OSHA 300A Annual Summary: Posting Rules, Signatory Authority, and the Three-Year Retention Requirement in Metalworking and Fabrication Shops

Walk into any mid-size metal fabrication shop in February and you'll find the OSHA 300A posted on the break room bulletin board — right next to the fire evacuation map and the expired SDS binder notice. The shop superintendent thinks they're compliant. The HR coordinator initialed the form. The plant manager's name is typed in the certification block. And that's exactly the problem.

The 300A violation that Compliance Safety and Health Officers (CSHOs) cite most often in metalworking and fabrication facilities is not a missing posting. It's a forged or improperly delegated signature — and it's one that shop-level EHS coordinators almost never see coming until the inspector asks a single question: "Who signed this, and what is their title?"

What the 300A Actually Is — And What It Isn't

The OSHA Form 300A is the annual summary of work-related injuries and illnesses compiled from the OSHA 300 Log under 29 CFR 1904.32. It is not a standalone document — it summarizes the 300 Log and must reflect totals from the prior calendar year. For a fabrication shop running three shifts of press brake operators, welders, and CNC lathe machinists, this means every recordable incident from January 1 through December 31 of the preceding year gets distilled into six numerical fields on a single page.

The distinction matters because CSHOs treating a 300A inspection will pull the underlying 300 Log immediately. If the totals don't reconcile — and in shops where supervisors are logging grinder injuries as "first aid only" to protect their department metrics, they often don't — both the recordkeeping violation and the 300A certification violation land simultaneously.

The Posting Window: Narrower Than Most Shops Realize

Under 29 CFR 1904.32(b)(6), the 300A must be posted no later than February 1 of the year following the year covered by the form, and it must remain posted until April 30 of that same year. That's a mandatory 89-day window — not a suggestion, not "sometime in Q1."

In metal fab environments, February 1 falls during one of the most chaotic operational periods of the year: post-shutdown restarts, new production quotes, and annual tooling changeovers for shops serving automotive or aerospace customers. The 300A gets deprioritized. A fabrication shop that pulls down the posting on March 15 to repaint the break room and forgets to put it back up has just created a Serious citation under 29 CFR 1904.32(b)(6), carrying a penalty of up to $16,131 per violation under 2024 OSHA penalty tables.

The posting location has its own requirement: it must be in a conspicuous place where notices to employees are customarily posted. In a shop with separate fabrication bays, a weld cell, and a shipping dock, posting only in the main office — where floor-level ironworkers and press operators never walk — doesn't satisfy the standard. CSHOs will ask employees where they go to read posted notices. If the answer is "I don't know where that is," the location is wrong.

The Signatory Requirement: The Violation Nobody Expects

This is where compliance breaks down in fabrication shops at a rate that should alarm every plant manager reading this.

Under 29 CFR 1904.32(b)(1), the 300A must be certified by a company executive — and the standard defines that term with specificity at 29 CFR 1904.32(b)(3). The certifying official must be one of the following:

• An owner of the company (if a sole proprietorship or partnership)
• An officer of the corporation
• The highest-ranking company official working at the establishment
• The immediate supervisor of the highest-ranking company official at the establishment

Most EHS coordinators and safety managers assume — incorrectly — that their signature satisfies this requirement. It does not, unless they meet one of those four definitions. In a 75-person contract metal fabrication shop, the "highest-ranking company official working at the establishment" is typically the plant manager or general manager, not the EHS coordinator, not the HR director, and not the production supervisor who signs everything else.

Most EHS coordinators assume that whoever manages safety paperwork can sign the 300A — but OSHA actually looks for whether the certifying individual holds a specific organizational rank, and whether they can speak to the accuracy of the underlying 300 Log if questioned during an inspection.

Here's the failure mode on the ground: The plant manager is traveling. February 1 is approaching. The EHS coordinator — who built the entire 300 Log, knows every incident, and is arguably more qualified to certify accuracy than anyone in the building — signs the form. Or worse, the plant manager emails back, "Just sign my name, I authorize you." That verbal delegation doesn't exist in 29 CFR 1904.32. The standard doesn't provide a delegation mechanism. When a CSHO walks in during an inspection triggered by a fatality involving a CNC machinist, pulls the 300A, and asks the signatory to explain their role, the answer "I'm the safety coordinator" immediately surfaces a recordkeeping violation.

A Willful citation on this issue — where an employer knew the requirement and deliberately circumvented it — carries penalties up to $161,323 per violation. That figure is not hypothetical. OSHA has issued Willful citations for systemic signature falsification in manufacturing environments.

The Three-Year Retention Rule and Where Fabrication Shops Get It Wrong

Under 29 CFR 1904.33(a), employers must save the 300 Log, the 300A annual summary, and the 301 incident reports for five years following the end of the calendar year they cover — not three years. The "three-year rule" is a persistent myth in the metalworking industry, likely a confusion with other retention schedules or a misremembering of the old standard.

The five-year retention period means a fabrication shop being inspected in 2024 must be able to produce records from 2019 forward. In shops that have changed ownership, merged with a larger contract manufacturer, or migrated from paper logs to an EHS software platform mid-decade, those older records frequently disappear. A missing 300 Log from a prior year is a citation under 29 CFR 1904.33(b)(1). Each missing year is a separate violation — five missing years is five citations, each up to $16,131.

During an inspection following a caught-in/between fatality involving a press brake operator, a CSHO will request all 300 Logs going back five years, not one. If the shop can produce only the current year's records, the recordkeeping violations stack on top of the primary fatality investigation. Shops that have switched EHS software systems — moving from a spreadsheet to a platform like Intelex or Cority — frequently discover that their data migration left older records in a format that can no longer be printed in OSHA-required format. That's a retention failure regardless of whether the data technically exists somewhere on a server.

What a CSHO Notices First in a Metal Fab Shop

Experienced CSHOs do not walk past the break room — they stop there. They photograph the bulletin board. They check whether the 300A is posted, whether it's the current year's summary, and whether the certification block is fully completed. They write down the name and title in the signature block before they do anything else, because that name becomes a question they'll ask three people before the inspection ends.

In metalworking shops specifically, CSHOs know to look for two discrepancies: a 300A showing zero injuries in a shop running angle grinders, plasma cutters, and manual deburring operations; and a 300A that lists only DART (Days Away, Restricted, or Transfer) cases but omits the "Other recordable cases" column. Both patterns suggest underrecording on the underlying 300 Log, which opens a separate line of questioning about whether supervisors — under pressure from operations managers chasing injury-rate bonuses — have been miscategorizing recordable incidents.

State Plan Variations That Affect Metal Fab Shops

Shops operating in state-plan states face additional requirements in some jurisdictions:

• California (Cal/OSHA, Title 8 CCR §14300.32): California mirrors federal OSHA on 300A posting and signature requirements but enforces recordkeeping with greater frequency through its targeted inspection programs for high-hazard industries including metal fabrication under NAICS 332.
• Michigan (MIOSHA, R 408.22204): Michigan's recordkeeping rule parallels federal requirements but MIOSHA inspectors are known to audit injury and illness records more aggressively in the automotive supply chain fabrication sector.
• Washington (L&I, WAC 296-27-02105): Washington state requires the same five-year retention but has specific electronic recordkeeping provisions that affect shops using cloud-based EHS platforms — paper copies must remain accessible at the physical establishment.

How to Build a Defensible 300A Process in a Fabrication Shop

The shops that don't get cited are not the ones with the most sophisticated EHS software. They're the ones where the plant manager — not the safety coordinator — physically signs the 300A on January 31, and where that signature is preceded by a 30-minute reconciliation meeting between the EHS coordinator, the HR manager, and the plant manager to walk through every entry on the 300 Log before certification.

That meeting is the internal control. It forces the executive signatory to attest to records they've actually reviewed. It catches the grinder laceration that a shift supervisor logged as first aid but that required stitches at urgent care. It catches the press brake operator whose restricted duty lasted 11 days but was never updated in the log. And it creates a documented record that the certifying official had knowledge of the log's contents at the time of signature — which matters significantly if an injury later leads to an OSHA inspection and someone claims the 300 Log was falsified without executive knowledge.

Retain signed copies of the 300A in a dedicated recordkeeping folder — physical or digital — along with the corresponding 300 Log and all 301s for that year. Label each folder by calendar year. Verify at the five-year mark, not the three-year mark, before purging anything.

Frequently Asked Questions from Metalworking and Fabrication Shops

Our EHS coordinator has been managing all OSHA paperwork for years. Can they sign the 300A?

Only if they are also the highest-ranking company official at the establishment — which in most fabrication shops, they are not. The EHS coordinator role does not satisfy the executive certification requirement under 29 CFR 1904.32(b)(3). The plant manager or general manager must sign. If your EHS coordinator has been signing for years and this has gone uncorrected, address it immediately — a pattern of improper signatures can support a Willful classification if discovered during an inspection.

We have two buildings on the same property — one for fabrication and one for finishing. Do we need one 300A or two?

This depends on how OSHA defines your "establishment" under 29 CFR 1904.46. If both buildings operate under a single establishment with one NAICS code and employees move between them, one 300A may suffice. If each building has separate supervision, separate operations, and would be considered a distinct fixed location of business, you likely need separate logs and separate 300As. Get this determination documented before an inspection — not during one.

We had zero recordable injuries last year. Do we still have to post the 300A?

Yes. A zero-entry 300A is still required to be certified, posted by February 1, and retained for five years. The zeroes must be entered in each column — leaving columns blank is not the same as entering zero and creates ambiguity that a CSHO will flag. Zero-injury years in active metalworking shops also tend to draw additional scrutiny about whether all recordable incidents were properly evaluated.

Our plant manager retired on January 15. Who signs the 300A that's due February 1?

Whoever is the highest-ranking company official at the establishment as of the certification date. If an interim plant manager has been designated, they sign. If no replacement has been named and the operations manager is the de facto senior official on site, document that role designation in writing before February 1. Don't let administrative transitions create a signature gap — the deadline doesn't move for personnel changes.

We switched EHS software in 2022 and can't easily export our 2019–2021 records in OSHA format. Are we exposed?

Yes. The five-year retention requirement under 29 CFR 1904.33(a) requires that records be accessible and producible in OSHA's required format. Inaccessible data that technically exists is treated similarly to missing data during an inspection. Prioritize exporting and archiving those legacy records now. Each missing year is a separate violation up to $16,131.

Can we post the 300A electronically on our internal intranet instead of physically posting it?

Only if all employees in the establishment have reasonable access to the electronic posting during their normal workday — and this is harder to demonstrate than most shops assume. A floor-level deburring technician or material handler who doesn't have a company login or regular computer access does not have "reasonable access." Physical posting in the location where notices are customarily posted remains the safest approach for most production-floor environments.

For contractors managing ISNetworld®, Avetta®, or Veriforce prequalification, EHS Inc provides fully managed OSHA compliance support. Book a free consultation at EHS Inc.