Injury and Illness Prevention Program (IIPP) for California
Every California employer with at least one employee is required to have a written Injury and Illness Prevention Program (IIPP) under SB 198 and Title 8 CCR §3203. There is no size exemption, no industry exemption, and no grace period.
Every California employer with at least one employee is required to have a written Injury and Illness Prevention Program (IIPP) under SB 198 and Title 8 CCR §3203. There is no size exemption, no industry exemption, and no grace period. It is the foundational written safety program from which every other Cal/OSHA program (PPE, hazard communication, lockout/tagout, confined space, heat illness, workplace violence) branches off. When a Cal/OSHA inspector arrives at your facility, this is the first document they ask for.
If you already know you need a California IIPP built or rewritten, this page explains what the document contains, how we approach the work, and what to expect when CDMS walks your site. If you are not sure whether your current safety program meets California’s requirements (or whether you have one at all), the section below will help you figure that out. Either way, an IIPP is not a binder of generic OSHA forms pulled off a shelf. It is a facility-specific document that has to reflect what your operations actually look like and what your employees actually do.
What a California IIPP Is (and What Cal/OSHA Requires)
SB 198 took effect in 1991 and added §3203 to Title 8 of the California Code of Regulations. The rule applies to every employer in the state. The IIPP is not filed with any agency. It lives on your site, available to employees and to any Cal/OSHA inspector who asks to see it.
A California IIPP has to cover eight specific elements. It also has to be “effective,” which is the regulatory word for “actually used.” A 250-page binder that nobody on the floor has ever read is not a defense in an inspection. Cal/OSHA evaluates whether you are implementing what your written program says you do. That distinction (paper compliance vs. implementable program) is the single biggest source of trouble we see when we walk a facility for the first time. We cover this in more detail in how to tell if your IIPP is actually working.
Common Reasons California Facilities Call Us About Their IIPP
Most of the IIPP work we do comes from one of six situations. If any of these sound like yours, your IIPP is likely the right place to start.
You have an IIPP, but it is federal OSHA, not California.
This is the most common one. A multi-state employer assumes their corporate safety manual covers California, and it does not. Federal OSHA does not require an IIPP-equivalent for general industry. California does, along with a handful of other states. A federal-only program will not satisfy a Cal/OSHA inspector and will not pass a general contractor’s compliance audit on subcontractors. More on the federal vs. California IIPP gap.
You have something, but you do not know if it is any good.
A previous consultant or HR vendor delivered a document, it has sat on a shelf for several years, and the references inside it are dated. Employees listed as responsible for sections have left the company. Codes of safe practice list job titles that no longer exist. Training records do not match what is in the plan. This is paper compliance, and it is the version of “having an IIPP” that fails fastest under inspection.
You do not have one at all.
A new facility, a recent acquisition, or a senior staff departure left you without a written program. Sometimes the trigger is a Cal/OSHA letter. Sometimes a general contractor running an audit on subcontractors flags the gap. Sometimes a workers’ compensation loss-control visit raises it.
A gap assessment turned up IIPP findings.
Nearly every facility gap assessment we run surfaces IIPP issues, even at facilities that thought they were in good shape. When the assessment hands you a list of things to address, the IIPP is usually at the top because everything else depends on it. What to do when a gap assessment finds IIPP issues.
You were just visited by Cal/OSHA, or you expect to be.
An inspector left a list of items to correct, or you have heard that Cal/OSHA is auditing facilities in your area. The first thing in their hand at the next visit is going to be your IIPP. What inspectors actually look for in your IIPP.
You are opening a new facility, or you just moved operations to California.
In California, an IIPP and a site-specific written program are typically prerequisites before a business license is issued. The earlier you start, the cleaner the launch.
The Eight Elements of a California IIPP
Cal/OSHA §3203 lays out eight required elements under subsection (a), plus a recordkeeping requirement under subsection (b) that documents them. Each one has to be present in writing, and each one has to be backed by actual practice at your facility.
| IIPP Element | What It Covers | Cal/OSHA Citation |
|---|---|---|
| 1. Responsibility | Identifies the person (or persons) with authority and responsibility for implementing the program. Best practice is to name a specific individual and title, and keep it current. | §3203(a)(1) |
| 2. Compliance | How the employer gets employees to follow safe work practices. Includes recognition and disciplinary procedures. | §3203(a)(2) |
| 3. Communication | The system for two-way communication between management and employees on safety matters. Includes meetings, suggestion procedures, and how employees report hazards without fear of reprisal. | §3203(a)(3) |
| 4. Hazard Assessment | Scheduled and unscheduled inspections to identify and evaluate workplace hazards. | §3203(a)(4) |
| 5. Accident/Exposure Investigation | Written procedures for investigating workplace injuries, illnesses, and exposure incidents. | §3203(a)(5) |
| 6. Hazard Correction | Methods and timelines for correcting unsafe conditions in a way appropriate to severity. | §3203(a)(6) |
| 7. Training and Instruction | When training is required: new hire, new assignment, when new substances/processes/equipment introduce a new hazard, and when the employer learns of a previously unrecognized hazard. All employees must be trained, with an added layer for supervisors. | §3203(a)(7) |
| 8. Employee Access | Employees and their designated representatives have the right to examine and receive a copy of the written Program. | §3203(a)(8) |
| Recordkeeping | Documentation of inspections, training, and hazard correction, retained per Cal/OSHA’s requirements. For employers required to keep them, the OSHA Form 300, 300A, and 301 injury/illness logs are cross-referenced here. | §3203(b) |
That is the regulatory skeleton. A real California IIPP also includes a company profile, a written safety policy, codes of safe practice by job classification, safety meeting structure, emergency response procedures, contractor notification language, and an appendix of supporting documents (inspection checklists, accident investigation forms, training documentation, the OSHA 300 logs, and any program-specific addenda your operations need). A deeper breakdown is available in what goes in an IIPP: the eight required elements under Cal/OSHA §3203.
What “Implementable” Means to a Cal/OSHA Inspector
Cal/OSHA’s standard is not “do you have a written plan.” It is “are you doing what your plan says you do.” That distinction is where most IIPPs fail.
When a Cal/OSHA inspector walks into a facility, they will look for the IIPP, then look for the evidence that it is being used. That evidence includes training records dated and signed by the people listed in the plan. Inspection records showing the inspections in your schedule actually happened. Accident investigation forms for any OSHA 300 entries. Codes of safe practice posted or distributed for the job classifications at your facility. Safety meeting minutes that match the cadence your IIPP describes.
A 628-page federal manual fails this test. So does a generic template downloaded from a free template site and dropped into a binder. The most common deficiencies we find when we walk a facility for the first time:
- The plan names a person responsible who no longer works at the company.
- Job classifications listed in the codes of safe practice do not match current operations.
- The IIPP includes sections that do not apply to the facility (outdoor heat illness procedures at an indoor-only facility, for example).
- Required programs are missing from the appendix (PPE assessment, heat illness, workplace violence, hazard communication).
- Training records are incomplete, undated, or do not cover the people listed in the program.
- Inspection schedules are documented but the inspections never happened.
When we find these gaps, we treat them as deficiencies to correct. Cal/OSHA, on the other hand, issues violations. The difference matters.
How CDMS Builds an IIPP for Your Facility
We come to your facility. That is the model. Our consultant travels to your site, walks your operations with someone who knows them (usually the facility manager, operations lead, or whoever has been handed safety responsibility), and gathers the information the IIPP needs to actually reflect your work.
Before the visit, we ask for what we need to scope and write the plan properly:
- Your existing IIPP, if you have one
- Up to three years of OSHA 300, 300A, and 301 logs, if your facility is required to keep them
- Your SIC or NAICS code
- A list of job titles and what each one actually does
- Copies of any existing safety policies and procedures
- Your current employee count
This is from the actual data collection sheet we use. Specificity at this stage saves time and prevents the document from drifting into generic territory.
On site, we walk your operations. We look at the floor, the storage areas, the maintenance practices, and the equipment. We talk to supervisors and employees about how work actually gets done. We identify the hazards your job classifications are exposed to. That walkthrough is also where we figure out which Cal/OSHA programs branch off the IIPP for your specific facility: do you need a PPE assessment under §3380, a heat illness plan under §3395 or §3396, a workplace violence prevention plan under SB 553, a hearing conservation program, a lockout/tagout program, confined space procedures? Some of these are appendices in the IIPP. Some are standalone programs the IIPP references. The walkthrough tells us which.
The deliverable is a written IIPP customized to your facility. It is built around your job classifications, your codes of safe practice, your actual operations. We deliver it as a PDF for review and an editable Word document at final delivery, with both versions in the same email so the as-delivered version is documented.
We do this as a fixed-price engagement. We will provide a timeline with your quote based on the scope your facility needs. Most California facilities do not need a 250-page document. They need an implementable one. For more on why the free template approach often misses, see IIPP templates and why a free Cal/OSHA sample isn’t enough.
How the IIPP Connects to Your Other Safety Programs
The IIPP is the trunk. The Cal/OSHA programs your facility actually needs branch off of it. Three of the most common branches that get built or reviewed alongside the IIPP:
PPE and hazard assessment under §3380.
Title 8 §3380 requires the employer to assess workplace hazards and certify the selection of PPE. The high-level hazard assessment we run during the IIPP walkthrough is enough to satisfy the regulatory requirement. A more detailed job hazard analysis (JHA) by process or by job classification is a separate piece of work that feeds into PPE selection and training. The difference between JHA and PPE assessment is worth understanding before you scope this work, and the procedural side is covered in how to run a workplace hazard assessment under Cal/OSHA §3380. The full service is described on our PPE and hazard assessment page.
Heat illness prevention under §3395 and §3396.
California has two heat illness standards. §3395 has applied to outdoor work since 2006 (water at one quart per employee per hour, shade at 80°F, high-heat procedures at 95°F and above, training, emergency response). §3396, effective July 23, 2024, applies to indoor work areas where the temperature reaches 82°F or the heat index reaches 87°F. Warehouses, food processing facilities, manufacturing floors, commercial kitchens, and laundries in inland California are typical candidates. The plan can sit inside the IIPP as an appendix or as a standalone document referenced from it. Our heat illness prevention plans page covers both standards. The indoor-specific requirements are detailed in our California indoor heat illness standard piece, and the structure of a real plan is broken down in our heat illness prevention plan template piece.
Workplace violence prevention under SB 553.
Most California employers with ten or more employees are now required to have a written workplace violence prevention plan. It is a separate program from the IIPP but often gets developed at the same time. Together, the IIPP, the heat illness plan, and the WVPP make up California’s core workplace safety programs for many facilities.
Frequently Asked Questions
Where is an IIPP filed?
It is not filed. The IIPP lives on site at your facility. Cal/OSHA does not maintain a registry of IIPPs and does not accept submissions. The plan needs to be available to employees, available to a Cal/OSHA inspector on request, and kept current as facility conditions change.
Does federal OSHA require an IIPP?
No. Federal OSHA does not require an IIPP-equivalent for general industry employers. California is one of a handful of states (along with Hawaii, Oregon, and a few others) that mandate a written injury and illness prevention program. If your safety manual was written to federal OSHA standards, it almost certainly does not meet Cal/OSHA’s §3203 requirements.
Who needs an IIPP in California?
Every California employer with at least one employee. There is no exemption based on size, industry, or whether the facility handles hazardous materials. The requirement applies to manufacturers, warehouses, offices, retail, food service, construction, agriculture, and every other category.
Can we write our own IIPP using a free Cal/OSHA template?
You can, and Cal/OSHA publishes sample templates for that purpose. The template is a starting point, not a finished document. The most common failure mode we see is a facility that downloaded a generic template, never customized it to actual operations, and never trained anyone on it. Cal/OSHA’s standard is not “do you have a document.” It is “are you implementing it.” If your team has the time and the regulatory knowledge to customize the template, train every employee on the content, and keep it current, the template works. If not, the template becomes paper compliance.
How often does an IIPP need to be updated?
Whenever facility conditions change in a way that affects safety. A new process, new equipment, new chemicals, a new building, new job classifications, an accident that reveals a hazard the plan did not address: all of these trigger an update. The OSHA Form 300 log gets posted annually (Form 300A) from February 1 to April 30. Training records need to be kept current. We typically review the IIPP annually with our ongoing compliance clients to keep it aligned with actual operations.
What happens if Cal/OSHA finds we don’t have an IIPP?
A missing or inadequate IIPP is a common Cal/OSHA citation. Penalties depend on the classification of the violation (regulatory, general, serious, willful) and on whether the facility has prior history. Beyond the citation itself, the absence of an IIPP frequently leads inspectors to look deeper into other programs, because the IIPP is the document that points to whether the rest of your safety system exists.
Building Your California IIPP
A California IIPP is not optional, and it is not generic. It has to reflect the operations at your specific facility, train the people who actually work there, and be backed by the records that show it is being used.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.