Build a Safety Program: 10 Steps From Hazards to Metrics

What this guide is and is not

This is a ten-step workflow for building a safety program that people actually use, and for tracking whether it is working. It is not a promise that a safety program will pay for itself, lower your insurance cost or reduce your claims by any amount. Those outcomes depend on your work, your people, your state and your insurer, and we do not claim a return on investment. Where we describe cost and benefit, we give you a worksheet to fill with your own numbers.

Labels used below:

• Legal requirement or official guidance: something from OSHA or another authority. We link the source next to the point and keep it brief.
• Recommended practice: our suggested workflow, drawn partly from OSHA's voluntary guidance. It is not a legal requirement unless the source says so.
• Opinion: our judgment.

OSHA rules, state plans and industry standards vary. For anything with legal consequences, confirm with OSHA, your state agency or a qualified attorney or safety professional.

You do not need any documents to start a conversation with us. This workflow does call for records, and each step names them.

Step 1: Learn the framework you will borrow from

Official guidance: OSHA's safety management page describes recommended practices organized around seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and communication and coordination for host employers, contractors and staffing agencies. These are voluntary recommendations, not a regulation. Read the page itself for OSHA's wording and detail.

Recommended practice: use the seven elements as the headings of your program map. Next to each, write what you currently do, who owns it and what record proves it.

Output: a seven-row map with owner and evidence columns. Leave blanks where nothing exists. Blanks are findings, not failures.

Exit gate: every element has either a named owner or a note saying it is unassigned.

If you also work with a PEO or insurer, it helps to know what safety support they provide. You can Discuss provider safety-support scope once your seven-row map is in view.

Step 2: Assign leadership ownership

Goal: make one named person accountable for each safety task.

Safety programs tend to stall when everyone is responsible and no one is.

Tasks:

• Name an executive sponsor who reviews safety status at a regular meeting.
• Name a program coordinator for scheduling, records and follow-up.
• Name a supervisor owner for each work area.
• Decide what the sponsor will review each month, such as open actions and near-miss reports, rather than only injuries.

Output: an ownership list with the review schedule.

Exit gate: each hazard control and training task in later steps has a name beside it.

Step 3: Set up worker participation and non-retaliation

Goal: make it easy and safe for workers to raise concerns.

Recommended practice, from OSHA's framework: worker participation is one of the seven elements. In practice, that means giving workers a way to report hazards, near misses and injuries, a way to take part in inspections and investigations, and a clear message that raising a concern will not be punished.

Legal note: federal law protects workers from retaliation for exercising certain safety rights, and some state laws add protections. Retaliation questions are legal questions. Involve counsel if a worker raises one.

Tasks:

• Offer at least two reporting routes, such as a supervisor and an anonymous option.
• Write a short non-retaliation statement and have leadership sign it.
• Include workers in hazard walks and incident reviews.
• Tell workers what happened after a report, so reporting feels worth the effort.

Output: a reporting procedure, a non-retaliation statement and a participation schedule.

Exit gate: a worker can describe how to report a hazard without asking a manager how.

Step 4: Identify hazards

Goal: list the hazards in the work, before deciding what to do about them.

Tasks:

• Walk each work area with a supervisor and at least one front-line worker.
• List tasks, not only locations. Many hazards sit in specific tasks, such as working at height, handling materials or operating equipment.
• Review past incident, near-miss and first-aid records for patterns.
• Include non-routine work, such as maintenance, weather exposure, new equipment and contractors.
• Record each hazard with a short description, location, task and who is exposed.

Output: a hazard register.

Exit gate: each hazard has an entry, and the register has been reviewed by someone who does the work.

Step 5: Prioritize and choose controls, engineering before PPE

Official guidance: OSHA's framework includes hazard prevention and control, and the commonly used hierarchy of controls ranks approaches from most to least protective: eliminate the hazard, substitute something safer, use engineering controls, use administrative controls such as procedures and training, and use personal protective equipment last. Check OSHA's page for how it presents this.

Recommended practice: rank hazards by how severe the harm could be and how likely it is, then choose controls from the top of the hierarchy where practical. PPE is a valid last layer and sometimes the only available one, but it should not be the first answer if a stronger control is feasible.

Tasks:

• Score each hazard on severity and likelihood using a simple scale you define.
• For each high-priority hazard, write at least one option at each hierarchy level, even if some are not feasible, and note why.
• Pick the control, owner, due date and how you will verify it is working.

Output: a prioritized control plan.

Exit gate: each high-priority hazard has a chosen control, an owner, a date and a verification method.

Step 6: Assign owners, timelines and verification

Goal: make sure a control is done and still working.

A control that was installed once and never checked can fail quietly.

Tasks:

• Use an action register with these fields: hazard, control, owner, due date, verification method, verifier, date verified, status.
• Separate the person who does the task from the person who verifies it where you can.
• Verification should be observable, for example a walk-through, a test or a record check.
• Set a review for controls that depend on behavior, because they tend to drift.

Output: the action register.

Exit gate: no action lacks an owner, a date or a verification method.

Step 7: Train and communicate

Official guidance: education and training, and communication with contractors, staffing agencies and host employers, are two of the seven elements in the OSHA framework.

Tasks:

• Match training to the hazards in your register, not to a generic list.
• Train in a language and format workers understand, and confirm understanding by observation, not just sign-in sheets.
• If you use contractors, temporary workers or a PEO, write down who trains whom and who supervises day-to-day safety. A PEO arrangement is a co-employment relationship, and the NAPEO FAQs describe it generally. Your client service agreement says who does what in practice, and safety supervision typically stays close to the worksite.
• Brief new and transferred workers before they start hazardous tasks.

Output: a training matrix tied to hazards, with dates and verification.

Exit gate: each hazardous task has a named trained group and a refresh plan.

If you are sorting out who supplies what safety support, you can Discuss provider safety-support scope and compare it with your training matrix.

Step 8: Know your recordkeeping and reporting duties

Legal requirement, with limits: OSHA's recordkeeping page explains injury and illness recordkeeping, and its reporting page explains how to report certain severe events. Which rules apply depends on your industry classification, size and state. Some employers are partly exempt from routine recordkeeping but still have reporting duties, and some states run their own OSHA programs with differences. We do not summarize thresholds or deadlines here because getting them wrong matters. Read the pages, and ask counsel or a safety professional if unsure.

Recommended practice: decide in advance who will decide whether an event is recordable or reportable, who will make the report and how quickly that person can be reached out of hours. Practice this once. Also confirm, if a PEO is involved, who files what, and write it into your register.

Output: a one-page recordkeeping and reporting responsibility sheet.

Exit gate: you can name who decides, who files and who backs them up.

Step 9: Choose metrics, leading and lagging

Official guidance: OSHA's leading indicators page discusses measures that look at prevention activity rather than only at injuries after the fact. Read it for OSHA's description and examples.

Recommended practice: use both kinds.

• Lagging measures count outcomes, such as recordable injuries, lost-time cases and claim counts. They matter, but they arrive after harm and can swing from small numbers.
• Leading measures track activity that should prevent harm, such as percent of corrective actions closed on time, inspections completed, training completed and verified, and near-miss reports received and reviewed.

A caution on near-miss reporting: when you improve reporting, the number of reports may rise. That is not automatically a sign that the workplace has become less safe. It may mean workers trust the process more. Read it alongside the severity of what is reported and how fast you close the actions. Do not reward or punish teams for report counts alone, because that can push people to under-report or over-report.

Tasks:

• Pick four to six metrics, at least two leading and two lagging.
• Define each so two people would count it the same way.
• Decide the review rhythm and who acts when a metric moves.

Output: a metric sheet with definitions, owners and review dates.

Exit gate: each metric has a definition, a source record and an owner.

Step 10: Review, adjust and decide what outside support you need

Goal: close the loop.

Tasks:

• At each review, check open actions, repeat hazards, incidents and near misses.
• Ask workers what is working and what is not.
• Update the hazard register after any change in work, equipment, staffing or location.
• Decide if outside help would speed things up, such as a safety consultant, a carrier loss-control visit or PEO safety services.

Output: a dated review note and revised action register.

Exit gate: the next review is scheduled and every overdue action is either completed, re-dated with a reason or dropped with a reason.

Safety cost and benefit worksheet

This worksheet contains no figures on purpose. We do not offer a return-on-investment estimate, and no published ratio should be treated as applicable to your business unless a qualified source ties it to your situation.

Fill in your own numbers and label each as actual, estimated or unknown.

Costs to record: equipment or engineering changes, training time and fees, supervisor time, consultant fees, program software, and any production time lost to implementation.

Possible benefits to observe, not assume: changes in injury counts, claim counts and severity over a period long enough to mean something, changes in near-miss reporting quality, fewer interruptions, and changes in insurance or PEO pricing if your provider confirms the reason in writing.

Cautions:

• Small numbers of claims move a lot from year to year. A single event can dominate.
• Insurance pricing reflects more than your safety record, including payroll, class codes, market conditions and program structure.
• Do not credit the program with a premium change unless the provider or carrier has explained the cause.

Worked example (fictional)

This example is invented and makes no claim about results.

Summit Ridge Exteriors, a fictional 35-person roofing contractor, wants to improve safety. These are its stated assumptions: work is in one state, crews work at height most days, and subcontractors sometimes join crews.

• Step 1 shows the company has strong supervisors but no written worker participation process and no contractor coordination.
• Step 4 finds the highest-priority hazard is work near roof edges.
• Step 5 considers eliminating exposure through different staging and prefabrication, then engineering controls such as guardrail systems, then administrative controls, then PPE. It chooses a mix and records why some options were not feasible.
• Step 6 assigns an owner to inspect each job's setup before work begins and a second person to spot-check.
• Step 9 tracks percent of job-start checks completed, corrective actions closed on time and near-miss reports reviewed, along with recordable cases. When near-miss reports rise in the first quarter, the owner reviews them for severity and does not treat the rise as failure.
• The worksheet shows costs recorded and benefits listed as unknown. No payback claim is made.

Roofing, a PEO and standalone workers' comp: a suitability check

Roofing and other high-hazard trades often face tighter coverage conditions. Whether a PEO program or a standalone policy suits a roofer depends on facts we cannot know in advance. This is not a ranking, and neither route is universally better.

Questions to ask each option, in writing:

• Will the carrier or program accept your classes, in your state, with your claim history? Ask for confirmation, not an assumption.
• What are the exclusions, such as excluded operations, height limits or subcontractor requirements?
• How does your own experience affect your price, and over what period?
• How are payroll audits and reconciliations handled, and what adjustments are possible?
• What safety and loss-control services are included, who delivers them, and how often are they on site?
• Who reports claims, and how fast?
• What happens if you leave? Ask about coverage transition and any collateral or deposit.

Opinion: compare full-year, all-in cost and service, not only a headline rate. Where your current arrangement is the best fit, we will say so.

Master checklist

• Seven-element program map completed.
• Executive sponsor, coordinator and area owners named.
• Reporting routes and non-retaliation statement in place.
• Hazard register built with front-line input.
• Hazards prioritized and controls chosen, strongest practical controls first.
• Action register with owners, dates and verification.
• Training matched to hazards and verified.
• Recordkeeping and reporting responsibilities written down.
• Leading and lagging metrics defined.
• Review scheduled.
• Cost worksheet filled with your own figures, unknowns marked.

When to bring in specialist help

• A qualified safety professional or industrial hygienist for hazard assessment and control design.
• Your insurance agent or carrier loss-control team for coverage and underwriting questions.
• An employment or safety attorney for retaliation concerns, citations, reportable events or contract questions.
• OSHA or your state program for official interpretation.

Sources and research directory

Checked 2026-10-25. Please confirm against each page, since guidance changes.

• OSHA, safety management: recommended practices and seven core elements. Voluntary guidance.
• OSHA, leading indicators: leading versus lagging measures.
• OSHA, recordkeeping: injury and illness records. Applicability varies.
• OSHA, reporting: reporting certain severe events. Check state plan differences.
• NAPEO FAQs: general description of co-employment and service agreements.

Talk it through

If you want help comparing a PEO program with a standalone policy, or understanding what safety support each would provide, you can Discuss provider safety-support scope. No documents are required for the first conversation. Start with your questions. If staying with your current setup is the best option, we will say so.

We proactively explain who pays us and how compensation works.