OSHA’s Top 10 Violations (FY2025) and the ISO 45001 Clause That Prevents Each

Last Updated on September 11, 2026 by Hafsa J.

Federal OSHA cited fall protection (29 CFR 1926.501) 6,992 times in fiscal year 2025, its most cited standard for the 15th consecutive year, and issued 27,815 citations across its ten most frequently cited standards. Those are the final FY2025 figures, pulled by OSHA on April 15, 2026, and they replace the preliminary list announced at the National Safety Council congress in September 2025. Every standard on the list corresponds to a specific requirement of ISO 45001:2018.

Every September the safety press republishes the same ten lines. What it rarely does is read them the way an ISO 45001 auditor would. The OSHA list is prescriptive: it names the guardrail that was missing, the forklift operator who was never evaluated, the energy-control procedure that was never written. ISO 45001 is the management system that is supposed to make those failures impossible by design. Put the two side by side and the list stops being a ranking and becomes a diagnostic: for each of the ten standards, there is one clause of ISO 45001 whose requirement, if it had been met, would have prevented the citation.

This article gives the final FY2025 counts, one chart, the clause-by-clause crosswalk, what the numbers say once they are read through ISO 45001, and a short method for using the list inside an OH&S management system. It is updated every year when OSHA publishes the preliminary list in September and the final counts the following spring.

What OSHA’s Top 10 Is, and Why It Matters to an ISO 45001 System

The Occupational Safety and Health Administration ranks its standards every year by the number of violations cited during federal inspections across all industries. The list is presented in September at the NSC Safety Congress & Expo as preliminary data, on records collected through August, and finalized the following spring once the fiscal year is closed and every inspection is entered. OSHA publishes the ranking on its website; the citation counts per standard are published by Safety+Health, the National Safety Council magazine that co-presents the list.

For an organization running an ISO 45001 system, the list has one property that no internal audit can reproduce: it is empirical. It is not what a consultant thinks the hazards are, it is what inspectors found, tens of thousands of times, in real workplaces. The ten standards do not change much from year to year. The same ten appeared in FY2024 and FY2025; only the order moved. That stability is the point. If the same conditions are found year after year, the hazard identification, competence and operational control processes of the organizations inspected are not working, and those are precisely the processes ISO 45001 clauses 6, 7 and 8 exist to run.

Two limits apply. The counts cover federal OSHA inspections only; states that operate their own OSHA-approved State Plans keep their own statistics. And ISO 45001 certification does not satisfy any OSHA standard. The crosswalk in this article is an editorial analysis by QSE Academy, not an OSHA or ISO document.

The FY2025 Numbers

The Crosswalk: Ten OSHA Standards, Ten ISO 45001 Requirements

The table names, for each standard, the ISO 45001:2018 clause whose requirement most directly addresses the cited condition. Several other clauses apply to each; the one named is the one an auditor would open first. The sections that follow explain each line.

1. Fall protection, general requirements (1926.501): 6,992 citations

The standard requires protection for any employee working on a surface with an unprotected side or edge 6 feet or more above a lower level: guardrails, safety nets or personal fall arrest. Residential construction alone produced the largest share of the citations in the preliminary data. In ISO 45001 terms this is clause 8.1.2, the hierarchy of controls. The clause requires the organization to eliminate hazards first, then substitute, then apply engineering controls, then administrative controls, and only then PPE. A guardrail is an engineering control; a harness is PPE. An edge with neither is a hazard that was either never identified under 6.1.2.1 or identified and left without a control. Either way the finding is a system finding, not a worker finding.

2. Hazard communication (1910.1200): 3,010 citations

Hazard communication is the largest general-industry entry and the one most often cited in workplaces that have no chemical process at all: a cleaning cupboard, a maintenance bay, a warehouse with fuel on site. The cited failures are a missing written program, safety data sheets that exist but cannot be found, unlabeled secondary containers, and workers who were never told what the label means. Nothing here is about chemistry. ISO 45001 covers each failure generically: clause 7.4 requires processes for internal communication of OH&S information, clause 7.5 requires documented information to be available where and when it is needed, and clause 7.3 requires workers to be aware of the hazards relevant to them. An organization that runs those three clauses properly tends to be quiet on this line of the list.

3. Ladders, construction (1926.1053): 2,842 citations

Citations concern ladders used at the wrong angle, not extended 3 feet above the landing, used on unstable surfaces, or defective and still in service. ISO 45001 clause 8.1.1 requires the organization to establish operating criteria for its processes and to control them; ladder selection and set-up are exactly that kind of criterion. The defective-ladder case belongs to clause 9.1.1, monitoring and measurement: equipment that should have been inspected and removed from service, and was not.

4. Control of hazardous energy, lockout/tagout (1910.147): 2,562 citations

Lockout/tagout is the most procedural standard on the list: an energy-control program, a written procedure per machine, training for authorized and affected employees, and a periodic inspection of each procedure at least annually. Each requirement has a clause. The written procedures are operational controls under 8.1.1. The authorized employees are a competence requirement under 7.2. The annual inspection is monitoring under 9.1.1. And because maintenance contractors are often the people inside the machine, clause 8.1.4.2 requires the organization to coordinate its controls with contractors and hold them to the same rules.

5. Respiratory protection (1910.134): 2,294 citations

OSHA requires a written respiratory protection program, medical evaluation and fit testing before a worker wears a tight-fitting respirator. Citations usually mean one of the three is missing. ISO 45001 adds the question OSHA also asks but inspectors rarely reach: was the respirator needed at all? Clause 6.1.2.2 requires the assessment of OH&S risks, which for airborne hazards means an exposure assessment; clause 8.1.2 places engineering controls above PPE; and where respirators remain, the program itself is an operational control under 8.1.1.

6. Scaffolding, construction (1926.451): 2,286 citations

Scaffold citations concern platforms, guardrails, access and the absence of the competent person who must inspect the scaffold before each shift. Scaffolds are often erected by a subcontractor and used by everyone else, which is why clause 8.1.4.2 on contractors matters as much as 8.1.1 on operational control. The competent-person requirement maps directly to clause 7.2: the organization has to determine what competence the role needs and be able to show that the person has it. Scaffolding moved up one place between the preliminary and final FY2025 lists, trading with fall-protection training.

7. Fall protection, training requirements (1926.503): 2,216 citations

This is the only standard on the list that is purely about training. Employers must train each employee exposed to fall hazards, verify the training with a written certification record, and retrain when conditions change. That is clause 7.2 of ISO 45001 almost word for word: determine the necessary competence, ensure workers have it, take actions to acquire it, and retain documented information as evidence. The written certification OSHA asks for is the documented information clause 7.5.3 controls.

8. Powered industrial trucks (1910.178): 2,150 citations

Forklift citations are about operators who were never trained or evaluated, evaluations older than three years, and trucks not inspected before the shift. Clause 7.2 covers the training and evaluation. Clause 8.1.1 covers the pre-shift inspection as an operating criterion. Clause 8.1.3, management of change, covers the case OSHA singles out: refresher training is required when the operator moves to a different truck type or the workplace conditions change, which is exactly the trigger 8.1.3 asks the organization to control.

9. Eye and face protection (1926.102): 1,965 citations

Eye and face protection citations are the visible end of a missing hazard assessment. OSHA expects the employer to assess the workplace for impact, splash and radiation hazards and to select PPE accordingly. ISO 45001 clause 6.1.2.2 requires that assessment at task level; clause 8.1.2 places PPE at the bottom of the hierarchy, after the organization has considered removing the hazard; and clause 5.4, consultation and participation of workers, requires non-managerial workers to take part in determining the controls. PPE chosen with the people who wear it is worn. PPE chosen for them is found in a drawer.

10. Machine guarding (1910.212): 1,498 citations

Guards on points of operation, nip points and rotating parts are the textbook engineering control of clause 8.1.2. Two other clauses explain why unguarded machines keep reaching inspectors. Clause 8.1.4.1 on procurement requires the organization to control the purchase of equipment so that it conforms to the OH&S management system: a machine specified with guarding at purchase arrives guarded. Clause 8.1.3 on management of change requires a review when a machine is modified, relocated or repurposed, which is when guards come off and stay off.

What the List Says Once You Read It Through ISO 45001

Read through ISO 45001, the list collapses to three clauses. Clause 6.1.2 (hazard identification and risk assessment), clause 7.2 (competence) and clause 8.1 (operational planning and control, including the hierarchy of controls) address every standard on OSHA’s list. Six of the ten standards describe a physical control that was missing or defective: fall protection, ladders, lockout/tagout, scaffolding, powered industrial trucks and machine guarding. Three describe the last layers of defence, PPE and training: respiratory protection, eye and face protection, fall-protection training. One, hazard communication, is a communication and documentation failure.

The last-layer standards are the interesting ones for a management system. Clause 8.1.2 ranks PPE and training last in the hierarchy of controls, after elimination, substitution, engineering controls and administrative controls. A respirator or a training certificate that is missing is a symptom; the management-system question is why the hazard reached the worker in the first place. An internal audit that treats the three PPE and training standards as competence findings will close them. An audit that treats them as hierarchy-of-controls findings will prevent them.

The construction weight of the list is the other structural fact. Five of the ten standards belong to the construction part of the code, 29 CFR Part 1926, and those five produced 58.6% of the citations. Add ladders, scaffolding and fall-protection training to fall protection itself, and four fall-related standards account for 14,336 citations, more than half of the list. The top 10 is, to a large degree, a construction fall-hazard list with a general-industry tail.

The preliminary-to-final gap is the number to remember when the FY2026 list arrives. OSHA and Safety+Health announced the preliminary FY2025 list on September 16, 2025 in Denver, on data collected to August 12, 2025: 5,914 fall-protection citations and 23,537 across the ten standards. The final pull on April 15, 2026 gave 6,992 and 27,815, an 18.2% increase, with every count rising and one rank change. Preliminary lists also close on different dates from one year to the next (September 5 in 2024, August 12 in 2025), so they are not comparable with each other. Only the final counts, published the following spring, are.

The human scale behind the list is set by a different dataset. The Bureau of Labor Statistics counted 5,070 fatal work injuries in the United States in 2024, a death every 104 minutes, down 4.0% from 5,283 in 2023. OSHA’s ten standards are the conditions inspectors find most often before those numbers are written.

How to Use the List Inside an ISO 45001 System

The list is a free, annual, empirical hazard register for the US workplace. Five uses fit directly into the clauses of ISO 45001:

• Hazard identification (6.1.2.1). Check that each of the ten conditions that applies to your operations appears in the hazard register with a named control. Fall hazards, energy sources, chemicals, mobile equipment and machine points of operation are the five that apply almost everywhere.
• Hierarchy of controls (8.1.2). For the three PPE and training standards, ask what engineering or administrative control sits above the PPE. If the answer is none, the hierarchy has not been applied.
• Competence records (7.2). Lockout/tagout, forklifts, scaffolds and fall protection each carry an explicit competence requirement with a retraining trigger. Verify that the trigger is defined and that the records exist.
• Contractor control (8.1.4.2). Scaffolds, energy isolation and work at height are the three areas where a contractor most often holds the hazard. Confirm that contractor controls are coordinated, not assumed.
• Internal audit program (9.2). Use the ten standards as an audit theme once a year, in October, when the preliminary list is fresh. Ten questions, one per line, each anchored to the clause in the table above.

Frequently Asked Questions

Methodology and Sources

Source data. OSHA’s list of the ten most frequently cited standards is compiled from the OSHA Information System for inspections conducted by federal OSHA across all industries. OSHA publishes the ranked list on its Top 10 page, updated April 15, 2026 for FY2025. The citation counts per standard are published by Safety+Health, the National Safety Council magazine that presents the list with OSHA each September and reports the finalized counts the following spring.

Data year. FY2025 runs from October 1, 2024 to September 30, 2025. The counts on this page are the final FY2025 data pulled on April 15, 2026. The preliminary FY2025 counts (data to August 12, 2025, announced September 16, 2025) and the preliminary FY2024 counts (data to September 5, 2024, announced at NSC Orlando) are quoted only to document the preliminary-to-final gap. They are not used for year-on-year comparison because their collection windows differ.

Fatality figure. The 2024 Census of Fatal Occupational Injuries was released by the Bureau of Labor Statistics on February 19, 2026, later than its usual December date. The figures quoted (5,070 deaths, one every 104 minutes, down 4.0% from 5,283) are those of the BLS news release.

Clause mapping. The ISO 45001 crosswalk is QSE Academy’s editorial analysis. It names the clause whose requirement most directly addresses the cited condition. It is not an OSHA or ISO publication and does not imply that ISO 45001 certification satisfies any OSHA standard.

Sources

• OSHA, Top 10 Most Frequently Cited Standards for Fiscal Year 2025, updated April 15, 2026, checked September 11, 2026.
• Safety+Health, “OSHA reveals final ‘Top 10’ data for FY 2025”, April 29, 2026 (final counts).
• Safety+Health, “OSHA’s Top 10”, FY2025 feature (preliminary FY2025 and FY2024 counts, data windows).
• Safety+Health, “OSHA’s Top 10 for 2024” (FY2024 preliminary data window).
• U.S. Bureau of Labor Statistics, Census of Fatal Occupational Injuries Summary, 2024, February 19, 2026.
• 2026 NSC Safety Congress & Expo, session programme.
• ISO 45001:2018, Occupational health and safety management systems, requirements with guidance for use. Clause references from the published standard.

Last updated September 11, 2026 with final FY2025 data. Next update: after the FY2026 preliminary list is announced on September 15, 2026.

Related Reading and Resources

Three clauses cover OSHA’s entire list, and all three depend on leadership and worker participation being real rather than declared. Our clause-by-clause reading of ISO 45001 clause 5, leadership, worker participation and policy, explains what an auditor expects to see. ISO 45001 shares its structure with ISO 14001; the ISO 14001:2015 clause-by-clause breakdown shows how the same clauses 4 to 10 read on the environmental side of an integrated HSE system.

Hafsa J.

👋 Hi, I’m HAFSA, and for the past 12 years, I’ve been on a journey to
make ISO standards less intimidating and more approachable for everyone.

Whether it’s ISO 9001, ISO 22000, or the cosmetics-focused ISO 22716, I’ve spent my career
turning complex jargon into clear, actionable steps that businesses can actually use.

I’m not here to call myself an expert—I prefer “enthusiast” because I truly love what I do.
There’s something incredibly rewarding about helping people navigate food safety and quality management systems
in a way that feels simple, practical, and even enjoyable.

When I’m not writing about standards, you’ll probably find me playing Piano 🎹, connecting with people, or diving into my next big project💫.

I’m an engineer specialized in the food and agricultural industry
I have a Master’s in QHSE management and over 12 years of experience as a Quality Manager
I’ve helped more than 15 companies implement ISO 9001, ISO 22000, ISO 22716, GMP, and other standards
My clients include food producers, cosmetics manufacturers, laboratories, and service companies
I believe quality systems should be simple, useful, and efficient.