Four Stackable HazCom Citations From One Unauthorized Chemical: Why the Procurement Gate Has to Fail-Closed Before the Drum Lands

A drum lands on the receiving dock at 2:47 p.m. on a Wednesday. The bill of lading says it is a degreaser for the new line installation engineering ordered three weeks ago. The dock supervisor scans it in, signs the carrier paperwork, and rolls it into the staging area. No one on the dock has seen the safety data sheet. No one in EHS knew the drum was coming. The chemical is not on the master list, no one has been trained on its hazards, and it is now a Tier II inventory item that will need to be reported by March 1. If an OSHA compliance officer walks in this afternoon, that single drum is the seed of four separate citations under the agency’s own published inspection procedures — each carrying a serious-violation ceiling of $16,550, with the willful multiplier sitting at $165,514 (CPL 02-02-038; 29 CFR 1910.1200; OSHA penalty announcement, January 14, 2025).

This is what an informal procurement gate produces. The dock is not the wrong place to stop unauthorized chemicals; it is the wrong place to make the decision in the first place. The chemical approval program is the operational control that lives upstream of the dock — at the moment the purchase requisition is issued — and that is the only point where you can stop a non-compliant chemical without triggering the regulatory clocks attached to it. Below is what those clocks actually look like, what OSHA’s per-paragraph citation rule does to a single procurement gap, and the eight-step approval workflow that closes the loop.

How One Unauthorized Drum Triggers Four Citations

OSHA’s Inspection Procedures for the Hazard Communication Standard (CPL 02-02-038) instructs compliance officers to treat each substantive paragraph of 29 CFR 1910.1200 as a separate citation item when an employer has failed to comply. That is not theoretical. The directive specifically lists the absence of a written program (paragraph (e)), the absence of a chemical inventory list (also paragraph (e)), labeling failures (paragraph (f)), missing or inaccessible safety data sheets (paragraph (g)), and gaps in employee training on a newly introduced hazard (paragraph (h)) as items that “may be cited as separate violations” when the employer “has done nothing to comply.”

Apply that to the drum on the dock. The chemical is not on the master list — paragraph (e)(1)(i) violation. The drum’s SDS is not in the employees’ work area or available electronically without a barrier — paragraph (g)(8) violation. No one in the work area received training on this specific hazard before they were assigned to handle it — paragraph (h)(1) violation. If the work area is a PSM-covered process, there is also no written Management of Change documenting the technical basis, the impact on safety and health, and the authorization to introduce the new chemical — 29 CFR 1910.119(l) violation. Four citations from one drum, before the inspector finishes the walkthrough.

At the 2025 penalty ceiling, four serious citations run up to $66,200. If OSHA classifies any of them as willful — and “has done nothing to comply” language in CPL 02-02-038 is exactly the framing willful classifications run on — the willful ceiling is $165,514 per instance (OSHA, 2025 Annual Adjustments to OSHA Civil Penalties). The Field Operations Manual further permits violation-by-violation penalty proposals for egregious cases, which is the mechanism by which published willful HazCom enforcement actions climb into the hundreds of thousands of dollars from a single facility visit.

HazCom remained the #2 most-cited federal OSHA standard in general industry in FY2024 (OSHA Top 10 Most Frequently Cited Standards), with the same three failure patterns appearing in citation summaries: inventory list gaps, missing SDSs, and training gaps for newly introduced chemicals. Those three are exactly what an unauthorized chemical at the dock produces by definition. The procurement gate is the only control that prevents them simultaneously.

What Is a Chemical Approval Program, in Operational Terms?

A chemical approval program is a written procedure that requires every new chemical — every new supplier of an existing chemical, every reformulated version of an existing chemical, every new container size that affects storage or quantity calculations — to clear a fixed compliance review before a purchase order is issued. It is not a software tool, a binder, or a meeting. It is a sequence of approval steps with documented owners and documented outputs, and a fail-closed receiving rule that rejects shipments not on the approved list.

The point of the program is to put the regulatory decision in the hands of someone qualified to make it, at the moment when the decision can still be made without consequence. Once the drum is on the dock, every option costs money: ship it back (which the carrier may refuse if it is hazmat), warehouse it pending review (which creates an unpermitted storage condition), or accept it and start the clocks (which produces the four-citation scenario above). Pre-purchase review costs nothing comparable.

The Eight Steps the Approval Program Has to Execute

Step 1 — Pre-purchase SDS review. Procurement obtains the current safety data sheet from the supplier before the purchase order is issued. The SDS must be on hand at first shipment under 29 CFR 1910.1200(g)(1); pre-purchase review pulls that obligation forward to a point where the employer can still walk away from the chemical without absorbing it. The EHS team reads Section 1 (identity), Section 2 (hazards), Section 9 (physical/chemical properties), and Section 16 (revision date) at minimum.

Step 2 — Hazard classification and inventory impact assessment. EHS reviews the SDS against the existing chemical inventory list (29 CFR 1910.1200(e)(1)(i)), the EPCRA Tier II reporting thresholds (40 CFR 370), the RMP threshold list under 40 CFR 68 if the facility is covered, and NFPA 400 Maximum Allowable Quantity by control area. Decision: approve, reject, or approve-with-quantity-limit. Reject decisions get documented and forwarded back to engineering or operations so the alternative substitution conversation begins early.

Step 3 — Management of Change trigger for PSM-covered processes. If the process is covered by 29 CFR 1910.119 and the new chemical is a process chemical — or if the change involves a different concentration, supplier, or formulation of an existing one — the written MOC procedure under 1910.119(l) is initiated. The MOC documents the technical basis, impact on safety and health, modifications to operating procedures, time period for change, and authorization. No after-the-fact MOC is permitted; OSHA’s National Emphasis Program for chemical facilities treats undocumented MOCs as a high-priority finding.

Step 4 — Engineering review for substitution. Before approving the chemical, run the NIOSH hierarchy of controls: can elimination or substitution remove the hazard at the source? Document the alternatives assessment regardless of the outcome. This is the record the general duty clause and the TSCA Section 6 risk-management cases lean on when “feasible means” gets litigated, and it is the record that defends the procurement decision when a future inspector or insurance auditor asks why the facility uses the chemical it uses.

Step 5 — Training plan before first use. Required by 29 CFR 1910.1200(h)(1) — training must occur “whenever a new chemical hazard the employees have not previously been trained about is introduced into their work area.” The plan identifies who needs training, which work areas, what specific hazard (acute or chronic), what controls are required (PPE, ventilation, spill response), and confirms the trainer is qualified. Training is scheduled and confirmed before the chemical is allowed on the floor, not after.

Step 6 — Inventory update and SDS filing. The chemical is added to the master inventory list and the relevant work-area sub-list. The SDS is filed in the location accessible to employees during their work shifts — paper or electronic per 1910.1200(g)(8)–(g)(11) — with the access barrier rule satisfied (no login walls, no walk-to-the-safety-office workarounds, no shift-dependent restrictions).

Step 7 — Receiving dock authorization document. EHS issues a one-page approval certificate to the receiving dock that authorizes acceptance of this specific chemical, this specific supplier, this specific container size, and this specific quantity. Receiving’s rule is fail-closed: shipments not on the approval list get rejected at the gate and routed back to EHS. That is the entire procurement gate, mechanically — a receiving rule that the dock supervisor can execute without making a regulatory judgment.

Step 8 — Tier II inventory recalculation. EHS reassesses whether the new chemical pushes facility-wide inventory over an EPCRA reporting threshold mid-year and updates internal tracking so the March 1 Tier II submission reflects the new inventory under 40 CFR 370.40. After EPA’s November 17, 2025 EPCRA technical amendments (90 FR 53330), the Tier II hazard categorization must match the 2024 HazCom SDS classification — which means the SDS review done at Step 1 feeds the state filing directly, with no separate translation step.

Eight steps, each tied to a citation, each producing a documented record. The receiving dock executes only Step 7. The other seven happen upstream.

Why the 2024 HazCom and 2025 EPCRA Updates Make This More Urgent

OSHA finalized the most significant HazCom update since 2012 on May 20, 2024 (89 FR 44144), aligning the U.S. standard with the seventh revised edition of the UN GHS, restructuring hazard classes, and replacing “Flammable Aerosols” with the broader “Aerosols” and “Chemicals Under Pressure” classes (OSHA HazCom Standard Final Rule). The substantive downstream-employer compliance date is July 19, 2026, with conforming workplace labels, written program, and training updates required no later than May 19, 2028 for mixtures.

EPA’s November 17, 2025 EPCRA conforming amendments (90 FR 53330) replace the 24 EPCRA Tier II hazard categories with 112 categories drawn directly from the 2024 HazCom standard. The first reporting cycle under the new 112-category structure is March 1, 2027 for calendar-year 2026 inventory. The implication for the procurement gate is that a single SDS hazard classification now flows through both the workplace HazCom program and the state Tier II inventory report — the gate captures it once, and the work product does double duty. A facility that captures SDS hazard classifications informally or inconsistently will end up doing the EPCRA reclassification work twice and finding inconsistencies between the two on every audit.

Which Facilities Face the Heaviest Exposure?

Every employer that produces, uses, or stores hazardous chemicals is subject to 29 CFR 1910.1200. There is no small-business exemption from the written program, the inventory list, or the new-chemical training trigger. The standard applies across general industry (Subpart Z) and is incorporated into the construction (1926.59) and shipyard (1915.1200) standards by reference. That captures every manufacturer, fabricator, distributor, warehouse, water and wastewater utility, municipal operations yard, K–12 maintenance shop, hospital facilities group, and laboratory in the country.

Three sub-populations carry heightened exposure when the procurement gate is informal or missing:

PSM-covered facilities operating under 29 CFR 1910.119 and the Appendix A threshold list. Any introduction of a new process chemical — or a change in concentration, supplier, or formulation of an existing one — triggers a written Management of Change procedure that must be completed before startup. Combined OSHA HazCom plus EPA RMP plus PSM MOC citations from the same unauthorized chemical are the scenario that drives litigated penalty totals into seven figures.

EPCRA Tier II reporters with extremely hazardous substances over their threshold planning quantity or non-EHS chemicals over 10,000 pounds. A chemical entering the facility mid-year that pushes inventory over threshold creates a March 1 reporting obligation the EHS team did not see coming. After the November 2025 conforming amendments, the categorization on the Tier II form must match the 2024 HazCom SDS classification, so a misclassified or undocumented chemical fails both standards simultaneously.

TSCA-regulated manufacturers and importers. A new chemical substance not on the TSCA Inventory cannot be manufactured or imported without a 90-day Premanufacture Notice under TSCA Section 5. If EPA issues a Section 5(e) Consent Order with a New Chemical Exposure Limit, the workplace must enforce that NCEL through engineering controls or respiratory protection. The 90-day clock is non-negotiable, which is exactly why importers in particular need a pre-purchase gate that runs ahead of vendor onboarding.

State-Level Variations Worth Knowing

The federal HazCom standard preempts state worker right-to-know statutes for OSHA-regulated employers (29 USC 667). But state Tier II reporting under EPCRA delegated authority varies meaningfully across the states iSi covers. Kansas Department of Health and Environment administers Tier II through a state web-based reporting system with reports due March 1 each year; EHS substances trigger reporting at the lower of 500 pounds or TPQ. Oklahoma DEQ administers Tier II with a March 1 annual deadline at federal EPCRA thresholds. Missouri Emergency Response Commission accepts Tier II between January 2 and March 1 annually for facilities at or above EPCRA thresholds. Texas, Nebraska, and Colorado each run their own SERC-administered programs with state-specific fees and supplemental data fields, though threshold definitions track federal EPCRA.

Across all five states, the November 2025 conforming amendment means the Tier II hazard categorization now matches the 2024 HazCom SDS classification. The procurement-gate SDS review feeds the state filing directly. That is the operational case for capturing hazard data correctly at the gate the first time — every subsequent compliance product downstream of the gate inherits that data, and every error at the gate propagates through the Tier II submission, the HazCom training plan, the work-area labeling, and the MOC record if the chemical is PSM-covered.

What the One-Person EHS Team Should Build First

For the safety manager who also owns environmental, the procurement gate is the single highest-leverage control they can build. It works because it prevents the work from arriving disorganized in the first place. The gate document — a one-page approval certificate, a fail-closed receiving rule, and a fixed sequence of pre-purchase reviews — can be drafted in an afternoon. The harder part is the discipline of running every requisition through it without exceptions, and having someone qualified to perform Step 2 (hazard classification) and Step 3 (MOC trigger) on the chemicals that are novel or process-critical.

That is the structural compliance gap iSi closes. The procurement gate is the procedure. The qualified review authority is the senior environmental professional. An informal gate held together by one safety manager’s institutional memory is fragile; a written procedure backed by a national team of environmental practitioners is durable. iSi’s EHS COOP retainer puts that team behind the safety manager for a fraction of the cost of a single dedicated hire — and the HazCom program design work, including the chemical approval workflow itself, is part of the standard COOP scope. If the procurement gate at your facility is informal — no written procedure, no fail-closed receiving rule, no documented owner for Step 2 hazard classification — that is the gap to close before the next drum lands.