick the hazard that matches the work in front of you: the leading edge today, the silica from the saw tomorrow, the heat when the forecast turns.

The point is to keep safety in front of mind in a trade where the danger is routine and the routine breeds complacency. A talk that reads a generic page word for word does nothing. A talk that names the specific exposure on this roof, this morning, with this crew, changes how the next hour goes. Let the crew talk back. The worker who almost got hurt last week is the one with the lesson the binder does not have.

Document it the same way you document training: topic, date, who ran it, and who attended. The attendance sheet is the proof that the crew was warned about the exact hazard, which is exactly what gets examined after an incident. FieldOS can run the toolbox talk from a phone, capture the sign-in with a tap, and tie the talk to the job and the date, so the record exists without a clipboard that gets rained on and lost. A talk nobody signed is a talk that, on paper, never happened.

The job hazard analysis: break the task, find the hazard, control it

A job hazard analysis, the JHA, also called a job safety analysis or JSA, takes a task apart before anyone does it and asks where it can hurt someone. OSHA's guidance, in Publication 3071, lays out the method: break the job into steps, identify the hazard at each step, then determine the control that eliminates or reduces it. The same document drives the analysis the construction world often calls an activity hazard analysis, the AHA, that many GCs require for each phase of work.

Build the control with the hierarchy of controls, in order. Eliminate the hazard if you can, substitute a safer method, engineer it out, control it with procedure, and only then fall back to PPE. PPE is the last line because it depends on a person wearing it correctly every time, which is the line most likely to fail. The hierarchy is the same logic the fall protection guide applies to heights: remove the exposure first, protect against it last.

Do the JHA with the people who do the work, not at a desk. The crew knows the step where the footing is bad and the step where the line has to be unclipped to move, and those are the steps that hurt people. Write it before the task, walk it with the crew, and update it when the conditions change. A JHA filled out after the job to satisfy a file is paperwork. A JHA done before the work is prevention.

The PPE program: assess the hazard, then provide and train

Personal protective equipment is the last control, and a real PPE program starts with a hazard assessment, not a glove order. OSHA requires the employer to assess the workplace for hazards that need PPE, select the right equipment for those hazards, and then provide it and train people to use it. The assessment is the step that gets skipped, which is how a crew ends up with hard hats and no eye protection for the work that throws debris.

Provide the equipment and, for most required PPE, pay for it. OSHA's employer-payment rule covers most PPE the standards require, with a short list of exceptions like ordinary safety-toe boots and prescription safety eyewear. Make people buy their own fall harness and you have built a reason for them to skip it and a citation waiting to happen.

Training is part of the program, not a handoff. A worker has to know which equipment, when to wear it, how it fits, its limits, and how to inspect it and know when it is done. A harness with a deployed shock pack, a respirator with the wrong cartridge, a hard hat cracked from a drop, these protect nobody, and the inspection that catches them belongs in the daily routine and in the record.

The site-specific safety plan that GCs require

A site-specific safety plan, the SSSP, is your safety program written down for one project. The corporate manual says how your company handles fall protection in general. The SSSP says how this site handles it: the access points, the anchor locations, the emergency route, the hospital address, the competent person by name for this job, the phase-by-phase hazards. General contractors require it before you mobilize, and on larger work it is a condition of the subcontract.

The reason the SSSP exists is that the generic manual cannot anticipate the actual site. This roof has a fragile skylight field. That excavation hits a high water table. The crane swings over an occupied building. A plan that ignores those is a plan for some other job. Write the SSSP to the conditions you walked, and revise it when the site changes, because a six-story building is a different hazard at the slab than it is at topping out.

Tie the SSSP to the JHAs and the toolbox talks so they reinforce each other. The site plan names the phase hazards, the JHA breaks down each task within the phase, and the toolbox talk delivers the day's piece to the crew. Run together, they are one program at three altitudes. Run as separate paperwork exercises, they are three files nobody reads.

Site safety inspections and audits: find it and fix it

Regular inspections are required, and they are the part of the program that catches the hazard before it catches a worker. The construction general provisions at 1926.20 call for frequent and regular inspections of the job sites, materials, and equipment by competent persons. That is not a once-a-year audit. It is a walk of the site on a real cadence, looking for the guardrail that came down, the extension cord with the ground pin missing, the housekeeping that turned into a trip hazard.

An inspection that finds problems and does not fix them is worse than none, because now there is a record that you knew. The loop has to close: find the hazard, assign the correction, set a date, and verify it got done. The open item that sits for three weeks is the one an inspector reads as a program that sees hazards and lives with them.

This is where a field tool pays off. FieldOS lets the competent person run an inspection from a phone, photograph the deficiency, assign the fix to a person with a due date, and track it to closed, so the find-and-fix loop is documented start to finish instead of scribbled on a form that never circles back. When the GC or OSHA asks to see your inspection history, the answer is a record with photos and corrections, not a stack of checklists that all say everything was fine.

Incident response: first aid, report, investigate, and the OSHA clock

When someone gets hurt, the program runs in order: care for the person first, secure the scene, report it up the chain, and investigate the cause. First aid and medical attention come before anything else, and the emergency information from the SSSP, the hospital, the route, the muster point, is what makes those minutes work. Nobody should be looking up the nearest ER while a worker is down.

Then investigate for root cause, not blame. The goal is to find why the hazard was there and the control failed, so it does not happen to the next person. A bad investigation stops at the worker who fell. A good one asks why the anchor was where it was, why the plan allowed the exposure, why the training did not stick. Document the investigation while the details are fresh, because memory degrades fast and the scene gets cleaned up.

Two OSHA obligations attach, and people confuse them. Recording is the 300 log, covered next. Reporting is the call to OSHA for severe outcomes, and the clock is short. Under the reporting rule at 1904.39, a work-related fatality must be reported within 8 hours, and an in-patient hospitalization, an amputation, or the loss of an eye must be reported within 24 hours. There are timing conditions on which events trigger the duty, so confirm the current rule and your state-plan requirements, because state plans can be stricter. Miss the window and the late report becomes its own citation. FieldOS can timestamp the incident the moment it is logged from the field, which starts the clock on a record instead of a phone call someone half-remembers, but the reporting decision and the deadline are yours to verify against the standard.

OSHA recordkeeping: the 300 log, the 300A, and the 301

OSHA's injury and illness recordkeeping, in Part 1904, runs on three forms. The 300 log lists each recordable case for the year. The 301 is the incident report behind each entry, with the detail. The 300A is the annual summary that totals the year. A case is recordable when it is work-related and crosses a threshold like medical treatment beyond first aid, days away from work, restricted duty, or a transfer, and the distinction between first aid and recordable treatment is where most logging errors live, so check the case against the rule rather than guessing.

Post the 300A summary where employees see it, from February 1 to April 30 each year, even if the year had zero recordable cases. The dates and the duty are set in the recordkeeping rule, so confirm the current requirement, but that posting window is long-standing. Many employers also have an electronic submission obligation depending on size and industry, which is a separate step from posting.

Not every employer keeps the log. Companies with 10 or fewer employees during the prior calendar year are partially exempt from routine recordkeeping, as are certain lower-hazard industries by classification. Construction is generally not in the low-hazard exempt group, so most trade contractors above the size cutoff keep the log. Verify your status against the rule and the state plan. One thing the exemption never covers: the severe-injury reporting in the prior section applies to every employer regardless of size.

What is an EMR and why it drives the bid

The experience modification rate, the EMR or e-mod, is a multiplier that compares your workers' compensation loss history to other companies your size in your trade. It runs against an industry average set at 1.0. Below 1.0 means your losses are better than average and your premium is discounted. Above 1.0 means worse than average and you pay a surcharge. The premium is roughly the standard premium times the mod, so a 0.85 mod cuts the premium meaningfully and a 1.25 mod adds to it.

The mod is built from your claims over a three-year window, with the most recent complete years carrying weight, and frequency of claims tends to hurt the number more than a single large one. That matters for how you run the program: a string of small recordables can move the mod more than people expect. The number lags reality by a couple of years, so the work you do on safety today shows up in the mod down the road, not next quarter.

Where the EMR bites hardest is the bid. General contractors and owners use it as a prequalification screen, often drawing the line at below 1.0, and stricter on higher-hazard work. Prequalification platforms like ISNetworld and Avetta pull it automatically. A mod over the threshold can knock you out of the running before price ever enters the conversation. The program that keeps people from getting hurt is the same program that keeps the mod low and keeps you eligible to bid.

The Focus Four: falls first, then struck-by, caught-in, electrocution

OSHA's Focus Four are the hazards that kill the most construction workers: falls, struck-by, caught-in or between, and electrocution. They account for the large majority of construction deaths, and falls lead the list by a wide margin. Aim the program at these four first, because that is where the bodies are. Everything else in the program supports keeping people clear of these.

Falls are the number-one killer in construction and the top killer in roofing specifically, which is why fall protection gets its own full treatment in the roof fall protection guide and the roof hatch access guide. Read those for the trigger heights, guardrails, personal fall arrest, warning lines, skylights, the competent person for fall protection, and the rescue plan. The short version for the program: eliminate the exposure first, protect against it last, and train before anyone is exposed.

The other three each have their own signatures. Struck-by is the worker hit by a flying, falling, swinging, or rolling object: the load that swings, the rebar cap that is missing, the vehicle backing in a blind spot. Caught-in or between is the trench cave-in, the worker pinned between equipment and a wall, the hand pulled into a moving part. Electrocution is contact with an overhead line, an energized circuit that was not locked out, or a damaged cord. Each gets its own controls, its own training block, and its own toolbox talk, because the worker who knows falls cold can still walk into a swing radius.

Subcontractor safety: prequalify and orient

On most jobs you are either hiring subs or you are one, and the safety duty does not stop at your own crew. If you bring subs on, prequalify them: check their EMR, their citation history, their written program, and their training, the same screen a GC runs on you. A sub with a bad mod and no program is a hazard you are inviting onto your site and, on a multi-employer site, a liability that can land on you.

Then orient them. A site-specific orientation puts every worker, yours and the subs', through the hazards of this job, the access, the emergency plan, and the rules before they start. The orientation roster is also a record you will want if anything happens. Prequalification screens who you let on. Orientation makes sure the ones you let on know the site they walked into.

Discipline and accountability: enforce it, and lead it

A safety program with no consequences is a suggestion. Workers read the real rules off what gets enforced, not what the manual says, so the program needs a disciplinary policy that is written down, applied evenly, and actually used. Unclipping at height, removing a guard, skipping the lockout: these get a documented response, and the response is the same whether it is a first-week laborer or a twenty-year foreman.

Even enforcement is the part that makes or breaks it. The moment the crew sees the productive guy get a pass on the harness while the new hire gets written up, the program is dead and everyone knows it. Inconsistent discipline also reads badly to OSHA, which can treat a known, tolerated violation as evidence the program is not real.

Discipline is the stick, and it does not work alone. The strongest signal is the owner and the superintendent wearing the PPE, stopping the job for the hazard, and clipping in on the same roof they ask the crew to clip in on. Lead it from the top or do not expect it from the bottom.

Safety culture: stop-work authority and no-blame reporting

Culture is what the crew does when no supervisor is watching, and it is the difference between a program that survives a bad day and one that fails the first time production gets tight. The two practices that build it are stop-work authority and no-blame reporting. Give every worker the explicit, real authority to stop a job when they see a hazard, with no fear of being the one who slowed the pour, and back them the time they use it even if they were wrong.

No-blame reporting means near-misses and hazards get reported because reporting them does not get anyone punished. A near-miss is a free lesson: the fall that did not happen because the anchor held, the line that was dead when someone touched it. A crew that hides near-misses to avoid blame is a crew flying blind toward the one that does not miss. Reward the report, fix the hazard, and keep the blame for willful violations, not for honesty.

Culture is slow to build and fast to lose. One time leadership overrides a stop-work call to make a schedule, and the authority is gone for good.

Keep the records: to OSHA, no record means it did not happen

The whole program produces records, and the records are what prove the program is real. Training rosters, toolbox-talk sign-ins, JHAs, inspection reports with corrections, PPE assessments, incident investigations, the 300 log: each one is evidence that the work got done. To OSHA, the GC, and your insurer, the unwritten talk and the undocumented inspection did not happen. The record is the only version of events that counts after the fact.

Paper records lose this fight. The clipboard gets rained on, the sign-in sheet rides around in a truck and disappears, the inspection form never makes it back to the office, and the one document you need is the one that walked off the job. When a compliance officer asks for two years of toolbox talks, the company that kept them on paper spends a frantic week and still comes up short.

This is the natural place for a field tool to carry the program. FieldOS captures training sign-ins, toolbox talks, inspections, and incidents from a phone on the job, timestamps and tags each to the project, and keeps them in one place that does not flood or get left in a gangbox. The point is not the software. The point is that the proof gets created at the moment the work happens, by the person doing it, instead of reconstructed under pressure when someone official is standing in the trailer asking to see it.

Use the table below as the short list of what to keep and why it matters.

If OSHA shows up: rights, cooperation, and your own record

An OSHA compliance officer can arrive without notice, usually for a complaint, a referral, a programmed inspection, or after a reported injury. You have rights at the opening conference: ask for credentials, ask the reason for the visit, and you can ask to see a warrant, though demanding one sets a tone and the officer can return with one. Most contractors do better cooperating professionally than turning the visit adversarial.

Walk the inspection with the officer and document the same things they document. Take your own photos of whatever they photograph, write down what they look at and what they say, and have your competent person and your records ready. The written program, the training, the toolbox talks, and the inspection history are exactly what gets asked for, and the company that can produce them on the spot is in a different position than the one promising to send them later.

Designate ahead of time who handles an OSHA visit and what they do, because the worst time to figure it out is when the officer is at the gate. Train the foremen on the basics: be professional, be truthful, do not guess or volunteer beyond the question, and get the right person on the phone. The visit goes far better when the program it is checking already exists.

The small shop needs a program too: scale it, do not skip it

A two-truck contractor needs a safety program as much as a regional outfit, just sized to the work. OSHA's standards apply from the first employee, the Focus Four kill small crews the same way they kill big ones, and the GC's prequalification screen does not waive the requirement because the company is small. The injury that closes a large company is a rounding error to them and a death sentence to a shop of six.

Scaling down does not mean cutting elements. It means making each one fit. The competent person might be the owner. The written program is shorter but still real and still matched to the trades. Toolbox talks happen at the truck, the JHA is a five-minute conversation before the task, and the records live on a phone instead of a filing cabinet. A small contractor running a real, lean program beats a big one with a fat binder nobody opens.

The smaller the company, the more a field tool earns its place, because there is no safety department to chase paperwork. The owner is the foreman, the estimator, and the safety manager, and a phone that captures the talk and the inspection as they happen is the difference between a program that exists and one that was always going to get written down later.

Where safety programs fail in the field

The programs that fail tend to fail the same handful of ways, and none of them are exotic. The most common is no written program, or one that exists only as a binder nobody has opened, with another company's name still in it. The next is no designated competent person, or a title handed out with no real authority to stop the job and spend money fixing a hazard.

Then come the documentation failures, which are the ones that turn a good day's work into a citation. Toolbox talks and training that actually happened but were never written down. No JHA before the task, so the hazard nobody planned for is the one that bites. Incidents that never make it onto the 300 log, or severe injuries not reported to OSHA inside the window. And underneath all of them, no records, so even the safety work that did happen cannot be proven when an inspector or an insurer asks.

The pattern is the same every time. The program existed on paper and not on the roof, or it existed on the roof and not on paper. A program that lives only as a document does nothing for the crew. A program the crew runs but never records cannot defend the company. You need both, and the second one is the one contractors skip.

Common mistakes

• No written program, or a generic one that sits on a shelf with another company's name in it.
• No designated competent person, or a title with no real authority to correct hazards.
• Toolbox talks and training done but never documented with a date, topic, and sign-in.
• No job hazard analysis before the task, so the unplanned hazard is the one that hurts someone.
• Incidents not recorded on the 300 log, or severe injuries not reported to OSHA inside the window.
• Discipline applied unevenly, so the crew learns the real rule is whatever production allows.
• No records kept, so the safety work that happened cannot be proven to OSHA, the GC, or the insurer.

Field checklist

Standards and references

OSHA's construction standards, 29 CFR 1926, are the framework for most of this work. The general safety and health provisions at 1926.20 put the duty on the employer to maintain a program and to inspect the site with competent persons, 1926.21 covers safety training and education, and 1926.32(f) defines the competent person. Hazard-specific subparts carry their own written-plan and competent-person requirements, including fall protection in Subpart M, scaffolds in Subpart L, and excavation in Subpart P.

The Focus Four, falls, struck-by, caught-in or between, and electrocution, are OSHA's grouping of the hazards behind most construction deaths, with falls leading. Recordkeeping lives in 29 CFR 1904: the 300 log, the 301 incident report, and the 300A annual summary, with the 300A posted from February 1 to April 30, and severe-injury reporting at 1904.39 setting the 8-hour fatality and 24-hour hospitalization, amputation, and eye-loss windows. The exact thresholds, exemptions, and timing conditions shift with the rule, so confirm them against the current text.

Two things sit outside OSHA but drive the program just as hard. The experience modification rate, the EMR, comes from your workers' compensation carrier and the rating bureau, and it gates prequalification on most jobs. State-plan states, including California with its IIPP requirement at Title 8 Section 3203, can be stricter than federal OSHA and govern in their jurisdictions. Confirm the adopted standards, the state-plan rules, and the contract requirements with the authority having jurisdiction before you rely on any number or deadline in this guide. The written, living program, the real competent person, and documenting everything are the three things that hold up no matter which jurisdiction you are in.

Terms and acronyms

The safety program carries a lot of acronyms, and the same idea shows up under more than one name across OSHA, the GC's paperwork, and the insurer's forms.

Know the program documents and the people behind them, because a prequalification form and an OSHA inspection both speak in these terms, and answering in them is part of looking like a contractor who runs a real program.

IIPP

Injury and illness prevention program, the written safety program; required by Cal/OSHA and some other state plans

Competent person

Per 1926.32(f), one who can identify hazards and has authority to correct them; required for specific tasks

JHA / JSA / AHA

Job hazard analysis, job safety analysis, or activity hazard analysis; same process of step, hazard, control

SSSP

Site-specific safety plan, your program written for one project; commonly required by the GC

Focus Four

Falls, struck-by, caught-in or between, and electrocution, the hazards behind most construction deaths

EMR / e-mod

Experience modification rate; a workers' comp multiplier against 1.0 that drives premium and bid prequalification

OSHA 300 / 300A / 301

The recordable injury log, the annual summary, and the incident report under 29 CFR 1904

Recordable vs reportable

Recordable goes on the 300 log; reportable means the call to OSHA for a fatality or severe injury

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

People also ask

• At what height is fall protection required on a roof?
• What fall protection is required at a roof hatch?
• What is the 4 to 1 ladder rule?
• What is a mast-climbing work platform?
• What is a competent person for scaffolds?