OSHA’s recordkeeping regulation at 29 CFR Part 1904 requires most employers with more than 10 employees to record work-related injuries and illnesses using OSHA Forms 300, 300A, and 301. Beyond simply maintaining these records, the regulation establishes detailed requirements for determining recordability, classifying injuries, posting annual summaries, reporting severe injuries to OSHA, and electronically submitting data through the Injury Tracking Application (ITA). A program-level recordkeeping audit evaluates whether your facility is correctly identifying recordable cases, accurately completing required forms, meeting electronic submission deadlines, and retaining records for the required five-year period.
Free OSHA Recordkeeping Audit Checklist
Download our Word document checklist for osha recordkeeping program audits.
Download Checklist (.docx)Regulatory Requirements
29 CFR 1904 — Recording and Reporting Occupational Injuries and Illnesses
The OSHA recordkeeping regulation requires covered employers to maintain a log of all recordable work-related injuries and illnesses (Form 300), complete a detailed incident report for each case (Form 301), and prepare an annual summary (Form 300A). The regulation defines what constitutes a recordable case, establishes criteria for work-relatedness, and specifies how to classify injuries and illnesses including days away from work, restricted duty, and job transfer cases.
29 CFR 1904.41 — Electronic Reporting of Injury and Illness Data (ITA)
OSHA requires certain establishments to electronically submit injury and illness data through the Injury Tracking Application (ITA). Establishments with 250 or more employees (not in exempt industries) must submit Form 300A data annually. Establishments with 20–249 employees in industries listed in Appendix A to Subpart E must also submit 300A data. Effective January 1, 2024, establishments with 100 or more employees in high-hazard industries listed in Appendix B must additionally submit Forms 300 and 301 data. All electronic submissions are due by March 2 each year.
29 CFR 1904.39 — Reporting Fatalities and Severe Injuries
All employers, regardless of size or industry exemption status, must report work-related fatalities to OSHA within 8 hours and work-related in-patient hospitalizations, amputations, or losses of an eye within 24 hours. Reports can be made by calling the nearest OSHA Area Office, the OSHA hotline (1-800-321-OSHA), or online through OSHA’s reporting portal.
The 2024 final rule expanded electronic reporting requirements. Establishments with 100+ employees in designated high-hazard industries (Appendix B to Subpart E) must now submit Forms 300 and 301 in addition to Form 300A. Use the ITA Coverage Application at osha.gov/injuryreporting to determine your facility’s specific submission requirements.
Program Applicability and Exemptions
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Coverage determination | Facility has determined whether it is required to maintain OSHA injury and illness records under 29 CFR 1904. Establishments with 10 or fewer employees at all times during the previous calendar year are partially exempt under 1904.1. Establishments in certain low-hazard industries listed in Appendix A to Subpart B are partially exempt under 1904.2. Even partially exempt employers must report fatalities and severe injuries per 1904.39. |
| NAICS code verification | Facility’s NAICS code has been verified and correctly identified for determining both recordkeeping obligations and electronic submission requirements. NAICS code is consistent across all OSHA forms and the ITA. Any changes in industrial classification have been evaluated for impact on recordkeeping requirements. |
| Multi-establishment tracking | For employers with multiple establishments, each establishment maintains its own set of OSHA 300/300A/301 forms. Employee counts are determined per establishment, not company-wide, for electronic submission thresholds. Temporary and part-time employees are included in the count. |
Recordability Determination
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Work-relatedness evaluation | Procedures exist for evaluating whether injuries and illnesses are work-related per 1904.5. Work environment includes the establishment and other locations where employees are performing work-related duties. Geographic presumption exceptions (1904.5(b)(2)) are understood and applied correctly. Cases involving pre-existing conditions aggravated by workplace events are properly evaluated. |
| Recording criteria | All recordable cases meet one or more of the general recording criteria under 1904.7: death, days away from work, restricted work or transfer, medical treatment beyond first aid, loss of consciousness, or significant injury/illness diagnosed by a physician or licensed healthcare professional. First aid treatments as defined in 1904.7(a) are correctly distinguished from medical treatment. |
| Specific recording criteria | Specific criteria are applied for needlestick and sharps injuries (1904.8), medical removal cases (1904.9), hearing loss (1904.10 — standard threshold shift of 10 dB average at 2000, 3000, 4000 Hz adjusted for age), and tuberculosis (1904.11). Musculoskeletal disorders are recorded under the general recording criteria. |
| Day counting procedures | Days away from work and days of restricted work activity or job transfer are counted correctly per 1904.7(c). Count begins the day after the injury or illness, not the day of the event. Calendar days (not work days) are counted. Cap of 180 days is applied if the outcome is not known. Physician-recommended days are counted even if the employee works. |
Forms Accuracy and Completion
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| OSHA Form 300 (Log) | The OSHA 300 Log is maintained at each establishment and entries are made within 7 calendar days of receiving information about a recordable case. All required columns are completed accurately including case number, employee name, job title, date, location, injury description, classification, and days away/restricted. Privacy concern cases per 1904.29(b)(7) use 'Privacy Case' instead of employee name. |
| OSHA Form 301 (Incident Report) | An OSHA 301 Incident Report (or equivalent) is completed for each recordable injury or illness within 7 calendar days. All fields are completed including detailed description of how the injury occurred, what object or substance directly harmed the employee, and what the employee was doing just before the incident. Workers’ compensation or insurance first report of injury forms may substitute if they contain all required 301 data elements. |
| OSHA Form 300A (Annual Summary) | The 300A Annual Summary is accurately completed by February 1 each year summarizing the previous calendar year’s 300 Log. Summary is certified by a company executive per 1904.32(b)(3). The 300A is posted in a conspicuous place from February 1 through April 30. Zero-injury summaries must still be posted if the establishment is required to keep records. |
| Updating and correcting records | The 300 Log is updated to reflect changes in case classification or outcome within 7 calendar days of new information. If initial entry was incorrect, original entry is lined through and corrected entry is made. Do not erase or white-out original entries. Annual review of the 300 Log is conducted to verify completeness and accuracy before certifying the 300A. |
Posting, Access, and Privacy
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Annual summary posting | The certified 300A Annual Summary is posted in a conspicuous location where employee notices are customarily posted from February 1 through April 30 each year. If the establishment has no fixed location, the summary is posted at the location from which employees operate. Posting dates are documented. |
| Employee access to records | Current and former employees, their personal representatives, and authorized employee representatives have access to the OSHA 300 Log and 301 Incident Reports per 1904.35. Access must be provided by the end of the next business day. Forms 300 and 300A provided to employees and their representatives must contain employee names. Form 301 provided to an employee is limited to that employee’s own report. |
| Privacy protections | Privacy concern cases are identified per 1904.29(b)(7) and employee names are withheld from the 300 Log for these cases. Privacy cases include sexual assault, HIV/hepatitis/TB infections, needlestick injuries, mental illness, and cases where the employee independently requests privacy. Names are still recorded on the 301 Incident Report. |
Electronic Submission and Reporting
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| ITA submission requirements | Facility has determined its electronic submission tier using the ITA Coverage Application. Tier 1 (250+ employees, non-exempt): 300A data submitted annually. Tier 2 (20–249 employees, Appendix A industries): 300A data submitted annually. Tier 3 (100+ employees, Appendix B high-hazard industries): 300, 300A, and 301 data submitted annually. All submissions due by March 2 each year via the Injury Tracking Application (NeT). |
| ITA account and submission | Facility has an active ITA account with login.gov credentials. Authorized submitter has been designated. Company legal name is included with all submissions per the 2024 final rule. Data has been submitted for the most recent calendar year by the March 2 deadline. Submission confirmation has been retained. |
| Fatality and severe injury reporting | Procedures exist for reporting work-related fatalities within 8 hours and in-patient hospitalizations, amputations, and eye losses within 24 hours per 1904.39. Reporting methods include OSHA hotline (1-800-321-OSHA), nearest Area Office, or online portal. Contact numbers are posted and accessible. Reporting applies to all employers regardless of size or industry exemption. |
| State Plan considerations | If the establishment is in an OSHA State Plan state, any additional state-specific reporting requirements are identified and met. Some State Plans require additional data submissions or have different reporting thresholds. Minnesota, for example, requires additional private sector establishment submissions. |
Record Retention and Program Management
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Five-year retention | OSHA 300 Logs, 300A Annual Summaries, and 301 Incident Reports are retained for five years following the end of the calendar year they cover per 1904.33. During the storage period, the 300 Log is updated with any newly discovered recordable cases or changes in classification. Records are stored securely but are accessible for employee and OSHA requests. |
| Establishment transfer | If the establishment is sold or transferred, the new owner receives all OSHA recordkeeping records for the current year and previous five years. The new owner is responsible for maintaining and updating these records per 1904.33(b)(2). |
| Recordkeeper designation | A responsible person has been designated to maintain OSHA recordkeeping forms. This person is trained on recordability criteria, form completion, classification rules, privacy requirements, and electronic submission procedures. Training is documented and refreshed when regulations change. |
| Annual self-audit | The facility conducts an annual review of its recordkeeping program before certifying the 300A. Review includes verification that all recordable cases have been captured, classifications are correct, day counts are accurate, privacy cases are properly flagged, and the 300 Log has been updated for any case outcomes that changed during the year. |
Audit frequency: Conduct a comprehensive recordkeeping audit at least annually before certifying the 300A Annual Summary. Perform interim reviews quarterly to catch classification errors and missed cases early. Review recordability decisions within 7 days of each incident to ensure timely and accurate recording.
Corrective Actions
Common Issues and Responses
- Missed recordable cases: Review incident reports, first aid logs, and workers’ compensation claims for the past year to identify any unreported recordable cases. Add missed cases to the 300 Log and complete 301 forms. Retrain recordkeeping personnel on recordability criteria.
- Late or missing ITA submission: Submit the required data through the ITA immediately. Contact the OSHA Area Office to report the late submission. Review ITA submission procedures and set calendar reminders for the March 2 annual deadline.
- Inaccurate injury classification: Review OSHA’s recordkeeping decision trees and classification criteria. Correct the 300 Log entries by lining through incorrect data and adding corrected entries. Retrain personnel on the distinction between first aid and medical treatment, days away vs. restricted duty, and privacy concern cases.
- 300A not posted or late posting: Post the certified 300A immediately. Document the posting date and location. Set calendar reminders for the February 1 posting deadline and April 30 removal date. Ensure a conspicuous location is identified at each establishment.
- Missing fatality/severe injury report: Report immediately to OSHA if within the reporting window. If the window has passed, consult legal counsel. Implement a procedure requiring immediate notification to the designated safety person when any fatality, hospitalization, amputation, or eye loss occurs.
Download the Free Checklist
Get our osha recordkeeping program audit checklist in Word format. Customize it for your organization.
Download Checklist (.docx)
Go digital with Ecesis. Replace paper-based injury logs with Ecesis incident management software. Automate recordability determinations, generate OSHA 300/300A/301 forms, track day counts, manage electronic ITA submissions, and maintain a complete audit trail. Request a free demo.
Ecesis EHS Software
Incident Management
Automated OSHA recordability determinations with 300/300A/301 form generation and ITA export.
Compliance Calendar
Track 300A posting dates, ITA submission deadlines, and fatality reporting windows.
Training
Recordkeeping training for designated personnel with completion tracking and refresher scheduling.
Reporting and Analytics
Injury rate calculations (TRIR, DART, LTIR) with trending analysis and benchmarking.
Document Management
Secure storage for 300 Logs, 301 forms, annual summaries, and ITA confirmation records.
Task Management
Track corrective actions from recordkeeping audits and incident investigations.
