Process Safety Management (PSM) under OSHA 29 CFR 1910.119 and Risk Management Plans (RMP) under EPA 40 CFR 68 are comprehensive regulatory frameworks designed to prevent catastrophic releases of highly hazardous chemicals. PSM applies to facilities with processes involving chemicals listed in Appendix A at or above threshold quantities, or flammable liquids/gases at 10,000 pounds or more. The standard requires employers to certify compliance through a triennial audit covering all 14 program elements. EPA’s RMP program parallels PSM with additional requirements for hazard assessment, prevention programs, and emergency response. Because PSM and RMP share many overlapping elements, a combined audit is the most efficient approach for covered facilities. This checklist addresses the key requirements of both programs across all 14 PSM elements plus RMP-specific provisions.
Free PSM/RMP Compliance Audit Checklist
Download our Word document checklist for psm/rmp compliance program audits.
Download Checklist (.docx)Regulatory Requirements
OSHA 29 CFR 1910.119 — Process Safety Management of Highly Hazardous Chemicals
The PSM standard contains 14 elements that together form a management system for preventing releases of highly hazardous chemicals: employee participation, process safety information, process hazard analysis, operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning, compliance audits, and trade secrets. Facilities must conduct triennial compliance audits and retain the two most recent audit reports.
EPA 40 CFR 68 — Chemical Accident Prevention Provisions (RMP Rule)
The RMP rule requires facilities with more than a threshold quantity of a regulated substance to develop and implement a Risk Management Plan. The plan must include a hazard assessment, prevention program (which mirrors PSM for Program 3 facilities), and emergency response program. RMPs must be submitted to EPA and updated at least every five years or when significant changes occur.
Clean Air Act Section 112(r)
CAA Section 112(r) establishes the general duty clause requiring owners and operators of facilities handling extremely hazardous substances to identify hazards, design and maintain safe facilities, and minimize the consequences of accidental releases. This duty applies even to facilities not covered by the RMP rule.
Employee Participation and Process Safety Information
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Employee participation plan | Written plan exists for employee participation in PSM program development and conduct. Employees have access to PHAs, incident investigations, and other PSM elements. Consultation with employees on PSM program development is documented. |
| Chemical hazard information | Process safety information includes MSDS/SDS for all highly hazardous chemicals in the process. Information covers toxicity, permissible exposure limits, physical data, reactivity data, corrosivity data, and thermal/chemical stability data. |
| Process technology information | Documentation includes block flow or process flow diagrams, process chemistry, maximum intended inventory, safe upper and lower operating limits, and consequences of deviations. Material and energy balances are available for processes designed after May 26, 1992. |
| Equipment information | Documentation includes materials of construction, P&IDs, electrical classification, relief system design and basis, ventilation system design, design codes and standards, and safety systems (interlocks, detection, suppression). Equipment complies with RAGAGEP. |
Process Hazard Analysis
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| PHA completion and currency | Initial PHA has been completed for each covered process. PHAs are updated and revalidated at least every five years. Current revalidation is within the five-year cycle. All covered processes have a current PHA. |
| PHA methodology and team | Appropriate PHA methodology is used (What-If, Checklist, What-If/Checklist, HAZOP, FMEA, Fault Tree, or equivalent). Team includes at least one member with process-specific expertise, one with PHA methodology expertise, and one employee with process operating experience. |
| PHA scope and content | PHA addresses: hazards of the process, previous incidents with catastrophic potential, engineering and administrative controls, consequences of control failures, facility siting, human factors, and a qualitative evaluation of safeguards. Findings are documented. |
| PHA recommendation resolution | All PHA recommendations are resolved and documented with a timetable. Resolutions are communicated to affected personnel. Unresolved recommendations are tracked and justified. Management response to each recommendation is documented. |
Operating Procedures, Training, and Contractors
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Operating procedure adequacy | Written operating procedures exist for each covered process covering: normal operations (startup, shutdown, steady state), emergency operations, and temporary operations. Procedures address operating limits, consequences of deviation, steps to avoid exceeding limits, and safety and health considerations. |
| Operating procedure certification | Operating procedures are reviewed as often as necessary to ensure they reflect current operations. Procedures are certified as current and accurate annually. Certification is documented with date and certifier. |
| Employee training | Initial training includes an overview of the process and operating procedures with emphasis on specific hazards, emergency operations, and safe work practices. Refresher training is conducted at least every three years. Training documentation includes identity of employee, date, and means of verification. |
| Contractor management | Host employer evaluates contractor safety performance and programs. Contractors are informed of known hazards, emergency action plan, and applicable safe work practices. Contractor injury/illness log is maintained for the process area. Contractor performance is periodically evaluated. |
Pre-Startup, Mechanical Integrity, and Hot Work
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Pre-startup safety review | PSSR is conducted for new and modified facilities before startup. Review confirms: construction per design specs, safety/operating/maintenance/emergency procedures in place, PHA recommendations resolved, modified MOC requirements met, and training completed. |
| Mechanical integrity program | Written procedures exist for maintaining the ongoing integrity of process equipment: pressure vessels, storage tanks, piping systems, relief and vent systems, emergency shutdown systems, controls and pumps. Inspection and testing frequencies follow RAGAGEP (API, ASME, NBIC codes). |
| Inspection and testing execution | Inspections and tests are performed at documented intervals by qualified personnel. Results are documented and deficiencies are corrected before further use or in a safe and timely manner. Equipment deficiency log is maintained and tracked to resolution. |
| Hot work permit program | Hot work permits are issued for all hot work operations on or near covered processes. Permits document that fire prevention and protection requirements (29 CFR 1910.252(a)) are implemented. Permits indicate authorized date(s) and identify the work object. Permits are retained until completion. |
Management of Change and Incident Investigation
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| MOC program | Written MOC procedures address changes to process chemicals, technology, equipment, procedures, and facilities affecting covered processes. Procedures cover: technical basis for change, impact on safety and health, modifications to operating procedures, necessary timeframe, and authorization requirements. |
| MOC implementation | MOC reviews are completed and documented before implementing changes (except replacements in kind). Affected employees are informed of and trained on changes before startup. Process safety information and operating procedures are updated. P&IDs reflect all changes. |
| Incident investigation | Incidents resulting in or that could reasonably have resulted in a catastrophic release are investigated within 48 hours. Investigation team includes at least one person knowledgeable in the process and other persons with appropriate expertise. Findings are documented. |
| Investigation follow-up | Investigation report addresses factors contributing to the incident and recommendations. Recommendations are resolved and documented. Reports are reviewed with affected personnel. Reports are retained for five years. |
Emergency Planning and RMP Requirements
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Emergency action plan | Written EAP per 29 CFR 1910.38 is established for the entire plant. Plan includes procedures for handling small releases of HHCs in addition to standard EAP elements. EAP is coordinated with local emergency response agencies. |
| RMP hazard assessment | Worst-case release scenario and alternative release scenario analyses are documented. Offsite consequence analysis uses EPA-approved methodology (RMP*Comp or equivalent). Five-year accident history is compiled and included in the RMP submission. |
| RMP submission and updates | RMP is submitted to EPA and is current. Plan is updated within five years of initial submission, within three years of a change triggering applicability, or when changes at the facility alter the information in the RMP. Amendments are filed through EPA’s CDX/RMP*eSubmit system. |
| RMP prevention program | Program 3 facilities implement prevention program elements equivalent to OSHA PSM (all 14 elements). Program 2 facilities implement a prevention program with hazard review, operating procedures, training, maintenance, compliance audits, and incident investigation at minimum. |
Compliance Audit Program
| Audit Item | Expected Finding / What to Evaluate |
|---|---|
| Audit frequency and coverage | Compliance audit has been conducted within the last three years. Audit covers all 14 elements of 29 CFR 1910.119 for each covered process. Audit scope, schedule, and team composition are documented in the audit plan. |
| Auditor qualifications | At least one audit team member is knowledgeable in the specific process being audited. Team members have appropriate expertise in PSM auditing methodology. Auditors are objective and do not audit their own work areas. |
| Findings and corrective actions | Audit report documents all findings with specific references to the PSM element and regulatory provision. Employer has promptly determined and documented an appropriate response to each finding. Deficiencies have been corrected on the documented timetable. |
| Audit record retention | The two most recent compliance audit reports are retained. Reports document audit team members, scope, methodology, findings, and corrective action responses. Supporting documentation (interview notes, document review records) is organized and retrievable. |
Corrective Actions
Common Issues and Responses
- Overdue PHA revalidation: Schedule immediate PHA revalidation with a qualified team. Prioritize processes that are furthest past the five-year deadline. Document the revalidation and resolve all new recommendations on a defined timetable.
- Incomplete mechanical integrity program: Develop written procedures covering all equipment categories. Establish inspection frequencies per RAGAGEP. Create equipment deficiency tracking and prioritize overdue inspections by risk.
- Missing MOC documentation: Implement a formal MOC workflow requiring documented review, approval, and training before changes are implemented. Conduct a retrospective review of recent changes to identify any undocumented modifications.
- Expired operating procedure certifications: Schedule immediate review and annual certification of all operating procedures. Assign procedure ownership and implement calendar tracking for annual certification dates.
- Overdue triennial compliance audit: Schedule and conduct the compliance audit immediately. Ensure at least one auditor is knowledgeable in the process. Document all findings and develop a corrective action plan with assigned responsibilities and deadlines.
- Outdated RMP submission: Review and update the RMP with current hazard assessments, accident history, and prevention program information. Submit updated RMP through EPA’s CDX/RMP*eSubmit within required timeframes.
Download the Free Checklist
Get our psm/rmp compliance program audit checklist in Word format. Customize it for your organization.
Download Checklist (.docx)Ecesis EHS Software
PSM Software
Centralized management of all 14 PSM elements with PHA tracking, MOC workflows, mechanical integrity scheduling, and triennial audit management.
Management of Change
Structured MOC workflows with multi-level approvals, impact assessments, automated P&ID and procedure update tracking, and training verification.
Inspection Software
Schedule and document mechanical integrity inspections with mobile forms, photo documentation, and automated deficiency tracking.
Incident Management
48-hour investigation workflow, root cause analysis, recommendation tracking, and five-year incident history reporting for PSM and RMP.
Training Management
Track initial and three-year refresher training for PSM-covered employees with automated reminders and competency verification.
Corrective Actions
Track PHA recommendations, audit findings, MOC action items, and incident investigation recommendations through completion with escalation workflows.
