The EHS Programs California Facilities Get Cited for Most

Every year, federal OSHA publishes its top 10 most cited workplace safety standards. Every year at the California CUPA Conference, enforcement agencies present the violations they cite most frequently during hazardous materials and hazardous waste inspections. Water Boards audit stormwater compliance. Air Districts inspect permitted equipment and operations. The programs behind the top violations across all of these agencies are the same ones we find missing or outdated when we walk into a facility for the first time.

These aren’t obscure regulations. They’re the standard EHS programs that apply to most California industrial and commercial facilities. They show up on citation lists because they’re the ones most likely to be missing, incomplete, or out of date.

What CUPA Inspectors Cite Most

CUPAs, the local agencies (which may be fire departments, county environmental health departments, or other local agencies) that enforce hazardous materials and hazardous waste regulations, track violations across the California Unified Program. Data presented at the 2026 CUPA Conference shows the same categories at the top year after year.

Hazardous Materials (HMBP)

Among the most common CUPA findings is an incomplete or inaccurate chemical inventory in CERS, California’s online environmental reporting system. After that: missing or outdated employee training records, site maps that don’t reflect the current facility layout, and inadequate emergency response plans. Rounding out the top 10: failing to certify the HMBP by the annual due date, not updating emergency contacts, and not reporting changes to chemical inventory within the required timeframe.

The pattern is consistent. Facilities file the HMBP once and stop maintaining it. The chemical inventory drifts from what’s actually stored on site. The site map still shows the layout from before the renovation. The emergency contact listed left the company two years ago. None of this is hard to fix, but if nobody is assigned to keep it current, it drifts until the fire department finds it during an inspection. See the full checklist →

Hazardous Waste

On the waste side, the most common citation is improper labeling of accumulation containers: missing the “Hazardous Waste” label, missing accumulation start dates, or containers not properly closed when waste isn’t being added. Next: not keeping manifest records available for inspection, operating without a valid EPA ID number, exceeding accumulation time limits, and open or mismanaged containers.

Training shows up here too. Failure to ensure employees are familiar with proper waste handling and emergency procedures is a top-10 violation. So is failing to conduct or document weekly inspections of accumulation areas.

These are operational details, not complex regulatory questions. Labeling a container correctly takes seconds. But without someone actively managing the waste program (checking dates, verifying labels, documenting inspections), the details slip.

SPCC and Aboveground Petroleum Storage

The APSA/SPCC top violations center on inspection and testing records, maintaining a current SPCC plan on site, providing required training to oil-handling personnel, and completing the five-year plan review. The plan must be the current version. We’ve reviewed facilities where the SPCC plan existed but the on-site copy was an older revision, technically out of compliance despite having done the work.

“Oil” under SPCC includes hydraulic fluid, lubricating oil, cutting oil, fuel oil, and other petroleum products. Facilities that don’t think of themselves as petroleum operations often don’t think about SPCC, until an inspector asks for the plan. More on environmental compliance requirements →

Stormwater (Industrial General Permit)

Facilities covered under California’s Industrial General Permit are subject to Water Board inspections and audits, and the common findings are consistent. Not having a current Stormwater Pollution Prevention Plan on site. Missing or late sampling results in SMARTS, California’s online stormwater reporting system. Failing to respond to Numeric Action Level exceedances with corrective actions. And the operational best management practices that inspectors can see the moment they walk the facility: pollutant-generating activities conducted outside covered areas, open waste containers exposed to rain, inadequate housekeeping around material storage and loading areas.

The coverage question itself is a common gap. Stormwater permit requirements are triggered by SIC code, but they can also be triggered by specific activities, like a fueling station or outdoor equipment wash area, even if the facility’s primary SIC code wouldn’t require coverage. Facilities that don’t think stormwater applies to them sometimes find out during an inspection that it does.

Air Quality (Air District Permits)

California’s Air Districts (SCAQMD in Southern California, BAAQMD in the Bay Area, and dozens of others statewide) enforce air quality permits and regulations independently. Unlike CUPA and OSHA, they don’t publish ranked annual violation lists. But the common findings from Air District inspections follow a pattern.

Operating equipment without the required permit is the most straightforward violation, and it often happens not because the facility is ignoring the requirement, but because they didn’t know a particular piece of equipment or process needed one. Spray booths, solvent cleaning operations, generators, and certain manufacturing processes all have permitting thresholds that vary by district. Failing to notify the Air District of equipment modifications or changes in operation is another common finding. The permit reflects what was installed originally, not what’s running now. Exceeding emission limits, incomplete recordkeeping, and not maintaining required monitoring equipment round out the pattern.

For facilities in SCAQMD’s jurisdiction, rule-specific requirements add another layer. Rules like 1147 (NOx emissions from boilers), 1171 (solvent cleaning), and 1460 (metal recycling and shredding operations) have specific compliance requirements that apply based on equipment type and usage, and they change. Facilities that obtained a permit years ago may not be tracking which new or amended rules apply to their current operations.

What Cal/OSHA and Federal OSHA Cite Most

On the safety side, federal OSHA’s top 10 most cited standards have been stable for years. The same categories appear year after year, and California facilities are subject to Cal/OSHA standards that meet or exceed the federal requirements.

Hazard Communication is consistently in the top three. The citation isn’t for not having a HazCom program. Almost every facility has something. It’s for having one that’s incomplete: missing SDS for chemicals currently on site, containers without proper labels, employees who haven’t received training on the specific chemicals they handle, or training not delivered in the language the workforce speaks.

Lockout/Tagout is a perennial top-five citation. The requirement isn’t just a general lockout policy. It’s written energy control procedures for each specific piece of equipment, documented training for authorized and affected employees, and periodic inspections. Cal/OSHA’s standard under Title 8, Section 3314 goes beyond the federal standard with additional requirements around group lockout and periodic inspections. What we see most often is facilities where lockout happens in practice but the documentation doesn’t exist. The habits are there, but the program that proves it isn’t. Read about Cal/OSHA vs federal differences →

Respiratory Protection rounds out the top citations relevant to industrial and commercial facilities. Common discrepancies include no written program, missing elements in the program, employees not trained on the written program, no medical evaluations, no annual fit testing, and programs that aren’t task-specific. They don’t address the actual hazards present in the work being done.

Fall protection, ladders, scaffolding, powered industrial trucks, eye and face protection, and machine guarding consistently fill the remaining top-10 spots. Each one has a Cal/OSHA program requirement behind it, and each one gets cited because the program is either missing, outdated, or not being followed.

The California Layer

Federal OSHA’s top 10 doesn’t capture the Cal/OSHA-only requirements that have no federal equivalent. The IIPP (Injury and Illness Prevention Program) is required for every California employer under Title 8, Section 3203, and it’s the first document a Cal/OSHA inspector asks for. The Workplace Violence Prevention Plan under SB 553 is another California-specific requirement with no federal counterpart. They are common California-specific findings and should not be overlooked just because they do not appear on federal OSHA’s top-10 list. Learn more about Cal/OSHA requirements →

Top Violations and the Programs Behind Them

The programs in the right column are the ones a gap assessment evaluates. They’re also the ones most likely to be missing, incomplete, or out of date at facilities that haven’t had an outside review, because they’re the programs that require ongoing maintenance, and maintenance is what stops when no one is specifically assigned to it.

The Pattern Underneath

The top violations don’t change much year to year because the underlying pattern doesn’t change. Facilities set up programs when they first open or when an inspector forces the issue. Then operations shift, staff turns over, regulations get updated, and the programs don’t follow. The violations at the top of the list aren’t complex regulatory failures. They’re maintenance failures. Labeling. Training records. Annual certifications. Site maps. The basics that drift when nobody is watching.

A gap assessment evaluates your facility against the full regulatory landscape (CUPA-enforced programs, Cal/OSHA safety requirements, stormwater, air permits, wastewater) and identifies not just what’s outdated, but what should exist and doesn’t. The result is a clear picture of which programs need attention, organized by regulatory program with specific recommendations for each area.

Next Steps

If you recognized your facility in any of these violation categories, or you’re not sure which programs apply to your current operations, a conversation is the right place to start.

← Back to EHS Gap Assessment & Compliance Audit Services