Workplace Violence Prevention Plan Requirements Checklist
If you are vetting an existing plan or thinking about writing one in-house, this page is the checklist.
If you are vetting an existing plan or thinking about writing one in-house, this page is the checklist. We see two situations most often. A multi-location operator has a plan written before SB 553 went into effect and is not sure it still holds up. Or an in-house safety lead pulled down a sample plan, started working through it, and stopped at the hazard assessment because the categories did not match the facility.
A workplace violence prevention plan has to be in writing, specific to the facility, and complete on every element the regulation calls out. The requirements come from California Labor Code §6401.9, the standard SB 553 created and the one Cal/OSHA enforces. A plan is compliant when every required element is present, current, and tied to the actual workplace. Below is the checklist we work from when we write plans, and the one Cal/OSHA inspectors work from when they audit them.
For the full overview of the law and how CDMS handles each part, see our California Workplace Violence Prevention Plan (SB 553) guide.
Core WVPP Requirements
A workplace violence prevention program built around generic policy language is usually missing at least half of these. Labor Code §6401.9(c)(2) lays out the required plan contents in subparagraphs (A) through (M); the checklist below groups them in plain language. A compliant plan addresses all of them in writing.
| Required Element | What It Has to Cover |
|---|---|
| Responsible persons | The persons responsible for implementing the plan, identified by name or job title, with their roles spelled out when more than one person is involved |
| Employee involvement | How active employees and their representatives participate in developing and implementing the plan |
| Coordination with other employers | Procedures for communicating workplace violence hazards to contractors, temp agencies, and any other employers whose workers are on site |
| Reporting procedure | How employees report workplace violence concerns and threats, with assurance that reporting will not result in retaliation |
| Employee compliance | Procedures to make sure supervisory and nonsupervisory employees comply with the plan |
| Communication with employees | How the employer communicates with employees about workplace violence matters, how to report without fear of reprisal, and how concerns are investigated and resolved |
| Emergency response | How employees are alerted to a workplace violence emergency, evacuation or shelter plans, and how to get help from staff, security, or law enforcement |
| Hazard identification and evaluation | Procedures to identify and evaluate hazards, including periodic inspections, and the criteria used for each of the four types of workplace violence |
| Hazard correction | How identified hazards are corrected in a timely manner, and how each correction is documented |
| Post-incident response and investigation | Procedures for responding to affected employees and investigating after an incident |
| Training | Initial training, annual refresher training, and training whenever a new hazard is identified or the plan materially changes |
| Plan review | At least annually, after every workplace violence incident, and whenever a deficiency is identified |
A separate but related artifact, required by §6401.9(d), is the violent incident log. The log is not part of the written plan itself, but the plan must reference it and a compliant program cannot exist without one. The log fields, the PII omission rule, and the 5-year retention are covered in a separate piece.
Responsible Persons
The statute requires the plan to identify, by name or job title, the persons responsible for implementing it, and to describe their roles clearly when more than one person is involved. It does not prescribe a fixed list of titles. In practice, we break implementation into the functions below so nothing falls through the cracks. In a small facility, the same individual often carries several. In a multi-location operation, the functions are usually distributed across HR, operations, and site leadership.
When we write a plan, we sit with the client and assign the following responsibilities, by name or job title:
- Plan implementation: who owns the plan as a whole
- Hazard identification and periodic inspections: who performs the walk-throughs and updates the hazard inventory
- Incident response: who is contacted when an incident happens, on every shift
- Post-incident investigation: who conducts the investigation and documents the findings
- Communication with employees: who delivers plan updates and answers questions
- Training: who schedules and tracks initial and annual training
- Recordkeeping: who maintains the log, the training records, and the hazard assessments
- Annual review: who initiates the review and signs off on any changes
The most common deficiency we find on existing plans is that the role is assigned, but the person has since left the company or moved to a different position. The plan was current the day it was signed. It is not current now.
What Site-Specific Means
A workplace violence prevention plan has to describe this facility, not workplace violence in general. The phrase Cal/OSHA uses is site-specific, and it is what separates a compliant plan from a downloaded template. In practice, site-specific means the plan references the actual layout of the facility, the access points, the shift patterns, the categories of workplace violence that apply to the work, and the controls already in place.
A template can give you boilerplate structure for the administrative elements: responsible persons, employee involvement, emergency and incident response, training, and plan review. The hazard identification, hazard correction, and post-incident pieces cannot come out of a template. When we walk a facility, the first thing we look at is access: who comes through the door, when, and what stops them at each layer. That is where the site-specific information lives.
What’s Usually Missing
When we audit plans that were assembled in-house or copied from a sample, the same gaps appear repeatedly:
- A hazard assessment that does not separate the four types. Type 1 (criminal intent by a stranger), Type 2 (customer or client), Type 3 (worker on worker), and Type 4 (personal relationship) have different criteria and different controls. A plan that treats workplace violence as one category fails the hazard identification element.
- Coordination with outside employers is left out entirely. This is the element most commonly missing. If your facility uses contractors, temp staffing, or vendors who come on site, the plan needs to address how hazards are communicated to them and to their employers.
- No annual review documentation. The plan says reviews will happen annually. There is no log of when reviews were performed, who participated, and what changed in response.
- Training records that do not match the roster. Records show a generic workplace violence module was assigned, but there is no site-specific delivery on file, no quiz or interaction record, and no annual refresher.
- Responsible persons who have left the company. Names are still in the plan from the original writing.
- The violent incident log does not exist, or is confused with the OSHA 300 log. The §6401.9 violent incident log is a separate document with its own required fields and retention rule.
Any one of these is a citable deficiency under Cal/OSHA. Most existing plans we review have three or four.
Recordkeeping Minimums
Records associated with the plan have to be kept for specific minimum periods under California law:
- Violent incident logs: at least 5 years
- Hazard assessments and incident investigations: at least 5 years
- Training records: at least 1 year
- Employee access: employees and their representatives may request to view or copy the log, and copies must be provided within 15 calendar days, with personally identifying information redacted
These are floor minimums. We recommend keeping training records for the full life of the plan, because the training rule has a notice element (employees must be trained on the current plan, and proving that over time requires the historical record).
Putting the Plan Together
The checklist above is what a finished plan has to contain. Assembling it follows roughly this sequence:
Site walk-through.
Hazards, layout, access points, shift coverage.
Interviews.
Facility manager, HR, operations, and a sample of employees.
Hazard assessment
across the four violence types, with per-type criteria and documented findings.
Drafting.
Writing against the required §6401.9 elements, naming responsible persons (by name or job title) for each plan function.
Client review.
Names confirmed, hazards verified, procedures matched to actual operations.
Final delivery.
The plan, the violent incident log template, and the reporting form.
Initial training,
once the plan is final.
Annual review and refresher,
scheduled for the following year.
If you are starting from nothing, the sequence is the project. If you have an existing plan, the same sequence becomes the audit: each step is a verification point against what is already written.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.