What Goes in an IIPP: The 8 Required Cal/OSHA §3203 Elements
If you’re trying to figure out what an Injury and Illness Prevention Program actually is and what has to be in it, the answer lives in one place: Title 8 of the California Code of Regulations, Section 3203.
If you’re trying to figure out what an Injury and Illness Prevention Program actually is and what has to be in it, the answer lives in one place: Title 8 of the California Code of Regulations, Section 3203. Cal/OSHA laid out the core elements when SB 198 took effect in 1991. Subsection (a) sets eight required elements (the eighth, employee access to the Program, was added effective July 1, 2020), and subsection (b) sets the recordkeeping that documents them.
This piece walks through each of the eight elements plus the recordkeeping requirement: what the regulation requires, what it looks like in a real document, and where most California facilities fall short. For a wider look at the program itself, see our IIPP services for California employers.
The Eight Elements at a Glance
Every California employer with one or more employees is required to have a written IIPP. There is no industry, size, or hazard-level exemption. The plan stays on site (it isn’t filed with Cal/OSHA), and a Cal/OSHA inspector who walks in tomorrow will ask for it first.
| # | Element | Citation | What it requires |
|---|---|---|---|
| 1 | Responsibility | §3203(a)(1) | Identifies the person (or persons) with authority and responsibility for implementing the program. Best practice is to name a specific individual and title. |
| 2 | Compliance | §3203(a)(2) | A documented system for getting employees to follow safe work practices, with consequences when they don’t. |
| 3 | Communication | §3203(a)(3) | A two-way system to communicate safety information, with a way for employees to report hazards without retaliation. |
| 4 | Hazard Assessment | §3203(a)(4) | Scheduled and unscheduled workplace inspections to identify hazards. |
| 5 | Accident & Exposure Investigation | §3203(a)(5) | Written procedures for investigating workplace injuries, illnesses, and exposures. |
| 6 | Hazard Correction | §3203(a)(6) | Procedures for correcting unsafe conditions on a timeline proportional to the severity. |
| 7 | Training and Instruction | §3203(a)(7) | Training at hire, on new assignments, when new hazards are introduced, and when accidents reveal a gap. |
| 8 | Employee Access | §3203(a)(8) | Employees and their designated representatives have the right to examine and receive a copy of the written Program. |
| (b) | Recordkeeping | §3203(b) | Documentation of inspections, training, and investigations, retained per Cal/OSHA’s requirements. The records that document the eight elements above. |
A Closer Look at the Eight Elements
1. Responsibility (§3203(a)(1))
The IIPP must identify the person (or persons) with authority and responsibility for implementing it. The regulation allows “person or persons,” but the best practice is to name a specific individual and title rather than a bare job title, so accountability is clear and the program can be kept current. When a plant manager or EHS lead leaves, this is the line that goes stale first, and it’s also the line an inspector tends to spot first.
2. Compliance (§3203(a)(2))
The plan must spell out how the employer gets people to follow the program. This usually means a written disciplinary procedure paired with a recognition or incentive component. Both halves matter. If the document only lists consequences and no positive reinforcement, Cal/OSHA’s review guidance flags that as incomplete.
3. Communication (§3203(a)(3))
Safety communication has to flow both ways: from the employer to employees and from employees back. The regulation requires a system employees can use to report unsafe conditions without retaliation. Safety committees, toolbox talks, and a posted hazard-reporting form all live in this section.
4. Hazard Assessment (§3203(a)(4))
The IIPP must include scheduled periodic inspections and unscheduled inspections triggered by new processes, new substances, new equipment, or new injuries. This is the program-level inspection requirement; the deeper PPE-specific assessment lives under the §3380 hazard assessment. Both are required, and the IIPP should reference the §3380 work, not duplicate it.
5. Accident and Exposure Investigation (§3203(a)(5))
Written procedures for investigating workplace accidents, near-misses, and chemical exposures. The IIPP appendix typically carries the investigation form. Inspectors compare the form’s existence to whether it was actually used after the last OSHA 300 entry.
6. Hazard Correction (§3203(a)(6))
Once a hazard is identified, the IIPP has to document how it gets fixed and on what timeline. Imminent hazards are corrected immediately. Lower-severity findings get scheduled corrections with a target date. Cal/OSHA expects the timeline to match the risk.
7. Training and Instruction (§3203(a)(7))
Training is required at four triggers: at hire, when an employee is given a new job assignment, whenever a new substance, process, procedure, or equipment introduces a new hazard, and whenever the employer becomes aware of a previously unrecognized hazard. The Cal/OSHA training requirement covers all employees, not just supervisors, and supervisors get an additional layer on the hazards their reports are exposed to.
8. Employee Access (§3203(a)(8))
Added effective July 1, 2020, this element gives employees and their designated representatives the right to examine and receive a copy of the written Program, generally within five business days of a request. The IIPP should state how employees can access it and who to ask. It’s a newer element, so older programs written before 2020 often don’t address it at all.
Recordkeeping (§3203(b))
Separate from the eight elements above, subsection (b) requires records that document them: inspection records, training rosters, and accident investigation files, retained per Cal/OSHA’s requirements. For employers who are required to maintain OSHA injury and illness records, the IIPP file or appendix is typically cross-referenced to the OSHA Form 300, 300A, and 301 logs. Smaller employers (generally those with 10 or fewer employees) and certain low-hazard industries are partially exempt from routine 300/300A/301 recordkeeping, though serious injury and fatality reporting obligations still apply.
Starting from a template? Why the free Cal/OSHA IIPP sample isn’t enough →
Wondering if yours would hold up? Is your IIPP implementable or paper-only? →
Where California IIPPs Most Often Fall Short
When we walk a facility, the eight elements are usually all “present” in the binder. The gap is between what the document says and what’s actually happening on the floor.
The three most common failures we find:
Responsibility named at the wrong level. A corporate VP is listed instead of a site-level safety coordinator. The named person has never set foot in the facility.
Training documentation that doesn’t match the people on payroll. Employees who started six months ago aren’t on the training roster. Or the training is documented but didn’t cover the new hazards the facility added since.
Codes of safe practice that don’t reflect the jobs. §3203(a)(2) requires a system for ensuring employees follow safe work practices, and job-specific codes of safe practice are one of the most practical ways to meet that and show the program is customized to the facility. We routinely see facilities with twelve job classifications and three generic codes.
Cal/OSHA’s standard for a working IIPP is “effective.” If a Cal/OSHA inspection finds the program is documented but not implemented, the citation isn’t for the missing document. It’s for the failure to implement.
How the Eight Elements Tie Into the Rest of Your Safety Program
Think of the IIPP as the trunk of the tree. PPE, hazard communication, lockout/tagout, confined space, hot work, and heat illness prevention all branch off it. Each standalone program references the IIPP’s hazard assessment, training, and recordkeeping framework. When a Cal/OSHA inspector reviews any of those specialized programs, the IIPP is what ties them together.
That’s why “we have an IIPP book that’s mostly federal OSHA” is a problem. Federal OSHA does not require an IIPP-equivalent for general industry. A binder built from federal templates is missing the trunk, even when the branch programs look complete.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.