When you went from one shop to two, the compliance load did not double. It at least tripled. The first shop had its own inspections, programs, painters, and waste pickups. The second shop adds its own set, plus the overhead of keeping the two coordinated, plus the risk that something true at one shop is assumed to be true at the other when it is not.
This post is for owners running two or more locations and the general managers responsible for keeping them compliant.
The compounding problem
Each location has its own:
- EPA ID number for hazardous waste generation
- Spray-booth permits where the jurisdiction requires them
- Painter roster and 6H certifications
- OSHA 300 log for that establishment
- Fire extinguisher inspection schedule
- SDS library reflecting the chemicals actually in use at that site
- Local fire marshal relationship
Two locations means two complete sets of all of the above. The compounding piece is whether they are aligned. If location A switched to a different prep solvent six months ago, location B's SDS library should not still default to the old one.
Location-scoped roles, not flat user lists
The first structural question is who can see and edit what across locations. Three roles are typical for an MSO:
- Owner or VP of Operations. Sees every location, every record. Can edit anything.
- General Manager or Regional. Sees a subset of locations. Edits within their scope.
- Shop Manager or Lead. Sees and edits one location.
If the GM at location B can edit the painter roster at location A, you will eventually get an audit-trail question that has no clean answer. Location-scoped roles also make hiring a new shop manager safer. You do not have to grant company-wide visibility for someone running one site.
A common shortcut is to give every manager full access on the assumption that "everyone is trustworthy." Trust is not the issue. The issue is that the inspector or the DRP auditor will ask who signed off on the May fire extinguisher inspection at the Mt. Airy location, and you need an answer that ties back to one specific person at one specific site.
A central audit log
Location scoping for editing rights does not mean location scoping for the audit trail. The audit log should be central. Every state-changing action, at every location, should write to one log that the owner and the corporate compliance lead can review.
What that gives you:
- Visibility into anomalous patterns. If location C is logging far fewer toolbox talks than locations A and B, that is a signal long before the OSHA inspection.
- Reconciliation when an inspector asks about a record modified after the fact.
- Evidence for DRP audits that span sites.
The audit log entry should include actor, action, target record, location, timestamp, IP address, and the version hash of any document affected.
Centralized templates, locally customized
Written programs (HazCom, Respiratory Protection, Fire Prevention, Emergency Action) should be templated centrally and customized per location. Two reasons:
- The legal substance of each program is the same across the company. The chemical inventory and the responsible person are local. Splitting the document into a template plus a local-fields layer keeps the boilerplate consistent and the specifics accurate.
- When the underlying regulation changes, you update the template once. Each location's program inherits the change, with a prompt to re-acknowledge.
The trap to avoid is having each shop maintain its own Word document. Three shops, three documents, three slightly different revision dates. By year three, no one knows which one is canonical.
OSHA 300 logs are per-establishment
The OSHA 300 log is required to be maintained at the establishment where the injury occurred and posted from February 1 through April 30 each year for the prior year. A multi-location operator with three shops keeps three separate 300 logs. They do not merge. The annual 300A summary gets posted at each location.
A common MSO mistake is consolidating injury reporting up to corporate and assuming that satisfies the requirement. It does not. The log lives at the establishment.
Inspections do not coordinate, but you can
A federal OSHA inspection at one location does not automatically trigger inspections at sister locations. A complaint-driven inspection at location B is contained to location B. But if the same finding appears at multiple locations, the agency takes notice.
Your reaction to a finding at one location should be: did we just learn something that applies to all of them? If a 6H painter at the Frederick shop has an expired certificate, the next move is to pull the painter rosters at every location that day and confirm none of the others lapsed.
A starter checklist for MSOs
If you run two or more shops and have not formally structured the compliance side, three weekend's worth of work:
- Define location-scoped roles. Owner, GM, Shop Manager, Technician. Map every current employee to one role at one location.
- Pull the master record for each location: EPA ID, permits, painter roster, SDS library, written programs. Confirm each is current at each site.
- Set one calendar at corporate that pulls every annual deadline across every location. One view.
Once that is done, the day-to-day work is keeping each location's records current. The structural exposure goes away. What remains is the operational discipline at each site, which is where it should have been all along.