OSHA fire safety compliance: what your audit will look for

An OSHA fire audit isn't a surprise. Inspectors look for the same handful of documents in the same order, every time, across every industry. The reason workplaces still fail audits isn't the questions — it's that the answers are scattered across email threads, paper sign-in sheets, and an alerting system that doesn't keep a clean log. This guide walks through what an OSHA fire audit will actually request, where most safety teams come up short, and how to keep records that hold up under questioning.

Why OSHA fire audits are predictable

OSHA fire safety enforcement is anchored to two short, public standards: the Emergency Action Plan rule (29 CFR 1910.38) and the Fire Prevention Plan rule (29 CFR 1910.39). Both read like a checklist. An inspector arriving for an OSHA fire audit will work down that same list — written plan, training records, drill records, alarm and detection records, accountability — and ask for the documents that prove each one.

The audit is not a quiz on safety theory. It's a documentation review. If you can hand over clean, dated, signed records inside ten minutes, you're most of the way to a clean visit.

The four documents an OSHA fire audit will request

Across audits, four documents come up every time:

1. The written Emergency Action Plan. Exits, routes, muster points, the chain of command, and how employees will be alerted. Required in writing for any employer with 11+ staff.
2. Training records. Dated rosters showing every employee was trained on the EAP at hire and after any plan change.
3. Drill records. Date, scenario, participants, evacuation time, and the post-drill corrective actions.
4. Notification logs. Timestamped proof that the alarm and any electronic notifications actually reached employees during real events and drills.

Item four is where most workplaces lose points. The plan is in a binder; the training roster is in HR; the drill summary is in someone's email. The notification log — the one that proves a 9:14 a.m. alarm reached every floor by 9:14:08 — usually doesn't exist.

What inspectors look for in your evacuation drills

OSHA doesn't mandate a fixed drill cadence for every industry, but inspectors expect cadence appropriate to risk. Healthcare, schools, and high-occupancy buildings should drill at least annually, often quarterly. Inspectors look for:

• A scenario, not just an alarm test — what was being practiced.
• An attendance record, tied to a roster of who was on site.
• An evacuation time, measured from alarm to final muster confirmation.
• A corrective-action note, showing one thing changed because of the drill.

If your drill records say only "Q2 drill, all clear," expect a follow-up question. Pair drills with your crisis manager playbook so the scenario, timing, and corrective actions are recorded in one place.

The notification trail: where most audits go sideways

The EAP rule requires an alarm system and a means to alert employees. What it doesn't say in plain text — but every inspector implies — is that you should be able to prove the alarm worked. A bell on the wall is not, by itself, evidence. A clean notification trail includes:

• The exact time the alert was triggered.
• Which channels fired (siren, mobile push, SMS, desktop banner, voice call).
• Per-channel delivery records, plus confirmed read receipts on the channels that support them.
• The user account that triggered the alert.

Why mobile push and desktop alerts carry the audit

Not every channel can prove a recipient saw the message. Email read tracking relies on remote-image pixels that most modern clients block by default. SMS has no read-receipt protocol at all — carriers confirm delivery to the device, but not whether the recipient looked at it. Voice reports answered or unanswered, not heard. These channels still belong in the fire-safety mix; they widen the net across phones, networks, and attention contexts. But for the question an auditor cares about most — did your people actually see the alert? — mobile push and desktop alerts are the only channels that return a confirmed read with a server-side timestamp.

The practical play is to run mobile push and desktop alerts as your primary, fastest channels and let email, SMS, and voice broaden the reach behind them. A modern mass notification platform that timestamps every send and delivery, and captures confirmed reads on the channels that can prove them, turns the audit conversation from "we believe staff were notified" to "here is the log."

Common findings — and how to get ahead of them

Repeat findings across OSHA fire audits cluster into a short list:

• EAP not written, or written and never updated. Date the document. Re-sign annually.
• Training records missing for new hires. Tie EAP training into onboarding so it can't be skipped.
• Drills run but not documented. Use a one-page template — scenario, time, attendance, action.
• Visitors unaccounted for during drills. Pull your visitor sign-in roster into the muster check.
• Alarm test logs missing. Monthly self-test, logged.

A 30-day OSHA fire compliance prep plan

1. Week 1. Pull the current written EAP. Confirm exits, muster points, and the alerting method are still accurate.
2. Week 2. Verify training records for every active employee. Backfill any new hires.
3. Week 3. Run a documented drill with a real scenario and full notification log capture.
4. Week 4. Compile the binder — EAP, training rosters, drill report, notification logs, alarm test records.

Compliance isn't what you do during an audit — it's what you can prove you did before one was scheduled.

What to do this week

• Read 29 CFR 1910.38 and 1910.39 end to end. They're shorter than you remember.
• Locate the written EAP and check the date.
• Export the last 90 days of notification logs from your alerting system.
• Schedule a documented drill in the next 30 days.
• Set up a single binder (digital or physical) with the four documents above.

Most fire-safety citations aren't about hardware — they're about paper. The workplaces that pass an OSHA fire audit don't run differently from the ones that fail; they just keep cleaner records. Start with the binder, then keep the timestamps.