PPE Hazard Assessment Under 29 CFR 1910.132: The Written Certification Reviewers Want

Of all the OSHA standards reviewers cross-check during prequalification, 29 CFR 1910.132 is the one most contractors get half-right. Crews are wearing PPE; foremen can tell you what they wear and why; the safety manual lists every category of equipment. What is missing is the piece OSHA actually requires in writing: a hazard assessment certification that documents the workplace, the person who performed the assessment, the date, and a clear identification of the document as a hazard assessment.

This guide walks through what 1910.132 requires, how the general PPE standard relates to the subpart-specific standards (eye, head, foot, hand), how to build a JHA-style assessment by task, what selection logic looks like in practice, training under 1910.132(f), reassessment triggers, and a sample certification structure that reviewers accept.

What 29 CFR 1910.132 Actually Requires

1910.132 is the general PPE standard. It does five things:

• 1910.132(a) — establishes the duty: PPE shall be provided, used, and maintained where hazards capable of causing injury or impairment are present.
• 1910.132(d) — requires a hazard assessment. The employer must assess the workplace to determine if hazards are present (or likely to be present) which necessitate PPE.
• 1910.132(d)(2) — requires a written certification of the hazard assessment.
• 1910.132(f) — requires training for each affected employee, plus a written certification of training.
• 1910.132(h) — establishes employer payment obligations (with narrow exceptions).

Reviewers are looking for two written documents: the hazard assessment certification and the training certification. Neither is optional.

The Written Certification — 1910.132(d)(2)

The hazard assessment certification is the document most often missing from contractor submissions. The standard is narrow but explicit. It must contain:

• The workplace evaluated
• The name of the person certifying that the evaluation has been performed
• The date(s) of the hazard assessment
• An identification of the document as a certification of hazard assessment

That last bullet is what separates a real certification from a generic safety memo. The document needs to say, in its title or first paragraph, that it is a Certification of Workplace Hazard Assessment under 29 CFR 1910.132(d). Reviewers literally search the document for that phrase.

One certification can cover multiple jobsites if the hazards and tasks are substantially similar — for example, a residential framing crew operating across a metro area. For industrial or refinery work, the certification typically lives inside the site-specific safety plan and is repeated per project.

1910.132 vs the Subpart-Specific PPE Standards

OSHA splits PPE rules into the general standard and a series of body-part-specific standards. Each has its own ANSI/ISEA reference:

Selection has to flow from the hazard assessment to the right ANSI standard. Saying "safety glasses required" in the assessment is not enough. The assessment should reference Z87.1 with appropriate markings (Z87+ for impact, D3/D4/D5 for splash/dust/fine dust, U6 for UV). Hard hat assignments should call out Type II if there is a lateral impact hazard (most steel erection, some demo). Foot protection should specify the I/C ratings appropriate to the hazard.

Hazard Assessment by Task — JHA Style

OSHA's non-mandatory Appendix B to Subpart I lays out a recommended assessment process. Most contractors run it by task using the JHA library. For each activity, work through five hazard categories:

1. Impact — flying objects, falling objects, swinging objects (head, eye, foot)
2. Penetration — sharp edges, nails, glass, rebar (hand, foot, body)
3. Compression / Roll-Over — heavy equipment, dropped pipe, materials handling (foot, body)
4. Chemical — solvents, fuels, acids, caustics (eye, hand, body, respiratory)
5. Heat / Cold — welding, torch cutting, cold storage (eye, hand, body)
6. Harmful Dust — silica, lead, cadmium, wood (respiratory, eye)
7. Light Radiation — welding arc, UV, IR (eye, face, body)

For each task, document the hazards present, the source (e.g., "swing radius of excavator," "splash from acidic descaler"), and the PPE selected. A grinding task might list: impact (eye/face), particulate (respiratory if non-trivial), noise (hearing), heat (gloves), and produce a PPE call-out of Z87+ goggles or face shield over Z87 glasses, leather gloves, hearing protection, and a fit-tested respirator if dust monitoring shows exposure.

The JHA-by-task approach also makes the assessment defensible at audit. Inspectors and reviewers can trace any worker's PPE back to a documented hazard, not a generic "wear what your foreman tells you" instruction.

PPE Selection Logic

Selection follows a hierarchy. Engineering controls and administrative controls come before PPE in OSHA's hierarchy of controls. PPE is the last line of defense. The hazard assessment should briefly note that engineering/administrative controls were considered, why they were insufficient or impractical, and what PPE backstops the residual risk. A reviewer reading "PPE selected because engineering controls infeasible" without explanation will push back.

Once you select, specify by manufacturer and model where it matters — particularly for cut-resistant gloves (ANSI A1–A9 levels), chemical-resistant gloves (the SDS may name the polymer required), and respirators (NIOSH approval number). "Leather gloves" is not enough on a deck rebar tying job; "ANSI A4 cut-resistant glove with palm coating" is.

Training Under 1910.132(f)

Training is the second leg of the standard. Every employee required to wear PPE must be trained on:

• When PPE is necessary
• What PPE is necessary
• How to properly don, doff, adjust, and wear PPE
• The limitations of the PPE
• The proper care, maintenance, useful life, and disposal of PPE

The employer must verify each employee understands the training. 1910.132(f)(4) requires retraining when:

• Workplace changes render previous training obsolete
• Changes in PPE render previous training obsolete
• The employee shows inadequate skill or understanding

The training certification (different document than the hazard assessment certification) must include each employee's name, the dates of training, and the subject of the certification. Most contractors fold this into a roster sign-off; that satisfies the standard if the roster also identifies itself as the PPE training certification under 1910.132(f)(4).

Reassessment Triggers

OSHA does not specify an interval, but the standard requires reassessment when conditions change. Treat any of the following as a reassessment trigger:

• New tool, new chemical, new substrate, or new process
• Work in a new physical environment (overhead obstacles, restricted access, energized equipment)
• Incident or near-miss that PPE did not adequately mitigate
• New OSHA standard or revised ANSI standard (e.g., the 2016 revision of ANSI/ISEA 105)
• New owner/host PPE matrix that exceeds your baseline

Most ISN clients expect at least annual review. Date-stamp the reassessment even when nothing changed; an outdated certification is the second-most common rejection after a missing one.

How This Connects to Prequalification

For ISN RAVS reviews, the PPE program is one of a dozen written programs that get scored. Reviewers expect: a written PPE program (not just the hazard assessment), the hazard assessment certification with the four required elements, the training certification, and a PPE matrix tied to actual tasks. Owner client-specific requirements in ISNetworld Connect frequently impose additional PPE — Type II hard hats at most refineries, FR clothing in any electrical exposure area, ANSI A4 cut gloves at most chemical and energy clients. Map your matrix against the owner's client-specific list before mobilizing.

This program also intersects with adjacent written programs. The fall protection program incorporates fall PPE under 1926.502. The HazCom program drives chemical PPE selection from each SDS Section 8. The hot work permit program overlays welding/cutting PPE on top of base PPE. A reviewer reading these documents in sequence wants consistent ANSI references, consistent training cadence, and consistent named program administrator.

Sample Certification Structure

A short, clean, defensible hazard assessment certification looks like this:

1. Title: "Certification of Workplace Hazard Assessment — 29 CFR 1910.132(d)(2)"
2. Workplace: physical address(es) covered, or project name and project number
3. Scope of Operations: one paragraph describing the trades performed at this workplace
4. Person Certifying: printed name, title, signature
5. Date(s) of Assessment: date the walk-down was performed; date the certification is signed
6. Method: JHA-by-task, walk-down with foreman, document review
7. Hazard Inventory by Task: table of task → hazards identified → controls (engineering/administrative) → PPE selected (with ANSI reference)
8. PPE Matrix: condensed view of base PPE plus task-specific add-ons
9. Reassessment Trigger Statement: what events require redoing the assessment
10. Attachments: JHA library references, owner client-specific PPE addenda

Common Reviewer Rejections

• No document titled or identified as a hazard assessment certification
• Certification signed but missing the person's printed name and title
• Date of assessment more than 12 months old with no reassessment record
• PPE listed generically ("safety glasses, gloves") without ANSI references or task linkage
• No multi-employer paragraph addressing host-required PPE additions
• Training certification missing entirely or attached as a generic safety roster without identifying the topic as 1910.132(f) PPE training
• Hierarchy of controls not addressed — the reviewer cannot tell why PPE is the chosen control
• Respirator use mentioned in the assessment but no separate written respiratory protection program under 1910.134

The pattern across these rejections is the same one that shows up in the ISN MSQ and across the ISN grade requirements: reviewers want explicit regulatory hooks and named, dated, signed documents. Generic copy-paste manuals fail; short specific documents pass.

The Bottom Line

1910.132 is two written documents and a workflow. The hazard assessment certification names the workplace, the certifier, and the date, and identifies itself as a hazard assessment. The training certification names each employee, the dates, and the topic. In between sits a JHA-by-task selection process that ties hazards to ANSI-referenced PPE and acknowledges that engineering and administrative controls come first. Get those three pieces in order — assessment, training, reassessment — and your PPE program clears every prequalification review without comment.

PrequalPilot stores your PPE hazard assessment certifications, training rosters, and reassessment dates with every other RAVS document — and tracks owner client-specific PPE matrices so a refinery's Type II hard hat requirement does not get missed at mobilization. See pricing →