OSHA Recordkeeping Internal Audit Checklist for Multi-Site Teams

A multi-site internal audit samples cases at each establishment and tests the decisions behind them, not just whether the forms exist. Comparing the same checks across sites shows where intake habits drift.

Internal audits work best when they check decisions, not just form completion.

At the end of each year, 29 CFR 1904.32(a) requires you to review the 300 Log to verify that the entries are complete and accurate and to correct any deficiencies before you total and certify it. The review has to be as extensive as needed to make sure the entries are right. Recordkeeping violations carry maximum penalties of $16,550 per serious or other-than-serious violation and $165,514 per willful or repeated violation (2026 amounts), so the review is where most of the risk is removed.

1. Is each case work-related, with the basis or exception written down?
2. Is each case new, not a continuation of an earlier entry?
3. Does the recording criterion match the source documents (treatment, restrictions, days away)?
4. Is the right column checked, and are day counts calculated in calendar days from the day after the injury?
5. Are privacy concern cases flagged, with the names on the confidential list?
6. Is each description specific enough to identify the case without oversharing?
7. Do the log totals match the 300A, and does the 300A match any ITA file?
8. Can the establishment's records be produced within 4 business hours?

Review sample cases for work-relatedness, treatment, outcomes, day counts, privacy entries, access readiness, and ITA coverage. Most year-end corrections trace back to a fact missed months earlier: a restriction note that never reached safety, a case logged twice, or hours pulled from the wrong report. The fix is a monthly review of a sample of cases against their source documents, so year end is a confirmation rather than an investigation.

Whatever you use should make these easy to keep and retrieve:

• A sample of cases compared against their source documents
• Reconciliation of log totals with the 300A and any ITA file
• A list of corrections with dates and reasons
• Sign-off by the reviewer before the executive certifies

1. Select samples at each site.
2. Compare the facts with the classifications.
3. Review the forms.
4. Close corrective actions.

At the director level the question is less about one case and more about whether every site applies the rule the same way, with evidence you could show an inspector.

Keep these in mind when you compare approaches:

• Teams audit whether a file exists instead of whether the decision is defensible.
• One site with a different intake habit can distort company-wide dashboards.
• Sites that use their own local spreadsheets drift apart; one intake standard across sites prevents most of it.

Whatever you choose, name one source of truth for each establishment and make every form, rate, and ITA file come from it. Most recordkeeping failures come from two records of the same case that disagree.

An internal audit of six sites samples five cases each. Five sites are consistent; the sixth has classified three prescription-strength recommendations as first aid. The corrective action is a refresher for that site's coordinator and a monthly check of its clinic notes for a quarter.

300log shows which incidents are still in progress, keeps the 301 facts next to each log entry for review, and recalculates the 300A as you correct cases.

• Common OSHA Recordkeeping Errors to Avoid in 2026
• Audit-Ready OSHA Recordkeeping Checklist for Safety Teams
• OSHA Recordkeeping Audit Trail: Evidence to Keep Behind Every Case
• OSHA 300 Privacy Concern Cases: Examples and Safer Log Descriptions