An HR director at a 150-person manufacturing company gets a call about an injury on the plant floor. The operations manager has the incident details, the supervisor has spoken with the employee, and the PEO handles payroll and workers' compensation administration. Nobody can say with confidence who must make the OSHA report, which deadline applies, or where the injury log is maintained.
That uncertainty is common in mid-market companies. A PEO can centralize administrative work, but it doesn't automatically transfer the employer's operational safety duties. The practical question isn't whether the company has a safety policy. It's whether people, deadlines, records, equipment, and contract language work together when an incident occurs.
Table of Contents
- The Legal Foundation of OSHA Employer Responsibilities
- Understanding the General Duty Clause
- Training, PPE, and Hazard Communication Requirements
- Reporting Deadlines and Recordkeeping Obligations
- Preparing for OSHA Inspections and Avoiding Citations
- Allocating OSHA Responsibilities in a PEO Relationship
- Your OSHA Compliance Action Plan
The Legal Foundation of OSHA Employer Responsibilities
The Occupational Safety and Health Act of 1970 established the core legal duty behind OSHA employer responsibilities. Employers must provide a workplace free from recognized serious hazards and comply with applicable OSHA standards, including requirements involving worker training, safe tools and equipment, and workplace notices. OSHA's employer responsibility guidance sets out this framework.
For the manufacturing HR director facing the injury call, the first lesson is practical. OSHA compliance isn't a policy stored in an HR folder. It's a continuing obligation that reaches from hazard prevention to incident reporting, recordkeeping, employee access to records, and protection against retaliation.
What the foundational duty requires
An employer must maintain a workplace where recognized serious hazards are addressed, provide training in a language and vocabulary employees understand, keep tools and equipment safe, and post required notices. Those duties apply broadly across private-sector workplaces, whether the company operates a factory, warehouse, office, laboratory, or field service operation.
A company can outsource payroll processing, benefits administration, or parts of workers' compensation management. It can't outsource awareness of the conditions its employees face every day. The plant manager still controls production practices, supervisors still direct work, and the employer still needs a reliable process for escalating hazards.
Practical rule: A PEO relationship can clarify who performs a task, but it doesn't make responsibility disappear.
The reporting framework makes that point especially clear. A workplace fatality must be reported within 8 hours, while a work-related inpatient hospitalization, amputation, or loss of an eye must be reported within 24 hours. OSHA's severe-injury reporting guidance identifies these deadlines.
Why the obligation continues after an incident
OSHA responsibilities also include injury and illness records, employee access to those records, and safeguards against retaliation. A company that responds well to an injury but fails to preserve the required documentation still has a compliance problem.
For an HR leader evaluating a PEO, the contract should therefore be reviewed alongside the company's safety program. The PEO co-employment legal structure matters because it helps distinguish legal relationships from the specific operational duties that must be performed at the worksite.
Understanding the General Duty Clause
The general duty clause prevents employers from treating OSHA compliance as a checklist limited to standards with a specific regulatory citation. Under the clause, employers must keep the workplace free from recognized hazards that cause or are likely to cause death or serious physical harm, even when no specific OSHA standard addresses the condition. The Department of Labor's OSHA elaws resource describes this catch-all obligation.
A hazard becomes operationally important when the employer or industry recognizes it, the risk is serious, and a feasible method of correction exists. That combination changes the question from “Which rule covers this?” to “What does a reasonable safety program require this company to identify and control?”
Recognized hazards in daily operations
Consider a warehouse where poor lighting has contributed to repeated near-misses. Even if no single rule gives the exact lighting solution for that location, management has notice of a foreseeable risk and should evaluate corrective measures.
Other examples include:
- A chemical process the industry understands to be dangerous, even though no highly specific OSHA standard governs that exact process.
- Repetitive work that creates ergonomic risk, where task rotation, equipment changes, or other feasible controls may reduce exposure.
- A newly installed machine that introduces an unreviewed pinch point or unexpected energy source.
- A non-routine maintenance task assigned without a clear hazard assessment or escalation path.
The general duty clause pushes employers toward active hazard identification. Written policies alone won't demonstrate that the company recognized changing conditions, assessed the risk, selected controls, and verified that workers could use those controls.
A workable hazard-control process
Multi-state employers need a repeatable process rather than separate informal practices at every location. Each site should identify who performs assessments, who approves controls, who can stop work, and who receives escalation when a task falls outside normal operations.
Documented controls should connect the hazard to the action taken. A useful record identifies the affected task, the people responsible, the equipment or procedure selected, and the follow-up check. That evidence helps show that managers acted before an injury instead of waiting for an inspection or claim to expose the gap.
Training, PPE, and Hazard Communication Requirements
Day-to-day OSHA compliance depends heavily on three connected systems: employee training, personal protective equipment, and hazard communication. Each system fails when managers treat completion as the objective instead of confirming that workers understand the hazards and can perform the work safely.
Training must be delivered in a language and vocabulary the employee understands. It should address the hazards associated with the person's actual assignment, not just provide a generic orientation deck. Training should occur before initial assignment, when a new hazard is introduced, and again when conditions or employee understanding make refresher instruction necessary.
Training records should answer practical questions
An OSHA inspector or internal auditor will want more than a course title. The record should make it possible to identify:
- Who attended: The employee's name, role, location, or work group.
- What was covered: The hazard, procedure, equipment, or standard addressed.
- When training occurred: The date and any required follow-up.
- Who delivered it: The instructor, supervisor, or qualified provider.
- How understanding was confirmed: Demonstration, discussion, testing, or observed performance.
Language access deserves careful attention in multilingual workplaces. HR teams reviewing avoiding labor lawsuits with translation can apply the same discipline to safety materials, training aids, and employee communications. A translated handbook doesn't replace task-specific instruction, but language barriers shouldn't prevent an employee from understanding a hazard or control.
PPE and hazard communication
PPE begins with a hazard assessment. The employer must determine what protection is appropriate, provide required PPE at no cost to workers, and train employees to use, maintain, and recognize the limits of that equipment. A box of gloves in a supply room isn't a complete PPE program if employees don't know when gloves are required, which type is appropriate, or how replacement works.
Hazard communication requires a written program, accessible Safety Data Sheets, proper container labeling, and training on chemical hazards. The program should cover secondary containers, temporary work areas, contractor coordination, and the process for updating materials when a new chemical arrives.
A PEO may host learning content or retain training records, but the client company still needs to confirm that the assigned training matches the worksite. The PEO workers' compensation and safety compliance integration should be evaluated for that connection, especially where claims administration, safety support, and records sit in different systems.
Reporting Deadlines and Recordkeeping Obligations
A serious incident exposes ownership gaps immediately. A work-related fatality must be reported to OSHA within 8 hours. A work-related inpatient hospitalization, amputation, or loss of an eye must be reported within 24 hours, as stated in OSHA's reporting requirements memorandum.
Set the escalation process before an incident occurs. Supervisors need a clear contact, HR must confirm whether the event is reportable, and the PEO agreement should specify whether the PEO submits the report, supports the submission, or only receives information for workers' compensation administration. Assigning these duties in writing prevents delays when facts are incomplete and the clock is running.
The annual recordkeeping cycle
Employers with 10 or more employees generally must maintain OSHA injury and illness records when covered by the recordkeeping rule. The required forms are:
- Form 300: The Log of Work-Related Injuries and Illnesses.
- Form 300A: The Annual Summary.
- Form 301: The Incident Report.
The employer must review the log, certify the annual summary, and post Form 300A from February 1 through April 30 each year. Covered employers may also need to submit annual data electronically through OSHA's Injury Tracking Application. OSHA's recordkeeping guidance explains recording criteria and covered forms, while OSHA's forms guidance addresses electronic submission obligations.
| Requirement | Deadline | Retention Period |
|---|---|---|
| Severe-injury report for a fatality | Within 8 hours | Incident records follow applicable OSHA retention rules |
| Report for inpatient hospitalization, amputation, or loss of an eye | Within 24 hours | Incident records follow applicable OSHA retention rules |
| Form 300A posting | February 1 through April 30 | Core OSHA forms retained for 5 years |
| OSHA Forms 300, 300A, and 301 | Annual review, certification, and required submission | 5 years |
OSHA recordkeeping guidance from an independent compliance specialist can provide additional context when reviewing the process. The five-year retention requirement makes ownership of storage, access, corrections, and records transfer a contract issue, not an assumption. Review PEO record retention legal requirements before signing or ending a PEO relationship, and document who keeps the files after the transition.
Preparing for OSHA Inspections and Avoiding Citations
OSHA inspections can follow imminent-danger concerns, fatalities, employee complaints, or targeted enforcement programs. The inspection generally begins with an opening conference, moves through a worksite walkthrough, includes employee interviews, and ends with a closing conference.
The company's response should be organized but not theatrical. A designated management representative should accompany the inspector, answer accurately, identify requested records, and avoid guessing. Employees should be free to participate in interviews without coaching or retaliation.
What inspectors commonly find
Documentation gaps often expose deeper control problems, but they can also create citations when a company performed work without preserving evidence. Common trouble spots include:
- Training records: No reliable proof that employees received assignment-specific instruction.
- Hazard assessments: Assessments don't cover non-routine work, new equipment, or changed processes.
- PPE controls: Required equipment isn't available, isn't suitable, or isn't supported by use training.
- Recordkeeping: Forms are incomplete, inconsistent, inaccessible, or not retained properly.
- Employee notices: Required postings aren't displayed where employees can see them.
OSHA distinguishes among violation categories such as willful, serious, and other-than-serious violations. Penalty amounts can depend on the violation classification and enforcement circumstances, so a responsible preparation program shouldn't rely on guessing a potential dollar figure.
Build an inspection-ready operating file
A strong inspection file includes the written safety program, current hazard assessments, training rosters, PPE assessments, hazard communication materials, Safety Data Sheets, incident records, and evidence of corrective actions. The file should be accessible to the people who need it, including the site leader and the HR or risk contact responsible for responding.
Claims administration also deserves a separate review. Companies operating in New Jersey, for example, may find claims management for NJ firms useful when assessing how incident response, workers' compensation, and risk-control activities fit together.
The PEO audit defense responsibilities should be explicit in the service agreement. A PEO can support document production and coordination, but site management must still control the walkthrough, employee communication, and immediate correction of unsafe conditions.
Allocating OSHA Responsibilities in a PEO Relationship
The most dangerous PEO contract language is language that sounds complete but doesn't assign a named owner to a time-sensitive task. In a co-employment relationship, the PEO and client company typically share liability in ways that depend on the facts, the worksite, the applicable law, and the agreement. The contract should therefore allocate duties with operational precision.
Administrative work often fits naturally with a PEO. The client company, however, usually controls the daily workplace, equipment, supervisors, production methods, and employee behavior. That division should be reflected in the agreement rather than assumed.
Duties that need a clear owner
Negotiations should address each of these responsibilities separately:
- Severe-incident reporting: Who decides whether an event is reportable, who makes the OSHA submission, and who confirms the timestamp?
- Injury logs: Who enters the event, who reviews classification, and who corrects an error?
- Training: Who assigns courses, supplies site-specific instruction, and preserves attendance evidence?
- PPE: Who performs the assessment, purchases equipment, replaces it, and verifies use?
- Hazard assessments: Who inspects the site and who approves controls for new processes?
- Workers' compensation: Who manages the claim, coordinates with safety personnel, and communicates with the employee?
Contract standard: Every duty should have an owner, a backup, a response deadline, and a records location.
The contract should also address audit cooperation, inspection support, employee access to records, corrective-action tracking, and what happens to OSHA files when the relationship ends. Vague language such as “the PEO will assist with compliance” isn't enough for a fatality report or an inaccessible log.
Questions for a PEO evaluation
Ask the provider to demonstrate, not merely describe, how its system handles an incident. Which team receives the first notice? Can the client retrieve Forms 300, 300A, and 301 without opening a support ticket? Does the provider conduct site assessments, offer safety training, support corrective actions, and explain its liability coverage?
The PEO legal responsibility matrix can help buyers convert those answers into a written allocation matrix. The best arrangement isn't the one with the most promised services. It's the one where the client and PEO can identify exactly who acts when conditions change or an incident occurs.
Your OSHA Compliance Action Plan
OSHA compliance becomes manageable when HR treats it as an operating system rather than an annual paperwork exercise. The first review should focus on whether an employee, supervisor, HR leader, and PEO representative would make the same decision during a fast-moving incident.
Immediate actions
Start with the controls that protect the company from avoidable confusion:
- Verify severe-injury procedures. Confirm that the organization knows how to escalate a fatality, inpatient hospitalization, amputation, or loss of an eye within the applicable deadline.
- Locate current records. Confirm that Forms 300, 300A, and 301 are complete, accessible, and assigned to a named owner.
- Review training evidence. Check whether records identify the employee, subject, date, trainer, and worksite relevance.
- Confirm employee notices. Inspect each location where required workplace notices are posted.
Actions for the next 30 days
A workplace hazard assessment should cover routine work, non-routine work, newly introduced equipment, chemicals, and tasks performed across shifts or locations. The review should also test whether PPE is available, appropriate, replaced when needed, and supported by documented instruction.
Hazard communication deserves its own audit. Confirm that the written program is current, Safety Data Sheets are accessible, containers are labeled, and employees can explain the hazards associated with the chemicals they use.
Strategic work over the next 90 days
Review the PEO agreement line by line. The company should be able to identify who owns reporting, records, training administration, site assessments, PPE, inspection support, workers' compensation coordination, and post-incident corrective action.
Then establish a mock inspection protocol and recurring compliance review. A sustainable process tracks open hazards, overdue training, missing records, corrective actions, and changes in equipment or chemicals. It also gives employees a clear way to report concerns without fear of retaliation.
PEO Metrics helps HR, finance, and leadership teams compare PEOs, review safety and compliance support, and negotiate clearer responsibility and liability terms. Visit PEO Metrics to evaluate provider trade-offs before renewal, switching, or signing a new agreement.
