Job hazard analysis: what a JHA is and when United States law requires one

The odd thing about the JHA, and the thing most pages about it miss, is where its legal weight sits. The Occupational Safety and Health Administration describes the method at length but does not order anyone to use it. The closest thing to a general requirement is the personal protective equipment standard, and what that standard demands is a certificate recording who looked, where, and when. It does not ask what they concluded. The law is interested in the act of looking. That is why a JHA written up at a desk afterwards can satisfy the paperwork while defeating the purpose.

What is a job hazard analysis?

OSHA’s own definition is short. “A job hazard analysis is a technique that focuses on job tasks as a way to identify hazards before they occur. It focuses on the relationship between the worker, the task, the tools, and the work environment,” says OSHA Publication 3071, the agency’s 2002 revised booklet.

The unit of analysis is the task, not the site and not the person, which is why OSHA tells the analyst to make clear to the worker that “you are evaluating the job itself, not the employee’s job performance”. The output is a set of hazard scenarios, each describing where it happens, who is exposed, what triggers it and what would follow.

Is a JHA the same thing as a JSA?

In practice, yes. Job safety analysis and job hazard analysis describe the same method, and the choice is house convention rather than substance. The best evidence is OSHA’s own booklet, titled *Job Hazard Analysis*, which tells the reader: “When conducting your own job safety analysis, be sure to consult the Occupational Safety and Health Administration standards for your industry.”

Some organizations do draw a distinction, treating the JSA as the short pre-task version completed at the work front and the JHA as the fuller written analysis held on file. That distinction is a workplace convention, not a legal one, because no federal standard defines either term and neither name carries obligations the other escapes. You will also meet activity hazard analysis, or AHA, on federal construction contracts, where the term comes from the US Army Corps of Engineers safety manual, EM 385-1-1, and is imposed by the contract rather than by OSHA. Treat all three as one practice until a contract says otherwise.

Does OSHA require a job hazard analysis?

Not as a general duty. We could find no OSHA standard of general application requiring a job hazard analysis by name, a negative finding rather than something any single source states outright.

What does exist is a general obligation with no prescribed method. Section 5(a)(1) of the Occupational Safety and Health Act, the General Duty Clause, requires each employer to furnish employment and a place of employment “free from recognized hazards that are causing or are likely to cause death or serious physical harm” (29 U.S.C. 654). It names no document, no form and no frequency. In construction, 29 CFR 1926.21(b)(2) requires employers to instruct each employee “in the recognition and avoidance of unsafe conditions”, which presumes somebody has worked out what those conditions are without saying how.

The JHA itself sits on the recommended side of the line. OSHA’s *Recommended Practices for Safety and Health Programs*, which points readers to Publication 3071 for hazard identification technique, opens with an unusually blunt disclaimer: “These practices for safety and health programs are recommendations only.” It adds that employers will not be cited for failing to comply with them, and it limits its own audience to employers “except in the construction industry” (OSHA 3885, 2016). That exclusion is worth noting on a page that discusses construction, where pre-task hazard analysis is more entrenched in practice than anywhere else and where the pressure to produce one usually comes from a contract or a client rather than from the agency.

Two cautions. States and territories running their own OSHA-approved plans may set standards that differ from the federal ones, and Publication 3071 tells employers there to check with the state agency. A contract or an insurer can also make a JHA mandatory where federal standards do not.

The one rule that comes closest: the PPE hazard assessment

The personal protective equipment standard is the spine of this subject, because it is the only requirement of general application in American law that makes an employer assess a workplace for hazards and then prove in writing that it did.

29 CFR 1910.132(d) requires the employer to “assess the workplace to determine if hazards are present, or are likely to be present, which necessitate the use of personal protective equipment”, and then to verify that assessment “through a written certification that identifies the workplace evaluated; the person certifying that the evaluation has been performed; the date(s) of the hazard assessment; and, which identifies the document as a certification of hazard assessment”.

Read that list again and notice what is absent: the hazards found. The certification records that an assessment happened, by whom and when, and nothing about what it concluded or what was done as a result. An employer can therefore be fully compliant with the only broadly applicable written hazard assessment duty in federal law while holding a document that tells a reader nothing about the work. That is the gap a real JHA fills, and it is a gap the employer has to want to fill, because no inspector will cite it.

The rule is also narrower than it first appears. Paragraph (g) confines the hazard assessment duty to the eye, head, foot, hand and fall protection standards. It does not extend to respiratory protection at 1910.134 or to electrical protective equipment at 1910.137, each of which sets its own requirements.

Which other rules require a written hazard assessment?

Beyond the PPE rule the requirement bites by subject, and two standards account for most of it.

Permit-required confined spaces work on a different logic. 29 CFR 1910.146(c)(1) requires the employer to “evaluate the workplace to determine if any spaces are permit-required confined spaces”, and the entry permit under paragraph (f) must identify the hazards of the space to be entered, so here the findings themselves are recorded. In construction, 29 CFR 1926.1203(a) fixes both a person and a moment: before work begins, a competent person must identify all confined spaces in which the employer’s workers may work.

Process safety management is the most demanding. 29 CFR 1910.119(e) requires a process hazard analysis for covered processes, using “one or more” of six named methodologies, or “an appropriate equivalent methodology”, and addressing human factors among other things. It must be “updated and revalidated” at least every five years.

Neither of these turns a JHA into a general legal obligation. They confirm the pattern: American law asks for a written hazard analysis where the subject is dangerous enough to name, and leaves the method to the employer everywhere else.

What steps does OSHA describe?

Publication 3071 sets out a short sequence: involve the employees who do the work, because “they have a unique understanding of the job”; review the accident history, including near misses, which OSHA describes as “events in which an accident or loss did not occur, but could have”; fix anything easy immediately rather than waiting for the analysis to finish; then rank the hazardous jobs and break each one into steps.

That last instruction is the one that decides whether a JHA is worth anything, and it is the practical answer to the certification problem described above. OSHA tells the analyst to “watch the employee perform the job and list each step as the worker takes it”, and adds that “it may be helpful to photograph or videotape the worker performing the job”. For each step you then ask what can go wrong, what the consequences would be, how it could arise, what else contributes, and how likely it is. A document produced that way contains everything 1910.132(d) does not require, which is why it is worth producing.

OSHA also names the jobs that should go first: those with the highest injury or illness rates, those that could cause severe injury even with no accident history, those where one simple human error could be catastrophic, those that are new or recently changed, and those complex enough to need written instructions.

Who should carry out a JHA?

OSHA addresses the booklet to “employers, foremen, and supervisors” but presses repeatedly for the worker who does the job to be in the room. A job hazard analysis written without the person who performs the task is missing the information that matters most, which is what actually happens when the work is done rather than what is supposed to happen.

Where the regulations do specify competence, they specify it precisely. The confined space rule in construction names a competent person. The process safety standard requires a team “with expertise in engineering and process operations”, including “at least one employee who has experience and knowledge specific to the process being evaluated”. The PPE certification must name the person certifying. OSHA accepts that complex processes may need a consultant, but warns that the employer and the workers must stay involved “because you are on the worksite every day and most likely to encounter these hazards”.

How a JHA connects to the hierarchy of controls

A JHA that ends at a list of hazards is half a JHA. Publication 3071 is direct: “Information obtained from a job hazard analysis is useless unless hazard control measures recommended in the analysis are incorporated into the tasks.”

OSHA’s Appendix 1 gives the order of precedence as engineering controls, then administrative controls, then personal protective equipment. The more widely quoted version, the NIOSH Hierarchy of Controls, has five levels: elimination, substitution, engineering controls, administrative controls and PPE. The two are compatible, since OSHA folds elimination and substitution into its engineering tier, but check which scale your template uses before people start ticking boxes. OSHA also accepts that the measures adopted “will likely be a combination of all three items instituted simultaneously”, and that a lower control can serve as interim protection while a better one is built.

Note where PPE sits in both versions. It is the last resort in the hierarchy and the first, and almost only, place the law demands a written assessment. That inversion is worth being conscious of, because it pulls documentation effort toward the weakest tier of control.

What a completed JHA should contain

OSHA’s sample form in Appendix 3 is minimal: job title, job location, analyst, date, task number, task description, hazard type, hazard description, consequence, hazard controls, and a rational or comment field. The worked examples repeat that form once per hazard rather than once per job, so a three-step job with several hazards produces several sheets.

A completed job hazard analysis should let a reader who was not there reconstruct what the work involves, what could go wrong at each step, and what has been done about it. If a field on your form cannot be filled in by someone standing at the job, it is probably recording an assumption rather than an observation.

When should a JHA be reviewed?

OSHA gives no fixed interval for a JHA and asks instead for periodic review “to ensure that it remains current”, noting that even an unchanged job can yield hazards the first analysis missed. The trigger it singles out is an incident: “It is particularly important to review your job hazard analysis if an illness or injury occurs on a specific job,” including a close call, where OSHA asks you to discuss the situation with everyone who does that job. Whenever a JHA is revised, everyone affected has to be trained in the changed methods, procedures or protective measures. The only hard interval in this area is the five-year revalidation of a process hazard analysis under 1910.119(e)(6), which applies to covered processes only.

That review trigger connects the analysis to the other half of the paperwork. The events that send you back to a JHA are broadly the events that have to go on the injury and illness log, so the two records should be read together rather than kept by different people: our page on OSHA recordkeeping sets out what the 300, 300A and 301 forms capture. The connection runs the other way too. An organization with thorough hazard analysis and thin reporting will show a flattering TRIR for reasons that have nothing to do with how safe the work is, which is why neither document means much read on its own.

How a JHA differs from a United Kingdom risk assessment

It is common to see JHA described as the American term for a risk assessment. The two are not equivalents, and the difference is structural rather than linguistic. Under regulation 3 of the Management of Health and Safety at Work Regulations 1999, every British employer must make “a suitable and sufficient assessment” of the risks to employees and to others affected by the undertaking, and an employer with five or more employees must record the significant findings. That is a standing legal duty attaching to the undertaking as a whole. The American position inverts almost every one of those attributes: the method is not prescribed, the documentation requirement appears only in specific standards, and the unit of analysis is a single task rather than the business.

The practical translation runs in both directions. Anyone bringing a British compliance program into the United States should expect to keep risk assessment as the discipline while producing JHAs as the artifact, since the American paperwork is narrower than the thinking behind it. Anyone taking an American program into the United Kingdom should expect the recording duty to arrive far earlier and far wider than at home, and to attach to the business rather than to the task. For the British framework, see our page on risk assessment.

Related terms

• OSHA recordkeeping: the 300 Log, the 300A annual summary and the 301 incident report.
• TRIR, the Total Recordable Incident Rate: the rate calculated from those records, and what it does and does not prove.
• Risk assessment: the United Kingdom duty a JHA is often mistaken for.

Frequently asked questions

Sources

• OSHA, *Job Hazard Analysis*, OSHA 3071, 2002 (Revised)
• OSHA, *Recommended Practices for Safety and Health Programs*, OSHA 3885, October 2016
• 29 U.S.C. 654, Duties of employers and employees (General Duty Clause)
• 29 CFR 1910.132, General requirements (personal protective equipment)
• 29 CFR 1910.146, Permit-required confined spaces
• 29 CFR 1910.119, Process safety management of highly hazardous chemicals
• 29 CFR 1926.21, Safety training and education
• 29 CFR 1926.1203, General requirements (confined spaces in construction)
• NIOSH, Hierarchy of Controls
• Management of Health and Safety at Work Regulations 1999, regulation 3
• US Army Corps of Engineers, *Safety and Health Requirements Manual*, EM 385-1-1

Last reviewed: 16 September 2026

About Logincident. Logincident is a data and software company whose configurable platform captures structured evidence at the point an event happens and presents it in dashboards and reports. We are not a law firm or a claims handler, and nothing on this page is legal advice.