OSHA Workplace Violence Prevention Program: The Elements Explained (and What California Adds)

The first thing I ask for on a safety walkthrough is the workplace violence prevention plan, and the most common answer I get is a policy paragraph in the employee handbook that says the company does not tolerate violence. That is a policy. It is not a program, and since July 1, 2024 it is not a plan that would survive a Cal/OSHA inspection in California either. The gap between the three is what this post is about.

I have investigated the aftermath of enough threats, fights and one very bad night in a parking structure to tell you that the paperwork is not the point. The point is that somebody looked at where the money changes hands, who works alone after dark, which former employee everyone is nervous about, and wrote down what the company is going to do about each one before it happens. OSHA has been publishing the same five-part outline for doing that since the 1990s, California has now made a version of it law, and New York is following. Here is what each element means in practice, what the “seven elements” everyone searches for actually are, and what the California statute adds on top.

Does OSHA Have a Workplace Violence Standard?

No. OSHA says so in plain words: there are currently no specific OSHA standards for workplace violence. What OSHA has instead is Section 5(a)(1) of the OSH Act, the General Duty Clause, which requires every employer to furnish a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. OSHA treats violence as one of those hazards, and it has an enforcement directive, CPL 02-01-058 (January 10, 2017), that tells its inspectors how to open a workplace violence inspection and what a citation has to prove.

The directive matters more than the guidance documents because it describes the moment an employer becomes exposed. In OSHA’s words, an employer that has experienced acts of workplace violence, or becomes aware of threats, intimidation or other indicators showing that the potential for violence exists, is “on notice” of the risk and should implement a workplace violence prevention program combined with engineering controls, administrative controls and training. Every General Duty Clause citation I have read on this subject follows the same shape: the employer knew (an incident log, a police report, a string of complaints), the hazard was recognized in the industry (healthcare, late-night retail, social services), a feasible fix existed, and the employer did not act.

The numbers behind the enforcement come from the Bureau of Labor Statistics. Of the 5,283 fatal work injuries in the United States in 2023, 740 were due to violent acts, and 458 of those were homicides, which makes violence the third-leading cause of death on the job. OSHA’s written guidance is aimed at the industries that carry most of that risk: OSHA 3148 for healthcare and social service workers (2016), OSHA 3153 for late-night retail (2009), and a taxi and rideshare publication with NIOSH. The five elements in those guides are the framework OSHA expects everyone else to borrow, and they are the ones I use in every industry I work in.

What Are the Four Types of Workplace Violence?

Before you can assess a worksite you need the vocabulary, because the controls for a robbery are nothing like the controls for a coworker with a grudge. OSHA, NIOSH and now the California statute all use the same four types, sorted by the relationship between the attacker and the workplace:

• Type 1, criminal intent. The attacker has no legitimate business at the site and comes in to commit a crime. Convenience store robberies, a delivery driver held up on a route, a janitor confronted in a building after hours. This type accounts for most workplace homicides, and the controls are physical: cash handling, lighting, visibility, locks, and not working alone at night.
• Type 2, customer or client. The attacker is someone the business serves: a patient, a customer, a student, an inmate, a passenger, a visitor. This is the most common type of nonfatal assault, and it dominates healthcare, social services and public-facing counters. The controls are staffing, de-escalation training, alarms and a way to get help fast.
• Type 3, worker on worker. A current or former employee, supervisor or manager attacks or threatens a coworker. This is the type most workplace violence training videos are built around: warning signs, veiled and conditional threats, the coworker whose behavior changes. The controls are reporting, investigation, threat assessment and how terminations are handled.
• Type 4, personal relationship. Someone who does not work there but has a personal relationship with an employee, usually a current or former partner, brings the violence to the workplace. The controls are a reporting channel the employee trusts, restraining-order procedures, front-desk photo alerts and parking-lot escorts.

When I run a hazard assessment I score each work area against all four, because a hotel front desk is exposed to Types 1, 2 and 4 on the same shift, and a back-of-house kitchen is mostly a Type 3 problem. A program that only trains on Type 3 warning signs (which is what most off-the-shelf videos do) has covered a quarter of the risk. That is fine as the training element, as long as the rest of the plan does the other three quarters.

What Are OSHA’s Five Elements of a Workplace Violence Prevention Program?

OSHA 3148 calls them the five “building blocks” of an effective program, and every credible plan I have reviewed, including the Joint Commission requirements for hospitals and the California statute, is a rearrangement of the same five. Here is what each one looks like when it is real rather than written.

1. Management Commitment and Worker Participation

The program starts with a policy statement signed by the top person on site, a named individual who owns the plan (by job title, so it survives turnover), and money and time behind it. OSHA is specific that the commitment has to be visible: the policy covers everyone including customers, contractors and visitors; every report is investigated; nobody is retaliated against for reporting. The participation half is the part most companies skip. Workers who handle the cash, close the store or answer the call bell know where the risk is better than anyone in the office, and a program written without them is a program they will not follow. Put employees on the assessment walk, in the training design and in the post-incident review, and write down how they get there.

2. Worksite Analysis and Hazard Identification

This is the assessment, and it has three pieces. First, a records review: incident reports, first-aid logs, workers’ compensation claims, security reports, police calls and the complaints that never made it to paper. Second, an employee survey, because the near misses live in people’s heads. Third, a physical walk of every work area against the risk factors OSHA lists on its workplace violence page: exchanging money with the public, working alone or in isolated areas, working late at night or early in the morning, working where alcohol is served, delivering goods or services, guarding valuables, and working with volatile or unstable people. Score each area for each of the four types. If you want a formal way to handle the individual cases that come out of this step, my post on assembling a workplace threat assessment team covers who sits on it and what it does.

3. Hazard Prevention and Control

Once you know the hazards, you pick controls in the same order you would for any other hazard: engineering first, work practices second. Engineering controls are the built environment: lighting in the lot, locks and access control on employee entrances, a counter or barrier where cash changes hands, cameras that are actually watched, drop safes, panic buttons or a duress code on the phone system, and clear sight lines from the street. Work practice controls are how the work is done: visitor sign-in and badges, a buddy system for closing, cash limits and drop schedules, no lone work in high-risk areas, escorts to cars after dark, and a termination procedure that does not send a furious ex-employee back through the shop floor. The access-control side of this is its own training topic, which is why we treat workplace security as a separate course. This element also holds the emergency response procedures: how employees are alerted, where they go, and how they summon security and police. My post on running active shooter drills at work is the extreme end of that procedure.

4. Safety and Health Training

Every employee needs to be able to recognize the warning signs, know the four types and which ones apply to their job, know exactly how to report a threat and to whom, have some basic de-escalation skills, and know what to do when the emergency alert goes out. Supervisors and managers need a second session on receiving a report, what not to say, when to involve HR and law enforcement, and how to run a termination safely. Train at hire, retrain annually, and retrain when a new hazard shows up or the plan changes. The training element is the piece a video kit handles well; I cover how often below, because it is the question I get asked most.

5. Recordkeeping and Program Evaluation

Keep the incident reports, the investigation files, the hazard assessments, the corrective actions and the training rosters, and once a year sit down with the employee representatives and ask two questions: did the controls work, and what changed? New shift patterns, a new location, a new tenant next door, a new client population, and a threat that turned out to be real are all reasons to reopen the assessment. OSHA’s guidance says the evaluation should look at incident trends, employee surveys and whether the reporting system is actually being used. A log with zero entries in a 200-person warehouse is not a clean record. It is a reporting system nobody trusts.

What About the Seven Elements Everyone Searches For?

If you have searched this topic you have seen the question “What are the 7 elements of a workplace violence prevention program?” and a dozen different answers. Here is the honest version: there is no official list of seven. OSHA’s guidance has five elements. California’s Labor Code section 6401.9 lists thirteen required components of the written plan, lettered (A) through (M). The Cal/OSHA summary page condenses those into eight bullets. The “seven” you see in blog posts and consultant decks is whichever way a given author grouped the same material, and the most common grouping is: a policy statement, a hazard assessment, a threat assessment or response team, a reporting procedure, training, an incident response plan, and recordkeeping with review.

Notice that every one of those seven sits inside the five OSHA elements, and every one of them sits inside the California list. The count does not matter. What matters is that your written plan has all of the pieces, that it is specific to your site, and that you can show an inspector the assessment behind it. The plan outline in the chart above is the ten sections I use, which map to both lists and to the Cal/OSHA model plan.

What Does California’s SB 553 Add to the Plan?

California turned OSHA’s five recommendations into a legal requirement. Senate Bill 553 was signed on September 30, 2023, and Labor Code section 6401.9 has been in effect and enforceable since July 1, 2024. It applies to all employers, employees, places of employment and employer-provided housing in the state, with a short list of exemptions: healthcare operations already covered by Cal/OSHA’s Section 3342 healthcare standard, state correctional facilities, certain law enforcement agencies, employees teleworking from a location of their choice, and places of employment where fewer than 10 employees are working at any given time and the location is not accessible to the public. That last exemption is narrower than it sounds. A small office that the public can walk into is covered, and so is a ten-person night crew.

The statute requires four things. First, a written workplace violence prevention plan, either as a stand-alone document or as its own section of the Injury and Illness Prevention Program required by Section 3203, specific to the hazards of each work area, available to employees at all times. Second, a violent incident log for every incident, with the date, time and location, the type of violence, a detailed description, who committed it, the circumstances (working alone, poorly lit area, low staffing, rushed), where it happened, the type of incident from physical attack to threat to sexual assault, the consequences including whether police were called, and who completed the entry, with personal identifying information left out. Third, training when the plan is established and annually after that. Fourth, records: hazard identification and correction records and incident logs for five years, investigation records for five years, training records for one year, all available to employees within 15 calendar days of a request.

The plan itself has to include all of the following, and this is the list an inspector will check against:

• Names or job titles of the persons responsible for implementing the plan, with each person’s role described
• Procedures for the active involvement of employees and their representatives in developing and implementing it
• Methods for coordinating the plan with other employers on a shared site
• Procedures to accept and respond to reports of workplace violence and to prohibit retaliation against the person reporting
• Procedures to ensure supervisors and employees comply with the plan
• Procedures to communicate with employees: how to report to the employer or law enforcement without reprisal, how concerns are investigated, and how employees learn the results
• Procedures to respond to actual or potential emergencies: alerting employees, evacuation or sheltering, and how to get help from responders, security and police
• Procedures to develop and provide the required training
• Procedures to identify and evaluate hazards, with inspections when the plan is first established, after each incident and whenever a new hazard is identified
• Procedures to correct hazards in a timely manner
• Procedures for post-incident response and investigation
• Procedures to review the plan at least annually, when a deficiency is observed and after every incident, with employee involvement
• Anything else Cal/OSHA and the Standards Board later require

That last item is live. The statute directed Cal/OSHA to propose a formal regulation by December 31, 2025 and the Standards Board to adopt it by December 31, 2026, so the requirements are about to get more detailed, not less. Cal/OSHA’s general industry workplace violence page has a model written plan you can fill in, and it is a reasonable starting point as long as you actually do the site-specific assessment instead of leaving the template language in place. Our California workplace violence training kit was built for the training element of this statute and includes a sample fill-in-the-blank plan alongside the video, quiz and certificate; the California manager workplace violence training kit is the supervisor session.

How Often Is Workplace Violence Training Required?

It depends on who regulates you, and the honest federal answer surprises people:

• Federal OSHA: no interval, because there is no standard. OSHA’s guidance recommends training at hire and annual refreshers, and under the General Duty Clause “we trained everyone once in 2019” is not a defense after an incident.
• California, general industry (Labor Code 6401.9): initial training when the plan is first established, then annually, plus additional training whenever a new or previously unrecognized hazard is identified or the plan changes. The training has to cover the plan itself, how to get a copy, the definitions in the statute, how to report without reprisal, the hazards specific to the employee’s job, the violent incident log, and it has to include a live opportunity for questions with someone who knows the plan.
• California, healthcare (Title 8 Section 3342): its own standard since 2017 with initial and annual training and a separate incident log; those employers are exempt from 6401.9 because they already have more.
• New York: public employers have been required to run workplace violence prevention programs under Labor Law Section 27-b since 2006, and the Retail Worker Safety Act now requires private retail employers to adopt a written policy and train retail employees, with the interval depending on the size of the employer.
• Joint Commission accredited hospitals: a workplace violence prevention program with annual training, an annual analysis and a leadership-designated owner, as an accreditation condition.
• Everyone else: I recommend the California cadence. Train at hire, once a year, after any threat, assault or near miss at the facility, and whenever the assessment finds a new hazard. It is defensible under the General Duty Clause and it is what the presenter’s guide in our kits is built for.

What an Inspector Will Ask to See

Whether it is Cal/OSHA under 6401.9 or federal OSHA under the General Duty Clause after an incident, the document request looks the same, and I tell clients to build the binder in this order so it is ready before anyone asks:

• The written plan or program, dated, with the signed policy statement and the named responsible persons
• The hazard assessment for each work area, and the dates of the periodic inspections since
• The violent incident log (California) or incident reports (everywhere else), and the investigation file for each entry
• Corrective actions taken after each incident and each assessment, with dates
• Training records: dates, content or a summary, who taught it and their qualifications, and the names and job titles of everyone who attended
• Evidence of the annual review, including who from the workforce participated

If any of those six is missing, that is where the citation will land. In my experience the training roster is the one most companies can produce and the assessment is the one they cannot, and the assessment is the element that makes the other five mean something. Start there.

Frequently Asked Questions About Workplace Violence Prevention Programs