You Have Locks. Do You Have a Compliant Lockout/Tagout Program?
← Back to Blog Compliance

You Have Locks. Do You Have a Compliant Lockout/Tagout Program?

A LOTO program isn't compliant just because you own padlocks. OSHA's 1910.147 requires four elements — miss one and it's a citation. Here's the full audit.

by iSi Environmental

Almost every plant that services its own equipment owns a rack of red padlocks and a stack of danger tags. Far fewer can hand an OSHA inspector the four things that actually make a lockout/tagout program compliant with 29 CFR 1910.147. That gap — between “we do lockout” and “we run a compliant energy-control program” — is exactly why LOTO ranked #4 on OSHA’s FY2025 Top 10 most-cited standards, with 2,177 citations (OSHA FY2025 Top 10). The rule has been in force since 1989. Inspectors are not confused about it, and neither are the maintenance workers protected by it. What gets facilities cited is documentation discipline: missing machine-specific procedures, undocumented training, and the annual inspection nobody remembered to certify.

If you manage a plant or a maintenance crew, this post is the self-audit. It walks the four required program elements, the six-step energy-control sequence, the annual inspection almost everyone forgets, who has to be trained and how, what the standard actually costs when you get it wrong, and the exceptions that mean not every task needs full lockout. Every requirement below is tied to the specific paragraph of 1910.147 an inspector will cite. Run your program against it.

What is required for a LOTO program to be OSHA-compliant?

A compliant program under 29 CFR 1910.147 needs four things: a written energy control program, machine-specific written procedures, role-based employee training, and an annual periodic inspection by an authorized employee not using the procedure. Missing any one — even with the other three in place — is a citable violation (OSHA 1910.147(c)).

That last point is the one facilities underestimate. This is not a scored audit where three out of four earns a passing grade. Each element is an independent obligation. A plant with a polished written program, individual procedures for every press, and fully trained employees is still out of compliance if it skipped last year’s periodic inspection. Conversely, a facility that inspects diligently but runs one generic procedure across forty different machines is exposed on the machine-specific requirement. OSHA estimates the standard, properly implemented, prevents roughly 120 fatalities and 50,000 injuries a year (OSHA control-of-hazardous-energy overview) — which is why inspectors treat each element as load-bearing, not optional.

The standard covers every form of hazardous energy a maintenance worker can encounter: electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and stored energy in springs, capacitors, and elevated components. If unexpected startup or an uncontrolled release of any of these could injure someone during servicing, LOTO applies.

What are the six steps of the LOTO energy control procedure?

Under 1910.147(d), authorized employees must follow six steps in order: (1) prepare for shutdown, (2) shut down the machine, (3) isolate the energy source, (4) apply lockout/tagout devices, (5) release or restrain stored/residual energy, and (6) verify isolation with a zero-energy check before servicing begins (OSHA 1910.147(d)). The sequence is mandatory every time, not a suggested best case.

Two of these steps are where real incidents happen. Step 5 — releasing or restraining stored energy — is the one that kills people who did everything else right. A hydraulic accumulator, a raised ram, a charged capacitor bank, or a spring under load stays lethal after the disconnect is locked. The procedure has to account for it. Step 6, the zero-energy verification, is the physical proof that the isolation worked: try to start the machine (with the controls returned to off after), test for voltage, confirm the ram is down, bleed the line. “I locked it out” is a belief. A verified zero-energy state is a fact. The distance between those two is where amputations occur.

Prepare for shutdown, step 1, is often skipped in the write-up but matters in practice: the authorized employee has to know the type and magnitude of energy present and the hazards of controlling it before touching anything. That knowledge requirement is why generic procedures fail — a one-size procedure can’t tell an employee which of a machine’s four energy sources are live.

How often does OSHA require LOTO periodic inspections?

At least annually. Under 1910.147(c)(6), an authorized employee who is not using the procedure being inspected must review each energy control procedure and certify it — recording the machine, the inspection date, the employees included, and who performed the inspection (OSHA 1910.147(c)(6)). Skipped or self-inspected procedures are among the most common LOTO citations.

Read that “not using the procedure being inspected” clause carefully, because it trips up conscientious facilities. The inspector reviewing the punch-press procedure cannot be the same person who runs the punch-press lockout. The point is a fresh set of eyes catching drift between the written procedure and the way the work actually happens on the floor. When the same maintenance tech writes, performs, and audits his own lockout, the inspection is worthless as a control — and OSHA will treat it as not done.

The certification is the paper that proves it happened. In an inspection, undocumented equals not performed. If a compliance officer asks for your 1910.147(c)(6) certifications and you can’t produce them by machine and date, the annual-inspection element is a citation regardless of whether the inspections actually occurred. This is the single most-missed element in the standard and the easiest one for an officer to write, because it comes down to whether a dated record exists.

Do I need a separate LOTO procedure for every machine?

Generally, yes. Each machine needs a written procedure identifying its specific energy sources and isolation steps. A single generic procedure is only acceptable if the equipment meets all conditions of the narrow exception in 1910.147(c)(4)(i) — one energy source, no stored or residual energy, a single isolation method, and more (OSHA 1910.147(c)(4)). Most equipment does not qualify, so machine-specific procedures are the norm.

The single-procedure exception is real, but the conditions are cumulative and strict. To use one generic procedure, the machine must have no potential for stored or residual energy after shutdown, a single energy source that is readily identified and isolated, the isolation and lockout must fully de-energize the machine, a single lockout device must achieve a locked-out condition, the device must be under the exclusive control of the authorized employee, and the servicing must create no hazard for other employees. Fail one condition and the exception is gone. A press with a pneumatic clamp and a hydraulic ram has two energy sources and stored energy — it needs its own procedure. Most production equipment does.

This is where “we have a LOTO binder” facilities get cited. A binder with one boilerplate procedure photocopied for every machine reads, to an inspector, as no machine-specific procedures at all. The fix is not more hardware; it’s building out the equipment-specific procedures that identify each machine’s energy sources and the exact isolation points.

What LOTO training does OSHA require, and for whom?

Training is role-based under 1910.147(c)(7). Authorized employees learn to recognize hazardous energy and the methods to isolate and control it; affected employees (operators) learn the program’s purpose and not to restart locked-out equipment; other employees learn the prohibition on removing devices. Retraining is required when procedures change, assignments change, or an inspection finds deficiencies (OSHA 1910.147(c)(7)).

The depth of training scales with the role, and that is deliberate. An authorized employee — the person who actually applies the locks and does the servicing — needs the full hazard-recognition and energy-control competency. An affected employee who runs the machine needs enough to understand why it’s locked out and to never attempt a restart. Everyone else in the area needs to know that a lock and tag mean hands off. Train everyone to the authorized standard and you’ve wasted labor; train your authorized employees to the affected standard and you’ve under-trained the people doing the dangerous work.

The retraining triggers matter as much as the initial training. New equipment, a changed procedure, a reassignment, or a periodic inspection that surfaces a gap all reset the obligation. And, as with everything in this standard, the training certification is the proof. Documented training with employee names and dates is compliance; a claim that “everybody knows the procedure” is a finding waiting to happen.

What’s the difference between authorized, affected, and other employees?

Authorized employees perform the lockout and the servicing. Affected employees operate the equipment or work in the area but don’t perform lockout. Other employees are anyone whose work is or may be in an area where energy control is used (OSHA 1910.147(b)). Each group gets different training, and misclassifying employees leads to under-training and citations.

Getting the classification right is the front end of getting the training right. The maintenance tech who applies the locks is authorized. The line operator who runs that machine and has to stay clear during service is affected. The forklift driver who passes through the area is an other employee. Misclassify the operator as an other employee and you’ve under-trained someone who works within arm’s reach of the hazard. Because the training obligation flows directly from the classification, an error here cascades into a training deficiency the inspector will find.

How is a compliant LOTO program different from just using locks?

Applying a padlock is one step of one procedure. Compliance requires the written program, machine-specific procedures, documented role-based training, verified stored-energy release, an annual certified inspection, and standardized, controlled devices (OSHA 1910.147(c)). OSHA cites facilities that “do lockout” informally but lack the written procedures, training records, and inspection certifications the standard requires.

The devices themselves carry requirements most people skip past. Under the standard, lockout and tagout devices must be durable, standardized (by color, shape, or size), substantial enough to prevent removal without excessive force, and identifiable — they must indicate the identity of the employee who applied them. A mixed drawer of hardware-store padlocks with no assigned owner fails the identifiable-and-standardized test. The program also has to address the situations where informal lockout breaks down entirely: group lockout on a job with multiple authorized employees, shift changes where lockout responsibility transfers hand-to-hand, and contractor coordination where an outside crew and your people both have to be protected. Locks handle none of that on their own. A program does.

What equipment is exempt from the LOTO standard?

Two main exceptions apply. First, cord-and-plug-connected equipment is exempt where unplugging fully controls the energy and the plug stays under the exclusive control of the worker doing the servicing. Second, minor tool changes and adjustments that are routine, repetitive, and integral to production are exempt if alternative effective protection is provided (OSHA 1910.147(a)(2)). Normal production operations are outside LOTO — but the moment guarding is bypassed for servicing, LOTO applies.

These carve-outs are genuinely useful and worth understanding, because over-applying LOTO wastes labor on tasks the standard never intended to cover. Unplugging a bench grinder and keeping the plug in your pocket while you change the wheel is legitimate energy control without a formal procedure. A routine die adjustment that is part of running the machine, with effective alternative protection in place, doesn’t trigger full lockout. The boundary is servicing versus normal production: as long as the machine’s safeguards are doing their job during normal operation, you’re outside the standard. Reach past a guard, bypass an interlock, or put a hand into a point of operation for maintenance, and you’re back inside it — full procedure required. Misapplying either exception, in either direction, is itself a frequent citation.

What are the penalties for a LOTO violation?

In 2026, OSHA can assess up to $16,550 per serious violation and up to $165,514 per willful or repeat violation (OSHA penalties). These figures are frozen at 2025 levels — no inflation adjustment was made for 2026 under OMB Memorandum M-26-11 (OMB M-26-11). The widely repeated “penalties went up for 2026” line is simply wrong.

The exposure isn’t the single number — it’s how LOTO citations stack. A deficient program is rarely a one-machine problem. If your procedures are generic, they’re generic across the whole floor; if training wasn’t documented, it wasn’t documented for anyone; if the annual inspection was skipped, it was skipped everywhere. One structural failure multiplies across machines and employees, and repeat or willful classifications carry the top $165,514 figure. That arithmetic is how LOTO enforcement outcomes reach six figures even at mid-sized plants, and it’s the same asymmetry that makes an assessment cheap by comparison: a single willful violation runs up to $165,514, while an industrial hygiene or safety-program review that catches the gap first runs a small fraction of that.

Why is LOTO consistently in OSHA’s Top 10 most-cited standards?

LOTO ranked #4 in FY2025 with 2,177 citations (OSHA FY2025 Top 10). The persistence isn’t confusion about the rule — it’s the gap between having a program and having a compliant one. Most citations trace to three failures: generic (non-machine-specific) procedures, missing or undocumented training, and skipped or improperly conducted annual inspections.

Notice that all three are documentation failures, not hardware failures. The facilities getting cited generally own the locks and generally lock out their equipment. What they lack is the paper trail the standard requires: the equipment-specific procedure, the dated training record, the certified annual inspection. That’s a hopeful finding for a plant manager, because it means closing the gap is largely a matter of discipline and records, not capital spend. LOTO also shows up as a frequent finding after amputation and caught-in incidents, where a maintenance worker was injured by unexpected startup — which is why the standard stays under steady, program-driven enforcement rather than one-time campaigns.

Does OSHA plan to update the 1910.147 LOTO standard? (The counter-signal)

Possibly — and this is where the usual “tighten up or get fined” framing needs a correction. OSHA has kept LOTO on its long-term regulatory agenda, examining whether control circuit devices and modern robotics, including collaborative robots, warrant revisions to the 1989 standard (OSHA control-of-hazardous-energy overview). No revised rule is final. We covered that specific rulemaking question in our earlier post on the LOTO standard being on OSHA’s update list. The direction there is worth naming plainly: it is deregulatory-leaning, not tightening. A modernized rule could eventually permit newer isolation methods the 1989 standard prohibits — a potential loosening for advanced manufacturers, not a new burden.

Two more counter-signals belong in an honest read of where LOTO stands in 2026. First, as noted above, the 2026 penalty amounts are frozen, not increased; anyone selling urgency on the basis of “penalties just went up” is working from bad information. Second, the standard’s exceptions are genuinely generous — cord-and-plug work under the operator’s control and minor servicing during normal production are real carve-outs, and treating every maintenance task as a full-lockout event burns labor for no compliance benefit.

None of that means LOTO enforcement is easing. No signal suggests OSHA is de-emphasizing the standard; it remains #4 on the Top 10 and a routine finding after serious injuries. The honest practitioner’s read is this: the citations are real and preventable, but the fix is documentation discipline — machine-specific procedures, role-based training records, and certified annual inspections — not necessarily more hardware. Spend on the paper trail before you spend on the padlocks.

Do Kansas, Missouri, Oklahoma, Texas, or Nebraska have different LOTO rules?

The federal 1910.147 standard applies directly in states under federal OSHA jurisdiction, including Kansas, Missouri, Oklahoma, Texas, and Nebraska (OSHA 1910.147). State-plan states must adopt standards at least as effective as federal OSHA, and a few (California under Cal/OSHA, for example) maintain their own hazardous-energy provisions. Facilities should confirm whether they fall under federal OSHA or a state plan, but the core LOTO program requirements are the same nationwide.

For a manufacturer operating in the central-plains region, the practical takeaway is that the four required program elements govern uniformly. The variable is the enforcing authority, not the substance of the rule. A written program, machine-specific procedures, role-based training, and a certified annual inspection are what an inspector will look for in Wichita, Tulsa, Kansas City, or Omaha alike.

Run the self-audit this week

You can check your program against the standard in an afternoon. Four questions, four documents:

  1. Written energy control program — can you produce it, and does it describe your procedures, training, and inspection process? (1910.147(c)(1))
  2. Machine-specific procedures — is there a distinct written procedure for each piece of equipment that has more than one energy source or any stored energy, identifying the isolation points? Or are you relying on one generic procedure that doesn’t meet the (c)(4)(i) exception? (1910.147(c)(4))
  3. Role-based training records — do you have dated certifications showing authorized, affected, and other employees were trained to the right depth? (1910.147(c)(7))
  4. Certified annual inspection — for each procedure, is there a certification from the last twelve months, performed by an authorized employee who does not use that procedure, naming the machine, date, employees, and inspector? (1910.147(c)(6))

If you can’t put your hands on all four, you have the same gap that produced 2,177 citations last year — and it’s fixable before an inspector or an incident finds it first.

iSi’s OSHA compliance support and safety-program audits close exactly this gap: we run the four-element LOTO review, build the machine-specific procedures your equipment actually needs, document the role-based training, and stand up the annual periodic inspection so the certification exists before it’s asked for. A single willful LOTO violation runs up to $165,514; a program review that catches the gap first is a small fraction of that.

Not sure whether your lockout program would survive an inspection? Run it through iSi’s Compliance Gap Checker, or call (316) 264-7050 to schedule a LOTO program audit.

Sources

Tags: