OSHA's compliance audit element requires a formal evaluation at least every three years to confirm that PSM program procedures and practices are adequate and being followed. These letters address who may conduct the audit, the difference between an internal audit and an OSHA inspection, what the written audit report must contain, how promptly deficiencies must be corrected, and the record retention requirements for prior audit reports. Facilities frequently conflate the PSM compliance audit with annual safety reviews, management system audits, or OSHA inspection preparation. These letters clarify the distinct requirements.

What OSHA Has Said

Mar 21, 1995
Compliance Audit Frequency and Three-Year Clock and Documentation
OSHA clarifies that the three-year audit frequency is a maximum interval, not a target. The clock runs from the completion of the previous audit, and the written report must document findings and the schedule for corrective actions.
Read OSHA Letter ↗
Feb 24, 1995
Who May Conduct the Compliance Audit and Qualification Requirements
OSHA addresses whether the audit must be conducted by an independent third party or whether an internal team is acceptable. Internal audits are permitted, but auditors must be knowledgeable in PSM requirements and at least one auditor must not have direct responsibility for the element being audited.
Read OSHA Letter ↗
Jan 5, 1995
Compliance Audit Report Content and Corrective Action Tracking
OSHA specifies what the written audit report must contain: the findings, the corrective actions required, the schedule for completion, and the person responsible for each action. A list of findings without corrective action assignments is an incomplete audit report.
Read OSHA Letter ↗

⚡ Key Compliance Takeaway

A PSM compliance audit is not OSHA inspection preparation. It is an independent evaluation of your own program. Use auditors who know PSM and are not directly responsible for what they are auditing. The written report must assign corrective actions by name and deadline, and you must retain prior audit reports for at least five years.