OSHA Multi-Employer Worksite Doctrine: Who Gets the Citation?

What the doctrine is

On a shared jobsite, the employer whose workers are standing next to a hazard is not the only one OSHA can cite. OSHA's written policy on this is OSHA Instruction CPL 02-00-124, the Multi-Employer Citation Policy, in effect since December 10, 1999. It replaced the multi-employer paragraph of the Field Inspection Reference Manual, and it applies on multi-employer worksites "in all industry sectors," not only construction.

The core sentence, verbatim from the directive:

"On multi-employer worksites (in all industry sectors), more than one employer may be citable for a hazardous condition that violates an OSHA standard. A two-step process must be followed in determining whether more than one employer is to be cited."

The directive says it creates no new duties. The duties come from each employer's statutory duty to comply with OSHA standards and its duty "to exercise reasonable diligence to determine whether violations of those standards exist." What the policy does is tell a compliance officer how to decide which of the employers on a site gets the citation.

At a glance: CPL 02-00-124 sorts employers into four roles: creating, exposing, correcting and controlling. OSHA first decides each employer's role, then whether its actions met that role's obligations. A general contractor with supervisory authority is usually the controlling employer, held to reasonable care, which the directive calls lighter than the care it owes its own crew. Under OSHA's Multi-Employer Citation Policy, CPL 02-00-124, more than one employer can be cited for the same hazard on a shared worksite: the creating, exposing, correcting and controlling employers, each judged on whether it met the obligations of its role. A general contractor is usually the controlling employer and is held to a duty of reasonable care to prevent and detect violations, not strict liability.

---

The two-step test

Step one asks what role the employer plays: creating, exposing, correcting or controlling. Step two asks whether its actions were enough to meet the obligations of that role. The directive is blunt that the obligations differ: "the extent of the measures that a controlling employer must take to satisfy its duty to exercise reasonable care to prevent and detect violations is less than what is required of an employer with respect to protecting its own employees."

Two more rules frame every case. One employer can hold several roles, and the directive tells the compliance officer to consider the exposing role first, because a creating, correcting or controlling employer "will often also be an exposing employer." And only exposing employers can be cited for General Duty Clause violations.

The directive's thirteen examples are where the policy becomes practical. Each one below gives the facts OSHA describes and the outcome it reaches.

---

The creating employer

Definition: "The employer that caused a hazardous condition that violates an OSHA standard." Obligation: don't create violative conditions. A creating employer "is citable even if the only employees exposed are those of other employers at the site."

• Example 1, cited. A factory owner, Host, hires a contractor to service machinery. Host leaves drums of a chemical uncovered despite the contractor's repeated requests, and airborne levels exceed the permissible exposure limit (the limits in 29 CFR 1910.1000). Host created the hazard, and covering the drums was a simple, feasible engineering control. Host is citable.
• Example 2, not cited. Employer M hoists materials onto the eighth floor and damages the perimeter guardrails, the protection 29 CFR 1926.501(b)(1) requires at an edge 6 feet or more above a lower level. M has no authority to repair them. It keeps every employee, its own and everyone else's, away from the unprotected edge, and tells the controlling employer. M is not citable, because it took effective steps to prevent exposure.

The exposing employer

Definition: "An employer whose own employees are exposed to the hazard." If it created the hazard, it is citable as a creating employer. If someone else did, it is citable when it (1) knew of the condition or failed to use reasonable diligence to discover it, and (2) failed to take steps consistent with its authority to protect its employees.

The part subcontractors need to know: an exposing employer with authority to correct the hazard must correct it. One without that authority is citable if it fails to do each of three things: ask the creating or controlling employer to correct the hazard, inform its employees of the hazard, and take reasonable alternative protective measures. In extreme circumstances, such as imminent danger, it is citable for failing to pull its employees off the job.

• Example 3, cited. Sub S cleans a work area in a plant around a large, permanent hole. The standard requires guardrails; there are none. S asked the plant operator to install them and was refused. But S's own employees don't use personal fall protection, although it would be feasible. S is citable: asking was not enough, it also had to take the alternative protective step within its control. The directive was written when the rule required guardrails; today, 29 CFR 1910.28(b)(3)(i) accepts covers, guardrail systems, travel restraint or personal fall arrest for a hole 4 feet or more above a lower level.
• Example 4, not cited. Uncovered rebar on both sides of an access ramp presents an impalement hazard, which 29 CFR 1926.701(b) requires to be guarded. An electrical sub, E, has no authority to cover it, asks the general contractor to do so several times, and meanwhile sends its crew by another route that avoids most of the rebar. E is not citable.

The correcting employer

Definition: an employer "engaged in a common undertaking, on the same worksite, as the exposing employer" and "responsible for correcting a hazard," which "usually occurs where an employer is given the responsibility of installing and/or maintaining particular safety/health equipment or devices." Obligation: reasonable care in preventing and discovering violations, and correcting the hazard.

• Example 5, not cited. A carpentry contractor, C, is hired to erect and maintain guardrails (29 CFR 1926.502(b)) on a 15-story project. It inspects every floor morning and afternoon, checks delivery areas after each delivery, and repairs damage as soon as it finds it or it is reported through the general contractor. Workers moving equipment damage a rail on the sixth floor just after C's afternoon round; nobody tells C. OSHA inspects the next morning, before C's morning round. C is not citable: its system was reasonable for the size and activity of the project, and it could not reasonably have known.

---

The controlling employer

Definition: "An employer who has general supervisory authority over the worksite, including the power to correct safety and health violations itself or require others to correct them." Control can come from the contract or, without explicit contract provisions, from the exercise of control in practice.

Obligation: "reasonable care to prevent and detect violations on the site." The directive then limits it: the controlling employer "is not normally required to inspect for hazards as frequently or to have the same level of knowledge of the applicable standards or of trade expertise as the employer it has hired."

How much care is reasonable

The directive names the factors that set how often and how closely a controlling employer must inspect:

1. The scale of the project.
2. The nature and pace of the work, including how often the number or types of hazards change as the work progresses.
3. What it knows about the other employer: its safety history, its safety practices and its level of expertise.

More frequent inspections are normally needed when the controlling employer knows the other employer has a history of non-compliance, and may be needed at the start of a project with an employer it has never worked with. Less frequent inspections may be appropriate when there are strong signs of an effective safety effort. The directive names "a consistently high level of compliance" as the most important of those signs, followed by an effective, graduated system of enforcement, regular jobsite safety meetings and safety training.

To evaluate the controlling employer, OSHA asks whether it:

• conducted periodic inspections of appropriate frequency;
• implemented an effective system for promptly correcting hazards;
• enforced the other employer's compliance with an effective, graduated system of enforcement and follow-up inspections.

Three examples that show where the line is

• Example 6, not cited. A plant owner, GH, hires a sandblasting contractor, S, whose contract requires compliance and lets GH correct non-compliance with other workers and back-charge. Five workers, two contractors, work inside one building; the hazards don't change much. GH has worked with S for years, S has a consistently high level of compliance, and GH monitors it through weekly inspections, phone calls and a weekly review of S's own inspection reports. A respirator equipment problem leads S to violate the respiratory protection rules two days before GH's next inspection, and OSHA arrives the next day. (Part of the job was general industry and part construction; the respirator rules are the same, since 29 CFR 1926.103 adopts 29 CFR 1910.134.) GH exercised reasonable care and is not citable.
• Example 7, cited. A general contractor with the same contract rights hires a painter it has never worked with. It inspects often enough and finds violations of the construction fall protection rules (29 CFR 1926.501) on several visits. It points them out each time, and does nothing more. The general contractor met its duty to discover violations but not its duty to require correction, because it had no graduated system of enforcement. A citation is appropriate.
• Example 8, not cited. An electrical sub installs a panel box and runs an assured equipment grounding conductor program under 29 CFR 1926.404(b)(1)(iii), but misses a grounding wire inside the box, which a visual inspection would not reveal. The general contractor inspects at an appropriate frequency, knows from experience that the sub is competent and runs an effective program, and asked whether the equipment was safe. It was not obligated to test the outlets itself and is not citable.

The practical lesson of Examples 6 and 7 is the same: finding problems is half of the duty. Requiring correction, with escalating consequences, is the other half.

---

How control is proved

The directive recognizes three sources of control, and it tells compliance officers when an employer is not in control.

A specific contract right. The clearest case: the contract lets the employer require another employer to follow safety and health requirements and to correct the violations it finds.

A combination of other contract rights. An employer can be a controlling employer even when there is no safety clause, or when the contract says it has no safety authority, if its rights together give it "broad responsibility at the site involving almost all aspects of the job." The directive calls the authority to resolve disputes between subcontractors, set schedules and determine construction sequencing "particularly significant." In Example 9, a construction manager's contract denied it safety authority but let it set schedules and sequencing, direct work and resolve disputes. When a sub asked it to delay its start until the guardrail contractor had finished, the decision had direct safety consequences. The construction manager is a controlling employer, and it would be citable if it refused. Example 12 applies the same analysis to an engineering firm with the same contract rights.

Control in practice. With no explicit contract authority, an employer that actually exercises broad control over the subcontractors at the site, including safety, is a controlling employer (Example 13, a construction manager that runs most aspects of the subs' work anyway).

For both of the last two bases, the directive says citations should be issued only after consulting the Regional Solicitor's office.

Not in control. In Example 10, a firm whose contract limits it to reporting on the subs' contract compliance to the owner and making payments is not a controlling employer, even though it reports safety infractions to the owner. In Example 11, an architect that prepares drawings, inspects, reports to the owner and points out hazards to the general contractor, with no authority to enforce, is not either. Architects and engineers are controlling employers only when their involvement is broad enough to meet the same tests.

---

HazCom on a multi-employer site

Chemical hazards follow the same roles, with one extra rule. Under 29 CFR 1910.1200(e)(2), adopted for construction by 29 CFR 1926.59, an employer that produces, uses or stores hazardous chemicals where another employer's employees may be exposed must write three methods into its own HazCom program: how the other employers get on-site access to the SDSs ((e)(2)(i)), how they learn the precautionary measures ((e)(2)(ii)), and how they learn the labeling system ((e)(2)(iii)). The duty sits with the employer that brings the chemical. The full breakdown, and how to set up the exchange before a sub mobilizes, is on the multi-employer worksites hub.

Two HazCom situations show how the roles apply. They are illustrations, not OSHA examples.

A painting sub brings solvents and no SDSs. The painter owes the other employers SDS access under 29 CFR 1910.1200(e)(2)(i) and owes its own crew an SDS for each product, readily accessible during each work shift (1910.1200(g)(1), (g)(8)); it can be cited for both. The general contractor can be cited as the controlling employer only if it failed reasonable care: for instance, if it never asked for the paperwork before mobilization, or kept seeing the gap on its walks and did nothing about it.

An electrician decants degreaser into an unmarked spray bottle, and a plumber uses it. The electrical sub created an unlabeled workplace container, a violation of 29 CFR 1910.1200(f)(6); the portable-container exception in (f)(8) covers only a container for the immediate use of the worker who filled it. The plumbing contractor's employee was exposed, so the plumbing contractor is an exposing employer, citable if it knew or should have known and did not ask, inform and protect. The general contractor's exposure turns on the same reasonable-care questions as Example 7.

---

What the courts have said

Solis v. Summit Contractors, Inc., 558 F.3d 815 (8th Cir. 2009). The Review Commission had vacated a scaffold citation under 29 CFR 1926.451(g)(1)(vii) against a general contractor on an Arkansas job, reading 29 CFR 1910.12(a) to limit each employer's duty to its own employees. The Eighth Circuit disagreed: the regulation does not preclude the controlling-employer policy, and even if it were ambiguous the court would defer to the Secretary. It vacated the Commission's order and remanded.

Acosta v. Hensel Phelps Construction Co., 909 F.3d 723 (5th Cir. 2018). On a public library project in Austin, three workers of a sub-subcontractor placed rebar at the base of a wall of Type C soil (the least stable class in Appendix A to 29 CFR Part 1926, Subpart P) about 12 feet high and 150 feet long, with no protective system, while the general contractor's superintendents watched. OSHA cited the general contractor for a willful violation of 29 CFR 1926.652(a)(1). The ALJ vacated the citation, because the Commission generally applies the law of the circuit a case would be appealed to, and the Fifth Circuit's 1981 Melerine decision had said OSHA regulations protect only an employer's own employees. The Fifth Circuit reversed, holding that the Secretary has authority under section 5(a)(2) of the OSH Act to cite controlling employers at multi-employer worksites.

After Loper Bright. Hensel Phelps relied on Chevron deference. The Supreme Court overruled Chevron in Loper Bright Enterprises v. Raimondo on June 28, 2024, but wrote that it did "not call into question prior cases that relied on the Chevron framework," whose holdings "are still subject to statutory stare decisis despite our change in interpretive methodology." Summit also rested on the plain language of the regulation.

State-plan states

CPL 02-00-124 describes a federal program change. The states that run their own OSHA plans had to tell OSHA their intent within 60 calendar days; adoption was not required. On a job in a state-plan state, read that state's multi-employer policy before relying on the federal one.

---

Documentation is your defense

Reasonable care is proved with records, and the directive's own questions tell you which records.

Contract language helps establish both control and the remedies you can use:

• "Subcontractor shall comply with all applicable OSHA standards and correct violations identified by Contractor."
• "Subcontractor shall provide the SDS for each hazardous chemical it brings on site, and the information required by 29 CFR 1910.1200(e)(2), before the chemical arrives."
• "Contractor may stop the work, or correct a violation with other workers and back-charge Subcontractor." (The right to correct and back-charge is one of the contract rights in the directive's Example 6.)

One boundary worth keeping straight: being the controlling employer for citation purposes does not move a subcontractor's recordable injury onto your OSHA 300 Log. Under 29 CFR 1904.31(b)(3), the contractor records the injury of its own employee when it supervises that employee day to day. Whether a GC can demand a sub's log is a contract question, covered in does the GC get your 300 Log?.

Related: Multi-employer worksites hub · Subcontractor HazCom: the three (e)(2) exchanges · Subcontractor safety management · Citation response, abatement and PMA · OSHA Inspections hub · HazCom Standard 1910.1200

---

Sources & verification (read September 28, 2026): OSHA Instruction CPL 02-00-124, Multi-Employer Citation Policy (December 10, 1999), full text on osha.gov; 29 CFR 1910.1200(e)(2) and 1904.31 on the eCFR, 29 CFR 1926.59; Solis v. Summit Contractors, Inc., 558 F.3d 815 (8th Cir. 2009), on ca8.uscourts.gov; Acosta v. Hensel Phelps Construction Co., 909 F.3d 723 (5th Cir. 2018), No. 17-60543, on ca5.uscourts.gov; Loper Bright Enterprises v. Raimondo, No. 22-451 (U.S. June 28, 2024), on supremecourt.gov. The two HazCom situations above are illustrations, not OSHA examples. Not legal advice; multi-employer cases turn on their facts, and state-plan states can set their own policy.