The Two Compliant Structures

Cal/OSHA accepts two arrangements:

• A standalone WVPP. A separate written document that addresses California Labor Code §6401.9 on its own. The IIPP may reference it; the WVPP stands as its own program.
• A WVPP section or appendix inside the IIPP. A workplace violence section, written to the same requirements, embedded in the IIPP itself.

Either way, the content has to be complete. A one-paragraph mention of workplace violence inside an IIPP that says “see our workplace violence policy” without the required §6401.9 elements behind it does not satisfy SB 553. The reverse is also true: a standalone WVPP that does not name responsible persons or describe the hazard assessment is not compliant just because it lives in its own folder.

When Each Approach Makes Sense

In practice, the choice usually comes down to who maintains the documents and how the next review cycle is scheduled. If your IIPP is on a known annual cadence and one team owns it, the WVPP-inside-IIPP arrangement reduces calendar overhead. If the IIPP was written years ago and nobody has looked at it, building the WVPP separately avoids reopening a document that needs its own rewrite.

Where the Two Programs Overlap

The IIPP under Title 8 CCR §3203 and the WVPP under Labor Code §6401.9 share several structural elements. That overlap is why one document can serve both purposes when written carefully.

Both require:

• A named responsible person who owns the program
• Procedures for employee involvement, including how employees report hazards without retaliation
• A hazard assessment specific to the facility
• Training tied to the actual hazards employees face
• A correction process when hazards are identified
• An annual review

When we walk a facility and look at both programs side by side, the same job classifications, site layout, and supervisory structure show up in both documents. That is the practical case for combining them: the underlying facts are the same.

Where the Two Programs Differ

The differences are specific, and they are where most combined documents fall short.

The WVPP requires elements the IIPP does not:

• Hazard identification across four distinct types of workplace violence. Each type has its own assessment criteria. A generic IIPP hazard assessment does not capture them. See the four types of workplace violence under SB 553.
• A violent incident log under §6401.9. A separate log with specific fields, omitting personally identifying information, retained five years. Employees may request to view or copy it within 15 calendar days. The IIPP has no comparable record.
• Coordination with outside employers. Procedures for communicating workplace violence hazards to contractors, temp agencies, and any other employer whose workers are on site.
• Post-incident response and investigation procedures. Specific procedures for what happens after an incident: support for affected employees, the investigation process, and plan updates based on findings.
• A reporting procedure with anti-retaliation language tied specifically to workplace violence.

A WVPP section inside an IIPP that does not contain each of these is not compliant. When we audit combined documents, missing log procedures and a missing four-type hazard assessment are the two most common gaps.

What We Recommend

Most facilities we work with end up with the WVPP as a standalone document. The reasons are practical:

• The WVPP has its own annual review cycle and its own refresher training. Keeping it separate keeps the cadence visible.
• The violent incident log is a live recordkeeping item employees may request to view. Keeping it attached to the WVPP rather than buried inside a long IIPP binder is operationally cleaner.
• An inspector asking specifically for the workplace violence plan gets a clearly labeled document.

That said, if your IIPP is being rewritten anyway, building the WVPP in at the same time is reasonable and saves a site visit. The right answer is the one that gets the plan reviewed every year and the refresher training delivered on schedule. Cal/OSHA does not care which folder it is in. It cares that the plan exists, that it is specific to your facility, and that you are using it.