SB 553 Workplace Violence Prevention Plan: 8 Questions Cal/OSHA Will Ask Your California Office

In 2021, 57 working people in California died from acts of workplace violence. Across the United States, an average of 1.3 million nonfatal violent crimes happened in workplaces every year between 2015 and 2019 (Cal/OSHA, citing the Bureau of Justice Statistics). California responded with the first general industry workplace violence law in the country.

Since 1 July 2024, almost every employer in California has needed a written Workplace Violence Prevention Plan under Senate Bill 553, now California Labor Code section 6401.9. It is not limited to retailers, hospitals or security firms. It applies to the San Francisco office of a London AI lab, the Los Angeles team of a European insurer, the Palo Alto base of a SaaS scale-up, and the California campus of an international university.

For UK and international groups, the risk is simple: nothing like it exists at home, so nobody at head office thinks to ask for it. And the rules are about to get more detailed. California's Occupational Safety and Health Standards Board is required by law to adopt a permanent general industry standard by 31 December 2026, building on the statute.

The fastest way to test your readiness is to ask the questions an inspector would. Here are the eight that matter.

---

Question 1: "Is This Workplace Covered?"

Why they ask it: the law has narrow exceptions, and employers sometimes assume they fall inside one when they do not.

The main exceptions are healthcare settings already covered by California's separate healthcare violence standard, employees teleworking from a location of their own choice that is not under the employer's control, and places of employment where fewer than 10 employees work at any given time and that are not accessible to the public and that comply with the Injury and Illness Prevention Program requirements in Title 8, section 3203.

What a good answer looks like: a written scope decision for every California location. An office with a reception desk, visiting clients or regular deliveries is accessible to the public in practice, so the small-site exception rarely helps.

Where global firms trip: assuming a fully remote California team is out of scope. Teleworkers are excluded only when working from a location of their choice. Employees who visit a coworking hub, a client site or a company office on some days bring those places back into scope.

---

Question 2: "Show Me the Written Plan. Who Is Responsible for It?"

Why they ask it: the plan must name the people or job titles responsible for implementing it. A plan with no owner is a plan nobody is running.

The plan can be a standalone document or a separate section within your Injury and Illness Prevention Program (IIPP), which California has required of every employer for decades. Cal/OSHA publishes a model written plan for general industry, but it is a starting point, not a finished document.

What a good answer looks like: a site-specific plan naming a local responsible person in California, with a clear line to the group health and safety lead.

Where global firms trip: a template downloaded by head office, never tailored, with the responsible person listed as someone in London who has never visited the site.

---

Question 3: "How Were Your Employees Involved?"

Why they ask it: the law requires procedures to obtain the active involvement of employees and their authorised representatives in developing and implementing the plan, including identifying hazards and designing training.

What a good answer looks like: records of a staff survey, workshop or safety committee discussion, with evidence that employee input changed something in the plan.

Where global firms trip: writing the plan centrally and announcing it. Consultation that happens after the plan is finished does not meet the requirement.

---

Question 4: "How Did You Identify the Hazards at This Site?"

Why they ask it: the plan must include procedures to identify, evaluate and correct workplace violence hazards, including periodic inspections. Cal/OSHA expects that assessment to reflect the four types of workplace violence the law defines:

Type	Who the violence comes from	Example in an ICP office
Type 1	Someone with no legitimate business there	An intruder following staff through the door of a downtown office
Type 2	Customers, clients, students or visitors	A distressed claimant at an insurer, a hostile client at a law firm, a student on campus
Type 3	Current or former employees	A dismissed engineer returning after a round of layoffs
Type 4	Someone with a personal relationship to an employee	A former partner arriving at reception

What a good answer looks like: a site assessment covering access control, reception design, lone and late working, layoffs and terminations, and how threats made online or by phone are escalated.

Where global firms trip: treating violence as a security or HR matter and leaving it out of the health and safety risk assessment altogether. Our guide to lone working in tech and AI covers the late-night and out-of-hours risks most relevant to California tech teams.

---

Question 5: "How Does Someone Report a Threat, and What Protects Them?"

Why they ask it: the plan must explain how the employer accepts and responds to reports of workplace violence, and must prohibit retaliation against employees who report.

What a good answer looks like: more than one reporting route (manager, HR, an anonymous channel), clear timescales for responding, and a written non-retaliation commitment that staff actually know about.

Where global firms trip: reporting routes that run to a global HR inbox in another time zone. A threat reported at 4pm in Los Angeles should not wait until the London team logs on.

Sector note: in insurance and claims teams, much of the hostility arrives by phone, email and chat. Our post on abuse through a screen: 4 duties owed to support teams shows how to bring remote abuse into the same reporting system.

---

Question 6: "What Happens in an Actual Emergency?"

Why they ask it: the plan must cover how the employer responds to actual or potential workplace violence emergencies, including how employees are alerted, how they evacuate or shelter, and how they get help.

What a good answer looks like: an emergency procedure tailored to the building, coordinated with the landlord and any other employers on site (the law specifically requires methods for coordinating with other employers), and tested.

Where global firms trip: multi-tenant buildings. Your plan has to work with the building's own security and emergency arrangements, not assume you control them.

Sector note: for education providers with California campuses or study centres, Type 2 risk from students and visitors makes this question central rather than theoretical.

---

Question 7: "Show Me Your Training Records and Your Violent Incident Log"

Why they ask it: these are the two records that prove the plan is alive. Employers must provide effective training when the plan is first established and annually after that, and must keep a violent incident log recording every incident, not only those that cause injury.

Cal/OSHA guidance sets minimum retention periods: five years for hazard identification and correction records, violent incident logs and incident investigations, and one year for training records. Employees and their representatives can ask to see most of these records, and employers must make them available within 15 calendar days.

What a good answer looks like: complete records you can produce on request, stored in one system rather than spread across inboxes.

Where global firms trip: a one-off training session when the plan launched and nothing since, and no incident log at all because "nothing has happened". Threats, intimidation and verbal abuse count too.

Sector note: fast-growing software and AI and data businesses often hire faster than they train. Annual training needs to reach every new starter, not just the people employed when the plan launched.

---

Question 8: "What Did You Change After the Last Incident, and When Did You Last Review the Plan?"

Why they ask it: the plan must include procedures for post-incident response and investigation, and for reviewing its effectiveness and revising it when needed. A plan that has never changed suggests one that is never used.

What a good answer looks like: a short investigation record for each incident, a list of changes made as a result, and a dated annual review. Reviews should also follow any serious incident, a change of premises, or a significant restructuring.

Where global firms trip: no review cycle at all, and no plan to update the document once the permanent Cal/OSHA standard is adopted. Watch the Standards Board and Cal/OSHA's workplace violence guidance page for the final text.

Sector note: for law firms, practice areas such as family, employment and criminal law generate higher Type 2 risk. The review should check whether controls kept pace with the caseload.

---

How California Compares With the Rest of Your Group

California is unusual because it requires a dedicated written plan. Most jurisdictions cover workplace violence through general duties instead, which is exactly why head office teams miss the difference.

Jurisdiction	How workplace violence is regulated	Dedicated written plan required?
California	Labor Code 6401.9 (SB 553), with a permanent Cal/OSHA standard due	Yes, since 1 July 2024
United States (federal)	OSHA's General Duty Clause and OSHA guidance	No general industry standard
United Kingdom	General risk assessment duties and HSE guidance on violence at work	No, but violence must be assessed
Australia	Model WHS Regulations on psychosocial hazards, including aggression	No single plan, but specific risk management duties (Australia WHS)
Global baseline	ILO Violence and Harassment Convention, 2019 (C190), ratified by the UK and many other states	Depends on national law

For the UK picture in more depth, see our earlier article on workplace violence prevention legislation. For the wider US framework, see health and safety in the USA and how OSHA enforces its standards. Keeping track of differences like these is what a health and safety legal register is for.

---

Your 8-Question Readiness Check

#	Question Cal/OSHA will ask	Ready?
1	Is each California workplace in scope, with the decision recorded?
2	Is there a written, site-specific plan with a named local owner?
3	Can you evidence employee involvement in building the plan?
4	Has a site assessment covered all four types of workplace violence?
5	Are there multiple reporting routes and a non-retaliation commitment?
6	Is the emergency procedure coordinated with the building and tested?
7	Are training records and the violent incident log complete and current?
8	Is there a dated review, with changes made after incidents?

If you cannot answer "yes" to all eight for every California site, your plan is not yet ready for an inspector, or for the permanent standard on its way.

---

How Arinite Helps Global Groups With California Teams

Arinite has supported 1,500+ businesses across 50+ countries for 15+ years, protecting 100,000+ employees, with 95%+ client retention. Our qualified consultants help UK and international groups manage overseas requirements as part of one consistent system, working alongside your US counsel where legal advice is needed. See our United States page for more.

• Done For You: our health and safety consultants carry out the site assessment, draft the site-specific plan, and test it through independent health and safety audits.
• Done With You: we run the employee involvement process, train your California managers, and set up the incident log and review cycle with your local team.
• DIY: you manage the plan, training records and violent incident log on our health and safety consultants and software platform, so the evidence Cal/OSHA asks for is always one click away.

As international health and safety consultants, we map requirements like SB 553 across every country where you operate. Our global health and safety consultants keep group standards and local rules aligned, so a new law in one state does not become a blind spot for the whole business.

---

Frequently Asked Questions

Does SB 553 apply to UK or international companies with staff in California?

Yes. The law applies to employers with employees working in California, regardless of where the company is headquartered. A UK, European or Asian group with a California office or California-based employees needs a plan unless a specific exception applies.

Does SB 553 apply to remote workers?

Employees teleworking from a location of their own choice, not under the employer's control, are excluded. Remote employees who also work at company offices, coworking spaces or client sites are still covered for those locations.

What must a workplace violence prevention plan include?

It must name the people responsible, involve employees, set out reporting and anti-retaliation procedures, cover emergency response, training, hazard identification and correction, post-incident investigation, and regular review. Employers must also keep a violent incident log.

How often must workplace violence training be given?

Training must be provided when the plan is first established and at least annually after that, plus additional training when new hazards are identified or the plan changes.

Is a permanent Cal/OSHA workplace violence standard coming?

Yes. California's Occupational Safety and Health Standards Board is required to adopt a general industry workplace violence prevention standard by 31 December 2026. Employers should expect to review their plans against the final text once it is adopted.

---

Get Ready Before the Standard Lands

The statute already applies, and a more detailed standard is due by the end of 2026. Book a free gap analysis with Arinite and we will review your California plan against all eight questions, alongside your wider international compliance, and show you what to fix first.

Request your free gap analysis