A dated signature on the cover of last year's plan is the most common way this requirement is failed. The standard asks for specific content from the review, and it asks who was consulted.
The review. The Exposure Control Plan must be reviewed and updated at least annually and whenever necessary to reflect new or modified tasks and procedures which affect occupational exposure, and to reflect new or revised employee positions with occupational exposure (29 CFR 1910.1030(c)(1)(iv)).
What the review must do. It must reflect changes in technology that eliminate or reduce exposure to bloodborne pathogens (29 CFR 1910.1030(c)(1)(iv)(A)), and it must document annually the employer's consideration and implementation of appropriate commercially available and effective safer medical devices designed to eliminate or minimize occupational exposure (29 CFR 1910.1030(c)(1)(iv)(B)). That second item is the one added by the Needlestick Safety and Prevention Act; "we looked at safer sharps and here is what we decided" has to be written down every year.
Who gets a say. An employer required to have a plan must solicit input from non-managerial employees responsible for direct patient care who are potentially exposed to injuries from contaminated sharps, in the identification, evaluation and selection of effective engineering and work practice controls, and must document the solicitation in the plan (29 CFR 1910.1030(c)(1)(v)).
Access. The plan must be accessible to employees (29 CFR 1910.1030(c)(1)(iii)), and the sharps injury log and the plan together are what an inspector reads first in a healthcare setting.
If the review did not change anything, the plan should say what was considered and why nothing changed. Silence reads as no review.