OSHA Recordkeeping Audit Trail: Evidence to Keep Behind Every Case

A recordkeeping audit trail shows, for each case, the facts relied on, the decision, who made it, when, and every later change. The rule does not require one by name, but it is what makes a certification or a correction defensible.

The most useful audit trail is created during the year, not in the last week of January.

At the end of each year, 29 CFR 1904.32(a) requires you to review the 300 Log to verify that the entries are complete and accurate and to correct any deficiencies before you total and certify it. The review has to be as extensive as needed to make sure the entries are right. Recordkeeping violations carry maximum penalties of $16,550 per serious or other-than-serious violation and $165,514 per willful or repeated violation (2026 amounts), so the review is where most of the risk is removed.

Keep source evidence, classification notes, update history, and approval records behind each recordable decision. Most year-end corrections trace back to a fact missed months earlier: a restriction note that never reached safety, a case logged twice, or hours pulled from the wrong report. The fix is a monthly review of a sample of cases against their source documents, so year end is a confirmation rather than an investigation.

Whatever you use should make these easy to keep and retrieve:

• A sample of cases compared against their source documents
• Reconciliation of log totals with the 300A and any ITA file
• A list of corrections with dates and reasons
• Sign-off by the reviewer before the executive certifies

1. Attach support documents.
2. Record decision notes.
3. Review monthly.
4. Lock the filing packet after certification.

EHS managers usually run the monthly review, which is the best point to catch the late medical updates that change a case.

Keep these in mind when you compare approaches:

• Teams preserve final PDFs but lose why the numbers changed.
• Corrections after posting or ITA submission need a visible revision basis.
• Dashboards built from the log need to be refreshed after every correction, or leadership keeps seeing the old number.

Spreadsheets fail quietly: a sort that renumbers rows, a tab copied for the new year, a formula that misses a new column. None of that shows on the printed form, which is why any system, including a spreadsheet, should be tested on real historical cases before it is trusted.

An inspector asks why a hand laceration is not on the log. The case file shows the clinic note (Steri-Strips and cleaning, both first aid), the coordinator's decision two days after the incident, and the monthly review sign-off. The question takes two minutes to answer.

300log shows which incidents are still in progress, keeps the 301 facts next to each log entry for review, and recalculates the 300A as you correct cases.

• OSHA 300 Log Quality Control Checklist Before Certification
• OSHA Recordkeeping Internal Audit Checklist for Multi-Site Teams
• Common OSHA Recordkeeping Errors to Avoid in 2026
• OSHA Record Requests During an Inspection: What to Provide and When