Workplace Violence Prevention Plans: What SB 553 Means for Your Business

Why workplace violence prevention matters now

Workplace violence is the third leading cause of fatal occupational injuries in the United States. According to the Bureau of Labor Statistics, there were over 57,000 nonfatal workplace violence injuries in the most recent reporting year, and violence accounts for roughly 20 percent of all workplace fatalities.

This is not a problem limited to high-risk industries. Workplace violence occurs in retail stores, medical offices, restaurants, salons, and professional offices. Any business with employees who interact with the public, handle money, or work late hours faces elevated risk.

California became the first state to mandate written workplace violence prevention plans for nearly all employers when Governor Newsom signed SB 553 into law. The requirement took effect July 1, 2024, and applies to most California employers regardless of size. Other states are following — New York, Illinois, and Washington have introduced similar legislation.

What California SB 553 requires

SB 553 added Labor Code Section 6401.9, requiring most California employers to establish, implement, and maintain a written Workplace Violence Prevention Plan (WVPP). Here is what the law requires:

Covered employers

The mandate applies to virtually all California employers except:

• Employees teleworking from a location not controlled by the employer
• Workplaces already covered by existing Cal/OSHA violence prevention standards (healthcare facilities under Section 3342)
• Law enforcement agencies
• Facilities operated by the Department of Corrections

Required plan elements

Your WVPP must include:

1. Names and job titles of the persons responsible for implementing the plan
2. Effective procedures to obtain active involvement of employees and their representatives in developing, implementing, and reviewing the plan
3. Methods to coordinate plan implementation with other employers whose employees work at the same location
4. Procedures to accept and respond to reports of workplace violence, with no retaliation against reporting employees
5. Procedures to ensure compliance by all employees, including supervisors
6. Emergency response procedures
7. Procedures for post-incident response and investigation
8. Procedures for identifying and evaluating workplace violence hazards
9. Procedures to correct identified workplace violence hazards
10. Training requirements for all employees

Training requirements under SB 553

Employers must provide training:

• When the plan is first established
• When a new employee is hired
• When a new hazard is identified
• At least annually thereafter

Training must cover the plan contents, how to report incidents, how to seek assistance, and de-escalation strategies.

Violent incident log

Employers must maintain a violent incident log that records every workplace violence incident, including:

• Date, time, and location
• Detailed description of the incident
• Classification of who committed the violence (Type I through IV)
• Circumstances at the time of the incident
• Consequences of the incident
• What actions were taken to protect employees

This log must be maintained for a minimum of five years.

Understanding the four types of workplace violence

Cal/OSHA and OSHA classify workplace violence into four categories. Your prevention plan should address all four:

Type I — Criminal intent

The perpetrator has no legitimate relationship with the business. They commit violence during a crime such as robbery, trespassing, or vandalism.

Common in: Retail stores, restaurants, convenience stores, gas stations, any business handling cash.

Prevention measures: Cash handling procedures, adequate lighting, security cameras, panic buttons, limiting solo work at night.

Type II — Customer / client / patient

The perpetrator is a customer, client, patient, or someone receiving services from the business.

Common in: Healthcare, social services, retail, hospitality, salons, restaurants.

Prevention measures: De-escalation training, clear behavioral expectations, security protocols for agitated clients, buddy systems for high-risk interactions.

Type III — Worker-on-worker

The perpetrator is a current or former employee, supervisor, or contractor.

Common in: Any workplace, but elevated in high-stress environments with inadequate conflict resolution processes.

Prevention measures: Anti-harassment policies, conflict resolution procedures, management training, employee assistance programs (EAP), exit interview protocols.

Type IV — Personal relationship

The perpetrator has a personal relationship with an employee but no relationship with the business (domestic violence that spills into the workplace).

Common in: Any workplace. Domestic violence affects approximately one in four women and one in nine men.

Prevention measures: Confidential reporting mechanisms, safety planning for affected employees, workplace restraining orders, security notification of known threats, flexible work arrangements.

OSHA requirements for employers outside California

Even if your state has not passed SB 553-style legislation, OSHA's General Duty Clause (Section 5(a)(1)) requires employers to maintain a workplace free from recognized hazards likely to cause death or serious physical harm.

OSHA has issued numerous citations under the General Duty Clause for workplace violence. If violence is a foreseeable risk in your workplace and you have not taken reasonable steps to prevent it, you are exposed to citation.

Additionally, several OSHA standards apply directly:

• Recordkeeping (29 CFR 1904): Work-related violence must be recorded on OSHA 300 logs
• Emergency Action Plan (29 CFR 1910.38): Must address active threat scenarios
• Personal Protective Equipment (29 CFR 1910.132): May apply in some violence prevention contexts

States with pending or enacted violence prevention legislation

• New York: Retail Worker Safety Act requires panic buttons and violence prevention policies for retail employers with 10+ employees
• Washington: Expanded violence prevention requirements for healthcare and social services
• Illinois: Workplace Violence Prevention Act requires risk assessment and training
• Oregon: Enhanced workplace safety rules include violence prevention components
• Connecticut: Hospital and healthcare facility violence prevention requirements

Building your workplace violence prevention plan

Step 1 — Assign responsibility

Designate a violence prevention coordinator. This person leads plan development, coordinates training, investigates incidents, and serves as the point of contact for employee concerns. For smaller businesses, this may be the same person who manages other safety programs.

Step 2 — Conduct a workplace violence hazard assessment

Walk through your workplace and assess:

• Is cash handled on the premises?
• Do employees work alone or at night?
• Is the workplace in a high-crime area?
• Do employees interact with emotionally distressed clients or patients?
• Are there previous incidents of threats or violence?
• Are there adequate security measures (lighting, cameras, locks, panic buttons)?
• Do employees have a way to summon help?

Step 3 — Implement controls

Based on your assessment, implement controls using the hierarchy:

• Environmental controls: Security cameras, adequate lighting, locked entry points, panic buttons, bullet-resistant barriers (where warranted)
• Administrative controls: Cash handling policies, buddy systems, conflict resolution procedures, visitor management
• Behavioral controls: De-escalation training, anti-harassment policies, threat reporting procedures, employee assistance programs

Step 4 — Establish reporting and response procedures

Employees must know:

• How to report threats, concerning behavior, or actual violence
• That reporting will not result in retaliation
• What happens after a report is filed
• Emergency response procedures for active threats
• When to call 911 vs. when to contact internal security

Step 5 — Train all employees

Training should cover:

• The violence prevention plan and their role in it
• Recognizing warning signs of potential violence
• De-escalation techniques
• Emergency response (Run-Hide-Fight for active threats)
• Reporting procedures
• Domestic violence awareness and resources

Step 6 — Investigate and learn from incidents

After any violent incident or credible threat:

• Secure the scene and ensure employee safety
• Provide immediate support (medical, psychological)
• Investigate the root causes
• Update the plan based on findings
• Communicate changes to employees
• Document everything in the violent incident log

Common mistakes in violence prevention plans

1. Treating it as a one-time document: SB 553 requires annual review. Your plan should be a living document updated after incidents and changes.
2. No employee involvement: The law requires active employee participation in plan development. A plan written by management without employee input will not satisfy the requirement.
3. Ignoring Type IV (domestic violence): Many plans focus only on customer and criminal violence while ignoring domestic violence spillover, which is increasingly common.
4. No de-escalation training: Having a plan without training employees to implement it is like having a fire extinguisher nobody knows how to use.
5. Failing to maintain the violent incident log: SB 553 specifically requires this log, and it must be detailed and maintained for five years.

How ComplyStack builds your workplace violence prevention plan

A workplace violence prevention plan requires understanding SB 553 requirements (for California employers), OSHA General Duty obligations, and the specific violence risk factors in your industry. ComplyStack generates customized prevention plans based on your business type, state, workplace setting, and employee count — complete with hazard assessments, reporting procedures, training requirements, and incident response protocols tailored to your operation.