- Cal/OSHA publishes a free fillable model plan for general industry on the DIR website — using it is optional, but its structure mirrors the statute's required elements.
- The template is only the skeleton: compliance lives in what you write into it — named people, real procedures, and your site's actual hazards.
- The plan must be site-specific. One generic document copied across worksites is the most common failure an inspector can spot in minutes.
- A finished plan isn't the finish line: it has to be trained on, reviewed at least annually, and backed by records — see the compliance checklist.
Before you start: what the template is and isn't
The model plan (available free from the DIR website, with a companion fact sheet) is a fillable document with bracketed instructions marking everywhere your worksite-specific information goes. Cal/OSHA built it around the required elements of Labor Code §6401.9, which means the structure is sound — you don't need to invent an outline, and you won't accidentally skip a required element by following it.
What it can't do is answer the questions for you. Every section below ends in a decision about your worksite — who's responsible, how reports actually get made at 9pm on a Saturday, where someone shelters if a threat walks in. An inspector who has seen a hundred of these templates reads straight past the boilerplate to the filled-in parts. If those are generic, the template has bought you nothing.
The walkthrough
1. Who's responsible
The plan opens by asking for the names or job titles of the people responsible for implementing it. Write down real people who are actually present at the worksite and have authority to act — for most small businesses, the owner or site manager, plus a second person for shifts the first one doesn't work.
The mistake: naming a corporate function ("Human Resources") that nobody on the floor can identify or reach. The test an inspector applies is simple: ask an employee who's in charge of the plan. If the answer doesn't match the paper, the section fails in practice even though it's filled in.
2. Employee involvement
The statute requires effective procedures for the active involvement of employees (and their representatives) in developing and implementing the plan — in identifying hazards, designing training, and reporting and investigating incidents. This is the section employers most often leave vague, and it's one Cal/OSHA flagged as a priority from the start: the plan can't be something done to employees.
What to write: the specific mechanism, not a sentiment. "Workplace violence is a standing item at the monthly staff meeting; employees were surveyed during plan development on [date]; hazard walkthroughs include at least one non-supervisory employee." Then actually do it and keep notes — involvement you can't evidence didn't happen, as far as an audit is concerned.
3. Coordination with other employers
If anyone else's employees work at your site — janitorial contractors, security guards, temps from a staffing agency, delivery drivers with regular routes — the plan must describe how you coordinate with their employer: who trains them on your procedures, how they report incidents, and how you alert each other to hazards.
The mistake: skipping the section because "we have no other employers." Look again — a cleaning crew that comes Tuesday nights counts. If it truly doesn't apply, say so explicitly rather than leaving the bracket empty: an inspector reads a blank as unfinished, not as not-applicable.
4. Accepting and responding to reports — without retaliation
The heart of the plan: how an employee reports workplace violence or a threat, what happens next, and an explicit prohibition on retaliation. The procedures have to let employees report without fear of reprisal, which in practice means at least one channel that doesn't run through the person an employee might be reporting.
What to write: every real channel — tell the shift lead, call or text the owner, use the form, anonymously if you offer it — plus who investigates, roughly how fast, and how the reporter learns the outcome. Vague "management will take appropriate action" language is exactly what the statute's "effective procedures" standard is aimed at.
5. Communicating with employees
Closely related, but distinct: how the employer communicates workplace-violence matters to employees — how concerns will be investigated, and how employees are informed of results. Name the channels you actually use (staff meeting, group chat, posting by the schedule) and commit to closing the loop with whoever raised a concern.
6. Emergency response
The plan must describe how you respond to an actual or potential workplace violence emergency: how employees are alerted (and the warning means everyone understands), evacuation or shelter-in-place plans, and how to summon help — staff, security if you have it, law enforcement.
What to write: walk the building while you write this. Which doors lock from inside? Where does the back of house shelter? Who calls 911 and who meets the officers? A floor plan reference beats a paragraph. Generic "call 911" answers ignore what the section is really asking: what happens in the two minutes before the police arrive.
7. Training procedures
The plan documents how training is developed and delivered — when the plan is established, annually after that, and again when the plan changes or a new hazard appears. The full content requirements (and the interactive Q&A rule) are detailed in our training requirements guide; in the plan itself, commit to the schedule, who delivers it, and how questions get answered by someone who actually knows the plan.
8. Identifying and evaluating hazards
The plan must establish procedures to identify and evaluate workplace violence hazards, including periodic inspections — when the plan is established, after each incident, and whenever a new hazard becomes known.
What to write: your inspection cadence (quarterly is a defensible default for most small sites), who walks it, and what they look at — lighting, cash handling, lone work, sightlines, entry control, prior incidents in the neighborhood. Keep the completed checklists; they're among the records an inspector asks for, and they're kept five years.
9. Correcting hazards
Identification's twin: procedures to correct hazards in a timely manner. The plan states how fixes get decided, who owns them, and how interim measures bridge the gap when the real fix takes time (the mirror goes up this week; the badge lock is on order). Document the correction and the date — a hazard found and silently fixed, with no record, looks identical to a hazard ignored.
10. Post-incident response and investigation
What happens after something occurs: procedures for post-incident response and investigation. Who secures the scene and looks after affected employees, who investigates and how soon, who's interviewed, and where findings land — including the entry in the violent incident log, which has its own required fields and a five-year retention rule.
11. Reviewing and revising the plan
Finally, the plan commits to its own maintenance: review at least annually, plus whenever a deficiency becomes apparent and after incidents. The review involves employees (section 2 again), and revisions trigger training on what changed. Put a named owner and a recurring date on this — the annual review is the obligation that slips most often once the initial push is over.
Or answer the questions once, and keep the plan alive automatically.
SB553Ready's plan builder walks you through the same decisions in plain English, assembles the site-specific written plan, and then tracks the training, log, and annual review the plan promises — from $59/mo.
The five blanks that get employers cited
- The copied plan. One document, five worksites, identical hazards in each. Site-specificity is the statute's word, not ours.
- The unnamed responsible person. A role nobody at the site can identify, or a person who left six months ago.
- The empty coordination section. "No other employers" at a site with a nightly cleaning crew.
- Involvement with no evidence. The plan says employees participate; nothing shows they ever did.
- The plan that never moved again. Established July 2024, never reviewed since — the annual review obligation is already past due for plans that haven't been touched.
After the plan: what "maintained" means
A filled-out model plan satisfies the written plan element. The program it describes is the ongoing part: train everyone and keep the records, log incidents as they happen, walk the hazards on schedule, and review the plan each year. The compliance checklist lists every record with its retention period, and the penalties guide covers what the gaps cost.
Frequently asked questions
Is Cal/OSHA's model WVPP enough to be compliant?
The structure covers the required elements — compliance depends on what you write into it and whether the program it describes actually runs: training, the log, inspections, and the annual review. A generically completed template, or one plan copied across sites, doesn't meet the site-specific requirement.
Where do I download the model plan?
From the DIR website (dir.ca.gov), under Cal/OSHA's Workplace Violence Prevention resources for general industry. It's free, fillable, and comes with an employer fact sheet.
Does every worksite need its own plan?
The plan must be specific to each worksite's hazards and operations. A shared framework is fine; the named people, hazard assessment, and procedures must match each location.
How often does the plan need review?
At least annually, when a deficiency becomes apparent, and after any incident. Revisions trigger training on what changed.
Who should be named as responsible?
Real, present, empowered people — by name or job title. The practical test: any employee should be able to tell an inspector who owns the plan.
This article is general information about California law, not legal advice, and SB553Ready is a software tool, not a law firm. The model plan and Cal/OSHA guidance are updated from time to time; always work from the current version on dir.ca.gov and confirm your plan with qualified counsel or a safety professional. Statute text: Labor Code §6401.9.