Written Programs, Plans and Policies

1. Why This Topic Matters

Written programs, plans and policies are the backbone of any occupational safety and health management system. On the BCSP Certified Safety Professional (CSP) exam, this content sits inside the Program Management domain, which is one of the most heavily weighted areas of the blueprint. Examiners expect you to know (a) which regulations require a written document, (b) what elements a compliant and effective document must contain, (c) how the document hierarchy fits together, and (d) how written documents are controlled, communicated, evaluated and revised over time.

In practice, written documents matter because they:
• Demonstrate management commitment and establish accountability.
• Translate regulatory and consensus-standard requirements into site-specific actions.
• Provide a consistent, defensible basis for training, auditing and enforcement.
• Serve as legal evidence during OSHA inspections, litigation and insurance reviews. A missing or outdated written program is one of the most frequently cited OSHA violations (for example, Hazard Communication and Lockout/Tagout appear on the Top 10 list almost every year).
• Preserve organizational knowledge when people change jobs or leave.

2. What They Are – Key Definitions and the Document Hierarchy

The exam frequently tests whether you can distinguish between related terms. Think of a pyramid moving from broad intent to specific action:

Policy – A short, high-level statement of intent and direction, signed by top management. It answers why and what we believe. Example: 'XYZ Corporation is committed to providing a workplace free of recognized hazards and to continual improvement of its SH&E performance.' Policies rarely change and contain no detailed instructions.

Program – A comprehensive, structured framework that implements a policy for a specific hazard or management function. It answers what must be done, who is responsible and how success is measured. Examples: Hazard Communication Program, Respiratory Protection Program, Hearing Conservation Program, Lockout/Tagout (Energy Control) Program.

Plan – A document describing actions to be taken in response to a specific situation or to reach a defined goal, often time-bound or event-driven. Examples: Emergency Action Plan, Fire Prevention Plan, Exposure Control Plan, Site-Specific Fall Protection Plan, Health and Safety Plan (HASP) for HAZWOPER sites, annual safety improvement plan.

Procedure – Step-by-step instructions for performing a specific task safely. Examples: machine-specific lockout procedure, confined space entry procedure, hot work permit procedure.

Work Instruction / Job Safety Analysis (JSA) – The most granular level, describing individual steps, hazards and controls for a single job.

A useful memory aid: Policy = Commitment, Program = Framework, Plan = Response/Goal, Procedure = Steps.

3. OSHA Standards That Explicitly Require a Written Document

Know these cold – they are prime exam material:

• 29 CFR 1910.1200 Hazard Communication – written HazCom program (chemical inventory, SDS access, labeling, training, non-routine tasks, contractor communication).
• 1910.147 Control of Hazardous Energy – written energy control program with machine-specific procedures and annual periodic inspection.
• 1910.134 Respiratory Protection – written program with a designated program administrator, medical evaluation, fit testing, selection and maintenance.
• 1910.146 Permit-Required Confined Spaces – written permit space program.
• 1910.1030 Bloodborne Pathogens – written Exposure Control Plan, reviewed annually.
• 1910.38 Emergency Action Plan and 1910.39 Fire Prevention Plan – must be in writing when the employer has more than 10 employees; may be communicated orally with 10 or fewer.
• 1910.132 PPE – written certification of the workplace hazard assessment.
• 1910.119 Process Safety Management – extensive written requirements (process safety information, operating procedures, mechanical integrity, management of change, etc.).
• 1910.120 HAZWOPER – written safety and health program and site-specific HASP; written emergency response plan.
• 1910.95 Occupational Noise – hearing conservation program (written audiometric and exposure records; a written program is best practice and expected by examiners).
• 1926.502(k) Construction Fall Protection Plan – written, site-specific, prepared by a qualified person, used only when conventional fall protection is infeasible.
• 1926.65 / 1926.59 construction equivalents, and 1910.1001, 1910.1025, 1910.1026, 1910.1053 (asbestos, lead, chromium VI, silica) – written exposure control / compliance plans.
• 1910.269 and 1910.333 electrical safety – written procedures for energized work and lockout.

Also know that ANSI/ASSP Z10 and ISO 45001 (Clause 7.5, Documented Information) require organizations to maintain and control documented information, and that OSHA's Recommended Practices for Safety and Health Programs and the VPP program expect written documentation of core elements such as management leadership, worker participation, hazard identification and program evaluation.

4. How a Written Program Works – Essential Elements

Regardless of topic, a well-constructed written program typically contains these elements. The exam may ask you to identify the missing element or the first step.

1. Purpose and Policy Statement – why the program exists and the management commitment behind it.
2. Scope and Applicability – which locations, operations, employees and contractors are covered.
3. Regulatory and Standards Basis – references to applicable OSHA, EPA, NFPA, ANSI or corporate requirements.
4. Definitions – key terms so everyone shares the same understanding.
5. Roles and Responsibilities – management, supervisors, employees, program administrator, safety professional, contractors. Accountability must be clearly assigned.
6. Hazard Identification and Risk Assessment – how hazards are identified, evaluated and prioritized (e.g., JHAs, exposure monitoring).
7. Hazard Control Procedures – following the hierarchy of controls (elimination, substitution, engineering, administrative, PPE).
8. Training and Communication – who gets trained, on what, when (initial, annual, upon change) and how competency is verified.
9. Recordkeeping and Documentation – what records are kept, where, for how long (e.g., exposure and medical records for 30 years under 1910.1020; training records; inspection records; OSHA 300 logs for 5 years).
10. Program Evaluation and Audit – metrics, inspections, periodic review (often annual), and corrective action tracking.
11. Review and Revision / Management of Change – triggers for revision such as new processes, new regulations, incidents or audit findings; version and date control.
12. Approval and Signatures – evidence of management endorsement.

Document Control is a frequently tested sub-topic. Effective control includes a unique document number, revision level, effective date, author and approver, a distribution list, removal of obsolete copies, and ensuring the current version is accessible to workers (including language and literacy accommodation). ISO 45001 requires that documented information be available, suitable and protected.

Life Cycle (Plan-Do-Check-Act): Develop the document based on a hazard/needs assessment (Plan) → implement and train (Do) → audit, inspect and measure (Check) → revise and improve (Act). A written program that is never audited or updated is often described on the exam as a 'paper program' – it exists but is not effective.

Characteristics of an Effective Written Program
• Site-specific, not a generic template copied from another facility.
• Written in plain language appropriate for the workforce.
• Developed with employee participation.
• Realistic – describes what actually happens; a program that promises more than is practiced creates liability.
• Integrated with other business processes (purchasing, engineering, HR, contractor management).
• Measured with both leading indicators (training completion, inspections performed) and lagging indicators (injury rates).

5. Exam Tips: Answering Questions on Written Programs, Plans and Policies

Tip 1 – Master the vocabulary. If a question describes a brief statement signed by the CEO expressing commitment, the answer is policy. If it describes a document that assigns responsibilities and establishes procedures for a hazard class, it is a program. If it describes actions for a specific event or site, it is a plan. Step-by-step task instructions are a procedure.

Tip 2 – Know the 'more than 10 employees' rule. Emergency Action Plans and Fire Prevention Plans must be written for employers with more than 10 employees; employers with 10 or fewer may communicate them orally. This is a classic distractor.

Tip 3 – Remember which standards name a program administrator. Respiratory Protection (1910.134) specifically requires a suitably trained program administrator. Bloodborne Pathogens requires annual review and update of the Exposure Control Plan. Lockout/Tagout requires at least annual periodic inspection of procedures, certified in writing.

Tip 4 – When asked for the 'first step' in developing a program, choose assessment. The CSP exam consistently favors answers that begin with hazard identification, needs assessment or securing management commitment before writing anything. Writing procedures or buying PPE is never the first step.

Tip 5 – Management commitment and employee involvement are the 'best' answers. When a question asks what most influences the effectiveness of a written program, select answers involving visible management leadership, assigned accountability and worker participation over answers about formatting, length or legal review.

Tip 6 – Watch for 'paper program' scenarios. If a scenario describes a facility with a complete binder of programs but ongoing injuries or citations, the examiners are testing program evaluation, implementation and auditing – not the need for more documents.

Tip 7 – Revision triggers. Expect questions on when a written program must be updated: after a change in process, equipment, chemicals or personnel; after an incident or near miss; after an audit finding; after a regulatory change; or at a defined periodic review (commonly annually). Management of Change is the formal mechanism.

Tip 8 – Recordkeeping retention numbers. Memorize: OSHA 300/300A/301 – 5 years; employee exposure and medical records (1910.1020) – 30 years (medical records for duration of employment plus 30 years); training records – generally 3 years for Bloodborne Pathogens, duration of the program for most others; lockout periodic inspection certifications – until superseded.

Tip 9 – Eliminate absolute distractors. Answer choices containing words like 'always', 'never', 'only' or 'all employees must sign' are usually wrong. Choose answers that reflect risk-based, site-specific, documented and reviewed approaches.

Tip 10 – Think like a manager, not just a technician. The Program Management domain rewards answers that link written documents to accountability, communication, measurement and continual improvement. When two answers both seem technically correct, pick the one that strengthens the management system.

6. Quick Self-Check Questions

• Which OSHA standard requires a written certification of a hazard assessment? (1910.132 PPE)
• An employer with 8 employees has no written Emergency Action Plan. Is this a violation? (No – oral communication is permitted with 10 or fewer employees.)
• What is the primary difference between a policy and a program? (A policy states commitment and direction; a program provides the structured framework, responsibilities and procedures to implement it.)
• What document ensures that only the current version of a procedure is in use at the worksite? (A document control procedure.)
• What element of a written program verifies that it is functioning as intended? (Program evaluation / audit.)

Summary

Written programs, plans and policies convert management intent into controlled, auditable action. For the CSP exam, be able to define and distinguish each document type, list the major OSHA standards that mandate written documents, recite the core elements of a compliant program, and apply the Plan-Do-Check-Act cycle to development, implementation, evaluation and revision. Above all, remember that the written document is a means to an end – effective hazard control through management commitment, clear accountability and worker participation.