How to Audit OSHA 300 Records Before Certifying the Annual Summary

An OSHA recordkeeping review is often treated as an administrative exercise that starts when the annual summary is due. That timing is risky. A missing case, an incorrect classification, or an incomplete incident description can distort the record and weaken the organization's understanding of what happened at work.

This guide gives an EHS coordinator or recordkeeper an eight-step audit method for Forms 300, 300A, and 301 before the annual summary is certified. The aim is not to make the log look better. It is to make each entry traceable, consistently classified, protected where privacy rules apply, and ready for the company executive who must certify the summary.

A reliable OSHA recordkeeping audit reconciles the case source, recording decision, classification, privacy treatment, annual totals, and certification evidence before the Form 300A is signed.

What you need before starting

Gather the OSHA 300 Log, privacy case list if one exists, related Form 301 reports, workers' compensation or occupational-health notifications, clinic records, absence data, restricted-duty records, and the local recordkeeping procedure. OSHA's rules in 29 CFR Part 1904 require covered employers to use Forms 300, 300A, and 301, or equivalent forms, for recordable work-related injuries and illnesses. OSHA also states that these records generally must be retained for five years.

Step 1: Confirm the establishment scope

Define the establishment, workers, reporting year, and responsible recordkeeper before checking individual cases.

Confirm the establishment name, address, industry classification, reporting year, and headcount basis. Separate locations when the organization keeps separate logs. Check whether the site is required to keep OSHA records or qualifies for a partial exemption, then document the basis instead of treating a small workforce or low injury count as proof.

Step 2: Build the source-case list

Create one review list from every credible case source, because the formal log cannot be audited against cases that were never identified.

List events from incident reports, occupational-health referrals, clinic escalations, absences, restricted work, and follow-up reports. Mark each source and review status. Watch cases that moved from first aid to medical treatment or changed classification after follow-up. Use one case identifier when the same event appears in two systems.

Step 3: Test work-relatedness and case validity

Verify the work relationship, date, affected person, and evidence supporting each recording decision.

Review facts without rewriting the event to fit a preferred outcome. Confirm whether the condition arose from the work environment or was significantly aggravated by work, then record the reviewer's rationale. If evidence is incomplete, route the question to the responsible occupational-health, legal, or EHS authority instead of guessing.

Step 4: Recheck the recording criteria

Verify that each recordable case meets an OSHA criterion and matches the most serious outcome during the reporting year.

Check death, days away, restricted work or job transfer, loss of consciousness, significant-diagnosis criteria, and medical treatment beyond first aid. Compare similar cases and document why different facts produced a different classification. Do not downgrade a case because the employee returned quickly.

Step 5: Reconcile Forms 300, 301, and the privacy case list

Match every Form 300 entry to its supporting report while keeping privacy-sensitive information out of the public log.

Compare case number, date, job title, description, classification, days, and outcome across the records. Resolve missing forms, duplicate numbers, inconsistent dates, and vague descriptions. OSHA requires certain privacy cases to use a separate privacy case list, so document that decision and keep the confidential file access-controlled.

Step 6: Recalculate the annual summary

Recalculate Form 300A totals from the reconciled log, then compare the result with the draft and underlying case list.

Re-add total cases, days away, job transfer or restriction, and the relevant injury and illness categories. Confirm the establishment and reporting year. Have a second person repeat the calculation from the final Form 300 Log rather than checking only a spreadsheet formula. Record totals before and after corrections and the independent verifier.

Step 7: Review certification and posting readiness

Prepare Form 300A for certification only after the summary is complete, accurate, and supported by the final log.

OSHA states that the annual summary must be certified by a company executive and posted from February 1 through April 30 of the year following the year covered by the records. Check the posting location, dates, and any electronic submission obligation. Keep the signed certification, final forms, review notes, and correction history together.

Step 8: Close corrections and set the next review

Assign unresolved issues to owners with due dates, then schedule a monthly review so the annual audit is not the only quality check.

Corrections may involve a missing report, classification, privacy treatment, calculation error, or a local process that failed to route a case. Assign the action to the person who can fix the source, record verification evidence, and confirm closure. Andreza Araujo's work on the gap between visible compliance and operating culture is relevant here. A signed Form 300A shows that certification occurred, while recurring reconciliation shows whether the organization learns from the conditions that reach the log.

Final checklist for the recordkeeper

• Confirm establishment scope, reporting year, and responsibility.
• Reconcile cases from incident, clinic, absence, and restriction sources.
• Verify work-relatedness, criteria, classification, and day counts.
• Match Forms 300 and 301 and the privacy case list.
• Recalculate Form 300A totals and obtain an independent check.
• Prepare certification and confirm the February 1 to April 30 posting window.
• Assign corrections and schedule a monthly quality review.

Conclusion

An OSHA recordkeeping audit is strongest when it connects administrative accuracy with the conditions that produced each case. The recordkeeper's job is not to make the numbers look favorable. It is to make the evidence consistent enough that leaders can certify the summary, workers can trust the record, and EHS teams can use the pattern to improve control before the next event.

For leaders who want to connect recordkeeping discipline with stronger safety culture, Andreza Araujo's Safety School and practical safety resources offer a relevant next step.