Federal OSHA vs. California IIPP for Multi-State Employers
The single most common compliance gap we find at California sites with an out-of-state parent company is the same one, almost every time: the corporate safety program was built around federal OSHA, and the California location has no California-specific Injury and Illness Prevention Program (IIPP) on top of it.
The single most common compliance gap we find at California sites with an out-of-state parent company is the same one, almost every time: the corporate safety program was built around federal OSHA, and the California location has no California-specific Injury and Illness Prevention Program (IIPP) on top of it.
From the client side, it usually sounds like this: “We do have an IPC book. However, it’s federal OSHA standards, not California.” That quote came from a multi-state waterproofing company whose 628-page federal manual was delivered to every site, including the California branch. From corporate’s perspective, the facility was compliant. From Cal/OSHA’s perspective, the facility was missing its foundational safety document.
This piece walks through why a federal OSHA program does not satisfy California, what an IIPP adds on top, and what multi-state employers need to do to close the gap. For the broader picture, see our California-specific IIPP services for industrial and commercial facilities.
Federal OSHA Does Not Require an IIPP
The simplest version of the difference: federal OSHA, for general industry, does not require an Injury and Illness Prevention Program. There is no federal counterpart to California’s Title 8 CCR §3203. A safety program written entirely against federal standards can be complete on its own terms and still leave a California site without the document Cal/OSHA expects to see first.
A small number of states have an IIPP-equivalent rule under their own state plan, including California, Hawaii, Oregon, and Washington. Most states do not. If your corporate program was authored at a headquarters outside those states, it almost certainly does not contain an IIPP, and the gap will not be visible from a federal-OSHA checklist.
California has run its own state plan under Cal/OSHA since 1973, and SB 198 added the IIPP requirement in 1991. The program lives at Title 8, California Code of Regulations, §3203. Every California employer with one or more employees is required to have a written IIPP. There is no industry, size, or hazard-level exemption.
What California’s IIPP Adds on Top of Your Federal Program
A federal-only safety binder usually covers hazard communication, lockout/tagout, respiratory protection, PPE, and the other standards every industrial site needs. Those are useful and they apply in California too, but they sit one layer below the IIPP. The IIPP is the umbrella document that ties them together and assigns responsibility for keeping them current.
Here is what California requires on top of a federal-style program:
| Requirement | Federal OSHA (general industry) | California (Cal/OSHA) |
|---|---|---|
| Written IIPP | Not required | Required under Title 8 CCR §3203. Eight elements under (a): responsibility, compliance, communication, hazard assessment, accident investigation, hazard correction, training, and employee access, plus recordkeeping under (b). |
| Hazard communication, LOTO, PPE, respirator, etc. | Required under 29 CFR 1910 | Required under Title 8 with California-specific differences in several programs |
| Workplace Violence Prevention Plan (WVPP) | Not required for most industries | Required under SB 553 / Labor Code §6401.9 for nearly all employers since July 1, 2024 |
| Heat illness prevention, outdoor | No federal standard | Required under Title 8 §3395 (water, shade, high-heat procedures, training, emergency response) |
| Heat illness prevention, indoor | No federal standard | Required under Title 8 §3396 (effective July 23, 2024) for indoor work areas reaching specified temperature thresholds |
| Codes of safe practice by job classification | Not specifically required | Not named in §3203, but the standard, practical way to meet §3203(a)(2)’s requirement for a system ensuring employees follow safe work practices |
| OSHA Form 300/300A/301 logs | Required, with exemptions for small and low-hazard employers | Same exemptions apply; for covered employers, commonly cross-referenced in the IIPP appendix |
The IIPP is not redundant with the rest of your safety program. It is what makes the rest of the safety program enforceable from a Cal/OSHA perspective, because it names who is responsible, how training happens, how hazards get corrected, and how the documentation is kept. For a deeper look at what has to be in the document, see the eight required IIPP elements under Cal/OSHA §3203.
How the Gap Usually Shows Up
When we walk into a multi-state employer’s California location, the federal binder is usually thorough. It reflects real work by a corporate EHS team. The deficiency is not that the company is careless. It is that the California-specific layer was never added.
The three patterns we see most often:
No IIPP at all. Corporate sent the federal program. Nobody at the California site realized SB 198 required something different. The first time anyone asks for an IIPP is when Cal/OSHA, a general contractor’s safety auditor, or an insurance loss-control inspector requests it.
A federal IIPP-style document that does not satisfy §3203. Some federal templates use “Injury and Illness Prevention Program” as a label. The structure inside often does not match the eight Cal/OSHA elements, does not name a specific responsible person, does not include codes of safe practice by job classification, and does not address California-only programs like heat illness or WVPP.
A California IIPP that was localized from a federal template years ago and never maintained. The site has the document on paper, but it references job classifications that no longer exist, training that was never delivered, or programs the facility does not actually run. Cal/OSHA’s standard for the IIPP is “effective,” not “present.”
The first time the gap usually becomes visible is when a third party asks for the program. That can be a Cal/OSHA inspector after an injury report, a general contractor’s safety audit on a subcontractor, a fire department referral, or a workers’ compensation carrier doing loss control. By the time someone outside the company is asking, the easy fixes are already off the table.
What to Do If Your Program Was Built for Federal OSHA
The fix is not to rewrite the entire federal program. Most of it still applies. What is needed is the California-specific IIPP layered on top, with the federal program restructured underneath as the supporting standards.
What we typically do at multi-state sites:
Review the existing federal program to confirm which standards are already covered and which need California-specific revisions (heat illness, WVPP, and a few Title 8 programs that go beyond federal).
Build the IIPP as the umbrella document under §3203, with the eight required elements, a named responsible person at the site level (not a corporate VP), codes of safe practice for each job classification, and a hazard correction and inspection schedule.
Cross-reference the existing federal program as the supporting set of standards underneath. The IIPP does not have to duplicate the HazCom or LOTO program already written. It references them and assigns responsibility for keeping them current.
Add California-only programs the federal binder did not include (heat illness §3395 / §3396, WVPP under SB 553, any other Title 8 program triggered by the site’s operations).
Train employees at the California site on the IIPP. Cal/OSHA requires training all employees on the program, not just supervisors, and the training must be documented.
If you would rather build off a starting structure, see our piece on Cal/OSHA IIPP templates and why a free state-sample template is rarely enough for a real facility.
The pattern at most multi-state companies is that the corporate program is good work done against the wrong reference standard. Bringing the California site into compliance does not mean throwing it out. It means adding the layer Cal/OSHA expects on top.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.