How do you prove unpreventable employee misconduct to OSHA?

You prove unpreventable employee misconduct in two steps. First you plead it as an affirmative defense in your answer to the Secretary of Labor's complaint, as 29 CFR 2200.34(b)(3) requires. Then you show the Occupational Safety and Health Review Commission four things: a work rule adequate to prevent the violation, effective communication of that rule, methods for discovering violations, and effective enforcement when violations were discovered. The employer carries that burden. In TNT Crane & Rigging (2022) and Cooper/T. Smith (2020), neither employer could document earlier discipline for breaking the rule at issue, and the Commission affirmed both citations.

In May 2016, a TNT Crane & Rigging crew in Georgetown, Texas, finished installing new antennas on a communications tower, a job planned for a few days that rainy weather had stretched to a week. The next task was to take apart their Grove all-terrain 275-ton mobile crane for transport, and the company sent two more employees to help. When the four met for the job safety analysis, two of them raised concerns about the plan. The other two told them the crane had been assembled in the same location without incident, and the crew went ahead. As the operator lowered the boom, the load line held by a spotter/rigger contacted a 14,400-volt power line. The spotter/rigger was hospitalized with severe burns and other serious injuries.

OSHA cited TNT under two paragraphs of 29 CFR 1926.1407, the construction crane standard's section on power line safety during assembly and disassembly. TNT argued unpreventable employee misconduct before the judge and again on review. It had written power line rules, and for the second item the Commission found it had communicated them to its employees. It also put into evidence its written progressive discipline policy and eight disciplinary actions, one of them the firing of the supervisor at Georgetown. The administrative law judge vacated both items, twice. On review, in June 2022, the Commission reversed the judge and rejected the defense. It affirmed both serious items and assessed the $24,942 total penalty. Apart from that supervisor, TNT “has not shown that it ever previously disciplined an employee for violating its power line safety rules.”

This article draws on the Review Commission's rules at 29 CFR 2200.30 and 2200.34, the OSH Act provisions at 29 U.S.C. §§ 660 and 666, OSHA's Field Operations Manual (CPL 02-00-164), the TNT and Cooper/T. Smith decisions read in full, and decisions of nine federal courts of appeals. It covers federal OSHA and the Review Commission. We didn't review State Plan rules or decisions.

What are the four elements of unpreventable employee misconduct?

OSHA's own enforcement manual lists them. Chapter 5, §VI.B.1.a of the Field Operations Manual reads: “To establish this defense in most jurisdictions, employers must show all the following elements: A work rule adequate to prevent the violation; Effective communication of the rule to employees; Methods for discovering violations of work rules; and Effective enforcement of rules when violations are discovered.”

The Commission states them the same way. In TNT it quoted Manganas Painting (2007): the employer must show that it “(1) established work rules designed to prevent the violative conditions from occurring; (2) adequately communicated those rules to its employees; (3) took steps to discover violations of those rules; and (4) effectively enforced the rules when violations were discovered.” Cooper's version of the third element asks whether the employer “took all reasonable steps to discover noncompliance.”

You need all four. The manual says “all the following elements,” and TNT shows what that means in practice. On the first item, the Commission found that TNT's work rule “does not sufficiently address the requirements of § 1926.1407(b)(3),” so the first element failed. It added that even with sufficient rules, “its UEM defense would nonetheless fail for the same reasons explained below with respect to Item 2,” where monitoring and enforcement fell short.

Is unpreventable employee misconduct an OSHA requirement?

No. It's a defense the employer chooses to raise, and no OSHA standard in 29 CFR sets it out. It comes from decisions of the Review Commission and the federal courts of appeals. The Second Circuit summed up the case law in 1996, in New York State Electric & Gas: “The majority of the Circuits have held that unpreventable employee misconduct is an affirmative defense that an employer must plead and prove.”

The texts that name the defense, or the knowledge question behind it, are procedural or statutory:

The manual's definition shows where the defense sits in a case. An affirmative defense is “a claim that, if established by the employer and found to exist by the CSHO, will excuse the employer from a citation that has otherwise been documented.” By the time the defense comes up, the violation itself is already on paper.

When do you have to raise the defense, and who has to prove it?

You raise it in writing, in your answer, and you carry it at the hearing. Once you've contested the citation, the Review Commission's rules run the clock:

The answer is the place for it. Paragraph (b)(3) of 29 CFR 2200.34 reads: “The answer shall include all affirmative defenses being asserted.” Paragraph (b)(4) says that leaving one out “may result in the party being prohibited from raising the defense at a later stage in the proceeding, unless the Judge finds that the party has asserted the defense as soon as practicable.” The word is “may,” so the judge keeps some room. Don't build your case on that room.

The Secretary moves first. For a serious violation, the D.C. Circuit listed what the Secretary has to show in Wayne J. Griffin Electric (2019): “(a) the applicability of the cited standard, (b) the employer's noncompliance with the standard's terms, (c) employee access to the violative conditions, and (d) the employer's actual or constructive knowledge of the violation.” The knowledge part comes from the statute, 29 U.S.C. § 666(k).

Once that case is made, the defense is yours to prove. OSHA's manual says employers “have the burden of proving any affirmative defenses at the time of a hearing,” and in TNT the Commission wrote that “the burden of proof falls on TNT, not the Secretary.” The Commission's rules keep one argument open. Under 29 CFR 2200.30(g), “By pleading a matter affirmatively, a party does not waive its right to argue that the burden of persuasion on the matter is on another party.” That sentence carries the most weight when the employee who broke the rule is a supervisor, a case covered further down.

For the steps from the notice of contest to the hearing, see how to contest an OSHA citation.

What does an OSHA inspector look for when you blame the employee?

The defense starts during the inspection, whether or not anyone has named it yet. The Field Operations Manual tells compliance safety and health officers (CSHOs) that they “must anticipate when an employer is likely to raise an argument supporting such a defense” and “shall attempt to gather contrary evidence, particularly when an employer makes an assertion that would indicate raising a defense/excuse against the violation(s).” A foreman telling the CSHO during the walkaround that the worker knew the rule is that kind of assertion.

For this defense, Chapter 5, §VI.B.1.b of the manual adds: “CSHOs shall document whether these elements are present, including whether the work rule at issue tracks the requirements of the standard addressing the hazardous condition.” Its Example 5-1 is an unguarded table saw whose guard gets put back on while the CSHO watches. The facts to document are eight questions:

1. Who removed the guard and why?
2. Did the employer know that the guard had been removed?
3. How long or how often had the saw been used without the guard?
4. Were there any supervisors in the area while the saw was operated without a guard?
5. Did the employer have a work rule that the saw should be operated only when the guard is on?
6. How was the work rule communicated to employees?
7. Did the employer monitor compliance with the rule?
8. How was the work rule enforced by the employer when it found noncompliance?

Swap the saw for your cited condition and run the same eight questions before you write the answer. Questions 5 to 8 are the four elements, in order.

The manual also tells the CSHO how to document knowledge, the part of the Secretary's case your defense pushes against. Chapter 4, §II.C.4.b lists evidence that the employer could have known through reasonable diligence: “The violation/hazard was in plain view and obvious,” “The duration of the hazardous condition was not brief,” “The employer failed to regularly inspect the workplace for readily identifiable hazards,” and “The employer failed to train and supervise employees about the particular hazard.” Two of those four are about inspections and training, the same ground as the second and third elements of the defense.

Your injury records come up early too. Under Chapter 3, §VI.A.1.a, “At the start of each inspection, the CSHO shall review the employer's injury and illness records (including the employer's OSHA 300 logs, 300A summaries, and 301 incident reports) for three prior calendar years,” in “all general industry, construction, maritime, and agriculture inspections and investigations.” Under 29 CFR 1904.40(a), you provide copies of those records “within four (4) business hours” of the request. For the rest of the visit, see what to expect during an OSHA inspection.

Which records count for each element in construction and general industry?

No OSHA standard lists the records for this defense. The decisions show what the Commission weighed, and some of those records are ones a standard already makes you keep. The part of 29 CFR matters here: Part 1926 governs construction work, Part 1910 governs general industry, and a record required in one can be absent from the other. The table reads the eCFR edition of November 9, 2026.

None of the sections in the table asks for a discipline record. Among the inspections in the table, only the annual energy control inspection in general industry has to be certified. The third and fourth elements, where TNT and Cooper lost, rest mostly on records you keep because you decided to.

Near-miss reports appear in two narrow texts. Under 1910.178(l)(4)(ii)(B), an operator gets refresher training when “The operator has been involved in an accident or near-miss incident.” Under 1926.502(k)(10), an employer using a fall protection plan investigates a fall or “some other related, serious incident” such as a near miss, to decide whether the plan needs changing.

A record no rule requires can still be evidence. TNT's crew held a job safety analysis before the disassembly began, and two of the four raised concerns during it. The Commission still measured the written rule against 29 CFR 1926.1407(b)(3) and found it short.

Why do employers lose the unpreventable employee misconduct defense?

In TNT and in Cooper/T. Smith, the administrative law judge ruled for the employer and the Commission reversed. In TNT, the Commission quoted American Sterilizer (1997): “It is not enough that an employer has developed an exemplary safety program on paper,” because “the proper focus in employee misconduct cases is on the effectiveness of the employer's implementation of its safety program.”

The audits never looked at the hazard. TNT's vice president testified that the company's practice was not to send a supervisor to remote worksites like Georgetown, because its employees were hired and trained to work with “limited supervision.” That, he said, “doesn't mean absent from supervision.” He couldn't say how often worksites were audited, or how often remote ones were inspected: “I can't tell you the number at this time.” The inspection forms in evidence showed at least four audits over a month at other worksites, and “none of the four audits involved work near overhead power lines.” TNT never gave the evidence needed to judge its audit program, such as “the frequency with which audits occurred at each worksite and whether remote worksites, like the one at issue here, were ever audited at all.”

The discipline came after the accident. TNT put eight disciplinary actions into evidence. The Commission counted the firing of the Georgetown supervisor, citing Precast Services (1995): “Commission precedent does not rule out consideration of post-inspection discipline, provided that it is viewed in conjunction with pre-inspection discipline.” The seven others were given “in 2015 and early 2016 to other employees not at issue here, and none of them relate to power line safety.” For a crane employer with “more than 250 employees and numerous offices,” the Commission found it “highly unlikely that no TNT employee had ever previously violated these rules.” Blakeley's file had the same gap. Nine of its ten disciplinary records from 2016 were issued after the June 18 accident, and the tenth was written discipline for a non-safety issue, burning on top of a newly laid geogrid mat.

The warnings were never written down. Blakeley's safety director testified that he generally enforced work rules orally, and the fitter confirmed that the safety director corrected people on safety issues around the yard before the accident. Blakeley's own progressive discipline policy began with a verbal warning “that is also documented in the employee's personnel file.” For the violation at issue, the safety director gave the fitter a “verbal discretionary,” “wore him out” and “scolded” him, without documenting it in the fitter's personnel file as the policy required. Less than three weeks later, Blakeley promoted the fitter to a supervisory position. The supervisor who fell still hadn't been disciplined at the hearing, eight months after his misconduct. The Commission found that “Blakeley's reliance on undocumented oral reprimands is insufficient to establish that the company effectively enforced its safety program,” and that the failure to discipline both men under the company's own policy “is further evidence of the company's ineffective enforcement.”

The injury log was clean. The judge and Blakeley relied on the absence of earlier accidents from not using fall protection, “as corroborated by the company's work-related injury logs for 2015 and 2016.” The Commission quoted Stuttgart Machine Works (1981): “[a] favorable safety record only indicates that injuries have not occurred, not the absence of violations,” and it “can be a matter of good fortune rather than an indication of an effectively enforced safety program.” What Stuttgart asks of the employer is to “present specific evidence concerning the manner in which it enforces its [work] rules.”

The whole crew broke the rule. In TNT, the supervisor and the rest of the crew “were collectively involved in the violative conduct,” which the Commission treated as “evidence of lax enforcement and attention to crane safety near power lines.” It cited Gem Industries (1996): “Where all the employees participating in a particular activity violate an employer's work rule, the unanimity of such noncomplying conduct suggests ineffective enforcement of the work rule.”

The rule left the call to someone's judgment. TNT's policy said that “[i]f necessary a spotter will be designated to monitor the approach distance,” and it “mentions only one of the cited provision's numerous encroachment prevention measures.” The Sixth Circuit looked at a rule of the same kind in Danis-Shook (2003), where a pipefitter foreman was sucked down a basin drain and drowned during the expansion of a wastewater treatment plant in Beavercreek, Ohio. The company pointed to its written programs and its weekly “toolbox talks” on safety. Its rule required personal protective equipment “as needed,” and the court wrote: “This kind of rule relies on the judgment of supervisors, and as evidenced by the tragic result in this case, that was not enough.” The rule “was discretionary and not mandatory, and this was insufficient.”

What changes when the supervisor broke the rule?

The question moves to knowledge. Chapter 4, §II.C.4.c of OSHA's manual says that “The actual or constructive knowledge of a supervisor who is aware of a violative condition or practice can usually be imputed to the employer for purposes of establishing knowledge.” When the employer argues that the supervisor's own conduct was an isolated event of misconduct, “the CSHO shall attempt to determine whether the supervisor violated an established work rule, and the extent to which the supervisor was trained in the rule and supervised regarding compliance to prevent such conduct.”

The Second Circuit described the problem in 1996. When the supervisor is the one breaking the rule, “the usual rule that a supervisor's knowledge is imputed to the employer would make the knowledge requirement easy to prove: the non-complying supervisor obviously knew of his or her own conduct.” The courts of appeals have answered it in different ways. In Griffin (2019), the D.C. Circuit wrote that “four circuits have held that a supervisor's knowledge of his own violations may be imputed only if the violations were foreseeable to others in the company,” and that “two other circuits seem to permit such imputation without requiring foreseeability.” It left the question open: “Given the background common law of agency, we are skeptical of such a requirement. But Griffin barely briefed the issue, and we need not decide it.” In 2022, the Fourth Circuit called the case law a “confusing patchwork of conflicting approaches,” the words Justice White used in 1987 when he dissented from the denial of certiorari in L.E. Myers.

Which line applies depends on where the case can go next. Under 29 U.S.C. § 660(a), review lies in the court of appeals “for the circuit in which the violation is alleged to have occurred or where the employer has its principal office, or in the Court of Appeals for the District of Columbia Circuit.” When an appeal to one circuit is highly probable, the Commission has applied that circuit's law even where it differs from its own, as Cooper notes, citing Kerns Bros. Tree Service (2000). TNT's worksite and headquarters were both in Texas, in the Fifth Circuit. Blakeley's case arose in Mobile, Alabama, where its principal office is also located, in the Eleventh. New River Electrical, cited after an employee was severely burned picking up a live wire in November 2017, could appeal to the Sixth Circuit, where the violation occurred, the Fourth, where its principal office is, or the D.C. Circuit. The judge “analyzed the Secretary's case under each formulation.” The Fourth Circuit still reversed, and sent the case back for proceedings “that properly allocate the burdens of proof between the parties.”

Dana Container shows what records can do under the Third Circuit's test. Dana ran a truck-tank washing facility in Summit, Illinois, where employees entered tanks under the permit-required confined spaces standard, 29 CFR 1910.146. A supervisor entered a dirty tank without attaching himself to the retrieval device or following the entry permit procedures, and was found unconscious in a pool of chemical sludge. Because Dana's principal office was in New Jersey, the Commission also “tested its conclusion under the standard of Pennsylvania Power & Light” and found Dana's safety program inadequate. The Seventh Circuit found support in the permits: “nearly all of the tank entry permits at Dana's Summit facility contained errors or omissions,” some recorded entries past the 20-minute maximum “by over an hour,” and “there is no evidence that the Facility Manager followed up on the deficiencies.” It held that “The Commission was entitled to find that the uncorrected permit violations exhibited a pattern of disregard for the rules at Dana.” Those were the permits that 1910.146(e)(1) required Dana to prepare before entry.

Yates deals with a supervisor's knowledge of his own misconduct. In TNT, the judge applied it and found the supervisor's misconduct not foreseeable. On review, the Commission held that because the entire crew took part, “the supervisor's knowledge of the other crew members' conduct is imputed to TNT without a showing of foreseeability.” It noted that the Fifth Circuit, in Angel Brothers (2021), had “rejected the very same argument TNT makes here.” There, a foreman had directed a subordinate to work in an unprotected excavation, and the court held that imputing the supervisor's knowledge to the employer was appropriate “under basic agency principles.”

A supervisor's breach also counts against the employer on enforcement. In TNT, the Commission quoted the Fifth Circuit's Floyd S. Pike Electrical Contractor (1978): “[T]he fact that a foreman would feel free to breach a company safety policy is strong evidence that implementation of the policy was lax.” In Danis-Shook, the Sixth Circuit repeated what it had written in L.E. Myers (1987): “In cases involving negligent behavior by a supervisor or foreman which results in dangerous risks to employees under his or her supervision, such fact raises an inference of lax enforcement and/or communication of the employer's safety policy.”

Blakeley conceded the knowledge question by stipulation. Under ComTran, the Eleventh Circuit requires the Secretary to prove that a supervisor's misconduct was foreseeable before imputing his knowledge of it. Blakeley “stipulated to all of the elements of the Secretary's prima facie case, including the imputation of ‘[the supervisor's] knowledge of the violative conditions,’” his own failure to use fall protection included. The case came down to the defense, and the Commission didn't need to reach the Secretary's argument that the supervisor's involvement called for a “heightened burden.”

Whatever the circuit, the CSHO is told to look at how the supervisor was trained in the rule and supervised. Keep the supervisor's own training records, the audits of the supervisor's crews and any discipline the supervisor received.

How do you gather the records before your answer is due?

The CSHO reviews your injury records at the start of the inspection, and your answer is due 21 days after the complaint is served, under 29 CFR 2200.34(b)(1). Build the file while people still remember the job, one element at a time:

1. The work rule, next to the cited paragraph. The manual has the CSHO document “whether the work rule at issue tracks the requirements of the standard addressing the hazardous condition.” Put your rule beside the paragraph cited, requirement by requirement. TNT's spotter rule named one of the measures the standard lists and never said when a spotter was needed.
2. Proof the rule reached the employees involved. Training records and sign-in sheets with their names. Where a standard requires a certification, that's the record to produce: 29 CFR 1926.503(b) for fall protection training in construction, 1910.178(l)(6) for forklift operators, 1910.147(c)(7)(iv) for energy control training in general industry.
3. Audits that covered the hazard. The date, the place and what was checked. TNT's forms showed audits at other worksites, and none of work near power lines.
4. Written discipline from before the accident. In Precast, the employer failed on enforcement because the “company introduced no evidence that prior to [the misconduct] it had subjected an employee to termination, suspension, docked pay, or even a written reprimand or [oral] warning for failure to comply with a work rule.” Produce the whole period you have. Blakeley had owned the shipyard for about a year and a half, produced disciplinary notices for 2016 only, and gave no explanation.
5. Discipline after the accident, the supervisor's included. It counts when weighed with earlier discipline (Precast). Blakeley promoted the fitter and still hadn't disciplined the supervisor at the hearing.
6. Three years of injury records. The 300 Logs, 300A summaries and 301 reports the CSHO reviews, which 29 CFR 1904.40(a) gives you four business hours to provide. A clean record “only indicates that injuries have not occurred” (Stuttgart).
7. The defense in your answer. Plead unpreventable employee misconduct within the 21 days, under 2200.34(b)(1) and (b)(3), while the file is still being built.

HazComFast builds that file from the case. From a case in the OSHA 300 Log, an administrator picks Create Defense Package, and the package page lays out the four elements in a box titled “Unpreventable Employee Misconduct Defense,” with a count of the elements that have evidence and an Add evidence button under any element that still needs a piece.

“Propose evidence from the case” does the digging. It lists the records tied to the case as of the incident date, from its investigation to the equipment, the operator and the permit, then the jobsite's records from the year before, grouped by reason: “Last inspection of the equipment before the incident,” “Operator qualifications valid on the incident date,” “Permit the work was done under.” The jobsite's records come unchecked, and Add selected takes only the ones you pick.

The export is built to be checked. Once every element has evidence, Export PDF and pieces (ZIP) produces one ZIP with an index PDF, a contents page, a manifest in JSON and CSV, and one file per piece. A cited safety data sheet goes in as the revision that was cited, and an archived PDF goes in checked against the SHA-256 recorded when it was archived. Personal details such as birth dates, home addresses and phone numbers stay out of the copies. The index prints the jobsite's OSHA part and, under each piece, the 29 CFR section that asks for that kind of record.

Two more pieces are built at export. “Audit trail of the period” takes the audit log from 30 days before the incident to the export, for the jobsite, the incident, the equipment, the operator and the cited records. “Permit suspension timeline” gives the status changes of the permits involved, by whom and when.

After export, the package is locked. It can't be deleted, a record it cites can't be removed, and reopening it as a draft asks for a reason that goes into the audit log with the person's name and the time. The export itself is logged with the SHA-256 of the PDF and of the ZIP.

Related: How to contest an OSHA citation · What evidence goes into an OSHA citation defense package · What to expect during an OSHA inspection

---

Sources & verification: 29 CFR 2200.30, 2200.34, 1904.29 and 1904.40, and the 29 CFR sections in the record table, eCFR edition current as of November 9, 2026. 29 U.S.C. §§ 660 and 666, U.S. Code 2023 edition on govinfo.gov. OSHA Field Operations Manual, CPL 02-00-164, effective April 14, 2020. Read in full: TNT Crane & Rigging (OSHRC No. 16-1587, 2022), Cooper/T. Smith (OSHRC No. 16-1533, 2020), New York State Electric & Gas (2d Cir. 1996), Angel Brothers Enterprises (5th Cir. 2021), L.E. Myers (6th Cir. 1987) and the court of appeals decisions in the circuit table. Read only as quoted in those decisions: Manganas Painting, Capform, American Sterilizer, Precast Services, Gem Industries, Kerns Bros. Tree Service, Stuttgart Machine Works, Floyd S. Pike Electrical Contractor and Justice White's 1987 dissent from the denial of certiorari in L.E. Myers. 29 CFR 1926.1407 and 1915.77 as quoted in TNT and Cooper. Not reviewed: State Plan rules and decisions. This article is general guidance and isn't legal advice.