29 CFR 1910.119(o) requires employers to certify that they have evaluated compliance with the PSM standard at least every three years, to verify that the procedures and practices developed under the standard are adequate and being followed. The audit must be conducted by at least one person knowledgeable in the process, a report of findings must be developed, the employer must promptly determine and document an appropriate response to each finding and document that deficiencies have been corrected, and the two most recent audit reports must be kept. OSHA's letters focus on two practical questions: when the audit is due, and how fast you must fix what it finds.

What OSHA Has Said

Mar 21, 1995
The three-year audit must be completed, not just started
A facility that did its first audit on July 1, 1992 asked whether the next one only had to be started by the three-year mark. OSHA said the audit must be completed by that date. It added that under (o)(4) it is not enough to document the findings: the standard requires that deficiencies be corrected as promptly as possible.
Read OSHA Letter ↗
Feb 24, 1995
Fix deficiencies promptly, not within the next three years
Asked whether audit deficiencies could be corrected any time within the three-year cycle, OSHA said that when deficiencies are discovered, "it is imperative that corrective actions be initiated immediately, so that corrective measures can be implemented as soon as possible."
Read OSHA Letter ↗
Jan 5, 1995
When a new facility's first audit is due
A new chemical plant that started up in June 1994 asked when its first compliance audit was due. OSHA confirmed the first three-year audit could be completed by June 1997, three years from startup.
Read OSHA Letter ↗
Jul 12, 2006
Keep enough MOC records for the auditors to sample
In a letter on MOC record retention, OSHA said it expects enough management of change records to be available for the next compliance audit to review a representative sample.
Read OSHA Letter ↗

⚡ Key Compliance Takeaway

Put the audit due date on the calendar as a completion date, three years from the last one (or from startup for a new process), and finish the report before it. Then treat findings like open safety issues: assign each one an owner, a response, and a target date, start corrective action right away, and document closure. An audit with a stack of open findings from the last cycle is itself a finding.