JHA Form — What Belongs on the Document

Most JHA forms in circulation are three columns wide: step, hazard, control. That's the bare minimum, and it's why so many JHAs fail when a GC safety lead or an OSHA inspector actually reads one. A defensible JHA form needs more — not because OSHA prescribes it, but because the document has to demonstrate that the analysis actually happened.

The minimum legal structure

OSHA Publication 3071 doesn't prescribe a form. It describes a five-step process: break the job into steps, identify the hazards, decide on controls. Any form that supports that process is acceptable. But "acceptable" and "defensible" are not the same.

The fields a defensible JHA form includes

Header block

• Company name and logo
• Project / job site name and address
• Task / activity being analyzed
• JHA ID number (for retrieval)
• Date prepared and date of next review
• Prepared by (name + role)
• Reviewed by competent person (name + signature + date)
• Approved by (supervisor or safety lead)

Crew and PPE block

• Crew members assigned to the task (names, not just count)
• Required PPE list — head, eye, hearing, hand, foot, respiratory, fall, hi-vis
• Required tools and equipment
• Required permits (hot work, confined space, excavation, energized work, etc.)

Body — the analysis table

Each row is one step:

• Step number
• Job step description (verb-first, one action)
• Potential hazards (one per row, not lumped)
• OSHA reference where it applies (e.g. 1926.501 for fall protection)
• Hazard category (struck-by, caught-in, fall, electrical, chemical, ergonomic, heat/cold)
• Initial risk rating (severity × probability)
• Controls — engineering first, then administrative, then PPE
• Residual risk rating after controls
• Responsible person for the control

Footer block

• Crew acknowledgment — every crew member signs at the morning huddle
• Conditions check — confirms today's conditions still match the plan
• Stop-work authority statement
• Revision history

What auditors flag as missing

Patterns we see in GC prequal rejections and OSHA findings:

• No named competent person. "Safety officer" is not a name.
• Generic PPE. Hard hat and gloves listed for every task with no respiratory or fall protection where the hazards actually require them.
• No OSHA references. The controls are listed but never tied to a standard.
• One paragraph instead of steps. A task described in prose can't be analyzed step by step — see the worked examples for what a defensible breakdown looks like.
• No residual risk. The initial risk is rated, controls are listed, but no one closes the loop on whether the controls actually reduce the risk to acceptable.
• No crew sign-off. From a documentation standpoint, an un-signed JHA never happened.
• No review date. An out-of-date JHA in the binder is worse than no JHA.

Paper, fillable PDF, or software?

Paper works for one-off jobs. Fillable PDFs are the most common middle ground. Software is the only option that scales when you're producing dozens of JHAs a week across multiple sites. The form fields don't change — the production speed does.

Get the template

Riskora's JHA template includes every field listed above, pre-mapped to OSHA references. Hand-built JHAs in the platform auto-fill the header, crew, and PPE blocks; you focus on the step-by-step analysis.

Build a JHA in Riskora →

Related: JHA generator · How to write a JHA · JSA examples