Step 1: Confirm You Are Covered

Before writing anything, confirm the law applies. The coverage trigger is 10 or more employees at the workplace, or any workplace open to the public regardless of size. A 6-person back-office operation with no walk-in traffic is not covered. A 4-person retail counter is. There are four exceptions: employers already under the Cal/OSHA Workplace Violence Prevention in Health Care standard, teleworkers in locations not controlled by the employer, workplaces under 10 employees with no public access, and CDCR and law enforcement facilities. If your situation is borderline, our coverage and exemptions page breaks down each category.

Step 2: Assess Hazards Across the Four Violence Types

The hazard assessment is what makes the plan site-specific. Cal/OSHA defines four types of workplace violence: criminal intent by a stranger (Type 1), customer or client violence (Type 2), worker on worker (Type 3), and personal relationship violence brought into the workplace (Type 4). Each type has its own criteria and its own controls. A manufacturing floor with no public access is mostly a Type 1 and Type 3 environment. A retail showroom adds Type 2. A facility with night shifts and parking-lot exposure typically picks up Type 4 risk for at least some employees.

The assessment is a walkthrough of the facility against those four categories. Access points, lighting, parking-lot security, alarm systems, lone-worker scenarios, after-hours operations, public-facing counters, and shift transitions are the elements we examine when we walk a site. The output is a written list of hazards with the controls already in place and the controls that are missing.

Step 3: Write the Plan and Assign Responsible Persons by Name

The written plan addresses all the required §6401.9 elements. Those include: responsible persons, employee involvement, coordination with outside employers, reporting and anti-retaliation procedures, employee communication, emergency response, hazard identification and evaluation, hazard correction, post-incident response and investigation, training, and plan review. The full requirements checklist covers each element in detail.

The element that catches in-house drafts most often is responsible persons. The plan has to name individuals, by name, for the statutory responsibilities. “The Safety Manager” is not a name. The plan also has to name a backup or alternate for each role, because compliance does not pause when somebody is on vacation. When we write a plan, we sit with the client and assign each role to a specific person, with a documented alternate.

Step 4: Set Up the Violent Incident Log and Reporting Form

The violent incident log is a separate document from the written plan, required by §6401.9. It is also separate from the Cal/OSHA Form 300 log. It captures incidents even when nobody was injured: threats, acts of aggression, near misses. Personally identifying information of victims, witnesses, and other employees has to be omitted from the log.

You also need a reporting form so employees have a defined way to surface incidents that feed into the log. The log fields, the PII omission rule, and the 5-year retention requirement are covered in a separate piece. Set both documents up before initial training, because training has to walk employees through how to report and where the log lives.

Step 5: Deliver Initial Training to All Employees

Initial training is delivered to every employee covered by the plan, on the day the plan goes into effect or as soon after as the schedule allows. The training has to be site-specific. That means it covers the actual plan you just wrote, your facility’s hazards, your reporting procedure, the responsible persons named in your plan, and the violent incident log. A generic online module by itself does not meet the rule, because it cannot reference any of those elements.

Delivery format is flexible. In-person sessions, webinars, and online LMS courses are all acceptable, as long as the content is site-specific and there is a verifiable training record for each employee. We deliver in all three formats and in both English and Spanish.

Step 6: Put the Annual Review and Refresher Training on the Calendar Before You Need Them

SB 553 requires the plan to be reviewed at least annually, after any workplace violence incident, and whenever a deficiency is identified. Refresher training is also annual. The order matters: the plan review has to happen first, so the refresher training references the current plan, not last year’s. This is where most of the compliance lapses we see start. The plan from 2024 gets shelved, the year passes, and nothing happens until somebody notices on a renewal. The annual review and refresher cycle gets its own page because the sequencing rule trips up so many facilities.

Schedule both before Year 1 ends. A calendar entry that triggers in month 10 of every plan year is the simplest control.

Step 7: Maintain Records on the Right Retention Schedule

Records under SB 553 have specific minimum retention periods under California law:

• Violent incident logs: at least 5 years
• Hazard identification, evaluation, and correction records: at least 5 years
• Incident investigation records: at least 5 years
• Training records: at least 1 year

Employees and their representatives may request to view or copy the violent incident log, and the employer has 15 calendar days to provide it with personally identifying information redacted. Build the recordkeeping system on day one. Trying to reconstruct a year of log entries during an inspection is not a position you want to be in.