OSHA is responsible for enforcing the provisions of the Occupational Safety and Health Act of 1970 for about half the states; the remaining 26 states have been granted authority to set and enforce their own safety and health standards under a state plan approved by OSHA. At present, 22 of these 26 states enforce occupational safety and health provisions under a state plan covering all worksites, and have their own VPP programs. The other 4 states have plans covering only public sector employer worksites; VPP sites in these 4 states are part of OSHA's federally managed VPP. To help ensure compliance with federal safety and health regulations and standards, OSHA conducts enforcement activities and provides compliance assistance to employers. Enforcement represents the preponderance of agency activity and includes safety and health inspections of employer worksites. Among its compliance assistance efforts, OSHA established the VPP in 1982 to recognize worksites with safety and health systems that exceed OSHA's standards. A key requirement for participation in the VPP is that worksites have low injury and illness rates compared with the average rates for their respective industries. The VPP is divided into three programs (see table 1): the Star, Merit, and Star Demonstration programs. The Star program has the most stringent requirements because it is for worksites with exemplary safety and health systems that successfully protect employees from fatality, injury, and illness. OSHA's Directorate of Cooperative and State Programs--the national office--oversees the VPP activities of each of its 10 regional and 80 area offices. Each regional office has a regional administrator, who coordinates all of the region's activities, including the VPP, and a VPP manager, who implements and manages the program. The VPP manager conducts outreach to potential VPP sites and encourages participants to continually improve their safety and health systems. In addition, the VPP manager coordinates the region's activities related to the program, such as reviews of applications submitted by potential sites and on-site reviews of VPP sites. Employer worksites apply to OSHA to participate in the VPP. They must meet a number of requirements, including having an active safety and health management system that takes a systems approach to preventing and controlling workplace hazards. As shown in figure 1, OSHA has defined four basic elements of a comprehensive safety and health management system. These requirements must be in place for at least 1 year. In addition, there must be no ongoing enforcement actions, such as inspections, at the worksites or willful violations cited by OSHA within the 3-year period prior to the site's initial application to participate in the VPP. VPP sites are also required to have injury and illness rates below the average rates for their industries published by Bureau of Labor Statistics. These rates must be below the average industry rates for 1 of the most recent 3 years. VPP sites are required to report their injury and illness rates to OSHA's regional offices annually. The VPP managers review this information and send summary reports to the national office. For each calendar year, the national office compiles a summary report of injury and illness rates for VPP sites participating in the program. OSHA determines whether worksites are qualified to participate in the VPP through its approval process, which includes an on-site review of each worksite. According to OSHA guidance, the regional offices are required to conduct an on-site review of each potential VPP site to ensure that the four elements are in place and to determine how well the site's safety and health management system is working. As part of these reviews, the regions are required to verify the sites' injury and illness rates, interview employees and management, and walk through the facilities. This initial on-site review usually lasts about 4 days and involves approximately three to five OSHA staff, according to OSHA's VPP policies. OSHA also uses volunteers from other VPP sites--Special Government Employees who have been trained by OSHA--to conduct some portions of these reviews. OSHA's national office is responsible for the initial approval of all new VPP sites. VPP sites in the Star program must also be reapproved every 3 to 5 years after an on-site review is conducted by the region. OSHA's approval process is outlined in table 2. Once they have been approved, VPP sites must commit to continuously improving the safety and health of their worksites, maintaining low injury and illness rates, and reporting annually to OSHA on the status of their safety and health systems. The VPP sites' annual reports detail their efforts to continuously improve and detail the sites' injury and illness rates. OSHA's regional offices review these reports to ensure that the VPP sites' injury and illness rates have not increased beyond the program's requirements. According to OSHA's VPP Policies and Procedures Manual, OSHA must request that a site withdraw from the VPP if it determines that the site no longer meets the requirements for VPP participation. OSHA may also terminate a site for failure to maintain the requirements of the program. The national office is responsible for collecting the injury and illness data reported annually by VPP sites to the regions. If VPP sites' 3-year average rates rise above the average rates for their industries published by the Bureau of Labor Statistics, the regions must place the site on a rate-reduction plan if an on-site review is not conducted that year or must place the site in a 1-year conditional status if an on-site review is conducted. The regions must also notify the national office of actions they take in response to incidents, such as fatalities and serious injuries, at VPP sites. The regions are required to review sites' safety and health systems after such incidents to determine (1) whether systemic changes are needed to prevent similar incidents from occurring in the future and (2) whether the site should remain in the program. The regions may also conduct on-site reviews of VPP sites if they determine that the incidents were related to deficiencies in the sites' safety and health management systems. The decision to recommend whether a site at which a fatality has occurred should remain in the program is left to the discretion of the regional administrator. The VPP has grown steadily since its inception, with the number of employer worksites in the program more than doubling--from 1,039 sites in 2003 to 2,174 sites in 2008. During this period, the number of sites in the federally managed VPP, representing over two-thirds of all VPP sites, increased at a similar rate as the number of sites in the state managed programs. In 2003, there were 734 sites in the federal VPP and 305 in the state managed VPP. By the end of 2008, both the federal and the state programs had more than doubled to 1,543 and 631, respectively. (See fig. 2.) Although the industries represented in the VPP did not change significantly from 2003 to 2008, there were substantial increases in certain industries. The largest industry in the VPP was the chemical industry, which accounted for a 43 percent increase in the number of VPP sites, from 208 in 2003 to almost 300 in 2008. The motor freight transportation industry, which had only 20 sites in 2003, grew tenfold to just over 200 sites in 2008, due in part to the growth in the number of Postal Service sites. In addition, the number of sites in the electric, gas, and sanitary services industries increased from about 50 sites to more than 200 during the same period. See figure 3 for a comparison of the largest industries represented in the VPP in 2003 and 2008. While 4 federal worksites--including the Tobyhanna Army Depot in Tobyhanna, Pennsylvania, and the National Aeronautics and Space Administration Langley Research Center in Hampton, Virginia--have participated in the VPP since the late 1990s, the number of federal worksites increased to almost 10 percent of all VPP sites in 2008. At the end of 2008, almost 200 VPP sites were federal agencies or Postal Service sites. The majority of these sites--157--were post offices, processing and distribution centers, and other postal facilities, while most of the remaining sites were Department of Defense facilities, such as naval shipyards, Army depots, and Air Force facilities. In addition, from 2005 to 2008, 7 OSHA area offices in 1 region were approved as new VPP sites as a result of OSHA's efforts to have all of its offices participate in the program so that they could be role models for the federal agencies. The average size--based on the number of employees--of VPP sites has become increasingly smaller in the last 5 years. From 2003 to 2008, the average number of employees at VPP sites decreased from 501 to 408. In addition, the median size of a VPP site decreased from 210 to 145 employees. As shown in figure 4, the proportion of VPP sites with fewer than 100 workers increased from 28 percent in 2003 to 39 percent in 2008. Across all VPP sites, the number of employees covered by the VPP has grown to over 885,000 workers. A key factor influencing growth of the VPP has been OSHA's emphasis on expansion of the program. For example, in 2003, the Secretary of Labor for OSHA announced plans to expand eligibility for the VPP to reach a larger number of worksites. These plans included adding more federal sites, such as Department of Defense facilities and certain types of construction sites. OSHA's national office has given each of its 10 regions targets for the number of new sites to be approved each year. While the regions did not always meet these targets from fiscal years 2003 to 2008, they generally increased the number of new sites each year, as shown in table 3. Several OSHA regional administrators told us that expanding the program beyond the current level of approved sites will be difficult, given their current resources. Another factor influencing the growth of the VPP is outreach efforts, including participants' outreach to other employers and employers seeking out the program after hearing about it from OSHA or other employers. According to OSHA officials and VPP participants, outreach efforts focus on the positive benefits of the program, including improved productivity of workers at VPP sites and decreased costs, such as reductions in sites' workers' compensation insurance premiums due to lower injury and illness rates. Some employers, such as the Postal Service, also cite avoidance of the costs of workplace injuries--which the National Safety Council estimated as approximately $39,000 per year, per incident in 2007--as one of the benefits of participation. In addition, the national association of VPP participants, the Voluntary Protection Programs Participants' Association, contributes to program growth through its mentoring program in which current participants help new sites meet the qualifications of the VPP. We interviewed employees from VPP sites, and their perspectives varied. Employees who supported the program told us that the benefits include having a more collaborative partnership between OSHA, management, and workers; establishing a "mindset of safety"; and addressing several safety problems at one worksite that workers had tried for several years to have corrected. Those who did not fully support the program included employees at VPP sites who told us that they recognized some of the benefits of the VPP, but that they had reservations about the program. For example, some employees were concerned that, after the application process and initial on-site review had been completed, sites may not maintain the high standards that qualified them for participation. Furthermore, some employees said that the injury and illness rates requirements of the VPP are used as a tool by management to pressure workers not to report injuries and illnesses. OSHA's internal controls are not sufficient to ensure that only qualified worksites participate in the VPP. First, OSHA's oversight is limited by the minimal documentation requirements of the program. Second, OSHA does not ensure that its regional offices consistently comply with its policies for the VPP. OSHA's lack of a policy requiring documentation in the VPP files of actions taken by the regions in response to incidents, such as fatalities and serious injuries, at VPP sites limits the national office's ability to ensure that regions have taken the required actions. OSHA's VPP Manual requires regions to review sites' safety and health systems after such incidents to determine whether systemic changes are needed to prevent similar incidents from occurring in the future and whether the site should remain in the program. However, the manual does not require the regions to document their decisions or actions taken in the VPP files, which would allow OSHA's national office to ensure that the regions took the appropriate actions. When fatalities, accidents, or other incidents involving serious safety and health hazards occur at any VPP site, OSHA's policy requires that enforcement staff conduct an inspection of the site. In these cases, the area director is required to notify the VPP manager and send a report of the inspection. The VPP manager is then required to report information on the incidents that occurred to the Assistant Secretary for Occupational Safety and Health, the Director of Cooperative and State Programs, and the regional administrator. The decision on whether to conduct an on-site review after such an incident is left to the discretion of the regional administrator based on the results of the enforcement inspection. These reports, however, are not required to be included in the VPP files maintained by the regions. OSHA has a draft policy that sets time frames for retention of documents in the VPP files, but the policy does not contain guidance regarding the types of actions that must be documented in the files. Some regional VPP officials told us that they have requested such guidance from OSHA's national office, but the national office has not issued a directive on what information should be documented in the files or on how long it should be retained. The OSHA official responsible for overseeing the program did not agree with regional VPP officials, and stated that the VPP Manual addresses the documentation requirements. However, the manual does not require actions taken by the regions in response to fatalities and serious injuries to be documented in the VPP files. From our review of OSHA's VPP files, we found that there was no documentation of actions taken by the regions' VPP staff to (1) assess the safety and health systems of the 30 VPP sites where 32 fatalities occurred from January 2003 to August 2008 or (2) determine whether these VPP sites should remain in the program. We obtained information on VPP sites at which fatalities occurred during this period from OSHA's national office. To determine what actions were taken in response to the fatalities, we interviewed regional VPP staff and reviewed the regions' inspection and VPP files for the sites with fatalities. Although the actions taken by the regional VPP staff were not documented in the VPP files, we reviewed the inspection files and interviewed the VPP staff to determine the actions they took in response to the fatalities. The VPP managers told us that they placed 5 of the 30 sites on 1-year conditional status, and that 5 sites voluntarily withdrew from the VPP. OSHA allowed 17 of the sites to remain in the VPP--some in the Star program and some in the Merit program--until their next regularly scheduled on-site reviews. One of these sites had 3 separate fatalities over the 5-year period. Another site received 10 violations related to a fatality, including 7 serious violations and 1 violation related to discrepancies in the site's injury and illness logs. OSHA allowed this site to continue to participate in the VPP as a Star site. Three sites had not been reviewed by the regional VPP staff because OSHA's enforcement staff had not completed their investigations of the sites. As a result, sites that did not meet the definition of the VPP's Star program to "successfully protect employees from fatality, injury, and illness" have remained in the program. OSHA's oversight of the VPP is limited because it does not have internal controls, such as management reviews by the national office, to ensure that its regions consistently comply with VPP policies for verifying sites' injury and illness rates and conducting on-site reviews. Although having relatively low injury and illness rates are key criteria for program participation, the regions do not always verify sites' rates according to OSHA's policies. For example, the VPP Manual requires that, prior to conducting an on-site review, the region must obtain written approval from the national office allowing access to medical information related to injuries and illnesses at the site. However, our review of the VPP files and information from OSHA's national office showed that, for almost 80 percent of the cases, regions did not obtain such written approval prior to conducting their on-site reviews. As a result, the regions did not have access to workers' medical records needed to verify sites' injury and illness rates, and the national office had no assurance that the regions verified these rates as required. In addition, OSHA's national office did not review the actions taken by the regions to ensure that they followed up when VPP sites' injury and illness rates rose above the minimum requirements for the program. From our review of OSHA's 2007 summary report of injury and illness rates for VPP sites, we found that, for 12 percent of the sites, at least one of their 3-year average injury and illness rates was higher than the average injury and illness rates for their industries. For example, one VPP site reported a 3- year average injury and illness rate of 10.0, which was 7.6 points higher than the industry average of 2.4. Similarly, another site's 3-year average injury and illness rate was 7.5 points higher than the industry average. We found that this site's injury and illness rate had also been above the industry averages for each of the previous 4 years, yet it remained in the VPP Star program. OSHA's national office does not require regions to report information on actions taken to ensure that sites lower their injury and illness rates when these rates rise above the industry averages. The national office, therefore, cannot ensure that the regions take action as required. As a result, some sites that have not met a key requirement of the VPP have remained in the program. Finally, some regions conducted less comprehensive reviews of VPP sites than those required by the VPP Manual. In an effort to leverage its limited resources, OSHA permitted two regions to conduct abbreviated on-site reviews as part of a pilot program in which the regions were allowed to evaluate only one or two elements of sites' safety and health management systems, rather than all four elements. From our review of the VPP files, we estimated that, from 2000 to 2006, OSHA conducted abbreviated on-site reviews of almost 10 percent of its sites. As a result, some sites for which OSHA reviewed only two of the four elements may not have met all of the minimum requirements to participate in the program. According to the OSHA official responsible for managing the VPP, the agency discontinued its use of these abbreviated reviews after learning from the pilot that it is difficult to isolate certain program elements, and that evaluating only one or two elements leaves out key aspects of the program because the four elements are interrelated. OSHA's efforts to assess the performance of the VPP and evaluate its effectiveness are not adequate. First, OSHA has not developed performance goals or measures to assess the performance of the program. Second, OSHA contracted for a study of the VPP to evaluate its effectiveness, but the study was flawed. OSHA has not developed performance goals or measures for the VPP to assess the program's performance. The Government Performance and Results Act of 1993 requires agencies to set goals and report annually on program performance by measuring the degree to which the program achieves those goals. OSHA officials told us that, while they have not established specific goals for the VPP, the best measure of program performance is that VPP participants consistently report average injury and illness rates that are about 50 percent below their industries' average rates. However, these rates may not be the best measure of performance. First, our analysis of OSHA's annual summary reports of injury and illness rates for 2003 through 2007 showed that, for 35 percent of the sites in our sample for which data were available, there were discrepancies between the injury and illness rates reported by the sites and the rates noted in OSHA's regional on-site review reports for the same time periods. For example, OSHA's 2007 summary report showed that one VPP site reported an injury and illness rate of zero, but OSHA found during its on-site review that the rate was actually 1.7 for the same period. Second, OSHA has not evaluated the impact of the VPP on sites' injury and illness rates, such as comparing VPP sites' injury and illness rates with those of similar sites that do not participate in the program. OSHA also does not use information reported annually by VPP sites to develop goals or measures that could be used to assess program performance. VPP participants are required to conduct annual self assessments of their sites and to report this information to OSHA. The reports are to contain a review of the site's safety and health management system, including safety and health hazards identified and the steps taken to correct them; a description of any significant management changes that can affect safety and health at the site, such as changes in ownership; and information on benefits related to participation in the VPP, such as cost savings due to lower workers' compensation insurance premiums, decreased turnover and absenteeism, and increased productivity. However, OSHA's national office does not use the information from these reports because most of this information is maintained in the regional offices, and they are not required to send it to the VPP national office. In response to a recommendation in our 2004 report that the agency evaluate the effectiveness of the VPP, OSHA contracted with The Gallup Organization to study the effectiveness of the program--the results of which were reported in September 2005. As part of this study, OSHA identified two objectives that included (1) determining the impact of its outreach and mentoring programs on potential and new VPP sites' safety and health systems and (2) determining changes in the VPP sites' injury and illness rates due to their participation in the program. To obtain information for this study, The Gallup Organization sent a questionnaire to all VPP sites participating in the federally managed program. However, the study had significant design flaws. Specifically, the response rates by participants were low (46 percent overall, and 34 percent completed the questionnaire), and the data reported by participants were not validated. For example, a review of the sites' mentoring and outreach efforts, which are not indicators of program performance, made up two-thirds of the report, and other factors that could have influenced the sites' injury and illness rates were not considered or measured. Because of these limitations, we concluded that the report's findings were not reliable or valid and could not be used to demonstrate the effectiveness of the VPP. In our discussions with OSHA officials, they acknowledged the limitations of the study, but said they have not conducted any additional evaluations of the VPP and have no plans to conduct future evaluations of the effectiveness of the program. Officials said they do not need to do so because the low injury and illness rates reported by VPP participants are the best measure of the program's effectiveness. However, without a more reliable evaluation of the program, OSHA does not know whether the program is effectively meeting its objective of recognizing worksites with exemplary safety and health management systems that exceed OSHA's standards. OSHA continues to expand the VPP, which adds to the responsibilities of staff who manage and maintain the integrity of the program and reduces the resources available to ensure that non-VPP sites comply with safety and health regulations and with OSHA's standards. In the absence of policies that require its regional offices to document information regarding actions taken in response to fatalities and serious injuries at VPP sites, OSHA cannot ensure that only qualified sites participate in the program. In addition, some sites with serious safety and health deficiencies that contributed to fatalities have remained in the program, which has affected its integrity. Without sufficient oversight and internal controls, OSHA's national office cannot be assured that the regional offices are following VPP policies. Finally, because OSHA lacks performance goals and measures to use in assessing the performance of the VPP, it continues to expand the program without knowing its effect on employer worksites, such as whether participation in the VPP has improved workers' safety and health. To ensure proper controls and measurement of program performance, the Secretary of Labor should direct the Assistant Secretary for Occupational Safety and Health to take the following three actions: develop a documentation policy regarding information on follow-up actions taken by OSHA's regional offices in response to fatalities and serious injuries at VPP sites; establish internal controls that ensure consistent compliance by the regions with OSHA's VPP policies for conducting on-site reviews and monitoring injury and illness rates so that only qualified worksites participate in the program; and establish a system for monitoring the performance of the VPP by developing specific performance goals and measures for the program. We provided a draft of this report to the Secretary of Labor for comment. We received written comments from the Assistant Secretary for Occupational Safety and Health, which are reproduced in their entirety in appendix II. The agency also provided technical comments, which we incorporated in the report as appropriate. OSHA agreed with our recommendations to develop better documentation requirements and strengthen internal controls to ensure consistent compliance with VPP policies across its regions. Regarding our recommendation to develop performance goals and measures for the VPP to use in monitoring performance, OSHA stated that it would continue to identify and refine appropriate performance measures for the program. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to relevant congressional committees, the Secretary of Labor, and other interested parties. The report will also be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7215 or lasowskia@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. To identify the number and characteristics of employer worksites in the Voluntary Protection Programs (VPP), we analyzed data in the Department of Labor's Occupational Safety and Health Administration (OSHA) VPP database. We reviewed data in OSHA's VPP database for all sites in the VPP--both those in the federally managed program and in the VPP programs managed by the states. We analyzed data on VPP participation activity from the inception of the program in 1982 through the end of calendar year 2008. Prior to our analysis, we assessed the reliability of the information in OSHA's VPP database by interviewing OSHA officials; reviewing related documentation, including the data system user manual; and conducting electronic testing of the data. On the basis of our review of the database, we found that the data were sufficiently reliable to report the number and characteristics of participants in the VPP. To determine the factors that contributed to growth in program participation, we obtained information about the VPP from officials at OSHA's national office and the 10 regional offices. To enhance our understanding of the VPP from the perspective of the participants, we interviewed employees, including union and nonunion employees at VPP sites as well as employees from sites that elected not to participate in the VPP. To determine the extent to which OSHA ensures that only qualified worksites participate in the VPP, we reviewed OSHA's internal controls for the program and limited our review to VPP sites in the federally managed program that were part of the Star program. We reviewed sites in the federally managed program because they represent over 70 percent of the sites in the program--1,543 of the 2,174 sites--and because the policies and practices for the state managed programs differ from state to state. We reviewed sites in the Star program because they represented more than 95 percent of sites in the federally managed VPP at the time of our review, and because the Star program has the most stringent requirements. To assess OSHA's internal controls, we compared OSHA's VPP Policies and Procedures Manual with GAO's Standards for Internal Control in the Federal Government. We also reviewed OSHA's policies and procedures for the federal VPP, including (1) procedures for on-site reviews of VPP sites, (2) annual reporting requirements for VPP sites to report data to the regions, and (3) requirements for regional offices to report information to OSHA's national office. To determine the extent to which OSHA complied with its procedures in approving initial and renewing VPP participants, we reviewed OSHA's VPP files for a randomly selected, representative sample of VPP sites in the program as of April 2008. Estimated percentages derived from this sample have confidence intervals of no more than +/- 7 percent. The files, maintained by OSHA's regional offices, contained reports of the regions' on-site reviews of VPP sites. We reviewed the reports of the reviews conducted prior to the sites' initial acceptance and, if they had been in the program long enough to be reapproved, the most recent review conducted. We reviewed the VPP files and interviewed officials at OSHA's regional offices in Atlanta, Boston, Dallas, New York, and Philadelphia. We selected these sites to obtain a geographic range of regional offices with small, medium, and large numbers of VPP sites. We interviewed officials in the five remaining regional offices in Chicago, Denver, Kansas City, San Francisco, and Seattle by telephone and had them send the VPP files for their sites to us for review. To determine what actions OSHA took in response to fatalities at VPP sites, we asked OSHA's national office for a list of all sites at which fatalities occurred from January 2003 to October 2008. The national office asked the regions to provide this information, and the national office provided this information to us. We reviewed the inspection and VPP files maintained by the regional offices for these sites and interviewed VPP managers about the actions taken by the regions in response to the fatalities. Finally, we reviewed other information provided by the regional offices to the national office, such as data on the injury and illness rates for each VPP site that are reported by the sites annually to OSHA and tracked by the national office on electronic spreadsheets. To assess the adequacy of OSHA's efforts to assess the performance and effectiveness of the VPP, we reviewed its policies and procedures, performance and accountability reports, operating plans, and The Gallup Organization's 2005 evaluation report of the VPP. We reviewed these documents relative to the guidelines in the Government Performance and Results Act of 1993. To verify the injury and illness rates reported by VPP sites to OSHA's regions in the sites' annual reports, we compared the data tracked by the national office on sites' injury and illness rates with the rates reported in OSHA's on-site reviews for the sites in our sample of 184 sites. We assessed the Gallup study on the basis of commonly accepted program evaluation standards. We conducted this performance audit from March 2008 through May 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Revae Moran, Acting Director, and Anna M. Kelley, Analyst in Charge, managed all aspects of the assignment. Kathleen Boggs, Richard Harada, Yumiko Jolly, and Summer Pachman made significant contributions to the report. In addition, Richard Brown, Doreen Feldman, Justin Fisher, Cindy Gilbert, Sheila R. McCoy, Kathleen van Gelder, Gabriele Tonsil, and Shana Wallace provided key technical and legal assistance.

Summary:
The Department of Labor's Occupational Safety and Health Administration (OSHA) is responsible for ensuring workplace safety. OSHA has established a number of programs, including the Voluntary Protection Programs (VPP), that take a cooperative approach to obtaining compliance with safety and health regulations and OSHA's standards. OSHA established the VPP in 1982 to recognize worksites with exemplary safety and health programs. GAO was asked to review (1) the number and characteristics of employer worksites in the VPP and factors that have influenced growth, (2) the extent to which OSHA ensures that only qualified worksites participate in the VPP, and (3) the adequacy of OSHA's efforts to monitor performance and evaluate the effectiveness of the VPP. GAO analyzed OSHA's VPP data, reviewed a representative sample of VPP case files, and interviewed agency officials. The VPP has grown steadily since its inception in 1982, with the number of employer worksites in the program more than doubling--from 1,039 sites in 2003 to 2,174 sites in 2008. Although industries represented have not changed significantly, with the chemical industry having the largest number of sites in the VPP, the number of sites in the motor freight transportation industry--which includes U.S. Postal Service sites--increased tenfold from 2003 to 2008. The proportion of smaller VPP sites--those with fewer than 100 workers--increased from 28 percent in 2003 to 39 percent in 2008. Key factors influencing growth of the VPP have been OSHA's emphasis on expansion of the program and VPP participants' outreach to other employers. OSHA's internal controls are not sufficient to ensure that only qualified worksites participate in the VPP. The lack of a policy requiring documentation in VPP files regarding follow-up actions taken in response to incidents, such as fatalities and serious injuries, at VPP sites limits the national office's ability to ensure that its regions have taken the required actions. Such actions include reviewing sites' safety and health systems and determining whether sites should remain in the program. GAO reviewed OSHA's VPP files for the 30 sites that had fatalities from January 2003 to August 2008 and found that the files contained no documentation of actions taken by the regions' VPP staff. GAO interviewed regional officials and reviewed the inspection files for these sites and found that some sites had safety and health violations related to the fatalities, including one site with seven serious violations. As a result, some sites that no longer met the definition of an exemplary worksite remained in the VPP. In addition, OSHA's oversight is limited because it does not have internal controls, such as reviews by the national office, to ensure that regions consistently comply with VPP policies for monitoring sites' injury and illness rates and conducting on-site reviews. For example, the national office has not ensured that regions follow up as required when VPP sites' injury and illness rates rise above the minimum requirements for the program, including having sites develop plans for reducing their rates. Finally, OSHA has not developed goals or measures to assess the performance of the VPP, and the agency's efforts to evaluate the program's effectiveness have been inadequate. OSHA officials said that low injury and illness rates are effective measures of performance. These rates, however, may not be the best measures because GAO found discrepancies between the rates reported by worksites annually to OSHA and the rates OSHA noted during its on-site reviews. In addition, OSHA has not assessed the impact of the VPP on sites' injury and illness rates. In response to a recommendation in a GAO report issued in 2004, OSHA contracted with a consulting firm to conduct a study of the program's effectiveness. However, flaws in the design of the study and low response rates made it unreliable as a measure of effectiveness. OSHA officials acknowledged the study's limitations but had not conducted or planned other evaluations of the VPP.