A few months back, a Gulf Coast contractor called me because Avetta had downgraded their score, and they couldn’t bid on two pipeline jobs they’d already prequalified for. “We sent them our safety program,” the owner told me. “What else do they want?”
I asked him to email me what he sent. It was a 12-page generic safety manual: HazCom and PPE language pulled from a template, a few signature lines at the back, no revision history. What Avetta actually wanted was evidence of a safety management system: written hazard-specific programs, site-specific plans for active scopes of work, training records that tied back to those programs, leading indicator tracking, and management review notes showing the system was actually being used.
That confusion — between a safety management system, a safety program, and a safety plan — is one of the most common things I see in nearly three decades of safety consulting. The terms get used interchangeably in conversation, but they are not the same thing. The difference matters for OSHA compliance, for prequalification platforms like Avetta, ISNetworld, and Veriforce, for insurance underwriting, and most importantly, for whether your safety effort actually prevents injuries.
In 2024, the U.S. Bureau of Labor Statistics recorded 5,070 fatal work injuries and 2.5 million nonfatal injuries and illnesses in private industry. The companies with the lowest incident rates aren’t the ones with the thickest safety binders. They’re the ones with a real system underneath the binder.
A safety management system (SMS) is the overarching organizational framework that integrates policies, programs, and continuous improvement processes to manage all workplace safety and health risks. It is defined by ANSI/ASSP Z10.0-2019 and ISO 45001:2018.
A safety program is a written, hazard-specific document that addresses how a company controls a particular risk. For example, a Fall Protection Program, a Hazard Communication Program, or a Lockout/Tagout Program. Many are required in writing by OSHA.
A safety plan is the narrowest document: a project-, site-, or activity-specific application of the program, such as a Site-Specific Safety Plan or a Fall Protection Rescue Plan.
The hierarchy in one line: System → Program → Plan.
A safety management system is not a document. It is a set of integrated processes — policy, planning, implementation, evaluation, and corrective action — that an organization uses to manage all of its safety and health risks. The standards that define it formally are ANSI/ASSP Z10.0-2019 for U.S. companies and ISO 45001:2018 internationally. Both follow a Plan-Do-Check-Act cycle, and both are voluntary in the United States.
The Z10 standard has been around since 2005 and was last revised in 2019. ISO 45001 replaced OHSAS 18001 in 2018 and is now the dominant SMS standard for global supply chains. The two are largely compatible, and companies that implement one usually meet most of the other's requirements. A practical SMS implementation typically takes 12 to 24 months from senior management commitment to the first internal audit. For more on the build sequence, see our guide on how to implement a safety management system.
Short answer: No federal OSHA standard requires an SMS in general industry or construction. The exceptions matter, though:
For a deeper dive into the one place a SMS is federally required, read our breakdown of OSHA’s Process Safety Management standard.
A safety program is a written, hazard-specific document that defines how a company addresses a single risk area. OSHA refers to the broader concept as a “safety and health program” and lays out seven core elements in its Recommended Practices.
Element four — hazard prevention and control — is where the OSHA hierarchy of controls does the heavy lifting. Element six is what most companies skip: program evaluation and continuous improvement. A program that never gets reviewed against performance data is a binder, not a program.
Many specific written programs are legally required, regardless of whether your company has a broader SMS in place. The most commonly cited:
These are documents OSHA expects to see on paper, in the current revision, with employee training records attached. SafetyPro builds and maintains custom written safety programs tied to your specific scope of work, the platforms you’re qualified on, and the standards your clients require.
A safety plan is the most specific document of the three: a project-, site-, or activity-level application of one or more programs. The same Fall Protection Program produces a different Fall Protection Plan for every job site, depending on roof pitch, available anchor points, rescue access, and crew composition.
Common examples on a construction site:
In conducting customer SMS audits along the I-10 corridor, I keep finding “site-specific safety plans” that are obvious cut-and-paste jobs, with the wrong project name, client, or subcontractor list. A real plan reflects the actual scope of work in front of you. If yours could be used unchanged on any job, it isn’t a plan.
|
Element |
Safety Management System |
Safety Program |
Safety Plan |
|
Scope |
Whole organization |
One hazard or topic |
One project, site, or activity |
|
Time horizon |
Long-term, continuous |
Long-term, ongoing |
Short-term, scope-specific |
|
Required by federal OSHA? |
No (with PSM exception) |
Yes, for many specific hazards |
Sometimes (for example, FP rescue plan) |
|
Governing framework |
ANSI Z10 / ISO 45001 |
OSHA standards + 7 Core Elements |
Built from the program |
|
Typical owner |
Senior leadership |
Safety manager |
Project manager/site supervisor |
|
Updated when |
Annually + after major changes |
When regulations or the scope change |
Per project or activity |
The cleanest way to see how all three layers connect is to walk through one hazard end to end. Take fall protection.
The safety management system sets the policy: We will protect every worker from fall hazards above six feet at all times. It assigns responsibility for the program, defines training requirements, sets the audit cycle, and ties results into management review.
The Fall Protection Program is the written document that typically lives inside the SMS. It spells out OSHA-compliant procedures, equipment selection criteria, inspection frequency, training documentation, qualifications for Competent Persons, and rescue requirements. It is updated when the regulation changes or when the company’s scope of work changes.
The Fall Protection Plan for a typical Baton Rouge refinery turnaround includes the application of a specific job: anchor-point survey, rescue method, communication procedures, emergency contacts, and JSAs for each task. It exists for the duration of the project and is revised whenever the scope shifts.
You don’t pick one. You build all three in that order. For more on integrating these layers in construction specifically, see our piece on safety management system in construction.
A midstream contractor in the Baton Rouge–Lake Charles corridor came to us last year because their Avetta score was hurting their bids. On the surface, the documents looked fine: they had written programs for HazCom, LOTO, fall protection, and respiratory protection. They had training rosters. They had a safety manual.
What they didn’t have was an SMS that connected any of it. There was no documented management review cycle. No leading indicator tracking. No formal feedback loop from incident investigation back to program revision. Their site-specific plans were boilerplate copies of each other, with crew rosters that hadn’t been updated in months.
We built an SMS layer that integrated all three documents. The hazard-specific programs got refreshed and tied to current OSHA citations and platform requirements. The site-specific plans were rewritten to reflect the actual scopes of work, with a revision control process. Leading indicators — JSA quality, near-miss reporting rate, supervisor observation completion — were added, tracked monthly, and reviewed quarterly by the leadership team.
Within six months, the company passed their next safety audit without findings, restored its Avetta standing, and won two bids it previously couldn’t qualify for. Their recordable rate dropped 41% over the following year. None of that came from new safety equipment or a new program. It came from the system that made the existing programs and plans actually work. Our monthly safety management services help Gulf Coast contractors maintain that operating rhythm without adding internal headcount.
For most companies, the order is the same. Three questions:
If you’re not sure where you sit on that ladder, an outside safety consultant can usually map the gaps in a half-day site visit. SafetyPro provides custom safety management services that meet you wherever you are in the build sequence.
What is the difference between a safety management system and a safety program?
A safety management system is the organization-wide framework that integrates all safety activities. A safety program is a written, hazard-specific element within that system. The system governs strategy and continuous improvement; programs govern individual hazards, such as fall protection or HazCom.
Is a safety plan the same as a safety program?
No. A safety program is a hazard-specific document that applies across your operation. A safety plan applies a program to a specific job, site, or activity. Your Fall Protection Program is a single document; your Fall Protection Plan varies from project to project.
Is a safety management system required by OSHA?
No federal OSHA regulation requires a general-industry SMS. The exceptions are OSHA’s Process Safety Management standard (29 CFR 1910.119) for highly hazardous chemicals, and Cal/OSHA’s Injury and Illness Prevention Program. Many prequalification platforms and federal contracts effectively require one.
What are the seven elements of an OSHA safety and health program?
OSHA’s seven core elements are: management leadership; worker participation; hazard identification and assessment; hazard prevention and control; education and training; program evaluation and improvement; and communication and coordination for host employers, contractors, and staffing agencies.
What’s the difference between ANSI Z10 and ISO 45001?
ANSI/ASSP Z10.0-2019 is the U.S. national consensus standard for occupational health and safety management systems. ISO 45001:2018 is the international equivalent of OHSAS 18001 and has replaced it. Both follow Plan-Do-Check-Act and are largely compatible. ISO 45001 is more common for global supply chains.
Do I need a written safety program if I have an SMS?
Yes. An SMS is the framework; written programs are required components inside it. OSHA mandates written programs for many hazards — HazCom, LOTO, respiratory protection, bloodborne pathogens, and others — regardless of whether you have an SMS.
Lance Roux, CSP, is the founder and principal consultant at SafetyPro Resources, LLC. He has nearly three decades of experience across construction, oil and gas, manufacturing, and chemical processing, with a specialty in building integrated safety management systems for Gulf Coast contractors. Lance has helped hundreds of companies pass Avetta, ISNetworld, and Veriforce audits, and he serves as an expert witness in workplace incident litigation. He is the past president of the ASSP Louisiana Chapter, a former Area Director for the society, and an active member of the Associated General Contractors' committees. SafetyPro Resources is based in Baton Rouge and serves Louisiana, Texas, Mississippi, and the broader Gulf Coast.
Need help building an SMS, refreshing your written programs, or making your site-specific plans audit-ready? Talk to a SafetyPro consultant.