Your Safety Program Is Federal. A Third of Your Sites Are Not.
State plans must be at least as effective as federal OSHA, which means some are stricter. Multi-state operators running one federal program are under-compliant wherever a state has gone further.
A corporate safety program written to federal OSHA is a floor, not a ceiling. Roughly half the states operate their own OSHA-approved plans, and the approval standard is that the state plan must be at least as effective as the federal program.
At least as effective. Not identical. That phrase is doing all the work, and it is why a single federal program applied uniformly across a multi-state footprint is, by construction, under-compliant somewhere.
What "at least as effective" produces in practice
States that run their own plans may adopt federal standards verbatim, adopt them with modifications, or adopt standards on subjects where federal OSHA has none at all. All three happen.
The third category is the one that catches multi-state operators. When a state regulates something federal OSHA does not, a program written to federal requirements contains no corresponding provision — not a weaker one, no provision at all. There is nothing in the corporate document to flag as insufficient, because the subject simply is not there.
California is the most frequently cited example, having adopted requirements in areas where federal coverage is thinner. But it is not unique, and treating "we handle California separately" as the whole solution tends to leave gaps in the other state-plan jurisdictions that were quietly assumed to match federal.
Some state plans also cover state and local government employees where federal OSHA does not, which matters if any part of the organisation contracts with or operates as a public entity.
The four failure patterns
The uniform program. One corporate standard, applied everywhere, written to federal. Every site in a state-plan jurisdiction with additional requirements is short by exactly those requirements. This is the most common pattern and the hardest to see from headquarters, because the program is internally consistent and looks complete.
The California carve-out. Corporate recognises that California is different, builds a separate program for it, and implicitly treats the remaining state-plan states as federal. This is better than the uniform program and still leaves exposure across a number of jurisdictions.
The acquired site. A site acquired with the business came with a program written to its own state's requirements. It is folded into the corporate standard during integration, which quietly removes the state-specific provisions it used to have. Integration made the site less compliant, and nobody logged that as a change.
The moved process. A production line, a piece of equipment, or a work practice is transferred from one site to another for capacity reasons. The associated procedures travel with it. The destination site is in a different jurisdiction with different requirements, and the procedure that was correct at origin is now incomplete.
Reporting deadlines are a specific trap
Fatality and severe injury reporting timeframes are the kind of detail where a corporate playbook written to one set of requirements gets applied in a jurisdiction with different ones. Reporting obligations are time-critical, the window is short, and the decision is being made by people at a site during the worst hour of their year. They will do what the corporate playbook says.
If your incident response procedure states a single set of timeframes and contact details for every site, verify them against each jurisdiction you operate in. This is a small piece of work with an outsized consequence, and it is one of the few places where getting the corporate document wrong produces a violation within hours rather than at the next inspection.
Building for it without maintaining fifty programs
The workable structure is a federal baseline plus jurisdiction overlays, not parallel programs.
Write the corporate standard to federal requirements and treat it as the minimum every site meets. Then maintain, per state-plan jurisdiction, a documented overlay: what that jurisdiction requires beyond the baseline, which of your sites it applies to, and what those sites do differently as a result. The overlay is small. The baseline does the heavy lifting.
Critically, the overlay must be attached to sites, not held as a reference document. A site in a state-plan jurisdiction should receive the baseline and its overlay as one program, so the person running safety at that site is never expected to work out which additional rules apply to them. That determination belongs at the centre, where someone can be responsible for tracking regulatory change across the whole footprint.
The maintenance problem is the real problem
Writing the overlays once is a project with an end. Keeping them current is not. State plans amend their standards on their own schedules, and a change in one jurisdiction does not announce itself to the other forty-nine.
Whoever owns the corporate standard needs a defined way to learn that a jurisdiction has changed something, and a defined path from that change to the affected sites. Without it, the overlays are accurate on the day they are written and decay from then on — which is worse than not having them, because the organisation now believes the question has been handled.
Where to start
List your sites by jurisdiction. Count how many are in state-plan states. If that number is more than a handful and your corporate program has no jurisdiction-specific content, you have identified your largest single compliance gap, and it is one that a uniform, well-run, federally-correct program will never surface on its own.
General guidance only, not legal advice. State plan requirements change and vary by jurisdiction. Verify current requirements with the applicable state agency and a qualified safety professional before relying on any summary.
Not sure where you stand?
Take the 5-minute compliance assessment. Answer a few questions about your business and get a prioritized list of what OSHA expects, free.
Related Articles
Continue learning about OSHA compliance and workplace safety
Regulatory
Every Site Has an SDS Binder. Nobody at Corporate Has the Same One.
OSHA's Hazard Communication standard requires SDS access and consistent labeling at every facility. Multi-site operators often discover each plant built its own version.
Construction Safety
Excavation's Competent Person Is Designated at the Site. Corporate's Org Chart Assigns the Role by Title.
OSHA's excavation standard, 29 CFR 1926.651, requires a competent person who evaluates that specific site's soil daily. A title alone cannot substitute for it.
Fire Protection
Combustible Dust Isn't One Hazard. Across a Portfolio of Sites, It's a Different One at Each Address.
Combustible dust falls under OSHA's General Duty Clause and NFPA standards, not one rule — a portfolio policy must fit a different material at each site.