OSHA 10 / OSHA 30 training tracker

The 12-column tracker primes use to verify every worker’s OSHA outreach card across every active project. With state-specific recurrence cycles, trainer-ID verification, and card-on-file Y/N built in so the gate-check decision on day one stops being a judgment call.

OSHA 10 / OSHA 30 Training Tracker

Why federal and commercial primes need an OSHA card tracker, not a binder of photocopies

Every general contractor and federal prime running a job above five workers has the same Monday-morning scene at the project gate: a new sub crew shows up, the safety director asks for OSHA cards, three of the eight workers have laminated cards from a course completed in 2018 by a trainer the prime has never heard of, two have screenshots from an online provider whose name nobody at the prime can verify, one has nothing because his employer “promised the card was coming,” and the last two have a state-specific OSHA 10 from New York with an expired four-year cycle that renewed last August. The safety director makes a judgment call to let the crew on site under “training in progress,” and the prime is now exposed on a third of a sub crew without verified federal-grade safety credentials.

The fix isn’t a binder of photocopied cards in the field office. It’s a tracker. A single source of truth that captures every worker’s OSHA outreach card across every active project, by which trainer issued it and where their authorization comes from, with the state-specific recurrence cycles tracked per worker and the card-on-file Y/N separated from the worker’s verbal claim. Federal contracting officers and large commercial owners audit the OSHA 10 / 30 record the same way they audit certified payroll: name-by-name, date-by-date, card-number-by-card-number. A spreadsheet that just lists “John has OSHA 10. Yes” doesn’t survive that audit.

What makes OSHA 10 / 30 tracking on a federal or large-commercial project different from generic HR training tracking:

• The card is the credential, not the course. OSHA outreach training is documented by a 16-character alphanumeric card issued by the trainer through OSHA’s Outreach Portal. The card is the authoritative artifact, not the certificate of completion, not the course-provider receipt. Trackers that capture only the course-completion date without the card number can’t survive an audit.
• State-specific recurrence cycles change the math. Federal OSHA 10 and OSHA 30 cards have no expiration date. Once issued, the card is valid for the life of the worker. But several states (New York, Massachusetts, Connecticut, Nevada, Rhode Island, Florida, and others) overlay state-specific renewal cycles ranging from three to five years on top of the federal card.
• In-person vs. online matters in some jurisdictions. Federal OSHA accepts both in-person and OSHA-authorized online delivery. But several states and municipalities require in-person training for state-specific cards (NYC’s SST 40-hour requirement, for example, includes specific in-person components that online OSHA 30 doesn’t satisfy).
• The trainer’s authorization is auditable independently of the card. OSHA outreach trainers are individually authorized and assigned a trainer ID. The trainer’s authorization can be verified through OSHA’s Outreach Portal independently of any particular card.
• Sub-employed workers vs. prime-employed workers need separate handling. On a federal project, the prime is often verifying OSHA cards for hundreds of sub-employed workers across multiple subs. Each sub’s roster is its own verification problem; trackers that lump all workers into one list lose the sub-attribution audit trail.

This tracker is the practitioner’s version. It’s the artifact a federal-prime safety director or commercial-GC field admin actually maintains as the daily working document, not a quarterly safety report, not an annual compliance metric, but the spreadsheet that drives the gate-check decision when a new sub crew mobilizes. Use it on every active project. Update it the moment a new worker is added to the roster. Re-run the verification on every state-required renewal cycle.

Who this tracker is for

• General contractors verifying OSHA 10 / 30 credentials across 50–500+ subcontractor workers per active project
• Federal primes required to retain proof of worker safety training under FAR 52.236-13 and agency-specific safety requirements (USACE EM 385-1-1, NAVFAC, GSA)
• Specialty subcontractors maintaining the upstream credential file their primes will audit at mobilization
• Safety directors and EHS managers running gate-check verification and renewal cycles
• Project administrators maintaining the daily working roster of mobilized workers
• Compliance officers preparing for OSHA inspections, agency audits, and incident-related card verifications

The 12 columns the tracker captures

The tracker captures 12 columns for every worker on every subcontractor on every active project. Set up once per worker, refresh per state-renewal cycle:

1. Worker name, last 4 SSN, and employee/sub-employee status. Full legal name as it appears on the OSHA card, last 4 of SSN as a privacy-respecting unique identifier (do not capture full SSN. Most subcontract data-handling provisions prohibit it), and whether the worker is prime-employed or sub-employed. Sub-employed status drives downstream columns 2 and 11 (the trainer-on-site rule applies differently when the prime didn’t directly contract with the trainer). Card-name-mismatch is one of the two most common audit findings. Verify the name on the card matches the worker’s payroll record before recording the row.
2. Sub legal entity (or “Self” for prime employees). The legal entity of the sub that employs the worker, exactly as it appears on the subcontract signature block. “ABC Inc.” vs “ABC Construction LLC” matters at audit. For prime-employed workers, enter “Self”. These are the workers the prime is directly responsible for training, not just verifying. The tracker’s audit-trail value comes from being able to answer “which sub’s roster includes worker X” in five seconds; the legal-entity column is the join key for that lookup.
3. Project assignment and start date on project. The project ID where the worker is currently active, plus the date they first mobilized to that project. Workers move between projects within a single prime’s portfolio; one worker may be on three projects in a single year. Each project assignment gets its own tracker row even if the underlying card is the same. This is what makes the tracker auditable per-project rather than per-worker. The start date drives the day-one verification record (column 11).
4. OSHA training type. OSHA 10, OSHA 30, OSHA 30 Spanish, or an agency-specific variant (USACE 40-hour for federal water-resources work, EM 385-1-1 supplemental training, NYC SST 40-hour for NYC-jurisdictional work, California’s CAL/OSHA equivalent for state-funded work, etc.). The training type is matched against the project’s requirements at the row level. A worker with OSHA 10 mobilizing to a project requiring OSHA 30 is a Flag, not Current. Most large commercial and federal projects require OSHA 30 minimum for any worker with supervisory responsibility.
5. Course delivery method. In-person training vs. online OSHA-authorized provider. Federal OSHA accepts both delivery methods for standard 10/30 cards. Track the delivery method per worker even when the project allows both. When project requirements change mid-cycle (a sub picks up scope on a NYC site that requires SST 40-hour with in-person components), the tracker tells the safety director which workers need a supplemental in-person delivery and which already qualify.
6. OSHA outreach trainer name and trainer ID number. The individual OSHA-authorized outreach trainer who delivered the course, plus their OSHA-issued trainer ID. The trainer ID is auditable independently of the card through the OSHA Outreach Portal. Verifying the trainer is one of the two-factor checks that proves the card is authentic. When 12 workers from a single sub all show cards from a trainer the prime has never heard of, the prime runs the trainer ID through the Outreach Portal as a second-layer verification before letting the crew on site.
7. Course completion date. The date the worker completed the OSHA 10 or OSHA 30 outreach course as recorded on the card. Federal cards have no expiration date, but the completion date drives the state-specific recurrence calculation in column 9. A 2018 completion date is in-cycle for most states’ five-year renewal requirements but out-of-cycle for any three-year requirement. The completion date also matters for new-hire orientation crediting. Workers with recent completion dates may have completed updated curriculum content (e.g., post-2024 silica or fall-protection updates) that older cards predate.
8. OSHA-issued completion card number. The 16-character alphanumeric card number printed on every legitimate OSHA outreach card. This is the authoritative credential identifier. The card number traces back to the trainer’s records in the OSHA Outreach Portal and is the single most important field in the tracker for audit purposes. A card without a number is a forgery. A card with a number that doesn’t match the trainer’s portal record is a forgery. Capture this exactly as printed; verify against the OSHA Outreach Portal on any worker the prime hasn’t previously verified through that trainer.
9. State-specific recurrence requirement. For workers performing work in jurisdictions with state-specific renewal cycles. New York (NYC SST 40-hour and 8-hour annual refresher), Massachusetts (3-year recurrence on construction-funded state work), Connecticut, Nevada (Nevada-specific OSHA 10/30 with state-specific module), Rhode Island, Florida (state-funded project requirements). Track the jurisdiction and the renewal cycle interval per worker. For workers in jurisdictions with no recurrence requirement, enter “None. Federal card valid for life.”
10. Card expiration / renewal-required date. Calculated from the completion date plus the state-specific recurrence cycle in column 9. For federal-only workers, this column reads “No expiration. Card valid for life of worker.” For state-specific workers, the calculated renewal date drives the renewal-chase cadence: the project administrator emails the sub at 90 days from renewal-required date, follows up at 30 days, escalates at 7 days, and treats the worker as ineligible to perform work in the recurrence-jurisdiction the moment the date passes. Conditional formatting in the XLSX flags this column the same way the COI tracker flags policy expiration.
11. Trainer-on-site verification status. For state-required-trainer locales (NY 8-hour annual refresher delivered on-site by an authorized trainer, NV 10-hour state-specific component, NJ-specific site safety modules). Track whether the on-site trainer requirement has been met for the current cycle and which authorized trainer delivered it. Federal OSHA 10/30 outreach training is delivered off-site (or online) before the worker mobilizes; the on-site refreshers are a separate compliance layer that several states stack on top. Trackers that conflate the two miss the on-site cycle entirely.
12. Photo / scan of card on file (Y/N + file link). The verbal claim that a worker has an OSHA 10 is not enough; the tracker must hold the photo, scan, or PDF of the card itself, with a file link from the tracker row to the document store. Cards-on-file Y/N is a separate column from “card claimed Y/N”. The audit answer to “show me the card for worker X” is a 5-second lookup, not a search through email attachments. When the contracting officer asks for the OSHA card record for any worker who was on site during an inspection or incident, this column is what makes the answer instant.

How to set up and refresh the tracker per project

Set up the tracker at project mobilization, then maintain it as the daily working document for the safety director and project administrator. For each new worker mobilizing to a federal or large-commercial project:

• Pull the worker’s OSHA card (photo, scan, or PDF) and the sub-roster sheet listing all workers mobilizing under that subcontract for that project.
• Add one row per worker per project to the tracker. Fill columns 1-3 from the sub-roster; columns 4-8 from the card itself; column 9 from the project’s jurisdictional requirements; column 10 calculates from columns 7 and 9; column 11 from the on-site refresher record (if applicable); column 12 by uploading the card image and linking it to the row.
• Verify the trainer ID in column 6 against the OSHA Outreach Portal for any trainer the prime hasn’t previously verified. Verify the card number in column 8 matches the trainer’s portal record for any sub the prime hasn’t previously worked with.
• Set the renewal-chase cadence based on column 10: 90-day, 30-day, and 7-day notices for state-specific recurrence renewals.
• Re-review the tracker every Monday morning. Address every state-recurrence renewal coming up in the next 30 days; verify any new workers added to sub-rosters during the prior week were properly entered; spot-check 5% of existing rows against the OSHA Outreach Portal to validate card-number authenticity.
• On every renewal: pull the new card, update columns 7 and 8, recalculate column 10, reconfirm trainer-on-site (column 11) if applicable, re-upload the card image (column 12), and timestamp the new verification.

Stop scrambling to verify OSHA cards on every new project mobilization

The 12 columns above take a project administrator 6 minutes per worker to set up properly across an active sub roster, and another 30 minutes per Monday-morning review pass to maintain renewal cadences and verify new mobilizations. Multiply by 200 active workers across 5 active projects in 3 different states with their own recurrence cycles, and you’ve built a half-time job out of OSHA card verification and renewal chasing. Typically falling on the most senior safety director’s plate because they’re the only one with judgment to run the gate-check call when a card looks off. Contracts Connected’s Subcontractor Prequalification module captures every sub’s roster the moment they’re added to a project, auto-extracts OSHA card metadata from uploaded card images, validates trainer IDs against the OSHA Outreach Portal in the background, populates the tracker without a project administrator touching it, and auto-fires renewal cadences keyed to each worker’s state-specific recurrence requirement.

For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.

Frequently asked questions about OSHA 10 and OSHA 30 training tracking