Forty Sites, Forty Signatures: Who Can Certify Each OSHA 300A Under 1904.32, and What That Signature Actually Attests To

Every January, a stack of OSHA Form 300A summaries lands in front of someone to sign. In a single-location business, that someone is usually the owner or the plant manager, and the process is simple enough that nobody thinks about it. In a portfolio of dozens of locations, the process tends to evolve in one of two directions. Either each site manager signs their own summary with little visibility from above, or a regional or corporate executive signs a batch of them in one sitting, sometimes without seeing the logs behind them.

Both habits can hold up, and both can fail, and the difference is in what the signature is actually certifying. This post answers a specific question: under 29 CFR 1904.32, who is allowed to certify an establishment's annual summary, and what does that person attest to when they do? It is a different question from which establishments must submit their data electronically, which we covered in our piece on per-establishment electronic reporting. The certification applies to every establishment that keeps records, whether or not it submits anything.

The obligation is per establishment, so the signature is too

OSHA recordkeeping is built around the establishment, not the company. Under 29 CFR 1904.30, an employer with more than one establishment must keep a separate OSHA 300 Log for each establishment expected to be in operation for one year or longer. The annual summary follows the log. 1904.32(a) requires that at the end of each calendar year you review the log to verify entries are complete and accurate and correct deficiencies, create the annual summary, certify it, and post it.

That means a company with forty qualifying locations doesn't have one certification obligation. It has forty. Each summary carries the establishment name and address, the annual average number of employees covered by that log, and the total hours they worked, as 1904.32(b)(2) requires. Each needs its own certification, and each must be posted at its own establishment in a conspicuous place where notices are customarily posted, from no later than February 1 through April 30 of the following year, unaltered and uncovered.

For a head office function, the useful framing is that the 300A certification is forty small, separately signed statements of fact, each attached to a specific place. It isn't a corporate filing that happens to be reproduced forty times.

Who counts as a "company executive"

1904.32(b)(3) says a company executive must certify that they have examined the OSHA 300 Log and reasonably believe, based on their knowledge of the process by which the information was recorded, that the annual summary is correct and complete. 1904.32(b)(4) then lists who can be that executive. The list is short and specific:

An owner of the company, but only if the company is a sole proprietorship or partnership. An officer of the corporation. The highest ranking company official working at the establishment. Or the immediate supervisor of the highest ranking company official working at the establishment.

For multi-site operators, the practical consequence is that two very different people are both eligible. A corporate officer can certify any establishment's summary. So can the site's senior official, or that official's direct supervisor, who in many organizations is a regional or area manager.

What the list doesn't include matters just as much. A corporate safety coordinator who is not an officer, an HR generalist, a recordkeeping specialist, or an outside consultant who prepared the log cannot certify it on their own authority, however well they know the data. Neither can a regional director two levels above the site leader unless they are a corporate officer. Organizations that route the signature to whoever administers recordkeeping, rather than to someone on the regulatory list, can end up with summaries that look complete and aren't validly certified.

It's worth checking this against your actual org chart, not the one on file. Titles drift, sites get realigned between regions, and the person who was the site leader's immediate supervisor last year may not be this year.

What the signature attests to

The wording of 1904.32(b)(3) is more demanding than it first appears. The executive isn't certifying that the numbers were transcribed correctly from the log to the summary. They are certifying that they examined the log, and that they reasonably believe the summary is correct and complete based on their knowledge of the process by which the information was recorded.

That last phrase is the one that matters across a portfolio. A site leader certifying their own establishment usually has direct knowledge of the process. They know who records injuries, how cases reach that person, and whether the log is maintained through the year or reconstructed in December. A corporate officer certifying forty establishments in an afternoon is on firmer ground only if they have knowledge of the process at each of those forty sites. The regulation doesn't require them to have personally recorded anything, but it does tie the certification to an understanding of how the recording happens.

This is where the two common multi-site patterns diverge. Site-level signing puts the certification with the person closest to the process, but it leaves head office with no view of whether forty site leaders are applying the same standard when they review the log. Centralized signing gives head office one accountable signer, but it can hollow out the certification if the signer has no real basis for their belief about how each site records. Neither pattern is wrong as such. Each needs something to support it.

The year-end review is where consistency lives

1904.32(b)(1) requires the log to be reviewed as extensively as necessary to make sure entries are complete and correct. For a single site, "as extensively as necessary" is a judgment the site makes. Across a portfolio, it becomes the most useful control point of the year, because it is the one moment when every establishment's log is supposed to be examined against the same question at roughly the same time.

Organizations that treat the certification seriously tend to build that review into a common routine. Each site reconciles its log against the sources that should feed it: first-aid logs, workers' compensation claims, nurse or clinic visit records, restricted-duty assignments. Differences are explained or corrected before the summary is created. The certifying executive, whoever that is for each site, receives the summary together with a short note on how that reconciliation was done and what it changed. That note is what gives a corporate officer a reasonable basis for a belief about a site they've never visited, and it gives a site leader something to show if the process is ever questioned.

A portfolio view of the same exercise surfaces patterns no single site would notice. A location whose log is never corrected at year end, one whose hours worked don't track its headcount, or a region where cases are consistently classified differently from comparable sites are all worth a question before the signature goes on, not after. We looked at that classification drift in our piece on how site recording practices shape injury rates.

Setting the policy before January

Because the summary covers a calendar year and must be posted by February 1, decisions about who certifies which establishment are best made in the fall, not during the first week of January. A short written policy that names, for each establishment, the eligible certifier under 1904.32(b)(4) and an eligible alternate, states what review must happen before the summary reaches that person, and says where the signed original is retained, removes most of the ambiguity. Retention matters: 1904.33 requires the log, the annual summary, and the incident reports to be kept for five years following the end of the calendar year they cover, and the certified summary is part of that record.

Portfolio changes deserve specific attention. A site acquired mid-year, a site closed in the fourth quarter, or a location moved between business units can each leave the question of who is eligible to certify unsettled at exactly the wrong moment. We covered how the log itself behaves when ownership changes in our piece on successor employers and site divestitures.

Teams standardizing the forms themselves may find our OSHA 300 recordkeeping pack useful as a common starting point. It includes the 300, 300A, and 301 forms with a plain-English guide to what counts as recordable. None of this replaces reading 1904.32 alongside your own organization structure, and where a site's eligible certifier is genuinely unclear, it is worth resolving with counsel before the signature is needed.