Does OSHA require an audit trail for electronic safety records?

29 CFR Part 1904 does not impose a general audit-trail requirement for electronic injury records. Under 1904.29(b)(5), the system must produce equivalent forms when the access rules require them. The employer must also meet the rules on accurate entries, updates, retention and access. FDA’s 21 CFR 11.10(e) has an audit-trail requirement for closed systems within its own scope.

Late January, at a concrete contractor's main office. The safety coordinator opens last year's 300 Log, a spreadsheet on the shared drive, to go through it before the company president certifies the summary. A ladder fall from August that she remembers as a job restriction now shows days away from work. The change may be right. Nothing in the file says who made it, or when. The same week, a sales demo for safety software puts “audit trail” and “OSHA” on one slide, and she types the question into a search bar.

What Part 1904 requires from an electronic record

Part 1904 does not impose a general requirement to record who created, changed or deleted every electronic entry. Its computer-record provision, 1904.29(b)(5), requires the system to produce equivalent forms when the access rules call for them. The forms must contain the required information and remain readable and understandable.

That permission comes with the rest of the recordkeeping duties. A recordable case goes on the 300 Log and the 301 within seven calendar days of receiving the information. The annual summary requires review and certification. Stored logs must be updated during their five-year retention period, and copies must be available on the deadlines in 1904.35 and 1904.40.

An audit trail can help explain a correction or recover its history. It does not replace those duties. A log showing who changed an incomplete 301 does not make that form complete, and a record of an export does not prove that the right person received it on time.

Other OSHA uses of audit concern reviews of safety programs. 1910.119(o) requires compliance audits for covered processes, including a report of findings. That requirement applies to construction through 1926.64. It is separate from a computer history of changes to records. The current 1926.64 refers to 1910.119; it has no paragraph (o) of its own.

State Plans may impose additional recordkeeping requirements within the limits of 1904.37. Check the state’s provisions before setting the system’s retention and access policy.

Which federal regulation requires an audit trail?

The FDA’s 21 CFR 11.10(e) expressly requires an audit trail for the closed systems within its scope. 21 CFR 11.10(e) belongs to Part 11, “Electronic Records; Electronic Signatures,” published at 62 FR 13464 on March 20, 1997. Paragraph (e) reads in full:

“Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.”

Paragraph (e) is one of the controls that 11.10 lists for “Persons who use closed systems to create, modify, maintain, or transmit electronic records.” The reach of Part 11 is set in 11.1(b): electronic records “created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations,” plus electronic records submitted to the agency under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act. And 11.3(b)(2) reads: “Agency means the Food and Drug Administration.”

The OSHA 300 Log is kept under Part 1904. FDA Part 11 applies within its own scope, described in 11.1 and 11.3. A rule for records required by FDA does not become an OSHA requirement because an employer uses the same software for both kinds of records. Assess each record against the regulations that govern it.

Side by side, the two rules ask different things of a record kept on a computer.

On corrections, Part 11 says record changes “shall not obscure previously recorded information.” Part 1904, read literally, lets you remove the original entry or line it out.

What does OSHA require when you keep injury records on a computer?

29 CFR 1904.29(b)(5) asks the question in its own words and answers it: “May I keep my records on a computer? Yes, if the computer can produce equivalent forms when they are needed, as described under §§ 1904.35 and 1904.40, you may keep your records using the computer system.” Paragraph (b)(4) defines the form the computer has to produce: “An equivalent form is one that has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces.” An equivalent annual summary “must also include the employee access and employer penalty statements found on the OSHA 300-A Summary form” (1904.32(b)(2)(iii)). OSHA's letter of April 29, 2025 adds that employers “may maintain equivalent forms, in any file format (e.g. Excel, CSV) provided that the requirements in paragraph 1904.29(b)(4) are met.”

“When they are needed” refers to the deadlines in 1904.35 and 1904.40. With the other clocks of Part 1904, they look like this.

The first copies given under 1904.35 are free: “you may not charge for these copies the first time they are provided” (1904.35(b)(2)(vi)). Read with these deadlines, 1904.29(b)(5) sets a single condition for a computer system: it can produce equivalent forms when 1904.35 and 1904.40 call for them. The paragraph says nothing about logins or audit trails.

Anyone with a right of access can still ask for paper. OSHA's 2018 letter says that “individuals with a right of access under the recordkeeping regulation have the option to request, and the employer must provide, copies of recordkeeping information in paper form.” The 2025 letter repeats it and adds the other side: “Of course, if the individual requesting access to the information agrees to receive it by e-mail or through some other electronic format, it is acceptable under OSHA's recordkeeping regulation.”

Construction adds a question of where the log is kept. Under 29 CFR 1904.46, for activities where employees don't work at a single physical location, “such as construction,” the establishment “is represented by main or branch offices, terminals, stations, etc. that either supervise such activities or are the base from which personnel carry out these activities.” You keep a separate 300 Log for each establishment “that is expected to be in operation for one year or longer” (29 CFR 1904.30(a)), and you “may keep one OSHA 300 Log that covers all of your short-term establishments” (1904.30(b)(1)). The records can sit at headquarters or another central location if you can move the case information there within seven calendar days and “Produce and send the records from the central location to the establishment within the time frames required by §§ 1904.35 and 1904.40” (1904.30(b)(2)). For records kept in another time zone, 29 CFR 1904.40(b)(2) says “you may use the business hours of the establishment at which the records are located when calculating the deadline.”

These deadlines don't stop when a software contract ends. The five years of 1904.33(a) and the four business hours of 1904.40(a) are the employer's to meet, which is the subject of what happens to your OSHA records when you cancel safety software.

Establishments covered by 1904.41 submit electronically through OSHA’s Injury Tracking Application by March 2. Paragraph (a)(1) covers 300A information for establishments with 20 to 249 employees in Appendix A industries and establishments with 250 or more employees required to keep records. Paragraph (a)(2) also requires 300 and 301 data from establishments with 100 or more employees in Appendix B industries. Sending a PDF by email does not fulfill the ITA submission requirement.

How do you correct an old entry on the OSHA 300 Log?

29 CFR 1904.33(b)(1) covers it. During the five-year storage period, “you must update your stored OSHA 300 Logs to include newly discovered recordable injuries or illnesses and to show any changes that have occurred in the classification of previously recorded injuries and illnesses. If the description or outcome of a case changes, you must remove or line out the original entry and enter the new information.” The annual summary and the 301 forms work differently. You're “not required to update” them, “but you may do so if you wish” (1904.33(b)(2) and (b)(3)).

Read literally, the rule allows removal. In a spreadsheet, removing the original entry means typing over it, and no paragraph of Part 1904 asks you to note who made the change or when. Initials and a date beside each correction can document the change. If a record is subject to a preservation order or litigation hold, follow those duties before overwriting or removing the earlier information.

For the coordinator in late January, the rule that matters this week is the year-end review. 29 CFR 1904.32(a)(1) tells her to “Review the OSHA 300 Log to verify that the entries are complete and accurate, and correct any deficiencies identified,” and 1904.32(b)(1) says “You must review the entries as extensively as necessary to make sure that they are complete and correct.” The text asks whether each entry is right. It doesn't ask who typed it. She can settle the August case from the case file, which shows whether the worker missed days or worked on restriction.

Then “A company executive must certify that he or she has examined the OSHA 300 Log and that he or she reasonably believes, based on his or her knowledge of the process by which the information was recorded, that the annual summary is correct and complete” (1904.32(b)(3)). The executive is an owner of a sole proprietorship or partnership, an officer of the corporation, the highest ranking company official working at the establishment, or that official's immediate supervisor (1904.32(b)(4)). The rule doesn't say how the executive comes to know the process.

The certified summary goes up “no later than February 1 of the year following the year covered by the records” and stays “in place until April 30” (1904.32(b)(6)). Under 1904.32(b)(5), the posted copy may not be “altered, defaced or covered by other material.” That clause protects the sheet on the wall. It says nothing about the file behind it.

What has OSHA said about recordkeeping software?

Three OSHA interpretation letters address records kept with software. None of them mentions an audit trail, and each carries the clause that interpretation letters “cannot create additional employer obligations.”

The 2018 letter answered a company “considering developing a software application that would make it easier for employers to comply with OSHA's recordkeeping regulation.” One of its questions was whether a company meets the access requirements by giving government representatives and other authorized persons “permanent login access to an online database application containing the records.” OSHA said that nothing in its recordkeeping regulation prevents online access, that paper copies remain available on request, and that “online access would still need to meet the specific access requirements in the regulation.” Government representatives “have complete access to the recordkeeping forms, including the confidential list of employee names involved in privacy concern cases,” while “individual employees only have complete access to their own 301 incident reports.” So “the system would need to be designed in a way so that certain individuals could only access the specific information they are entitled to view.” The letter applies the access rules of 1904.35 and 1904.40 to an online system. Those rules, and who falls under them, are covered in who can see your OSHA 300 Log and injury records.

The 2025 letter answered a software company that asked whether OSHA would “accept the documents generated by our software as a substitute for the OSHA Form 300 and Form 300A.” The answer came with a condition: “If the forms generated by your company's software meet the requirements for equivalent forms at 29 CFR 1904.29 and 1904.32, then these forms could be used by employers to satisfy OSHA recordkeeping requirements for maintaining OSHA Form 300 and Form 300A.” A substitute for the 300A “must also be certified and physically posted annually in the workplace as required by section 1904.32,” and a note adds that “covered employers would also need to maintain OSHA Forms 301 for all recordable workplace injuries and illnesses.” On the product itself, the letter says: “Therefore, we are unable to evaluate your product or provide an endorsement.”

Both letters give the reason in the same words: “It has been OSHA's longstanding policy and practice not to endorse any commercial products, so OSHA will not certify software purporting to help employers meet OSHA recording and reporting requirements.” A product page that claims an OSHA endorsement contradicts both letters.

The 2009 letter is about one signature. OSHA wrote that its recordkeeping regulation “does not prohibit the use of electronic signature to satisfy the Annual Summary certification requirement,” and that the certification can be signed and dated on the 300-A form itself or on a separate statement appended to it. Then the condition: “if an employer chooses to certify the Annual Summary for an establishment by electronic signature, such certification must be printed and posted in the workplace from February 1 through April 30 of the year following the year covered by the OSHA Form 300-A.” The page also says the letter “may not be applicable to any situation not delineated within the original correspondence.” Electronic signatures get their own article: are electronic signatures valid for OSHA records?

Do medical and exposure records follow a different rule?

Medical and exposure records follow 29 CFR 1910.1020. Paragraph (d)(2) permits the employer to choose how to preserve them, provided the information remains preserved and retrievable. Chest X-ray films must remain in their original state. Unless a specific standard provides a different period, paragraph (d)(1) requires medical records for at least employment plus thirty years and exposure records for at least thirty years, subject to its listed exceptions. These provisions do not prescribe a general computer edit history.

In construction, 29 CFR 1926.33 carries a note: “The requirements applicable to construction work under this section are identical to those set forth at § 1910.1020 of this chapter.” For the 30-year periods on a construction company's books, see 30-year record retention under OSHA 1910.1020. The OSHA 300 Log keeps its own period, five years under 1904.33(a).

How can you tell who changed a safety record?

On paper, a lined-out entry stays readable under the line. On a computer, it depends on the system and on how it's set up. Part 1904 and 1910.1020 do not impose a general edit-history requirement. Decide what history to keep alongside the retention, access and preservation duties applicable to the records.

HazComFast keeps that history for the actions that carry weight. Certifying the OSHA 300A, exporting a defense package, placing a legal hold, a guest opening a safety data sheet through a shared link: each leaves an entry, with a label in English or Spanish and a place in the action filter. The author of an entry is the signed-in user, and the database refuses a write that forges it.

Administrators and managers read the Audit Logs on a computer or a phone. Search, the role filter and sorting run across the whole log, including entries beyond the current page, and the filters stay in the page address, so a copied link reopens the same view. Open an entry to see the fields that changed. Export the filtered view, or only the rows you've checked, to CSV. A manager on the road can filter by site and dates from a phone and open any entry the same way.

Administrators also have a Deletion Audit Log on the Legal Retention page. It lists each blocked deletion with the document's name, who tried, the date and the reason, and exports the filtered month.

Related reading: Are electronic signatures valid for OSHA records? · What happens to your OSHA records when you cancel safety software · Who can see your OSHA 300 Log · 30-year record retention under 1910.1020