Underwriting With Public Enforcement Data: OSHA, DOL, and EPA Records as Risk Signals

The federal government publishes more about a prospect's safety and compliance history than most underwriters ever look at. The loss run tells you what happened to the carrier. The public record tells you what happened to the employees and the regulators. For a PEO deciding whether to take on a client, or an MGA pricing a program, that second record is often the more useful one, and it costs nothing.

This post walks through the datasets we have found worth pulling, what each contains, and the discipline required to use them without turning a public record into an unfair underwriting decision. We checked the descriptions below against the agencies' own pages.

OSHA enforcement: inspections, violations, penalties

The Department of Labor publishes OSHA inspection data through its enforcement data portal and through Data.gov. The inspection dataset provides summary information about each OSHA inspection, and the catalog entry lists it as updated daily. Related tables cover the violations cited and the accident investigations tied to an inspection. The records go back decades and include both federal OSHA and, for many states, State Plan inspections.

For underwriting, the questions are specific. Has the prospect been inspected, and was the inspection programmed, complaint-driven, or triggered by an accident or referral. Were violations cited, and were any serious, willful, or repeat. Was the penalty contested, settled down, or paid as assessed. Is there an open inspection right now.

A programmed inspection with no citations is close to neutral. A complaint inspection that produced a serious citation tells you an employee reported a hazard and an inspector agreed. A repeat citation tells you the same hazard came back. A willful citation is rare and should change the conversation entirely.

The matching problem is real. OSHA records an establishment name and address as the inspector wrote them down. Matching that to the legal entity on an ACORD 130 takes name normalization, address matching, and a tolerance for DBAs. HALO IQ uses the same fuzzy company matching InboxIQ uses to route documents, with a human confirming any match below a confidence threshold.

OSHA ITA: the injury rates employers report about themselves

The Injury Tracking Application is different from the enforcement data. It is not what an inspector found; it is what the employer reported on its own Form 300A. OSHA has published the establishment-level 300A summary data since the 2016 reporting year, and beginning with 2023 data certain larger establishments in designated industries also submit case-level detail from Forms 300 and 301.

The submission requirement, per OSHA's data page, applies to establishments with 250 or more employees that are not in an exempt industry, and to establishments with 20 to 249 employees in a list of higher-hazard industries. That means a small clerical firm will not be in the data at all, and its absence means nothing. A 60-employee roofing contractor that should be in the data and is not has a recordkeeping problem that is itself a signal.

From the 300A summary you can compute a total case rate and a DART rate and compare them to the industry. OSHA is explicit that it does not validate the counts establishments report, so treat a suspiciously clean 300A for a hazardous operation the way you would treat a suspiciously clean loss run. When the self-reported injury count and the loss run disagree, one of them is wrong, and finding out which is the underwriter's job.

DOL Wage and Hour: the leading indicator for PAGA and misclassification

The Wage and Hour Division publishes its compliance action data, described on Data.gov as all concluded WHD compliance actions since fiscal year 2005, updated roughly quarterly. Each record shows whether violations were found, the back wages assessed, the number of employees due back wages, and any civil money penalties.

For a PEO this is arguably the most important dataset on the list, and the one fewest underwriters check. Workers' comp underwriting is about injuries. PEO underwriting is also about co-employment liability, and the wage-and-hour record is the best public evidence of how a prospect treats its payroll obligations. An employer with a federal back-wage finding in the last few years is one whose timekeeping, overtime, or classification practices already failed under scrutiny. In California that history belongs in the PAGA conversation, and in PAGA IQ we treat a prior WHD action as a reason to look harder at the regular-rate and meal-period math.

The federal data does not capture state labor agency actions, and California's Labor Commissioner record is a separate, less uniformly published source.

EPA ECHO: environmental compliance as an operations signal

EPA's Enforcement and Compliance History Online covers facility-level permit, inspection, violation, and enforcement data across the major environmental programs, and the agency publishes it both through a facility search and as bulk downloads.

Why would a workers' comp or PEO underwriter care about a stormwater permit violation? Because environmental compliance and workplace safety are managed by the same people with the same attitude. A manufacturer with a string of unresolved air or hazardous-waste violations is telling you something about how it runs its floor. It also tells you about chemical exposure, which for a PEO is a workers' comp exposure, an SDS inventory question, and a hazard communication question all at once. SafetyIQ's SDS inventory exists partly because this connection is so direct.

SAM.gov exclusions: who the federal government will not do business with

The System for Award Management maintains the federal exclusions list, and GSA publishes it through a public API and a downloadable extract. The record types include ineligibility with proceedings pending or completed, prohibitions and restrictions, and voluntary exclusions, and records are classified as individuals, firms, vessels, or special entity designations.

Most PEO prospects will never appear here. The ones that do are a hard stop for some programs and a serious conversation for all of them. An exclusion for a labor violation or for fraud is not something a PEO wants to discover from a carrier after binding. Checking takes seconds. The API requires an account key, and the public extract is a flat file you can refresh on a schedule.

FMCSA: the fleet record for anyone with trucks

If a prospect operates commercial motor vehicles it has a USDOT number, and FMCSA publishes a company snapshot for every registered carrier covering identification, size, safety rating if one has been assigned, roadside inspection and out-of-service results, and crash records. The snapshot is free and queryable one carrier at a time, and FMCSA also publishes its safety measurement data in bulk.

For a PEO, the fleet record is the loss run for the exposure the workers' comp loss run does not show well. A high vehicle out-of-service rate means maintenance is behind and drivers are at elevated risk of the kind of crash that becomes both a liability claim and an indemnity claim. For any client with a delivery fleet, pull the snapshot before the proposal, not after the first claim.

CSLB: the California contractor record, including who insures them

California's Contractors State License Board publishes a downloadable master list of licensed contractors at no charge. The license master file includes license number, business name, address, status, issue and expiration dates, classifications, bond information, and workers' compensation information. A separate personnel file lists the people associated with each license, and a separate workers' compensation file carries the coverage type, carrier, policy number, and policy dates.

For a PEO writing California construction, this file answers three underwriting questions at once. Is the license active and in what classifications, which should agree with the class codes on the submission. Who are the qualifying individuals and officers, which is the start of an ownership check for mod purposes. And who currently insures the workers' comp, or whether the contractor has filed an exemption claiming no employees, which is a conversation starter if the submission shows forty employees.

Using this responsibly

Public enforcement data is powerful precisely because it is unfiltered, and that cuts both ways. A few rules we follow.

Match carefully and keep the evidence. A false match attributes someone else's citations to your prospect. Every public record HALO IQ attaches to a company carries the matched name, address, and confidence so an underwriter can see why it belongs.

Weigh recency and resolution. A serious citation that was contested and vacated is not a serious citation. A back-wage finding from 2009 with nothing since is a company that fixed its problem. Show the record and its disposition, not just a count.

Treat absence as absence, not as clean. Most small employers have no federal enforcement record because nobody has looked.

Do not let the data replace the conversation. The best use of a public record is a better question for the site visit or the discovery call. An underwriter who walks in knowing about the 2023 complaint inspection and asks what changed afterward learns far more than one who does not. And a PEO's own counsel should confirm how public records fit into its underwriting guidelines, since some jurisdictions restrict how certain records can be used.

How this fits in HALO IQ

We built enforcement data ingestion in HALO IQ because our own PEO's underwriters were pulling these records by hand, one agency site at a time. Now the public record is pulled on a schedule, matched to the company, and shown in the client workspace alongside the loss runs, the mod projection, and the proposal. The underwriter still makes the call. They just make it with the whole record in front of them.