Every Site Buys Its Own PPE. That's Not a Procurement Problem, It's a Hazard Assessment Problem.

Ask a corporate EHS director how PPE gets decided at each site and the honest answer is usually some version of "we have a standard." A template exists, it lists the required gear by role, and it went out to every site manager at some point after it was written. What almost never exists alongside it is evidence that the standard was actually re-evaluated at each location it applies to, by someone who walked that specific floor, on a date that shows the evaluation happened there and not just at headquarters.

That gap is not a paperwork nuisance. It is the difference between meeting 29 CFR 1910.132(d) and merely intending to.

The standard is written per workplace, not per company

1910.132(d)(1) requires the employer to assess the workplace to determine whether hazards are present that necessitate PPE, and if so, to select PPE that protects against the hazards identified in that assessment, communicate the selection to affected employees, and ensure it fits. The word doing the work in that sentence is "workplace," not "company." OSHA does not treat a hazard assessment performed at one facility as automatically valid at another, even when the facilities run similar equipment and similar processes. Two plants running the same stamping press line can still have different guarding, different housekeeping, different ambient noise, and different traffic patterns, and each of those differences can change what PPE the assessment should call for.

1910.132(d)(2) makes the documentation requirement explicit: the employer must verify the assessment was performed through a written certification that identifies the workplace evaluated, the person who certified it, the date or dates of the assessment, and language identifying the document as a hazard assessment certification. A corporate template, however well written, does not contain any of those four elements for a given site unless someone at that site has actually filled them in. An inspector asking for the certification at Plant 7 is asking for a document with Plant 7's name and a real date on it — not the master template that was emailed out two years ago.

Where the standardization instinct works against the standard

Corporate standardization exists for good reasons. A single specification sheet keeps purchasing simpler, keeps the safety message consistent across locations, and avoids the situation where one site's safety director quietly decides steel-toe boots are optional. None of that is wrong. The problem is what standardization tends to replace rather than support: at a lot of multi-site operators, the corporate template becomes the hazard assessment, instead of becoming the starting point for one performed locally.

The practical failure mode looks like this. Corporate issues a PPE matrix by job title. Each site receives it, and each site manager treats "received the matrix" as equivalent to "assessed the workplace," because from where they sit, corporate already did the hard part. No one at the site walks the floor with the matrix in hand and checks whether it actually matches what that location's process looks like today. Six months later, a site adds a new piece of equipment, or reroutes a process that used to be enclosed and now runs in the open, and the matrix does not change, because nobody at that site believes updating it is their job.

Purchasing drift compounds the problem in the other direction. Even where the assessment itself is sound, a site facing a supply shortage or a budget line item substitutes a different glove, a lighter-duty face shield, or a different respirator cartridge without anyone re-checking whether the substitution still meets what the hazard assessment specified. Multiply that across dozens of sites making their own purchasing calls under their own local pressure, and the gap between what the corporate standard says and what employees are actually wearing on the floor can grow quietly for years without triggering an obvious signal at headquarters.

What an inspection actually surfaces

When OSHA inspects a facility and PPE compliance is in question, the request is rarely for the corporate policy. It is for the site-specific written certification under 1910.132(d)(2), and for evidence that the PPE actually in use traces back to that certification's findings. A multi-site employer that can produce a current, dated, site-specific certification for the location in question, along with records showing the PPE issued matches what the certification specifies, is in a materially different position than one that can only produce the corporate matrix and a purchase order history that may or may not line up with it.

This is also where enforcement patterns tend to travel across a portfolio rather than stay contained at one site. A citation at one facility for an inadequate or missing hazard assessment puts every other facility running the same corporate template on notice, in a way that is hard to argue away in a follow-up inspection elsewhere. "We use the same PPE standard company-wide" cuts both ways: it is efficient right up until one site's gap becomes evidence that the same gap plausibly exists everywhere the same unmodified template was distributed.

Making the corporate standard the floor, not the whole assessment

The fix is not to abandon standardization. It is to be precise about what the corporate document is for. Treat the corporate PPE matrix as the baseline expectation and the reference point for procurement, and treat the site-specific hazard assessment as a distinct, required document that references the corporate baseline but is completed, dated, and certified locally. That means someone at each site — a plant safety lead, an operations manager, whoever is accountable for that location — actually walks the floor against the corporate matrix, confirms it still matches the hazards present, notes anything that has changed, and signs a certification for that facility on a real date.

The same logic applies to the retraining and re-verification cadence. A hazard assessment performed when a facility opened does not stay valid indefinitely. Equipment changes, process changes, and even changes in what a supplier can reliably deliver are all reasons to redo the walk-through and re-date the certification, and a portfolio-wide operator should have a standing cadence — annually at minimum, and after any material process change — for every site to refresh its own certification rather than assuming the original one still holds.

Our PPE hazard assessment checklist gives site safety leads a consistent, one-page format for that walk-through, so every location is documenting the same way even while each one is genuinely assessing its own floor rather than re-stamping someone else's.

Standardizing the format of the assessment is not the same thing as standardizing the assessment itself, and that distinction is exactly what 1910.132(d) is built to test.

Who actually owns the local certification

One reason this gap persists is that ownership of the site-specific certification often sits nowhere clearly enough to be accountable for. Corporate EHS owns the matrix. The plant manager owns output. The site's safety lead, where one exists, often reports up through operations rather than through corporate EHS, which means the annual reminder to refresh the certification competes with a dozen production priorities that have a manager's direct attention in a way a compliance document does not.

Naming the role explicitly — not "the site is responsible" but a specific title, with the certification refresh built into that role's calendar the same way a preventive maintenance schedule is built into a technician's — closes most of that gap on its own. It also gives corporate EHS something concrete to audit: not "does every site have a copy of the matrix," which nearly all of them will, but "does every site have a current, dated, site-specific certification on file," which is a much smaller and much more revealing number to track across a portfolio.

That number is also the one that matters if a citation at one facility prompts a records request across others. A portfolio where every site can produce its own current certification is a portfolio where one site's finding stays a single-site problem. A portfolio where most sites are holding the same undated corporate template is one where a single gap can read as a systemic one.