Corrective Action Plan Template for Safety Audit and OSHA Findings

Give every finding one row with a named owner, a due date set by risk, the control you chose and why, and an effectiveness check with its own date and verifier. Close the row only when that check passes.

An audit or an inspection produces a list of findings. The list on its own changes nothing on site. A corrective action plan is where each finding gets a fix, a person responsible for it and a way to prove the fix held. If you are still preparing for the walk itself, start with the OSHA inspection checklist. This article picks up after the walk, when the findings are in.

The corrective action plan template

Use one row per finding. A finding that needs several actions keeps one row for the finding and links to each action. The third column shows the worked example used later in this article.

These fields line up with OSHA's Recommended Practices for Safety and Health Programs. Its hazard control plan guidance says to list hazards in order of priority, assign responsibility to a person with the power to implement the control, set a target completion date, plan how to track progress and plan how to verify effectiveness after the control is in place (OSHA Hazard Prevention and Control).

Correction, corrective action and the effectiveness check

Many plans close too early because three separate jobs share one status field.

The correction deals with the condition you found. A missing guard is refitted, a blocked exit is cleared, an unsafe task is stopped. It is usually fast and it belongs on the day of the finding.

The corrective action deals with the reason the condition existed, so it does not come back on the same machine or on the one next to it. It needs a root cause first. If your team has no set method, the comparison of 5 Whys, fishbone and fault tree analysis helps you pick one that matches the finding.

The effectiveness check asks whether the corrective action worked once time had passed. OSHA's guidance lists the questions: were the controls implemented as planned, were engineering controls installed and tested, were workers trained, and are the controls used correctly and consistently (OSHA Hazard Prevention and Control, Action item 6). Give the check its own date and, where possible, a verifier other than the owner.

If your management system follows ISO 45001, the international standard for occupational health and safety management systems, incident investigation and continual improvement are among its key elements (ISO 45001:2018). Check the exact wording of the corrective action requirements in your licensed copy of the standard before you map your plan to it.

Rank the fixes with the hierarchy of controls

For each finding, list the control options before choosing one. OSHA recommends selecting controls according to a hierarchy that puts engineering solutions, including elimination and substitution, first, then safe work practices and administrative controls, and personal protective equipment last. It also says to eliminate or control serious hazards immediately, to use interim controls while longer-term fixes are built, and to avoid controls that introduce new hazards (OSHA, Action item 2).

In practice this means writing down the control level next to every action. A plan where every action reads "retrain staff" or "remind workers" is a plan that relies entirely on behaviour. Those actions can be right, but the plan should show that higher controls were considered and why they were or were not feasible. The hierarchy of controls explainer walks through each level with examples.

Set due dates by risk and agree how overdue items escalate

Due dates should follow the risk rating. OSHA's guidance gives three useful rules: serious hazards are controlled immediately, work is done on a worst-first basis when resources are limited, and easy, inexpensive fixes such as housekeeping or removing trip hazards are done promptly whatever their rating (OSHA, Action item 5).

Beyond that, the targets are your policy. Write them down once so that every plan uses the same rules. A common pattern is a short window for high-risk items with an interim control in place from day one, longer windows for lower ratings, and a named escalation path: the owner is reminded, then the owner's manager is involved, then the site lead. If a date has to move, record the new date, the reason and who approved it, and keep the original date visible.

Track the plan with a few measures that warn you early: the share of actions closed on time, the age of open high-risk actions, and how often effectiveness checks fail. These are leading indicators in the sense described in leading vs lagging safety indicators.

When the finding is an OSHA citation: abatement verification

When findings come from a federal OSHA citation, the plan has outside deadlines. Under 29 CFR 1903.19 (eCFR text), the main points are:

• Abatement certification. Within 10 calendar days after the abatement date, the employer certifies that each cited violation has been abated, giving the date and method of abatement and a statement that affected employees and their representatives have been informed. Certification is not required where the compliance officer observed abatement within 24 hours during the on-site inspection and noted it in the citation.
• Abatement documentation. For willful and repeat violations, and for serious violations where the citation says so, documents showing abatement go with the certification. The rule lists evidence of purchase or repair of equipment, photographic or video evidence and other written records as examples.
• Abatement plans and progress reports. Where the time allowed for abatement is more than 90 calendar days, OSHA may require an abatement plan, and the citation will say so. The plan is due within 25 calendar days from the final order date and covers the steps, the schedule and how employees are protected in the meantime. Periodic progress reports may also be required.
• Employee notification. Each document submitted, or a summary, is posted near the place where the violation occurred and stays up for three working days after submission. For serious, repeat and willful violations involving movable equipment, a warning tag or a copy of the citation is attached to the equipment.

Add the citation and item number, the abatement date and the certification due date to each row, and keep the evidence of completion in a form you could submit. State Plans must be at least as effective as federal OSHA (OSHA State Plans FAQ), so in a State Plan state, check the state's own abatement rules.

Worked example: one lockout finding from observation to closure

This is a hypothetical example at a food packaging plant. It is chosen because a generic procedure was one of the examples raised in Soter's 29 September 2026 webinar on OSHA inspection readiness, where the point was that a control a site believes is in place can still be judged unsuitable: a one-page generic lockout procedure, or fit tests that were done but never recorded.

Observation. During an internal audit, the auditor watches a technician clear a jam in a case packer with only the emergency stop pressed. The posted lockout procedure is one generic page that does not name the machine's energy sources. The auditor records the location, time, a photo of the procedure and a short note.

Requirement. The lockout standard requires documented procedures that clearly and specifically outline steps for shutting down, isolating, blocking and securing the machine, for placing and removing lockout devices, and for testing that the energy controls are effective (1910.147(c)(4)(ii)).

Correction on the day. The supervisor stops the task. Until the plan is complete, every jam is cleared under full lockout. This is an interim control and the row says so.

Root cause. Asking why in sequence shows that jams happen several times a shift, the full lockout takes long enough that the shortcut became normal, and the generic procedure never showed where to isolate this machine. The cause sits in the design of the infeed and in the procedure, so retraining the technician alone would leave both in place.

Corrective actions, ranked. Engineering first: the maintenance lead fixes the infeed guide that causes most jams, which reduces how often anyone needs to reach into the machine. Then administrative: the EHS manager writes a machine-specific procedure that names each energy source and isolation point and includes a test step before work starts. Authorized employees are trained on it. Each action has its own owner and due date.

Effectiveness check. At 30 and 60 days, an authorized employee who does not run that line observes jam clearances, and the jam log is reviewed to see whether frequency has fallen. The standard also requires a periodic inspection of each energy control procedure at least annually, performed by an authorized employee other than the ones using it, and certified (1910.147(c)(6)). The plan links this finding to that inspection.

Closure. The finding closes when both checks pass and the EHS manager signs off with the evidence attached. If an observer sees the shortcut again, the finding reopens and the root cause is reviewed. Had this been an OSHA citation, the same work order, photos and procedure revision could support the abatement certification.

Where SoterAI fits

In the webinar, the suggested sequence was to review policies, audit the facility, then "fix it and prove it" by tracking each fix as an Action and marking it complete when done. Soter's Help Centre documents how Actions work. An action has a required title and assignee, an optional description, an optional link to a related record and an optional due date. Its status is Pending until someone selects Complete Action, where evidence such as a photo or signed form can be attached. Each action keeps an Activity Log of creation, reassignment, edits, completion, evidence upload and reopening, and the Help Centre states the log cannot be edited. An action can be assigned to someone outside the workspace by email, which gives a contractor access only to their assigned actions (Managing Actions).

The same page describes creating, updating, completing and listing actions from a chat or a workflow, and actions created by SoterAI link back to the chat they came from. Overdue items surface in a weekly email digest each Monday that lists actions due that week and overdue actions, including ones you assigned to someone else (Reading your weekly Action digest). For the plan itself, the Help Centre publishes a Corrective Action Plan prompt with sections for the hazard, requirements, steps and owners, timeline, resources, monitoring and reporting.

The documented statuses are Pending and Completed, so give the effectiveness check its own action with a later due date and a different assignee. That keeps the fix and the proof that it held as two visible items. To see how a finding becomes a tracked record, open Corrective Action Plans or the Site Audit workflow.

See how a finding becomes a tracked corrective action. Open Corrective Action Plans.