Just Made Safety Manager? Here's How to Get Your OSHA Compliance House in Order

If you were handed the safety manager title last week — maybe on top of an operations, HR, or quality job you already had — the OSHA rulebook can read like a wall with no door. There is a door, and it is not where most checklists tell you to look. The fastest way for a newly assigned safety manager to get oriented to OSHA compliance is to work the requirements in the order OSHA actually enforces them: injury and illness recordkeeping, severe-incident reporting, written programs and training, the annual posting and electronic-submission calendar, and the General Duty Clause behind all of it. That sequence is this guide.

We work this same orientation with safety managers across 40 states, almost always at small-to-midsize manufacturers and contractors where one person owns environmental compliance without deep environmental training. The pattern is consistent: the gaps are rarely in the hard technical work. They are in the absolute, unforgiving timing rules that nobody told the new manager about. Start here and you close those gaps before an inspector finds them.

Where Should a New Safety Manager Start With OSHA Compliance?

Start with the obligations OSHA enforces first: confirm your OSHA 300/300A/301 recordkeeping status (required above 10 employees), stand up severe-incident reporting (8-hour fatality, 24-hour hospitalization), verify your written programs and training match operations, and meet the February 1–April 30 posting and March 2 electronic-submission deadlines (29 CFR Part 1904).

The reason to sequence it this way instead of alphabetically is that OSHA does not weigh these obligations equally. A missed reporting call after a fatality is a different category of exposure than a written program that needs an update. Triage in OSHA’s order, not the order a generic template lists them. Your first 90 days come down to five moves: confirm recordkeeping status, post a reporting procedure, hit the posting and submission calendar, inventory your written programs against actual operations, and tie verifiable training to each program. Everything below expands those moves.

Which Businesses Have to Keep OSHA Injury and Illness Records?

Employers with more than 10 employees at any time in the prior calendar year must keep OSHA 300, 300A, and 301 records, unless they fall in a partially exempt low-hazard industry classification. Businesses with 10 or fewer employees are partially exempt from routine recordkeeping — but never from severe-incident reporting (OSHA 3746; 29 CFR 1904 Subpart B).

This is the first thing to nail down, because it determines whether half of what follows even applies to your site. The three forms work together: the 300 log captures each recordable case as it happens, the 300A summarizes the year, and the 301 documents the individual incident in detail. Confirm two facts on arrival — your headcount across the prior year and whether your industry sits on the partial-exemption list — then verify the current-year log is complete and accurate. A manager at a 200-person fabrication shop and a manager at an 8-person specialty contractor have very different recordkeeping duties. They have identical reporting duties, which is exactly the trap the next section covers.

What Injuries Does OSHA Require Employers to Report, and How Fast?

Every employer, regardless of size or exemption status, must report a work-related fatality within 8 hours and an in-patient hospitalization, amputation, or loss of an eye within 24 hours. Reports go to OSHA by phone, the 1-800-321-OSHA line, or the online reporting form. This duty has no small-employer carve-out (OSHA Recordkeeping).

This is the single most common gap a new safety manager inherits, and it is the one with the least forgiveness on timing. The partial exemption that lets a small low-hazard employer skip the 300 log does nothing here. A 6-person shop that never touches a 300 form still has 8 hours to report a fatality and 24 hours to report a hospitalization, amputation, or eye loss. The fix is not complicated, but it has to exist before you need it: post a phone-accessible procedure that names who calls, which number they call, and what the clock is. Build it in week one. You do not want to be reading the rule for the first time with the clock already running.

When Is the OSHA 300A Due, and What Is the ITA Submission Deadline?

The OSHA 300A summary must be physically posted from February 1 through April 30 of the year after the records were kept. Separately, covered establishments must electronically submit injury and illness data through the Injury Tracking Application (ITA) between January 2 and March 2 — the deadline for calendar-year 2025 data is March 2, 2026 (ITA FAQs).

These are two distinct obligations that get confused constantly. Posting the 300A is the physical summary on the wall where employees can see it, every year, for that three-month window (29 CFR 1904.32). Electronic submission through the ITA is a separate filing that only applies to establishments in the covered population — generally larger establishments and those in higher-hazard industries identified by NAICS code. A new manager’s job is to determine whether the establishment falls in that electronic-submission population, and if it does, submit the prior year’s data before the March 2 deadline. Posting is for nearly everyone with a log; electronic submission is for a defined subset. Confirm which bucket each of your sites is in.

What Written Safety Programs Does OSHA Require?

OSHA does not impose one universal written program — the programs you need depend on what your operation actually does. Common triggers include Hazard Communication (GHS labeling and SDS access), respiratory protection, lockout/tagout, permit-required confined space, and an emergency action plan (OSHA Recordkeeping; OSHA Small Business).

This is where new managers either over-build or under-build, and both cost something. There is no master list that applies to every facility, so do not copy one from another plant. Walk the operation and inventory what it triggers: chemicals on site pull in Hazard Communication, energized equipment pulls in lockout/tagout, respirators pull in a respiratory protection program, tanks and vaults pull in confined space. Match each written program to a real hazard you can point to on the floor, then confirm the program document exists, reflects current operations, and is not three managers out of date. A written program that describes a process you no longer run is a finding waiting to happen. Build to what your operation actually triggers, not to a maximalist checklist — and not to a checklist missing the program your floor obviously needs.

How Long Must a Safety Manager Keep OSHA Records?

Injury and illness records — the 300 log, the 300A annual summary, and the 301 incident reports — must be retained for five years following the end of the calendar year they cover, and updated as new information on recorded cases emerges (29 CFR 1904.33).

The retention rule has a wrinkle most new managers miss: it is not a passive “keep the files in a drawer” rule. During the five-year window you are required to update the logs if you learn new information about a recorded case — a recordable injury that later results in days away, a classification that changes. So one of your first physical tasks is locating the prior five years of logs. If they are incomplete, you reconstruct what you can and document the gap; you do not quietly start fresh. An inspector who asks for five years of 300 logs is not asking whether you were the manager back then. Find them, complete them, and put them somewhere you can produce them inside an hour.

How Much Are OSHA Penalties, and What Raises Them?

For 2026, the maximum is $16,550 per serious or other-than-serious violation and $165,514 per willful or repeat violation; failure-to-abate runs $16,550 per day. These amounts carry over from 2025 with no inflation increase. The assessed penalty turns on hazard gravity and adjustment factors — employer size, good faith, and violation history (OSHA Penalties; 2026 adjustment memo).

Two things a new manager should understand about these numbers. First, they are per violation, not per inspection — a single walkthrough that finds five serious items is five times $16,550, not one. Second, the published maximum is rarely the assessed amount, because OSHA adjusts for gravity and for factors you can actually influence: employer size, demonstrated good faith, and your history. A documented program, complete logs, and a clean record are not just compliance hygiene — they are the adjustment factors that move an assessed penalty down. The 2026 figures matching 2025 (no inflation bump) is a small reprieve, but the willful/repeat number tells you where the real exposure lives: repeated or knowing violations, not first-time honest gaps.

Is There a Free Way to Audit My Safety Program Without Risking a Citation?

Yes. OSHA’s On-Site Consultation Program provides free, confidential safety and health reviews to small and medium employers, fully separate from enforcement — no citations, no penalties. Priority goes to high-hazard worksites and employers with 250 or fewer on-site employees, and completion can lead to SHARP recognition and a programmed-inspection exemption (OSHA On-Site Consultation; SHARP FAQ).

This is the move a new safety manager should book in week one, and almost nobody does. The On-Site Consultation Program is run separately from OSHA’s enforcement side — the consultant who walks your facility cannot and does not issue citations, and what they find does not go to the enforcement office. It is the closest thing to a no-risk dress rehearsal you will get: a trained reviewer finds the gaps before an inspector does, and you fix them on your own timeline. Employers who complete the process and correct the findings can earn SHARP recognition, which carries an exemption from programmed inspections. For a manager trying to find out what they inherited, this is the fastest honest read on the whole program — and it costs nothing.

Does OSHA Cover My Industry, or Am I Exempt?

Most private-sector employers are covered by federal OSHA; some operate under a state-plan program with its own at-least-as-effective rules. “Partial exemption” affects only routine recordkeeping for low-hazard industries — it does not exempt you from the General Duty Clause, severe-incident reporting, hazard controls, or training (OSHA Recordkeeping).

The word “exempt” causes more trouble here than any other in the rulebook, because it gets read far too broadly. Partial exemption is narrow: it removes routine 300-log recordkeeping for certain low-hazard industries, and nothing else. You still owe the 8-hour and 24-hour reports, you still owe hazard controls and training, and you are still answerable under the General Duty Clause for recognized hazards with no specific standard. The second jurisdictional question is whether you sit under federal OSHA or a state plan. Roughly half the states run OSHA-approved state plans that must be at least as effective as federal OSHA and can be more stringent. In iSi’s core region — Kansas, Missouri, Oklahoma, Nebraska, and Texas — private-sector employers are under federal OSHA, so the thresholds, reporting windows, and penalty caps in this guide apply directly. If you run multiple sites, check each one: a single company can span federal and state-plan states with different posting and submission mechanics.

How OSHA Decides Who to Inspect

One more thing worth knowing as you orient: OSHA enforcement is risk-prioritized, not random. High injury rates reported through the ITA feed OSHA’s Site-Specific Targeting lists, and complaints and referrals drive roughly 46% of inspections (complaint handling). The practical takeaway for a new manager is that the data you submit and the conditions your own people see are what put a site on a list. That cuts both ways — a clean, well-documented program is also what keeps you off one.

It is also worth keeping the burden honest. Not every regulatory trend points toward more work. The partial-exemption list genuinely removes routine logging for many small low-hazard employers, and some information-collection burdens have been revised downward over time. The honest framing for a new manager: the reporting duties are absolute and unforgiving on timing, but recordkeeping and program scope are proportionate to your headcount and hazard. Build to what your operation actually triggers.

Your First 90 Days, in Order

Pull it together into a sequence you can work:

Confirm recordkeeping status. Headcount over 10 and not partially exempt? Verify the current-year 300 log is complete and accurate.
Stand up severe-incident reporting. Post a phone-accessible procedure: fatality within 8 hours; hospitalization, amputation, or eye loss within 24 hours.
Hit the calendar. Post the 300A February 1–April 30; determine whether you are in the ITA electronic-submission population and, if so, submit the prior year’s data by March 2.
Inventory written programs against actual operations. HazCom, respiratory protection, lockout/tagout, confined space, emergency action plan — match each to a real hazard and close the gaps.
Tie training to each program. Build a verifiable record with initial and refresher dates.
Book the free On-Site Consultation. Get a no-citation baseline read on the whole program before an inspector does.

That is the orientation, worked in OSHA’s order. Most of it a new manager can run alone with the primary sources linked above. Where it gets harder is at the multi-site employer spanning federal and state-plan jurisdictions, or at the operation where the written programs and the actual floor drifted apart years ago and nobody has reconciled them since.

That reconciliation work — inventorying programs against operations, rebuilding the training record, confirming jurisdiction site by site — is most of the surrounding work that pulls a new safety manager away from the on-site judgment calls only they can make. It is also exactly what iSi’s EHS compliance support is built to handle: a national team across 40 states that plugs in behind your safety manager without adding headcount. If you want a no-risk starting point, OSHA’s free On-Site Consultation is the right first call. If you want a second set of expert eyes on what that consultation surfaces — and a team to close the gaps — that is the conversation to have with us.