How to Audit Your OSHA Recordkeeping Before an Inspection

If an OSHA representative requested your injury and illness records today, could your team locate the right forms, explain each recordability decision, and confirm that the information is consistent?

For many companies, the challenge is not a lack of effort. Information gets spread across incident reports, workers’ compensation files, medical documentation, spreadsheets, emails, and paper records. Over time, small inconsistencies can become difficult to untangle.

A regular internal OSHA recordkeeping audit can help you find those issues before your team is responding under pressure.

What is an OSHA recordkeeping audit?

An OSHA recordkeeping audit is an internal review of the processes and records used to document work-related injuries and illnesses.

A thorough audit may include:

• Confirming whether your establishments are required to keep OSHA records
• Reviewing recordability decisions
• Checking OSHA 300 Log entries
• Matching entries to OSHA 301 Incident Reports or equivalent forms
• Verifying the OSHA 300A Annual Summary
• Reviewing privacy protections
• Confirming retention and updating practices
• Checking electronic-submission requirements
• Making sure records can be produced within the applicable timeframe

The goal is not to add every workplace incident to the OSHA 300 Log. The goal is to make consistent, supportable decisions based on the requirements that apply.

First, confirm whether OSHA recordkeeping applies

Before reviewing individual cases, confirm which parts of OSHA’s recordkeeping requirements apply to your company and establishments.

Under federal OSHA rules, a company that had 10 or fewer employees at all times during the previous calendar year is generally partially exempt from routinely keeping OSHA injury and illness records. Certain establishments in designated lower-hazard industries may also qualify for a partial exemption.

These are only partial exemptions. Covered employers must still report certain severe work-related incidents to OSHA, including fatalities, inpatient hospitalizations, amputations, and losses of an eye.

Size-based exemptions are determined using the peak employment of the entire company during the previous calendar year. Industry exemptions are generally based on the classification of the individual establishment. Review OSHA’s small-employer exemption and industry exemption.

Employers operating in an OSHA-approved State Plan state should also confirm the requirements that apply in that jurisdiction. State Plans must be at least as effective as federal OSHA, but state requirements and procedures can vary. Check OSHA State Plan coverage.

Understand recording, reporting, and electronic submission

These terms are related, but they do not mean the same thing.

Recording

Recording generally means documenting a recordable work-related injury or illness on the OSHA 300 Log and completing an OSHA 301 Incident Report or equivalent form.

Reporting

Certain serious events must be reported directly to OSHA:

• A work-related fatality must generally be reported within eight hours.
• A work-related inpatient hospitalization, amputation, or loss of an eye must generally be reported within 24 hours.

Additional timing and scope rules apply, including when the employer first learns that the event occurred or was work-related. Review 29 CFR 1904.39.

Electronic submission

Certain establishments must electronically submit information from their OSHA recordkeeping forms each year. The requirements depend on establishment size and industry.

Under the current federal rule:

• Certain establishments with 20 to 249 employees submit information from Form 300A.
• Establishments with 250 or more employees that are required to keep OSHA records submit information from Form 300A.
• Certain establishments with 100 or more employees in designated industries submit information from Forms 300 and 301 in addition to Form 300A information.

Required annual submissions are due by March 2. Employers should review the current rule and applicable industry lists before deciding whether electronic submission is required. Review OSHA’s electronic-submission requirements.

Step 1: Gather your recordkeeping information

Start by collecting the records that help show what happened and how each case was handled.

Depending on your organization, that may include:

• OSHA 300 Logs
• OSHA 301 Incident Reports or equivalent forms
• OSHA 300A Annual Summaries
• Internal incident and near-miss reports
• First-aid logs
• Workers’ compensation records
• Medical or occupational health documentation
• Supervisor reports
• Return-to-work and restriction records
• Temporary-worker incident information
• Electronic-submission confirmations

The purpose of this step is reconciliation. An incident appearing in an internal system but not on the OSHA 300 Log is not automatically an error. It may not meet OSHA’s recording criteria. However, your team should be able to explain and support the decision.

Step 2: Review each recordability decision

Not every incident that happens at work belongs on the OSHA 300 Log.

A typical recordability review asks:

1. Is the case work-related?
2. Is it a new case?
3. Does it meet one or more of OSHA’s general recording criteria?
4. Does a specific recording rule apply?

Under OSHA’s general criteria, a work-related injury or illness is typically recordable if it results in:

• Death
• Days away from work
• Restricted work or job transfer
• Medical treatment beyond first aid
• Loss of consciousness
• A significant injury or illness diagnosed by a physician or other licensed healthcare professional

Additional criteria apply to certain conditions, including needlestick injuries, medical removal, occupational hearing loss, and work-related tuberculosis.

Work-relatedness is generally presumed when an event or exposure in the work environment caused or contributed to the condition or significantly aggravated a preexisting condition, unless a specific exception applies. Review OSHA’s work-relatedness rules and general recording criteria.

When a decision is not straightforward, document the information reviewed, the conclusion reached, and who made the decision. Consult a qualified safety or legal professional when needed.

Step 3: Audit your OSHA 300 Log

Review each OSHA 300 Log entry for completeness and consistency.

Check:

• Employee identity, unless the case qualifies as a privacy concern case
• Job title
• Date of injury or illness
• Location where the event occurred
• A brief description of the injury or illness
• The affected body part
• The object or substance involved
• The correct case classification
• Accurate days-away and restricted-work counts
• Whether the entry needs to be updated

Compare the information with incident reports, medical recommendations, restriction records, and other supporting documentation.

Pay particular attention to cases that changed after they were first recorded. An employee may initially receive first aid but later require medical treatment beyond first aid. A case may begin as restricted work and later involve days away.

OSHA requires employers to update stored OSHA 300 Logs during the five-year retention period when newly discovered recordable cases or changes in case classification are identified. Review OSHA’s retention and updating requirements.

Step 4: Match each entry to an OSHA 301 or equivalent form

Each recordable injury or illness entered on the OSHA 300 Log must have an OSHA 301 Incident Report or an equivalent form.

An equivalent form can be used when it contains the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. An insurance or workers’ compensation form may qualify, but only if it contains all the information OSHA requires.

During the audit, confirm:

• Every OSHA 300 entry has a corresponding OSHA 301 or equivalent form
• Dates and descriptions are consistent
• Required fields are complete
• The correct establishment is identified
• Privacy-sensitive information is properly protected

OSHA requires recordable cases to be entered on the OSHA 300 Log and OSHA 301 Incident Report within seven calendar days after the employer receives information that a recordable injury or illness occurred. Review OSHA’s form and timing requirements.

Step 5: Check temporary and contract-worker cases

Temporary and contract-worker cases can create confusion about which employer records the injury or illness.

OSHA generally requires employers to record injuries and illnesses involving:

• Employees on their payroll
• Workers who are not on their payroll when the employer supervises those workers on a day-to-day basis

The host employer and staffing company should coordinate so a qualifying case is recorded only once. Day-to-day supervision is an important part of determining which employer maintains the record. Review OSHA’s covered-employee requirements.

During the audit, confirm that temporary-worker incidents were not missed or recorded twice.

Step 6: Protect employee privacy

OSHA identifies specific types of privacy concern cases. For those cases, the employee’s name must not appear on the OSHA 300 Log. Instead, the employer enters “privacy case” and maintains a separate confidential list connecting the case number with the employee’s identity.

Privacy concern cases include certain injuries or illnesses involving:

• Intimate body parts or the reproductive system
• Sexual assault
• Mental illness
• HIV infection, hepatitis, or tuberculosis
• Contaminated needlestick injuries and cuts
• Certain other illnesses when the employee voluntarily requests privacy

If the description could still identify the employee, OSHA permits the employer to use discretion while providing enough information to describe the cause and general severity.

Privacy protections should be part of every internal audit, especially when records are stored electronically or shared across locations. Review OSHA’s privacy requirements.

Step 7: Verify the OSHA 300A Annual Summary

At the end of each calendar year, employers subject to the recordkeeping requirements must review the OSHA 300 Log, correct identified deficiencies, create the annual summary, have it certified by a qualifying company executive, and post it.

Check that:

• The OSHA 300A totals match the OSHA 300 Log
• Zeroes are entered where required if there were no recordable cases
• The establishment information is complete
• Average employment and total hours worked are included
• A qualifying company executive signed the certification
• The summary was posted in a conspicuous location
• The posting remained in place from February 1 through April 30

Do not post the OSHA 300 Log or OSHA 301 forms in place of the 300A Summary. Those records contain information that is not intended for general workplace posting.

Review OSHA’s annual-summary requirements.

Step 8: Confirm retention and access procedures

OSHA generally requires employers to retain the following records for five years after the end of the calendar year they cover:

• OSHA 300 Logs
• OSHA 300A Annual Summaries
• OSHA 301 Incident Reports
• Privacy case lists, when applicable

During that period, stored OSHA 300 Logs must be updated when required. OSHA does not require employers to update stored 300A summaries or 301 reports, although employers may do so.

Your team should also know how to respond to a request for records.

When an authorized government representative requests records maintained under Part 1904, the employer generally must provide copies within four business hours. Employees, former employees, and authorized representatives also have access rights with different deadlines and limitations. For example, a relevant OSHA 300 Log generally must be provided to a qualifying requester by the end of the next business day.

Review OSHA’s employee-access requirements and government-access requirements.

Step 9: Look for inconsistencies and patterns

A recordkeeping audit should do more than check whether boxes are filled in.

Look for:

• Similar incidents classified differently
• Missing follow-up after medical restrictions changed
• Inconsistent descriptions across forms
• Cases assigned to the wrong establishment
• Temporary-worker cases that were missed or duplicated
• Differences between OSHA logs and internal incident systems
• Repeated injuries involving the same equipment, location, or task
• Training or procedure updates that were recommended but not completed

Patterns do not automatically establish a violation. They can, however, help safety leaders decide where further investigation, corrective action, or training may be needed.

Step 10: Give the process a clear owner

A dependable recordkeeping process needs defined responsibilities.

Document who is responsible for:

• Receiving incident information
• Evaluating work-relatedness and recordability
• Completing and reviewing forms
• Monitoring changes to medical restrictions
• Protecting private information
• Preparing and certifying the annual summary
• Completing required electronic submissions
• Responding to employee or government requests
• Monitoring federal and State Plan changes

OSHA requires an annual review of the 300 Log as part of preparing the 300A Summary. More frequent internal reviews can also be useful, especially for companies with multiple locations, changing workforces, or frequent cases. A quarterly review may be a practical company process, but it is not a universal OSHA requirement.

Common OSHA recordkeeping mistakes

Some of the most common problems include:

• Assuming every workplace incident is recordable
• Failing to record a case that meets OSHA’s criteria
• Confusing first aid with medical treatment beyond first aid
• Recording the same temporary-worker case twice
• Missing the seven-calendar-day entry requirement
• Failing to update a stored OSHA 300 Log when a case changes
• Using an incomplete substitute for the OSHA 301
• Posting the wrong form
• Missing the February 1 through April 30 posting period
• Overlooking electronic-submission requirements
• Mishandling privacy concern cases
• Assuming workers’ compensation decisions automatically determine OSHA recordability

When a case is unclear, avoid guessing. Review the applicable standard and obtain qualified guidance.

OSHA recordkeeping audit checklist

Before completing your review, confirm that:

• You know which establishments must keep OSHA records
• Recordability decisions are documented and supportable
• OSHA 300 entries are complete and accurate
• Each entry has an OSHA 301 or qualifying equivalent
• Cases were entered within the required timeframe
• Temporary-worker cases are assigned correctly
• Privacy concern cases are protected
• OSHA 300A totals match the corresponding log
• The 300A was properly certified and posted
• Required records are retained for five years
• Stored OSHA 300 Logs are updated when necessary
• Electronic submissions are completed when required
• Your team can respond to record requests within the applicable deadline
• State Plan requirements have been reviewed

Frequently asked questions

Does every workplace injury go on the OSHA 300 Log?

No. A case generally must be work-related, be a new case, and meet OSHA’s general or specific recording criteria. Certain exceptions may also apply.

How quickly must a recordable case be entered?

Employers generally must enter a recordable case on the OSHA 300 Log and complete an OSHA 301 or equivalent report within seven calendar days after receiving information that a recordable injury or illness occurred.

How quickly must records be provided during an OSHA inspection?

When an authorized government representative requests records maintained under Part 1904, the employer generally must provide copies within four business hours.

How long must OSHA recordkeeping forms be retained?

The OSHA 300 Log, OSHA 300A Annual Summary, OSHA 301 Incident Reports, and any privacy case list generally must be retained for five years after the end of the calendar year they cover.

When must the OSHA 300A Summary be posted?

The OSHA 300A Annual Summary must generally be posted by February 1 and remain posted through April 30.

How often should OSHA records be audited?

OSHA requires employers subject to the recordkeeping rules to review the 300 Log at the end of the calendar year when preparing the annual summary. Companies may choose to perform more frequent internal reviews based on their size, number of locations, and recordkeeping activity.

Make recordkeeping a routine process

An OSHA recordkeeping audit should not begin only when an inspection is underway.

A better process reviews cases consistently, documents difficult decisions, reconciles related records, protects employee privacy, and assigns clear ownership. That makes it easier to identify potential errors while the information is still available and the people involved remember what happened.

OSHA injury and illness records are also only one part of a broader safety documentation process. If your review raises questions about workforce training requirements or training records, you can run Ving’s free Safety Risk Assessment to identify likely training requirements and regulatory citations for further review.

This article provides general information and does not constitute legal, regulatory, or workplace safety advice. OSHA requirements depend on the employer, establishment, industry, jurisdiction, and specific facts. Employers should review current federal and State Plan requirements and consult qualified safety or legal professionals when needed.