The OSHA Citation Defense Package: What Evidence Wins a Contest

An OSHA citation is not a verdict — it is an opening position. Whether it ends in the penalty as written, a reduced fine, a reclassification, or a full dismissal depends far less on how well you argue than on what you can prove. And proof, under the fifteen-working-day clock that starts the moment you sign for the citation, means evidence you already have — dated, organized, and complete. In informal conferences and contests, the employers who fare best are rarely the ones with the best story; they are the ones who can lay a clean, cross-referenced record on the table that answers the citation point by point. That record is the defense package. This guide breaks down what belongs in it, why each piece carries weight, and why the winning move is to assemble it long before a compliance officer ever knocks.

The clock and the math: You have 15 working days to file a Notice of Contest. OSHA's penalty then bends to the evidence: good faith up to −25%, size up to −70%, history −20% — reductions a documented program earns. On a shared site, the multi-employer policy (CPL 02-00-124) can cite four roles for one hazard; your records decide which one is you. You have 15 working days to contest an OSHA citation, and a written, implemented safety program can reduce the penalty by up to 25 percent for good faith — evidence you must assemble before the citation arrives, not after.

The fifteen-day window, and what happens in it

The moment a citation and notice of penalty arrive, a fifteen-working-day clock starts. Do nothing and the citation becomes a final order — unappealable (29 CFR 1903.17(a) sets the 15 working days). Inside that window you have two moves, and they are not mutually exclusive.

First, you can request an informal conference with the OSHA Area Director (29 CFR 1903.20). It is a working step: a working meeting where you present your side, show your evidence, and very often negotiate a settlement that reduces penalties, reclassifies violations, or adjusts abatement dates. Second, you can file a written Notice of Contest, postmarked within 15 working days of receipt (29 CFR 1903.17(a)), which moves the case to the independent Occupational Safety and Health Review Commission for formal adjudication. Critically, requesting the informal conference does not pause the fifteen-day deadline to contest — so the calendar, and the evidence, have to be ready fast.

In both settings the currency is the same: documentation you can produce on the spot. Which is why the defense package cannot be built after the citation. It has to already exist.

What a defense package contains

A citation defense is not one document but a curated set, each piece answering a predictable question an inspector or judge will ask. The strongest packages cover all of it.

Notice the through-line: every item is contemporaneous. A training log dated three weeks before the inspection is evidence; a training log created the week after the citation is a liability. This is why the defense package is really a byproduct of running a documented program day to day — the record is generated as the work happens, not manufactured in response to a fine.

The element your inspection logs actually attack

It helps to know what OSHA has to prove, because the evidence in the table maps to it directly. To sustain a serious citation the agency must establish four things: (1) the cited standard applied to your operation; (2) its terms were violated; (3) one or more employees were exposed to, or had access to, the violative condition; and (4) the employer knew, or with the exercise of reasonable diligence could have known, of that condition. The knowledge element comes from the statute itself: section 17(k) of the OSH Act, 29 U.S.C. 666(k), defines a serious violation as one the employer knew of or, with the exercise of reasonable diligence, could have known of. The first three are usually straightforward for the compliance officer to document. The fourth — the knowledge element — is where a defense package does its heaviest work.

Dated self-inspection and job-hazard-analysis logs are the cleanest possible evidence of reasonable diligence: they show you were actively looking for the hazard, not ignoring it. And the knowledge element cuts both ways. If the cited condition was transient — created and gone within a shift, in a spot your documented inspection routine would not reasonably have caught — then OSHA has to prove you should have known, and a record of a functioning inspection program is exactly what makes that hard. This is also the mechanism behind the unpreventable employee-misconduct defense: a rule the worker violated in a way you could not reasonably have detected defeats the same element. The inspection log isn't just good-faith paperwork; it is aimed at the specific thing the Secretary must prove.

Records OSHA already requires you to keep

Part of a defense package is not optional paperwork at all. These are records the standards require, and they are the first things to put in the folder:

HazCom itself requires no training record, but a dated roster tied to 29 CFR 1910.1200(h) is how you answer the interviews an inspector runs. Everything else in the package, from inspection logs to photos, is evidence you choose to keep because it answers the knowledge element.

The penalty math a defense package moves

Documentation is not just about winning a contest outright; it directly moves the number. OSHA builds a penalty from a gravity-based amount and then applies reductions — and the largest, most controllable of those is good faith, which turns almost entirely on whether you have a written, implemented program to show.

The good-faith reduction is where the defense package pays for itself before a case even begins. An employer who can hand over a current, implemented program earns a cut that an employer with the same safety practices but no documentation simply cannot. The behavior can be identical; the evidence is what the reduction rewards.

The multi-employer question: who owns the hazard

On any shared jobsite — which is most construction and much of general industry — one hazard can produce citations against several employers. For chemicals, 29 CFR 1910.1200(e)(2) already puts the duty to share SDS access, precautions and labeling on each employer. OSHA's multi-employer policy, CPL 02-00-124, recognizes four roles: the employer who created the hazard, the one who controlled it, the one responsible for correcting it, and the one whose employees were exposed. You can be cited purely as an exposing employer even if another company built the hazard.

The defense here is factual, and it is perishable. If your crew was exposed to a hazard that a general contractor or another sub created and controlled, the evidence that establishes that — who was doing what, when, and what reasonable steps you took to protect your people — has to be captured at the time. Reconstructing it weeks later, from memory and scattered photos, is exactly the position you do not want to argue from. (For the underlying legal framework, see OSHA HazCom for contractors and the multi-employer worksite doctrine.)

Why scattered evidence loses

Here is the failure mode that costs employers real money: the evidence exists, but it cannot be assembled in time. Training sign-offs are in one binder, inspections in another, permits in a folder on a jobsite trailer, corrective actions in email, photos on three different phones, and the program document on someone's laptop. When the fifteen-day clock is running, "we did everything right" is worthless if it takes two weeks to prove it — and the informal conference is next Tuesday.

A defense package solves a logistics problem as much as a safety one. The goal is to keep the record in a form that is timestamped as it is created and exportable on demand, so that responding to a citation is a matter of assembling what already exists rather than reconstructing what you hope you can remember. That is the difference between walking into the Area Director's office with a bound, cross-referenced record and walking in with a story.

Build the evidence before the citation arrives

An OSHA citation starts a short, unforgiving clock, and the response that works is not eloquence but evidence. A defense package — the written program, the dated training and inspection logs, the corrective-action proof, the multi-employer facts — is what earns the good-faith reduction, supports a reclassification, and, often enough, gets a citation vacated. None of it can be created after the fact; contemporaneous is the whole point. The employers who treat their day-to-day records as a defense they are constantly building, rather than paperwork they will assemble if they ever need it, are the ones who walk into the informal conference holding the strongest hand in the room. For the process itself, see how to contest an OSHA citation; for the number at stake, how OSHA calculates the penalty.

Related: OSHA Inspections hub · How to Contest an OSHA Citation · How OSHA Calculates the Gravity-Based Penalty · Does OSHA Enforcement Actually Work? · OSHA Penalties by State · Multi-Employer Worksite · When safety software manufactures evidence against you

Sources & verification (verified October 5, 2026 against the eCFR, current as of September 25, 2026): Contest and informal-conference procedures per 29 CFR 1903.17 (15 working days to file a Notice of Contest) and OSHA's enforcement guidance; cases proceed to the independent Occupational Safety and Health Review Commission. Penalty-reduction factors applied to the gravity-based penalty per OSHA's Field Operations Manual (Chapter 6), reflecting the July 14, 2025 update: size up to 70% (employers with 1–25 employees; up to 80% for willful-serious violations under Table 6-4), good faith up to 25% (effective written safety-and-health program; 15% for incidental deficiencies; not applied to high-gravity-serious, willful, repeated, or failure-to-abate violations), and history 20% (clean five-year record or never inspected). Multi-employer citation policy per OSHA CPL 02-00-124 (effective December 10, 1999), which defines the creating, controlling, correcting, and exposing employer roles. This article is general information about assembling documentation, not legal advice; consult qualified counsel for a specific citation.