If an OSHA representative requested your injury and illness records today, could your team locate the right forms, explain each recordability decision, and confirm that the information is consistent?
For many companies, the challenge is not a lack of effort. Information gets spread across incident reports, workers’ compensation files, medical documentation, spreadsheets, emails, and paper records. Over time, small inconsistencies can become difficult to untangle.
A regular internal OSHA recordkeeping audit can help you find those issues before your team is responding under pressure.
An OSHA recordkeeping audit is an internal review of the processes and records used to document work-related injuries and illnesses.
A thorough audit may include:
The goal is not to add every workplace incident to the OSHA 300 Log. The goal is to make consistent, supportable decisions based on the requirements that apply.
Before reviewing individual cases, confirm which parts of OSHA’s recordkeeping requirements apply to your company and establishments.
Under federal OSHA rules, a company that had 10 or fewer employees at all times during the previous calendar year is generally partially exempt from routinely keeping OSHA injury and illness records. Certain establishments in designated lower-hazard industries may also qualify for a partial exemption.
These are only partial exemptions. Covered employers must still report certain severe work-related incidents to OSHA, including fatalities, inpatient hospitalizations, amputations, and losses of an eye.
Size-based exemptions are determined using the peak employment of the entire company during the previous calendar year. Industry exemptions are generally based on the classification of the individual establishment. Review OSHA’s small-employer exemption and industry exemption.
Employers operating in an OSHA-approved State Plan state should also confirm the requirements that apply in that jurisdiction. State Plans must be at least as effective as federal OSHA, but state requirements and procedures can vary. Check OSHA State Plan coverage.
These terms are related, but they do not mean the same thing.
Recording generally means documenting a recordable work-related injury or illness on the OSHA 300 Log and completing an OSHA 301 Incident Report or equivalent form.
Certain serious events must be reported directly to OSHA:
Additional timing and scope rules apply, including when the employer first learns that the event occurred or was work-related. Review 29 CFR 1904.39.
Certain establishments must electronically submit information from their OSHA recordkeeping forms each year. The requirements depend on establishment size and industry.
Under the current federal rule:
Required annual submissions are due by March 2. Employers should review the current rule and applicable industry lists before deciding whether electronic submission is required. Review OSHA’s electronic-submission requirements.
Start by collecting the records that help show what happened and how each case was handled.
Depending on your organization, that may include:
The purpose of this step is reconciliation. An incident appearing in an internal system but not on the OSHA 300 Log is not automatically an error. It may not meet OSHA’s recording criteria. However, your team should be able to explain and support the decision.
Not every incident that happens at work belongs on the OSHA 300 Log.
A typical recordability review asks:
Under OSHA’s general criteria, a work-related injury or illness is typically recordable if it results in:
Additional criteria apply to certain conditions, including needlestick injuries, medical removal, occupational hearing loss, and work-related tuberculosis.
Work-relatedness is generally presumed when an event or exposure in the work environment caused or contributed to the condition or significantly aggravated a preexisting condition, unless a specific exception applies. Review OSHA’s work-relatedness rules and general recording criteria.
When a decision is not straightforward, document the information reviewed, the conclusion reached, and who made the decision. Consult a qualified safety or legal professional when needed.
Review each OSHA 300 Log entry for completeness and consistency.
Check:
Compare the information with incident reports, medical recommendations, restriction records, and other supporting documentation.
Pay particular attention to cases that changed after they were first recorded. An employee may initially receive first aid but later require medical treatment beyond first aid. A case may begin as restricted work and later involve days away.
OSHA requires employers to update stored OSHA 300 Logs during the five-year retention period when newly discovered recordable cases or changes in case classification are identified. Review OSHA’s retention and updating requirements.
Each recordable injury or illness entered on the OSHA 300 Log must have an OSHA 301 Incident Report or an equivalent form.
An equivalent form can be used when it contains the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. An insurance or workers’ compensation form may qualify, but only if it contains all the information OSHA requires.
During the audit, confirm:
OSHA requires recordable cases to be entered on the OSHA 300 Log and OSHA 301 Incident Report within seven calendar days after the employer receives information that a recordable injury or illness occurred. Review OSHA’s form and timing requirements.
Temporary and contract-worker cases can create confusion about which employer records the injury or illness.
OSHA generally requires employers to record injuries and illnesses involving:
The host employer and staffing company should coordinate so a qualifying case is recorded only once. Day-to-day supervision is an important part of determining which employer maintains the record. Review OSHA’s covered-employee requirements.
During the audit, confirm that temporary-worker incidents were not missed or recorded twice.
OSHA identifies specific types of privacy concern cases. For those cases, the employee’s name must not appear on the OSHA 300 Log. Instead, the employer enters “privacy case” and maintains a separate confidential list connecting the case number with the employee’s identity.
Privacy concern cases include certain injuries or illnesses involving:
If the description could still identify the employee, OSHA permits the employer to use discretion while providing enough information to describe the cause and general severity.
Privacy protections should be part of every internal audit, especially when records are stored electronically or shared across locations. Review OSHA’s privacy requirements.
At the end of each calendar year, employers subject to the recordkeeping requirements must review the OSHA 300 Log, correct identified deficiencies, create the annual summary, have it certified by a qualifying company executive, and post it.
Check that:
Do not post the OSHA 300 Log or OSHA 301 forms in place of the 300A Summary. Those records contain information that is not intended for general workplace posting.
Review OSHA’s annual-summary requirements.
OSHA generally requires employers to retain the following records for five years after the end of the calendar year they cover:
During that period, stored OSHA 300 Logs must be updated when required. OSHA does not require employers to update stored 300A summaries or 301 reports, although employers may do so.
Your team should also know how to respond to a request for records.
When an authorized government representative requests records maintained under Part 1904, the employer generally must provide copies within four business hours. Employees, former employees, and authorized representatives also have access rights with different deadlines and limitations. For example, a relevant OSHA 300 Log generally must be provided to a qualifying requester by the end of the next business day.
Review OSHA’s employee-access requirements and government-access requirements.
A recordkeeping audit should do more than check whether boxes are filled in.
Look for:
Patterns do not automatically establish a violation. They can, however, help safety leaders decide where further investigation, corrective action, or training may be needed.
A dependable recordkeeping process needs defined responsibilities.
Document who is responsible for:
OSHA requires an annual review of the 300 Log as part of preparing the 300A Summary. More frequent internal reviews can also be useful, especially for companies with multiple locations, changing workforces, or frequent cases. A quarterly review may be a practical company process, but it is not a universal OSHA requirement.
Some of the most common problems include:
When a case is unclear, avoid guessing. Review the applicable standard and obtain qualified guidance.
Before completing your review, confirm that:
No. A case generally must be work-related, be a new case, and meet OSHA’s general or specific recording criteria. Certain exceptions may also apply.
Employers generally must enter a recordable case on the OSHA 300 Log and complete an OSHA 301 or equivalent report within seven calendar days after receiving information that a recordable injury or illness occurred.
When an authorized government representative requests records maintained under Part 1904, the employer generally must provide copies within four business hours.
The OSHA 300 Log, OSHA 300A Annual Summary, OSHA 301 Incident Reports, and any privacy case list generally must be retained for five years after the end of the calendar year they cover.
The OSHA 300A Annual Summary must generally be posted by February 1 and remain posted through April 30.
OSHA requires employers subject to the recordkeeping rules to review the 300 Log at the end of the calendar year when preparing the annual summary. Companies may choose to perform more frequent internal reviews based on their size, number of locations, and recordkeeping activity.
An OSHA recordkeeping audit should not begin only when an inspection is underway.
A better process reviews cases consistently, documents difficult decisions, reconciles related records, protects employee privacy, and assigns clear ownership. That makes it easier to identify potential errors while the information is still available and the people involved remember what happened.
OSHA injury and illness records are also only one part of a broader safety documentation process. If your review raises questions about workforce training requirements or training records, you can run Ving’s free Safety Risk Assessment to identify likely training requirements and regulatory citations for further review.
This article provides general information and does not constitute legal, regulatory, or workplace safety advice. OSHA requirements depend on the employer, establishment, industry, jurisdiction, and specific facts. Employers should review current federal and State Plan requirements and consult qualified safety or legal professionals when needed.