Regulations and Standards in Program Design

Overview
Every safety and health program a Certified Safety Professional designs sits on a legal and technical foundation. That foundation is built from two distinct but related sources: regulations (mandatory legal requirements issued by government agencies) and standards (consensus documents developed by professional or technical bodies that describe recognized good practice). Understanding how these two sources differ, how they interact, and how they are translated into written programs, procedures, training, and recordkeeping is a core competency tested throughout the CSP examination, particularly within the Management Systems, Risk Management, and Law and Ethics domains.

Why This Topic Is Important

1. Legal defensibility. A program that does not satisfy applicable regulations exposes the employer to citations, civil penalties, criminal liability for willful violations that cause fatalities, and increased exposure in tort litigation. The CSP is expected to be the person in the organization who knows which rules apply and ensures the program meets them.

2. Regulations are the floor, not the ceiling. OSHA itself acknowledges that many of its rules date from the early 1970s. Consensus standards such as ANSI/ASSP Z10, ISO 45001, NFPA 70E, and ACGIH TLVs frequently represent a higher, more current level of protection. A well-designed program uses regulations as the minimum and standards to drive toward best practice.

3. The General Duty Clause. Section 5(a)(1) of the OSH Act requires employers to furnish a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA uses consensus standards, manufacturer instructions, and industry practice as evidence that a hazard is recognized and that a feasible means of abatement exists. This makes voluntary standards effectively enforceable when no specific regulation applies.

4. Exam weight. Questions on this topic appear in many forms: identifying which regulation governs a scenario, distinguishing mandatory from voluntary language, recognizing required written program elements, applying recordkeeping rules, and understanding how management system standards structure a program. Candidates who understand the framework rather than memorizing isolated citations perform far better.

What It Is: Key Definitions and Distinctions

Regulations are rules issued by government agencies under authority delegated by legislation. In the United States they are published in the Code of Federal Regulations (CFR). Key titles the CSP should know:
• 29 CFR 1904 – OSHA recordkeeping and reporting of occupational injuries and illnesses
• 29 CFR 1910 – General Industry standards
• 29 CFR 1915, 1917, 1918 – Shipyard, marine terminal, and longshoring
• 29 CFR 1926 – Construction standards
• 29 CFR 1960 – Federal agency programs
• 30 CFR – Mine Safety and Health Administration (MSHA)
• 40 CFR – Environmental Protection Agency (EPA): RCRA, CAA, CWA, EPCRA, Risk Management Program (Part 68)
• 49 CFR – Department of Transportation (DOT): hazardous materials transport, Parts 100–185; PHMSA; FMCSA
• 10 CFR – Nuclear Regulatory Commission

Regulations use the word shall and are legally enforceable. Violations carry penalties classified as other-than-serious, serious, willful, repeat, and failure to abate.

Standards (consensus or voluntary standards) are developed through a balanced, open, due-process procedure by organizations accredited by ANSI or operating internationally through ISO. They typically use the word should for recommendations and shall only when the standard itself is written in mandatory form for adoption. Key standards:
• ANSI/ASSP Z10.0 – Occupational Health and Safety Management Systems
• ISO 45001 – OH&S Management Systems (international)
• ISO 14001 – Environmental Management Systems
• ISO 31000 – Risk Management guidelines
• ISO 9001 – Quality Management Systems
• ANSI/ASSP Z490.1 – Criteria for Accepted Practices in Safety, Health, and Environmental Training
• ANSI/ASSP Z244.1 – Control of Hazardous Energy (lockout/tagout and alternative methods)
• ANSI/ASSP Z359 series – Fall Protection
• ANSI/ASSP A10 series – Construction and Demolition
• ANSI/ASSP Z590.3 – Prevention through Design
• ANSI/ASSP Z117.1 – Confined Spaces
• ANSI/ASSP Z16.1 – Safety and Health Metrics and Performance Measures
• ANSI Z87.1 – Eye and Face Protection; Z89.1 – Head Protection; ASTM F2413 – Protective Footwear
• NFPA 70 (National Electrical Code), NFPA 70E (Electrical Safety in the Workplace), NFPA 101 (Life Safety Code), NFPA 1 (Fire Code), NFPA 30 (Flammable and Combustible Liquids), NFPA 652/654 (Combustible Dust), NFPA 1600 (Business Continuity)
• ACGIH TLVs and BEIs – Exposure guidelines (not law, but widely cited)
• NIOSH RELs – Recommended Exposure Limits
• ASME – Boilers, pressure vessels, cranes (B30 series), elevators (A17.1)
• CGA – Compressed Gas Association pamphlets

Incorporation by reference (IBR). When a regulation cites a consensus standard by edition and date in the text of the rule (for example, 29 CFR 1910.6), that specific edition becomes legally mandatory. Later editions of the same standard are not automatically binding, though OSHA may accept compliance with a newer edition as a de minimis condition if it is equally or more protective. This distinction is a frequent exam point.

Types of regulatory and standards language
• Specification standards tell you exactly what to do (guardrails must be 42 inches plus or minus 3 inches; a machine guard must prevent contact with the point of operation).
• Performance standards state the outcome to be achieved and leave the method to the employer (the respiratory protection program must be administered by a suitably trained program administrator; the exposure must be kept below the PEL).
• Horizontal standards apply across all industries (walking-working surfaces, hazard communication, PPE).
• Vertical standards apply to a specific industry or operation (sawmills, pulp and paper, telecommunications, grain handling). When a vertical standard applies, it takes precedence over a general horizontal standard covering the same condition.

Other regulatory instruments
• Letters of Interpretation – OSHA explanations of how a standard applies to specific circumstances; not new law but reflect enforcement position.
• Compliance Directives (CPLs) and Instructions – guidance to compliance officers on how to inspect and enforce.
• National Emphasis Programs (NEPs) and Local Emphasis Programs – targeted enforcement initiatives (amputations, heat, combustible dust, silica, trenching).
• Variances – temporary (while coming into compliance), permanent (alternative method equally protective), experimental, or national defense.
• State Plans – 22 states and territories cover private and public employers; others cover public employees only. State plans must be at least as effective as federal OSHA and may be stricter (California, Washington, and Michigan are common examples).
• Preemption – Section 4(b)(1) of the OSH Act: where another federal agency exercises authority over a working condition (FAA, DOT, MSHA, NRC, Coast Guard), OSHA does not regulate that condition.

Hierarchy for program design
1. Federal, state, and local law and regulation (mandatory floor)
2. Regulations incorporated by reference (mandatory)
3. Consensus standards and industry practice (recognized hazards; evidence under the General Duty Clause; best practice)
4. Manufacturer instructions and warnings (often cited by OSHA; frequently relied upon in litigation)
5. Corporate policies, contractual requirements, insurer requirements, customer specifications (may exceed all of the above)

A sound program is designed to meet the most stringent applicable requirement from all of these layers.

How It Works: Translating Requirements Into a Program

Step 1 – Applicability determination (the legal register). Identify the industry classification (NAICS), jurisdiction (federal OSHA vs. state plan), operations performed, materials used, equipment present, and employee populations. From this, build a regulatory register or legal and other requirements register listing every applicable regulation, consensus standard, permit condition, and contractual obligation. Both ISO 45001 (Clause 6.1.3) and ANSI Z10 require the organization to identify and have access to legal and other requirements and to keep them current.

Step 2 – Gap analysis. Compare current practices against each requirement. Document gaps, assign risk rankings, and prioritize corrective action. This is a form of compliance audit and is the Check element of Plan-Do-Check-Act applied at program inception.

Step 3 – Identify mandatory written program elements. Many OSHA standards explicitly require a written program. The CSP must know the common ones:
• 1910.38 Emergency Action Plan (written if more than 10 employees)
• 1910.39 Fire Prevention Plan
• 1910.95 Hearing Conservation Program (at or above 85 dBA 8-hour TWA action level)
• 1910.119 Process Safety Management (14 elements)
• 1910.120 HAZWOPER (written safety and health program)
• 1910.132 PPE hazard assessment (written certification)
• 1910.134 Respiratory Protection Program (written, with program administrator, medical evaluation, fit testing)
• 1910.146 Permit-Required Confined Space Program
• 1910.147 Control of Hazardous Energy (energy control procedures, annual periodic inspection)
• 1910.1020 Access to Exposure and Medical Records
• 1910.1030 Bloodborne Pathogens Exposure Control Plan (annual review)
• 1910.1200 Hazard Communication Program (written program, SDS, labels, training)
• 1910.1001, .1025, .1026, .1027, .1028, .1053 – substance-specific standards (asbestos, lead, chromium VI, cadmium, benzene, silica) with exposure assessments, medical surveillance, and written compliance plans
• 1926.20/.21 – Construction accident prevention program and training
• 1926.502 – Fall protection plan (when conventional fall protection is infeasible)
• 1926.1101 – Asbestos in construction

Step 4 – Build each program element to satisfy the regulatory text and the relevant consensus standard. For example, a lockout/tagout program must contain every element of 1910.147 (scope, energy control procedures, training for authorized/affected/other employees, periodic inspection, group lockout, shift change, contractor coordination) and may additionally adopt ANSI Z244.1 risk-based alternative methods for minor servicing. A fall protection program meets 1910 Subpart D and I or 1926 Subpart M and uses ANSI Z359 for equipment specification, inspection, and rescue planning.

Step 5 – Training design. Nearly every OSHA standard contains a training requirement, often specifying initial training, refresher intervals (annual for BBP, HAZWOPER 8-hour refresher, PRCS when duties change, LOTO when procedures change, respirator annually, PIT every 3 years), and documentation. ANSI Z490.1 provides the framework for needs analysis, objectives, delivery, evaluation, and recordkeeping.

Step 6 – Recordkeeping and reporting. 29 CFR 1904 requires the OSHA 300 Log, 301 Incident Report, and 300A Summary (posted February 1 to April 30, retained 5 years). Fatalities must be reported within 8 hours; inpatient hospitalization, amputation, or loss of an eye within 24 hours. Establishments meeting size and industry criteria submit data electronically. Exposure records are retained 30 years; medical records for duration of employment plus 30 years; training records per specific standards (typically 3 years for HAZWOPER and BBP). Audiometric records are kept for duration of employment; noise exposure measurements for 2 years.

Step 7 – Document control and management of change. Regulations change through rulemaking (published in the Federal Register with notice-and-comment periods), consensus standards are revised on 5-year cycles or as needed, and operations change. The program must include a mechanism to monitor these changes and update the register, procedures, and training. ISO 45001 Clause 7.5 and Z10 Section 9 address documented information and its control.

Step 8 – Evaluation and continual improvement. Internal audits, management review, leading and lagging indicators (ANSI Z16.1), and corrective action close the PDCA loop. Compliance audits verify conformance to the regulatory register; management system audits verify the system itself is functioning.

Management system standards as program architecture
Both ANSI Z10 and ISO 45001 follow Plan-Do-Check-Act and the Annex SL high-level structure (ISO 45001): Context of the Organization, Leadership and Worker Participation, Planning, Support, Operation, Performance Evaluation, Improvement. Key design implications:
• Management leadership and worker participation are foundational, not optional.
• Risk assessment drives priorities; compliance is a required output, not the only output.
• The hierarchy of controls (elimination, substitution, engineering, administrative, PPE) is explicitly required.
• Procurement and contractor management must flow requirements to third parties.
• Legal and other requirements must be identified, communicated, and evaluated for compliance.
OSHA's Recommended Practices for Safety and Health Programs (2016) and the Voluntary Protection Programs (VPP) four elements – Management Leadership and Employee Involvement, Worksite Analysis, Hazard Prevention and Control, Safety and Health Training – are also frequently referenced.

Common Exam Scenarios

Scenario A – Which rule governs? A worker on a construction site uses a scissor lift. The construction standard (1926) applies, not 1910, because construction work is defined by the activity, not the employer's primary industry. For aerial lifts, 1926.453 incorporates ANSI A92 by reference.

Scenario B – No specific standard exists. Employees are exposed to ergonomic hazards or workplace heat. OSHA has no comprehensive general industry ergonomics or heat standard; enforcement proceeds under the General Duty Clause using ACGIH TLVs, NIOSH criteria documents, and industry guidelines as evidence. The correct program design response is to apply recognized consensus guidance and document a hazard assessment and controls.

Scenario C – Standard is stricter than regulation. The OSHA noise PEL is 90 dBA with a 5 dB exchange rate; ACGIH recommends 85 dBA with a 3 dB exchange rate. A program designed to the TLV is more protective and still compliant. The exam often asks which value is legally required (OSHA) versus recommended best practice (ACGIH/NIOSH).

Scenario D – State plan jurisdiction. A facility in California must comply with Cal/OSHA Title 8, which includes requirements that federal OSHA lacks (written Injury and Illness Prevention Program, heat illness prevention, workplace violence prevention). The exam tests the principle that state plans must be at least as effective and may be more stringent.

Scenario E – Incorporation by reference. A question asks whether a company may comply with a newer edition of an ANSI standard than the one cited in the OSHA rule. The answer: OSHA generally treats compliance with a newer, equally or more protective edition as a de minimis violation that carries no penalty or abatement requirement, but the legally cited edition remains the formal requirement.

Scenario F – Written program trigger. An employer with 8 employees asks whether a written emergency action plan is required. Under 1910.38, employers with 10 or fewer employees may communicate the plan orally. Knowing thresholds like this is frequently tested.

Exam Tips: Answering Questions on Regulations and Standards in Program Design

Tip 1 – Read for the operative verb. Shall, must, and required signal regulation. Should, recommended, and good practice signal consensus standards or guidance. If a question asks what is legally required, eliminate answers describing best practice; if it asks what a CSP should do to build the most effective program, the answer usually incorporates the more protective consensus standard.

Tip 2 – Remember the floor-and-ceiling rule. Regulations are minimums. When two answers both appear correct and one meets regulation while the other exceeds it in a feasible way, BCSP typically rewards the more protective choice unless the question is specifically testing legal minimums.

Tip 3 – Most specific requirement controls. A vertical standard overrides a horizontal one; a substance-specific standard overrides the general air contaminants table; a construction standard overrides general industry when construction work is being performed.

Tip 4 – Know the General Duty Clause and its four elements. To cite 5(a)(1), OSHA must show (1) a hazard existed, (2) the hazard was recognized (by the employer or the industry), (3) it was causing or likely to cause death or serious physical harm, and (4) a feasible means of abatement existed. Consensus standards are the usual evidence of recognition and feasibility.

Tip 5 – Memorize high-yield numbers. 8 and 24-hour reporting; 300A posting February 1 to April 30; 5-year log retention; 30-year exposure and medical record retention; 85 dBA action level and 90 dBA PEL; 10-employee threshold for written EAP and partial recordkeeping exemption for 10 or fewer employees; PRCS and LOTO annual periodic review; BBP annual plan review; PSM process hazard analysis revalidation every 5 years; PIT evaluation every 3 years; HAZWOPER 40/24-hour initial and 8-hour annual refresher; respirator fit test annually.

Tip 6 – Identify the agency correctly. Mines go to MSHA; hazardous materials in transport go to DOT/PHMSA; environmental releases and waste go to EPA; radiation sources often go to NRC or agreement states; workplace exposure goes to OSHA. Jurisdiction questions are designed to see if you default to OSHA when another agency preempts.

Tip 7 – Sequence matters. When asked for the first step in designing a program, the answer is nearly always to identify applicable requirements and assess hazards (the register and gap analysis), not to write procedures or train employees. When asked for the last step, it is typically evaluation, audit, or management review.

Tip 8 – Recognize management system vocabulary. Terms like context of the organization, interested parties, legal and other requirements, documented information, nonconformity, management review, and continual improvement point to ISO 45001/Z10. Questions framed in this vocabulary expect PDCA-based answers emphasizing leadership and worker participation.

Tip 9 – Do not confuse incorporation by reference with voluntary adoption. If a standard is named in the CFR text with an edition date, it is mandatory. If it is simply the current industry standard, it is evidence of recognized practice but not directly enforceable except through the General Duty Clause.

Tip 10 – Letters of interpretation are not law. They clarify OSHA enforcement intent but cannot create new obligations beyond the standard's text. Distractors may describe them as binding regulations.

Tip 11 – Use the elimination approach. Strike answers that (a) violate the hierarchy of controls by jumping to PPE, (b) rely solely on employee behavior, (c) describe a single agency as governing everything, or (d) treat voluntary guidance as a legal mandate when the stem says required by law.

Tip 12 – Watch for state plan clues. A stem mentioning California, Washington, Oregon, Michigan, or an Injury and Illness Prevention Program is signaling a state plan question; the correct answer will acknowledge that state requirements may exceed federal rules.

Tip 13 – When in doubt, choose documentation and systematic process. BCSP values written hazard assessments, documented training, periodic review, and defined roles. An answer that institutionalizes the requirement into the management system is favored over an ad hoc fix.

Tip 14 – Practice reading CFR citations. Be able to decode 29 CFR 1910.147(c)(6) as Title 29, Part 1910, Section 147, paragraph (c)(6). Questions may give a citation and expect you to recognize the subject (147 = LOTO, 146 = PRCS, 134 = respirators, 1200 = HazCom, 1030 = BBP, 119 = PSM, 95 = noise, 38 = EAP, 1904 = recordkeeping).

Quick Reference Summary
• Regulation = mandatory, government, shall, enforceable with penalties.
• Standard = consensus, voluntary unless incorporated by reference or adopted by contract, should, evidence of recognized practice.
• General Duty Clause fills gaps where no specific standard exists.
• Program design sequence: identify requirements and hazards, gap analysis, write program elements, implement controls and training, keep records, audit and review, update for change.
• Management system standards (Z10, ISO 45001) supply the PDCA architecture; OSHA regulations supply the mandatory content; consensus standards supply the technical detail and best practice.
• On the exam, read the stem for required versus recommended, pick the most specific applicable rule, and favor the more protective, systematically documented answer.