The Three Plans at a Glance

The three plans share an enforcement agency (Cal/OSHA) and a structure (written, customized to your operations, available on site). They differ in what they cover, when they were enacted, and which employers they apply to.

Each plan is enforced separately. A Cal/OSHA inspector can cite a facility for the IIPP, the WVPP, or the heat illness plan independently of the others. They are not interchangeable, and a strong IIPP does not absorb the other two.

Why They Get Bundled

The IIPP is the umbrella. The WVPP and heat illness plan attach to it.

In practice, the WVPP and the heat illness plan can sit inside the IIPP as appendices or live as standalone documents that the IIPP references. Cal/OSHA accepts either arrangement, as long as the content for each plan is specific and customized to your operations and the supporting records (training, inspections, incident logs) exist. A generic reference inside the IIPP that says “we have a heat illness program” without the actual §3395 or §3396 content does not satisfy the standard.

When we walk a facility for the first time, the most common gap pattern is not the absence of all three plans. It is one strong program and two thin ones: an IIPP that gets attention every year, a heat illness reference that has not been updated since the indoor standard took effect, and no WVPP at all. SB 553 changed that math for most employers in mid-2024, and the WVPP is the plan we now add most often during IIPP rewrites.

The three are also bundled at the buying side. Procurement emails and proposal requests routinely list all three together. Loss-control auditors check for all three. A general contractor running a safety audit on subcontractors checks for all three. If your facility has one but not the others, you have one plan and two open findings.

What Each Plan Requires (in Brief)

• IIPP under §3203. Eight required elements under subsection (a): responsibility, compliance, communication, hazard assessment, accident investigation, hazard correction, training, and employee access. Plus recordkeeping under subsection (b). Best practice is to name a specific responsible person and title (not just a job title) and to write job-specific codes of safe practice, which are the practical way to meet the requirement for a system getting employees to follow safe work practices. For employers required to keep them, the recordkeeping cross-references the OSHA Form 300, 300A, and 301 logs. The IIPP lives on site. It is not filed with any agency. For a deeper breakdown of the eight elements, see what goes in an IIPP under Cal/OSHA §3203.
• WVPP under SB 553. A written plan that identifies workplace violence hazards, includes procedures for employee reporting and supervisor response, requires a violent incident log, mandates employee training on the plan and the specific hazards at your facility, and is reviewed annually. The plan must be specific to the workplace. A template from another employer does not satisfy the standard. Healthcare facilities already covered by Cal/OSHA’s §3342 healthcare workplace violence standard continue to operate under that rule, not under SB 553.
• Heat illness prevention under §3395 and §3396. Water at one quart per employee per hour for the entire shift. Outdoor shade access at 80°F (available on request at lower temperatures). Indoor cool-down areas maintained below 82°F where indoor work areas reach the trigger temperature. High-heat procedures at 95°F outdoor. Indoor heat-control measures at 87°F temperature or heat index (and at 82°F where employees wear heat-restrictive clothing or work in high radiant heat). Acclimatization procedures, emergency response, and training. The indoor plan must be written in English and in the language understood by the majority of workers. For the structure of a real plan, see our heat illness prevention services for California facilities.

How These Plans Get Built (and Why the Order Matters)

The IIPP comes first. It is the foundation, and the way it gets written shapes how the WVPP and the heat illness plan attach.

When we build all three together, the site visit covers the operations once and the data feeds all three documents. The job classifications and codes of safe practice in the IIPP become the basis for identifying who needs WVPP training and who is exposed to heat. The hazard assessment in the IIPP surfaces the heat-exposed indoor work areas and the spots where workplace violence risk is elevated (cash-handling, public-facing work, isolated shifts). Doing the plans in sequence rather than as separate visits keeps the documents consistent with each other.

The other reason to build them together: each plan has its own training requirement. The IIPP requires every employee trained on the program. The WVPP requires every employee trained on the workplace violence plan and the hazards at your facility. The heat illness plan requires every supervisor and every employee with potential heat exposure trained before the work starts. When the plans are written in coordination, the training can be delivered as one curriculum rather than three separate sessions that overlap and confuse the workforce.

Common Scenarios Where All Three Surface

The bundle shows up most often in five situations:

• Multi-state employer entering California. The federal safety manual covers none of the three. The facility needs an IIPP, a WVPP, and a heat illness plan before it can defend itself at a Cal/OSHA visit, a GC audit, or a loss-control review.
• New facility opening. Before a business license is issued and operations begin, the IIPP and the program-specific plans for the operations on site need to be in place.
• Gap assessment after a personnel departure. The facility had a program, the person who maintained it left, and a recent walkthrough revealed that the IIPP is stale, the heat illness plan does not address the 2024 indoor standard, and the WVPP was never written.
• Cal/OSHA inspector visit. An inspector arrives, asks for the IIPP, and follows the trail to the heat illness and workplace violence programs the IIPP either references or fails to.
• GC compliance audit on subcontractors. A general contractor’s safety audit checks for all three documents and rejects subcontractors that cannot produce them.

In every one of these scenarios, the answer is the same. The three plans get built (or rebuilt) together because the facility needs all of them, not because they are the same document.

Closing the Gap

California’s required written safety plans (the IIPP, the WVPP, and the heat illness plan) are separate documents with separate enforcement, but they are built from the same site walk, attached to the same operations, and trained on the same workforce. Treating them as a bundle is how most California facilities get them done.