GUIDES – Oil and Gas Compliance
Oil and Gas EHS Policies (US):
A Complete Guide for Safety Managers
A Complete Guide for Safety Managers
A compliant Environmental, Health, and Safety (EHS) policy programme is the foundation of every oil and gas safety management system. This guide covers what US federal regulations require, what every oil and gas EHS policy must contain, how to build and maintain a policy programme that survives an OSHA inspection, and the most common gaps that trigger citations and incidents.
29 CFR
1910.119 – PSM Standard
OSHA’s Process Safety Management standard is the primary federal regulation governing EHS policy requirements for oil and gas facilities handling highly hazardous chemicals above threshold quantities.
OSHA 29 CFR 1910.119
14
Elements Required by PSM
OSHA PSM requires 14 specific programme elements including process safety information, process hazard analysis, operating procedures, training, contractor management, and emergency response.
OSHA PSM Elements Overview
$156K
Max OSHA Penalty Per Citation
Willful or repeat OSHA violations at oil and gas facilities carry a maximum penalty of $156,259 per citation as of 2024. EHS policy failures are among the most common bases for willful classifications.
OSHA Penalty Schedule 2024
Overview: Why EHS Policies Are the Foundation of Oil and Gas Safety
An EHS policy is not a document you write to satisfy an auditor. It is the written declaration of how your organisation identifies hazards, manages risk, assigns responsibility, and responds when things go wrong. In oil and gas operations, where process hazards can produce catastrophic consequences, a weak or missing EHS policy is not just a compliance problem: it is an operational risk that OSHA, EPA, and your own incident investigation process will identify as a root cause.
US federal regulations impose specific policy and programme requirements on oil and gas operators. OSHA’s Process Safety Management standard (29 CFR 1910.119) mandates 14 programme elements for facilities handling highly hazardous chemicals above threshold quantities. EPA’s Risk Management Programme rule (40 CFR Part 68) imposes parallel requirements for accidental release prevention. BSEE offshore safety regulations (30 CFR Parts 250 and 254) govern offshore oil and gas operations. In addition to federal requirements, most major oil and gas operators layer on corporate EHS management system standards aligned with ISO 45001 or OSHA’s Voluntary Protection Programme.
This guide covers what a complete US oil and gas EHS policy programme must contain, how each element is structured, what OSHA inspectors look for during a PSM inspection, and how to audit your own policy programme for the gaps most commonly cited in oil and gas enforcement actions.
Who This Guide Is For
EHS managers at oil and gas production, refining, and midstream facilities
Safety managers building or rebuilding a PSM-covered site safety programme
Corporate EHS teams conducting policy audits across multi-site operations
Operations managers preparing for OSHA PSM inspections or RMP audits
New hires to EHS roles at oil and gas companies needing a policy foundation
Prerequisites: What You Need Before Building an EHS Policy Programme
Determine PSM Applicability
Identify whether your facility handles any of the 137 highly hazardous chemicals listed in OSHA’s Appendix A to 29 CFR 1910.119 at or above the listed threshold quantities. If it does, PSM applies in full and all 14 programme elements are mandatory. Many oil and gas facilities are PSM-covered due to flammable liquids above 10,000 pounds.
OSHA PSM Applicability
Confirm EPA RMP Coverage
EPA’s Risk Management Programme rule (40 CFR Part 68) applies to facilities with more than a threshold quantity of regulated substances. RMP has three programme tiers based on hazard level and accident history. Most oil and gas facilities subject to PSM are also subject to RMP Program 3, which has the most comprehensive requirements.
EPA RMP 40 CFR Part 68
Identify All Applicable OSHA Standards
Beyond PSM, oil and gas EHS policies must address applicable standards including 1910.147 (LOTO), 1910.119 (PSM), 1910.120 (HAZWOPER for emergency response), 1926 Subpart CC (cranes), and any applicable industry-specific standards. Offshore operations add BSEE 30 CFR Parts 250 and 254.
OSHA Standards for Oil and Gas
Inventory Existing Policies and Gaps
Before writing new policies, inventory what currently exists. Map each existing policy to its regulatory requirement and identify gaps: required elements with no written policy, policies that exist but have not been reviewed in more than 12 months, and policies that do not reflect current site conditions or procedures.
OSHA PSM Inspection Reference
Assign EHS Policy Ownership
Each policy and programme element must have a named owner with the authority and resources to implement and maintain it. EHS policies without a named owner and review cycle are consistently cited during inspections as evidence of inadequate management system implementation. Ownership is separate from approval: the site safety manager may own a policy; the site manager or VP of EHS typically approves it.
OSHA PSM Section (c)
Step-by-Step: Building a Complete Oil and Gas EHS Policy Programme
1
Write a Clear EHS Policy Statement
The EHS policy statement is the executive declaration that defines the organisation’s commitment to safety and environmental performance. It must be signed by the most senior leader at the facility or company level, communicated to all workers and contractors, posted visibly at the worksite, and reviewed annually. The statement should specify the commitment to PSM programme compliance, regulatory compliance, incident prevention, and continuous improvement. A policy statement that does not reflect the actual management commitment it describes is worse than no statement: it creates documented evidence of a gap between stated commitment and actual practice during an inspection.
OSHA PSM Section (c)(1): Employee Participation
2
Develop Process Safety Information (PSI)
PSI is the technical foundation of all PSM-covered EHS policy work. It must document the hazards of each highly hazardous chemical on site (using SDS and additional hazard data), the technology of each covered process (block flow diagrams, process descriptions, design basis), and the equipment of each covered process (materials of construction, P&IDs, design codes, relief system design, safety system descriptions). PSI must be complete and current before any process hazard analysis is conducted. Under 29 CFR 1910.119(d), PSI must be compiled and made available to workers involved in operating the process.
OSHA 29 CFR 1910.119(d): Process Safety Information
3
Conduct and Document the Process Hazard Analysis (PHA)
The PHA is the structured review of each covered process to identify, evaluate, and control hazards. OSHA requires the use of one or more of six specified methods: What-if, Checklist, What-if/Checklist, HAZOP, FMEA, or Fault tree analysis. The PHA team must include at least one person with expertise in engineering and process operations and at least one person who currently works in the process being analysed. PHA findings must be documented, resolved with a written response, and all recommendations acted upon within a defined timeframe. PHAs must be revalidated every five years.
OSHA 29 CFR 1910.119(e): Process Hazard Analysis
4
Write and Maintain Operating Procedures
Operating procedures must address the steps for each operating phase (initial startup, normal operations, temporary operations, emergency shutdown, emergency operations, normal shutdown, and startup following a turnaround or emergency shutdown), the operating limits and consequences of deviation, safety and health considerations for each phase, and safety systems and their functions. Procedures must be accurate, current, and accessible to operators. Under 29 CFR 1910.119(f)(2), procedures must be reviewed as often as necessary and certified annually that they reflect current operating practice.
OSHA 29 CFR 1910.119(f): Operating Procedures
5
Build the Training Programme
Each employee involved in operating a PSM-covered process must be trained in the overview of the process, operating procedures, and the safety and health hazards of the process. Training must be documented and the employer must certify in writing that each employee has understood the training. Refresher training must be provided at least every three years and more frequently when conditions change. Training records must be retained for the duration of employment. The most common PSM training citation is the absence of written certification that the worker understood the training — not just attendance records.
OSHA 29 CFR 1910.119(g): Training
6
Implement a Contractor Management Policy
Oil and gas operations rely heavily on contractors for maintenance, construction, and specialised services. PSM requires the employer to inform contractors of known potential fire, explosion, or toxic release hazards related to the contractor’s work and the emergency action plan. Contractors must document that their employees have been trained in the work practices necessary to perform their jobs safely and have been informed of applicable PSM hazards. The host employer must evaluate contractor safety programmes and performance before awarding contracts and periodically while the contractor is on site.
OSHA 29 CFR 1910.119(h): Contractors
7
Establish a Management of Change (MOC) Process
MOC is one of the highest-value PSM elements for preventing incidents and one of the most frequently cited in deficiency. A change to process chemicals, technology, equipment, procedures, or facilities (other than replacement in kind) must be reviewed through the MOC process before the change is implemented. The MOC review must address the technical basis for the change, safety and health impacts, modifications to operating procedures, necessary time period for the change, and authorisation required. Workers affected by the change must be informed and trained before startup.
OSHA 29 CFR 1910.119(l): Management of Change
8
Build the Mechanical Integrity Programme
Mechanical integrity covers the design, fabrication, installation, inspection, and maintenance of process equipment. PSM requires written procedures for maintaining the ongoing integrity of process equipment, training for maintenance employees, equipment inspection and testing at established frequencies, correction of deficiencies before further use, and quality assurance procedures for new equipment and spare parts. The mechanical integrity programme must be documented and the inspection records must be retained. Under OSHA guidance, ‘grandfathered’ equipment that does not meet current design codes must be managed under a risk-based approach.
OSHA 29 CFR 1910.119(j): Mechanical Integrity
9
Develop an Emergency Response Plan
PSM-covered facilities must establish and implement an emergency action plan that covers emergency escape procedures, reporting procedures for fires, releases, and other emergencies, rescue and medical duties, preferred means of reporting emergencies, and names or job titles of persons to be contacted for information. The plan must be coordinated with the local emergency response community (fire department, LEPC) under OSHA 1910.38 and EPA RMP requirements. Training on the plan must be conducted at least annually and following any significant change.
OSHA 29 CFR 1910.119(n): Emergency Planning and Response
10
Implement Incident Investigation and Audit Procedures
Every incident and near-miss that resulted in or could reasonably have resulted in a catastrophic release of a highly hazardous chemical must be investigated within 48 hours of the incident. The investigation team must include at least one person with knowledge of the process involved and may include contractors. Recommendations from investigations must be resolved and implemented. PSM also requires a compliance audit every three years conducted by at least one person with knowledge of the process. Audit findings must be documented and resolved, with the two most recent audit reports retained.
OSHA 29 CFR 1910.119(m) and (o): Incident Investigation and Compliance Audits
Compliance Checklist: Oil and Gas EHS Policy Programme Audit
Source: OSHA 29 CFR 1910.119 | OSHA PSM Inspection Directive CPL 03-00-021
Troubleshooting: Common EHS Policy Failures and How to Fix Them
PHA Findings Not Closed
Problem: Process hazard analysis was completed on time, but the documented findings and recommendations have not been acted upon within the required timeframe, and no written response has been provided.
Fix: Assign every PHA finding to a named owner with a due date. Track open findings in a register visible to the safety manager and site manager. Any finding that cannot be resolved within the timeframe must have a documented interim risk control and an escalated completion date with written management approval.
OSHA 1910.119(e)(5)
MOC Bypassed for Temporary Changes
Problem: Operations staff treat ‘temporary’ changes as outside the MOC process. A valve is replaced with a different pressure rating, or a chemical substitution is made ‘just for this batch,’ without MOC review or worker notification.
Fix: Define ‘temporary change’ explicitly in the MOC policy with a maximum duration (typically 3-6 months) and require the same MOC review for temporary changes as for permanent ones. Any change that persists beyond the approved temporary window automatically triggers a permanent MOC. Remove ‘temporary’ as a category that bypasses the review.
OSHA 1910.119(l)
Operating Procedures Not Reflecting Current Practice
Problem: Written procedures exist but do not match what workers actually do in the field. Operators have developed workarounds for equipment that changed without an MOC, or the procedure was written for the original process design and not updated through subsequent modifications.
Fix: Conduct a procedure accuracy audit by having operators walk through the procedure step by step while actually performing the task. Any step that cannot be followed as written is a discrepancy that requires either procedure revision or a formal deviation with MOC. Implement the annual certification requirement under 1910.119(f)(2) as an active verification, not a signature on a cover page.
OSHA 1910.119(f)
Training Records Show Attendance but Not Understanding
Problem: Training completion records show that workers attended a session but do not include any assessment of whether the worker understood the content. During an OSHA inspection, attendance records alone do not satisfy the 1910.119(g)(2) requirement to certify understanding.
Fix: Implement a scored assessment component for all PSM training modules. The completion record must include the assessment score, a pass/fail determination, and the employee’s signature confirming understanding. Configure your LMS to generate these records automatically. Workers who do not pass the assessment must not return to operating the process until they do.
OSHA 1910.119(g)(2)
Mechanical Integrity Inspection Intervals Undocumented
Problem: Maintenance conducts equipment inspections but has no written policy specifying the required frequencies, testing methods, or acceptance criteria for each equipment type. During an inspection, OSHA cannot verify that inspections are occurring at appropriate intervals.
Fix: For each category of PSM-covered equipment, document the inspection frequency, inspection method, acceptance criteria, and what happens when a deficiency is found. Frequency must be consistent with manufacturer recommendations, applicable engineering standards (ASME, API), and process conditions. Where equipment is in severe service, increase frequency beyond the baseline standard.
OSHA 1910.119(j)
Incident Investigation Not Starting Within 48 Hours
Problem: Serious incidents or near-misses are not investigated within 48 hours of the event because site resources are occupied with immediate response, or because near-misses are not recognised as requiring investigation under PSM.
Fix: Create a standing incident investigation team with named primary and backup members. The 48-hour requirement is for investigation initiation, not completion: the first team meeting, evidence preservation actions, and preliminary timeline must occur within 48 hours. Extend the definition of what requires investigation to include all near-misses that could reasonably have resulted in a catastrophic release.
OSHA 1910.119(m)
Key Takeaways
PSM applicability determines your mandatory policy obligations
If your facility handles a covered chemical at or above its threshold quantity, all 14 PSM elements are mandatory — not optional best practice. Start by confirming PSM applicability before building the programme. RMP follows parallel logic under EPA jurisdiction.
Written understanding certification is not the same as attendance records
29 CFR 1910.119(g)(2) requires the employer to certify in writing that each employee has understood the training — not just attended it. Assessment-based completion records with scores are the only form of documentation that satisfies this requirement. Attendance sheets alone will fail an OSHA inspection.
MOC is the element most frequently bypassed in practice
Management of change failures are cited in the majority of PSM-related incidents investigated by CSB and OSHA. The failure mode is almost always the same: a change was classified as temporary, as replacement in kind, or as too minor to require review. Define these exclusions narrowly and audit actual field practice against them regularly.
PHA revalidation and open finding closure are active obligations
The PHA is not complete when the study is finished. It is complete when every finding has a documented response and every recommendation has been implemented or formally deferred with a compensatory control. The five-year revalidation clock restarts from the date of PHA completion, not from the date the original PHA was conducted.
Annual operating procedure certification must be an active verification
Under 1910.119(f)(2), operating procedures must be certified annually as reflecting current operating practice. This certification is meaningless if it is a management signature on a cover page. It must be an active verification that the written procedure matches what workers actually do — conducted by walking the procedure in the field, not by reviewing the document at a desk.
Frequently Asked Questions
Does OSHA PSM apply to all oil and gas facilities?
No. PSM applies to facilities that use, store, manufacture, handle, or move any of the 137 highly hazardous chemicals listed in 29 CFR 1910.119 Appendix A at or above the listed threshold quantities. For flammable liquids, the threshold is 10,000 pounds. Oil and gas production facilities, gas processing plants, and refineries frequently meet this threshold, but not all oil and gas operations are PSM-covered. OSHA PSM Covered Chemicals
What is the difference between PSM and RMP?
OSHA PSM (29 CFR 1910.119) and EPA RMP (40 CFR Part 68) are parallel regulations that overlap significantly for oil and gas facilities. PSM is a worker safety regulation; RMP is an environmental and community protection regulation. Most oil and gas facilities subject to PSM are also subject to RMP Program 3. The two programmes share many elements but have different thresholds, different covered substances lists, and different compliance demonstration requirements. Facilities must comply with both independently. EPA RMP Overview
How often does a PSM Process Hazard Analysis need to be updated?
Under 29 CFR 1910.119(e)(6), the PHA must be updated and revalidated by a team at least every five years after the initial PHA. The revalidation must be based on the previous PHA findings, a review of any process changes since the last PHA, and an updated hazard evaluation. The revalidation team must include at least one employee who works in the process. All findings from the revalidation must be documented and resolved. OSHA 1910.119(e)(6)
What does ‘replacement in kind’ mean for MOC purposes?
Replacement in kind (RIK) means replacing equipment or a component with one that meets the same specifications as the original. A pump replaced with a pump of the same model, specifications, materials, and ratings is replacement in kind and does not require MOC review. A pump replaced with a different model, a different material of construction, or a different rated pressure is not RIK and requires MOC review before installation. If there is any uncertainty about whether a change qualifies as RIK, it should go through the MOC process. The cost of an unnecessary MOC review is always less than the cost of a citation or incident from a bypassed MOC.
What must a hot work permit include under PSM?
Under 29 CFR 1910.119(k), the employer must implement a safe work practice for controlling ignition sources in areas where the release of flammable or combustible materials could occur. Hot work permits must identify the area where hot work is to be performed, the date and time authorised for the hot work, the object on which hot work is to be performed, and must be signed by the authorised person. PSM does not prescribe every permit element but references OSHA’s hot work standards and the facility’s own permit system. The permit system must be site-specific and consistently enforced. OSHA 1910.119(k)
How long must PSM training records be retained?
OSHA does not specify a minimum retention period for PSM training records beyond the requirement that records be maintained. Best practice and most state regulations require retention for the duration of employment plus a defined period (typically 3-5 years) after termination, to cover any delayed incident investigation or litigation. The training certification under 1910.119(g)(2) must certify the employee’s understanding, not just their attendance, and must be retained for the same period as the training records themselves.
What triggers a PSM compliance audit?
Under 29 CFR 1910.119(o), the employer must certify that they have evaluated compliance with the provisions of PSM at least every three years. The audit must be conducted by at least one person knowledgeable in the process. The audit must cover all 14 PSM elements. The two most recent compliance audit reports must be retained. Audit findings must be documented and promptly resolved. An OSHA PSM inspection will request the two most recent compliance audits as one of its first document requests. OSHA 1910.119(o)
Sources
Government and Regulatory Sources
- OSHA. 29 CFR 1910.119: Process Safety Management of Highly Hazardous Chemicals: all 14 PSM elements including employee participation, PSI, PHA, operating procedures, training, contractors, PSSR, mechanical integrity, hot work, MOC, incident investigation, emergency planning, compliance audit, and trade secrets.
- OSHA. PSM Inspection Directive CPL 03-00-021: OSHA enforcement guidance for PSM inspections; most common citation patterns and inspection document request list.
- OSHA. Penalty Schedule 2024: $156,259 maximum for willful/repeat violations; $15,625 per serious violation.
- EPA. 40 CFR Part 68: Risk Management Programme: parallel RMP requirements; Programme 3 obligations for most oil and gas PSM-covered facilities.
- OSHA. PSM Covered Chemicals and Threshold Quantities: 137 listed chemicals; 10,000-pound flammable liquid threshold; applicability determination guidance.
Research and Industry Sources
- CCPS. Guidelines for Risk-Based Process Safety: process safety management system framework; MOC, PHA, and mechanical integrity best practice guidance.
- Energy Institute. Process Safety Competency Framework: role-based competency standards for PSM programme roles including EHS managers, process engineers, and operators.
- API. Recommended Practice 754: Process Safety Performance Indicators: industry standard for measuring PSM programme effectiveness through leading and lagging indicator tracking.
Related VelSafe Articles
Law
Oil and Gas Crane Operations Law: OSHA Requirements
Full legal analysis of 29 CFR 1910.179 and 1926 Subpart CC crane compliance requirements, operator certification, penalties, and employer obligations.
Worker Safety
Oil and Gas Control of Work: What Every Worker Needs to Know
Permit-to-work, isolation, stop-work authority, and what workers must do when control of work systems break down in oil and gas operations.
Tips
8 Continual Risk Assessment Tips for Oil and Gas
Practical CRA tips covering trigger-based reassessment, stop-work authority, SIMOPS reviews, and permit-to-work integration for oil and gas safety teams.
Oil and Gas Compliance
More Oil and Gas EHS Guides and Compliance Resources
VelSafe covers PSM compliance, process safety, permit-to-work, and EHS policy guidance for oil and gas safety managers and compliance teams. Browse all oil and gas content.
Browse All Oil and Gas Articles
