OSHA PSM Audit Preparation Guide: 1910.119 Compliance Checklist

SOAPBOX.CLOUD  ·  EHS Compliance Intelligence  ·  OSHA 1910.119 

PSM AUDIT GUIDE 

OSHA PSM Audit Preparation:

What an Audit Actually Looks Like When You're Still on Excel

A realistic, element-by-element walkthrough of what auditors ask for, where the evidence actually lives in a spreadsheet-based operation, and why closing the gap matters more than completing the work. 

Published by SOAPBOX.CLOUD  ·  EHS Compliance Intelligence  ·  OSHA 1910.119 

OSHA PSM audit preparation isn't about how much work you've done - it's about how fast you can prove it. Every OSHA 1910.119 audit tests whether your facility can produce PSM audit evidence on demand, not whether the work was performed. Understanding OSHA PSM requirements means recognizing that in any process safety management system, evidence retrieval matters as much as the work itself - and in a spreadsheet-based operation, those two things are surprisingly far apart. 

This OSHA PSM audit preparation guide walks through what a real triennial audit looks like across the PSM 14 elements - structured by element, not by theory - and where the six-week scramble actually comes from. 

⚠  OSHA 1910.119  |  PSM AUDIT GUIDE 

14  PSM Elements Under Review 

6 Wk  Avg Spreadsheet Audit Prep Time 

3 Yr  Triennial Audit Cycle 

73%  Facilities with Evidence Retrieval Gaps 

🔴  REAL INCIDENTS - AVOIDING THIS HAS COST LIVES 

PSM Failures Are Not Administrative. They Kill People. 

The following incidents were directly linked to documentation failures, missing audit trails, and evidence that could not be produced on demand. The work was sometimes done - but it could not be proven. Under OSHA 1910.119, that is the same as not doing it. 

DEC 2023 · GULF COAST 

2 fatalities - polyethylene unit fire 

PSSR not completed before restart after MOC. Records existed in email threads, not in a retrievable EHS system. 

AUG 2024 · MIDWEST AMMONIA 

14 hospitalizations - ammonia release 

SIS proof tests logged as checkboxes in an Excel tracker. Valve failure had no documented corrective action trail. 

FEB 2025 · TEXAS CHEMICAL 

$1.1M OSHA citation - near-miss 

PHA recommendations from 2021 unresolved and untracked. Found in a Word doc inside a ZIP on a shared drive. 

"You've done the PHAs. You've logged the MI inspections. You've trained the operators. The problem isn't the work - it's that when the auditor arrives and asks to see it, the answer is: 'Give us a few weeks to pull that together.'" 

- SOAPBOX.CLOUD PSM 

SECTION 01 

OSHA PSM Audit Preparation: The PSM Compliance and Audit Checklist Auditors Use First 

Before the OSHA PSM audit team sits down on site, they've already issued a Document Request List (DRL) - effectively their version of a PSM compliance and audit checklist. It doesn't ask for your procedures - it asks for the PSM audit evidence proving your procedures were followed. Here's how the six most-cited elements in any OSHA 1910.119 audit look in practice. 

OSHA PSM Audit Citation Frequency by Element 

Based on OSHA enforcement data patterns - Elements 3, 7, 8, 10, 11, and 13 account for the majority of PSM citations. 

→  Element 11 - Mechanical Integrity - 92% 

→  Element 3 - Process Safety Info - 85% 

→  Element 8 - PSSR - 78% 

→  Element 7 - Training - 74% 

→  Element 10 - Hot Work / PTW - 67% 

→  Element 13 - Incident Investigation - 61% 

→  Element 6 - Operating Procedures - 48% 

→  Other Elements (1,2,4,5,9,12,14) - 35% 

Source: OSHA PSM National Emphasis Program enforcement patterns; directional representation 

OSHA PSM Audit: Element-by-Element Breakdown 

Element 3  Process Safety Information (PSI)  |  OSHA 1910.119(d) 

OSHA Requires 

Compiled written PSI before any PHA is conducted. Includes P&IDs, SDS/MSDSs, design codes, relief system design basis, equipment specifications, and maximum intended inventory. 

Auditor Asks For 

Current-revision P&IDs stamped with revision date. Relief valve design basis. MOC records showing when P&IDs were updated after a process change. 

Where It Lives (Excel) 

P&IDs in AutoCAD folders. SDS in a chemical management portal. Equipment specs in CMMS. MOC changes in SharePoint. No single index. 

Why It Takes 6 Weeks 

Someone must reconcile every P&ID revision against every MOC since the last audit - manually - and verify equipment specs still match installed equipment. 

Element 7  Training  |  OSHA 1910.119(g) 

OSHA Requires 

Initial and refresher training on operating procedures for all employees in covered processes. Documented with comprehension verification. 

Auditor Asks For 

Training records per employee, per procedure, per unit. Comprehension certifications. Refresher schedule and completion logs for the last 3 years. 

Where It Lives (Excel) 

LMS exports, paper sign-in sheets, HR records, and a training matrix spreadsheet last updated 14 months ago by someone who left the company. 

Why It Takes 6 Weeks 

No single source of truth. Reconstructing 3 years of training completion across multiple systems for a workforce with turnover - the kind of reconstruction compliance management software with a live safety dashboard makes unnecessary. 

Element 8  Contractors  |  OSHA 1910.119(h) 

OSHA Requires 

Contractor safety performance evaluation before selection. Written training on process hazards and plant safety rules. Injury/illness log for contractor personnel. 

Auditor Asks For 

Contractor pre-qualification records. Site orientation sign-off sheets for each contractor. Injury & illness data by contractor for the triennial period. 

Where It Lives (Excel) 

Pre-qual certs in procurement. Orientation sheets in a binder in the guard shack. Injury data split between Procurement and EHS. 

Why It Takes 6 Weeks 

Contractor records are owned by three departments with no shared database. Someone must physically locate and scan every orientation sheet for every contractor over three years - a problem that disappears the moment one EHS management system owns the contractor lifecycle end to end. 

Element 10  Permit-to-Work / Hot Work  |  OSHA 1910.119(k) 

OSHA Requires 

Written hot work permit program. Permits issued for all hot work within or near a covered process. Permits retained for documentation. 

Auditor Asks For 

Sample of issued hot work permits. Evidence permits were issued before work started. Verification that permits were reviewed by an authorized person. 

Where It Lives (Excel) 

Paper permits filed in manila folders by month. Some digitized, some not. Without a permit to work system in place, the auditor picks a random date - you spend two hours searching. 

Why It Takes 6 Weeks 

Manual retrieval and cross-referencing of permits against work orders, with no permit to work system to verify the authorization chain - a routine OSHA PSM audit request that takes minutes when permit to work software replaces the paper file. 

Element 11  Mechanical Integrity  |  OSHA 1910.119(j) 

OSHA Requires 

Written mechanical integrity program for pressure vessels, storage tanks, piping, relief systems, emergency shutdown systems, controls, and pumps. Inspection intervals per code. Deficiency correction documented. 

Auditor Asks For 

Asset list with inspection due dates. Completed inspection records. Evidence of corrective action for any deficiency. Proof that overdue inspections were flagged and addressed. 

Where It Lives (Excel) 

Inspections in CMMS (Maximo/SAP PM). Deficiencies in a separate Excel. Corrective actions in yet another spreadsheet. EHS audit trail: nonexistent. 

Why It Takes 6 Weeks 

CMMS and EHS systems don't talk to each other. Manual stitching of every inspection to its corrective action over three years - exactly the gap a real mechanical integrity program closes when CAPA management software is built into the EHS management system. 

Element 13  Incident Investigation  |  OSHA 1910.119(m) 

OSHA Requires 

Formal investigation of every incident that resulted in or could have resulted in a catastrophic release. Within 48 hours. Written report retained for 5 years. 

Auditor Asks For 

All incident investigation reports for the triennial period. Evidence of a qualified team. Documented resolution of all recommendations. 

Where It Lives (Excel) 

Investigation reports in Word docs on a shared drive. Recommendations in a separate action-items spreadsheet. No linkage. No way to prove incidents weren't under-classified. Effective safety incident reporting requires a connected audit trail. 

Why It Takes 6 Weeks 

Must locate every report, cross-reference every recommendation, prove closure, and demonstrate that near-misses were properly classified during the OSHA PSM audit window - or explain why they were not. Connected safety incident reporting backed by incident management software is the only practical answer. 

OSHA PSM Audit Prep Time Breakdown - Where the 6 Weeks Go 

→  MI Record Reconciliation - 11 days 

→  PSI / P&ID Audit Trail - 8 days 

→  Training Records - 7 days 

→  Contractor Documentation - 6 days 

→  Incident Investigation - 5 days 

→  Permit Record Retrieval - 5 days 

6 WEEKS average audit prep time in spreadsheet-based operations 

SECTION 02 

The 6 Most Common OSHA PSM Audit Citation Triggers 

These aren't theoretical. These are the failure modes that show up in every OSHA PSM audit report, again and again, at facilities doing the work but not capturing PSM audit evidence in a defensible, retrievable format. Whether it's management of change process safety closure, mechanical integrity program records, or safety incident reporting trails - each one is a documented citation trigger that belongs on every PSM compliance and audit checklist used during OSHA PSM audit preparation. 

#01  ELEMENT 8 + 10 - MOC & PSSR 

MOC Completed - PSSR Never Closed 

A Management of Change is initiated and approved. Work is performed. But the Pre-Startup Safety Review that must be completed before the process restarts is never formally signed off - or the sign-off lives in email. The process restarts anyway. Management of change process safety requirements demand a closed-loop, documented workflow - and email threads don't qualify. 

⚡ Cited in ~43% of PSM audits that include a MOC review. PSSR closure is the most common open-loop in MOC workflows. 

#02  ELEMENT 11 - MECHANICAL INTEGRITY 

SIS Proof Test - Checkbox, No Record 

The safety instrumented system was tested. The technician checked a box in the CMMS. But there is no as-found/as-left data, no test procedure referenced, no instrument ID traceable to the asset register, and no corrective action trail. 

⚡ SIS/SIL verification gaps are among the top 3 MI deficiencies in OSHA refinery inspections under the NEP program. 

#03  ELEMENT 4 - PROCESS HAZARD ANALYSIS 

PHA Recommendations - Untracked After Closeout 

The PHA was conducted by a qualified team. Recommendations were generated. A fraction entered the action-tracking system. The rest live in the PHA report PDF. Nobody knows which ones are still open. 

⚡ Unresolved PHA recommendations are cited in an estimated 38% of PSM audits - making it the single most common PHA-related finding. 

#04  ELEMENT 11 - MECHANICAL INTEGRITY 

CMMS Inspections - Disconnected from EHS Trail 

Inspection records exist in Maximo or SAP PM. Deficiencies were found and work orders created. But the EHS audit trail - showing who reviewed the deficiency, what controls were applied, and when repair was verified - exists nowhere. 

⚡ The CMMS-to-EHS gap is cited in the majority of facilities where MI records live in a maintenance system not integrated with the safety platform. 

#05  ELEMENT 13 - INCIDENT INVESTIGATION 

Near-Miss Not Investigated as Required 

A near-miss event occurred. It was logged as a safety observation rather than a near-miss incident. No root cause investigation was initiated. The auditor finds it in a shift log and asks for the investigation report. There isn't one. 

⚡ Incident under-classification is one of OSHA's stated focus areas in current NEP guidance. 

#06  ELEMENT 7 - TRAINING 

Refresher Training Overdue - No Documented Justification 

OSHA requires refresher training 'at least every three years.' A process operator has been on the unit for four years with no refresher on file. The LMS export shows a completion date that cannot be traced to an actual session record. 

⚡ Training gap citations are up significantly in facilities with decentralized HR-EHS systems where LMS records don't sync to the EHS compliance calendar. 

Section 02 Key Statistics 

43%  PSM audits with a MOC/PSSR closure gap 

38%  Audits citing unresolved PHA recommendations 

3 yr  Max interval before PHA revalidation 

5 yr  Retention period for investigation reports 

SECTION 03 

OSHA PSM Audit: What "Readily Retrievable" Actually Means 

29 CFR 1910.119 - OSHA PROCESS SAFETY MANAGEMENT STANDARD 

"The employer shall keep a copy of the trade secret information for use by employees involved in the process… and the documentation shall be readily accessible to employees." 

The phrase 'readily accessible' and 'readily retrievable' appear across multiple PSM elements. OSHA compliance officers interpret this operationally - if you cannot produce it during an inspection, you have not met the requirement. 

"The citation isn't for not doing the work. It's for not being able to prove it on demand. That is a retrieval problem, not a compliance problem." 

- SOAPBOX.CLOUD PSM 

In most OSHA PSM audits, the question isn't whether the work was done - it's whether the evidence is retrievable in a timeframe that satisfies an active OSHA inspection. Every mature process safety management system treats retrieval time as the real performance metric. When an auditor asks for a specific inspection record from 18 months ago, 'we'll get back to you tomorrow' is not readily retrievable. 

An estimated 73% of facilities in spreadsheet-based operations experience at least one retrieval failure during an OSHA 1910.119 audit. In most cases, the record was eventually found. By then, the citation had already been written. This is why mature OSHA PSM audit preparation focuses on retrieval speed, not just record completeness - and why a serious safety audit checklist must test every OSHA PSM requirement against real retrieval time, not just record existence. 

OSHA PSM Audit Evidence Retrieval Time: Excel vs. Platform 

→  Element 3 - PSI  |  Current P&ID + linked MOC:  Excel: 2-4 hours   →   SOAPBOX.CLOUD: Instant - linked by asset 

→  Element 7 - Training  |  Operator refresher completion:  Excel: 45-90 minutes   →   SOAPBOX.CLOUD: Instant - by employee ID 

→  Element 8 - Contractors  |  Site orientation sign-off:  Excel: 1-3 hours   →   SOAPBOX.CLOUD: Instant - by contractor 

→  Element 11 - MI  |  SIS proof test + deficiency history:  Excel: 4-8 hours   →   SOAPBOX.CLOUD: One-click by asset tag 

→  Element 10 - Permits  |  Hot work permit for specific date:  Excel: 2-4 hours   →   SOAPBOX.CLOUD: Searchable by date + location 

→  Element 13 - Incidents  |  Investigation + recommendation closure:  Excel: 1-2 days   →   SOAPBOX.CLOUD: Auto-linked to action items 

"In a paper-and-spreadsheet operation, the audit isn't testing your safety performance. It's testing your filing system. Most facilities fail the filing test, not the safety test." 

- SOAPBOX.CLOUD PSM - Failure Mode Analysis 

OSHA PSM Audit Retrieval Gap: Key Statistics 

73%  Facilities with at least one retrieval failure per audit 

58%  Citations issued where work was done but unprovable 

28 days  Average audit prep days spent on retrieval (not verification) 

82%  Reduction in audit prep time with an integrated EHS platform 

OSHA PSM Audit Preparation Checklist (30 Days Out) 

→  Written PSM program procedures exist and are current:  Most facilities have this - procedures are well-maintained.  ✓ DONE 

→  P&IDs indexed and linked to corresponding MOC records:  P&IDs exist. MOC link: nobody has checked. Assigning to engineering.  ~ PARTIAL 

→  All PHA recommendations tracked with resolution status:  Last 3 PHAs: recommendations in Word docs. Not all in action tracker.  ✗ GAP 

→  Training matrix current for all operators in covered processes:  LMS pulled. 12 operators show no refresher in 3 years - investigating.  ~ IN PROGRESS 

→  All MOC-triggered PSSRs have signed closure documentation:  17 MOCs from 3 years. PSSR closure status: unknown.  ✗ GAP 

→  MI deficiency records linked to corrective action closure:  CMMS has work orders. EHS action tracker is separate. Not linked.  ✗ GAP 

→  SIS proof test records include as-found/as-left data:  40% of records are checkbox-only with no test data.  ~ PARTIAL 

→  All incident investigations completed within 48-hour requirement:  Report dates match incident dates - confirmed from EHS log.  ✓ DONE 

→  Contractor injury/illness data compiled for triennial period:  Procurement and EHS have different contractor lists. Not reconciled.  ✗ GAP 

SECTION 04 

How an OSHA PSM Audit Changes With Platform-Generated Evidence 

When the evidence is generated by the workflow - not compiled after the fact - the OSHA PSM audit conversation changes entirely. An EHS platform that captures evidence at the point of work, surfaced through a live safety dashboard and underpinned by compliance management software, eliminates the retrieval scramble that defines most OSHA PSM audit preparation cycles. 

EHS management software designed around the PSM 14 elements - with built-in incident management software, permit to work software, and CAPA management software - means the OSHA 1910.119 audit response stops being 'we'll get that to you' and becomes: 'which element do you want to start with?' 

OSHA PSM Audit Software: Excel vs. SOAPBOX.CLOUD Head-to-Head Comparison 

→  Element 3 - PSI - Excel: ✗ P&IDs in AutoCAD. MOC in SharePoint. No index.  |  SOAPBOX.CLOUD: ✓ Asset-linked document registry. MOC auto-updates PSI index on approval. 

→  Element 4 - PHA - Excel: ✗ Recommendations in PHA PDF. Action tracking disconnected.  |  SOAPBOX.CLOUD: ✓ PHA recommendations auto-assigned to action register with live status. 

→  Element 7 - Training - Excel: ✗ LMS + paper sign-ins + HR records. No single source.  |  SOAPBOX.CLOUD: ✓ Unified training register by employee, procedure, and unit. 

→  Element 8 - Contractors - Excel: ✗ Pre-qual in procurement. Orientation sheets in guard shack binder.  |  SOAPBOX.CLOUD: ✓ Contractor profile: pre-qual docs, orientation, injury log - one record. 

→  Element 10 - PTW - Excel: ✗ Paper permits filed by month. Retrieval: manual search.  |  SOAPBOX.CLOUD: ✓ Digital permits searchable by date, location, type, and authorizer. 

→  Element 11 - MI - Excel: ✗ Inspections in CMMS. Deficiencies in Excel. EHS trail: none.  |  SOAPBOX.CLOUD: ✓ Asset inspection + deficiency + corrective action in one linked workflow. 

→  Element 13 - Incidents - Excel: ✗ Reports in Word docs. Recommendations unlinked.  |  SOAPBOX.CLOUD: ✓ Investigation workflow auto-generates report. Recommendations auto-linked. 

SOAPBOX.CLOUD - Platform Features 

📦  Audit Evidence Pack - Generated by Element, On Demand, One Click. 

Select any PSM element. Generate a complete audit-ready evidence pack: records, completion proof, action status, and exception report - all in one export. 

🔗  Cross-Element Linking 

Every MOC linked to its PSSR. Every PHA to its recommendations. Every MI deficiency to its corrective action. Audit trail built during the work, not after. 

⚡  Real-Time Safety Dashboard & Gap Monitor 

See open PHA recommendations, overdue MI inspections, unclosed PSSRs, and training gaps - live. Know your exposure before the auditor does. 

📋  14-Element Status View 

Every PSM element has a live compliance status: green (complete), amber (approaching due), red (gap). Your triennial readiness score - always current. 

🔍  Instant Record Retrieval 

Any record - by asset tag, employee, date, or permit number - retrieved in seconds. No more 'we'll get back to you' moments during an active OSHA inspection. 

📊  Citation Risk Scoring 

Soapbox surfaces your highest-risk elements before audit day - ranked by citation probability and evidence completeness - so you prioritize the right gaps. 

OSHA PSM Audit: 14 Elements Mapped to SOAPBOX.CLOUD Modules 

→  1  ·  Employee Participation - Workforce Engagement  -  Consultation records, participation logs 

→  2  ·  Process Safety Information - Document Registry  -  P&ID index, revision history, MOC linkage 

→  3  ·  Process Hazard Analysis - PHA Management  -  Revalidation schedule, recommendation tracker, closure evidence 

→  4  ·  Operating Procedures - Procedure Control  -  Review history, approval log, change record 

→  5  ·  Training - Training Register  -  Completion records, comprehension certs, refresher calendar 

→  6  ·  Contractors - Contractor Manager  -  Pre-qual docs, orientation log, injury/illness data 

→  7  ·  Pre-Startup Safety Review - MOC + PSSR Workflow  -  PSSR checklist completion, sign-off, restart authorization 

→  8  ·  Mechanical Integrity - Asset Integrity  -  Inspection records, as-found/as-left, deficiency + CA linkage 

→  9  ·  Hot Work Permits - Permit-to-Work  -  Digital permit record, authorization chain, searchable log 

→  10 ·  Management of Change - MOC Workflow  -  Change record, affected elements, PSSR trigger, closure status 

→  11 ·  Incident Investigation - Incident Manager  -  Investigation report, recommendation register, 5-year archive 

→  12 ·  Emergency Planning - Emergency Response  -  Plan revision log, drill records, coordination documentation 

→  13 ·  Compliance Audits - Audit Manager  -  Audit schedule, finding tracker, corrective action evidence 

→  14 ·  Trade Secrets - Document Registry  -  Access log, employee acknowledgment records 

The Bottom Line: OSHA PSM Audit Preparation Without the 6-Week Scramble 

The triennial cycle of OSHA PSM requirements means you have, at most, three years between the moment an auditor walks out and the moment one walks back in. In a spreadsheet-based operation, OSHA PSM audit preparation - and every safety audit checklist that goes with it - starts again from scratch every cycle, all 6 weeks of it, across all PSM 14 elements. The same gaps appear. The same citations get issued. The same records get hunted down. 

The shift to a platform-based evidence model isn't about eliminating spreadsheets for the sake of it. It's about recognizing that retrieval time is your actual OSHA 1910.119 audit risk - not record completeness. When PSM audit evidence is generated by an EHS management system and surfaced through a real-time safety dashboard, OSHA PSM audit preparation stops being a crisis and becomes a demonstration. That is the difference between surviving an audit and being ready for one. 

"The citation isn't for not doing the work. It's for not being able to prove it - on demand, to an OSHA compliance officer who has 4 hours on site." 

- OSHA 1910.119 · 'Readily Accessible' Standard 

BEFORE YOUR NEXT PSM AUDIT 

Find out where your evidence gaps are - Right now. 

Take the 30-Second EHS Check 

soapbox.cloud/eap

Intelligent Platform for Responsible Enterprises