HR and legal checklist

Workplace violence threat response checklist for HR and legal teams

When a threat hits the workplace, the first job is safety. The second job is making sure the response creates the right SB 553 records: the violent incident log, the confidential investigation file, the hazard review, and the follow-up actions that show the plan actually worked.

Updated June 18, 2026 9 min read Checked against Labor Code Section 6401.9
Key facts
  • Protect people first. Separate involved people, get help, preserve immediate safety, and follow emergency procedures before polishing records.
  • Threats can be loggable. SB 553 covers threats of violence, not only physical attacks or police-involved events.
  • Keep the log non-identifying. The violent incident log omits personal identifying information; HR/legal details stay in the separate investigation file.
  • Review hazards after the incident. A threat should feed plan review, hazard correction, communication, and training decisions.
  • Preserve before editing. Save messages, witness statements, video-retention notes, law-enforcement contacts, and corrective-action records before memories and systems change.

The first hour: stabilize and preserve

This checklist is not emergency-response training. If there is an active or imminent threat, follow your emergency procedures and contact law enforcement or emergency services as appropriate. Once people are safe, HR and legal should make sure the first hour produces a clean record trail.

  • Separate and protect. Move employees away from the threat, arrange medical help if needed, and keep witnesses from debating facts before statements are taken.
  • Identify the response owner. Name one person to coordinate HR, site leadership, security, and legal follow-up so no one assumes someone else opened the file.
  • Capture time-sensitive evidence. Preserve texts, emails, voicemails, chat screenshots, incident reports, visitor logs, video-retention notes, photos, and law-enforcement or security call details.
  • Start the confidential investigation file. Use it for names, witness statements, sensitive facts, medical-adjacent information, legal notes, and case chronology.
  • Open the SB 553 log entry. Start the non-identifying violent incident log entry while the basic facts are fresh, then complete it as witness and investigation facts come in.

Threat response checklist

StepWhat to doRecord to create or preserve
1. Safety responseFollow emergency procedures, separate involved people, call for help when needed, and protect employees from continuing danger.Emergency response notes, security or law-enforcement contact, medical-response note if applicable.
2. Initial fact captureRecord date, time, location, who reported the threat, immediate witnesses, and where relevant messages or video may exist.Confidential investigation intake, preservation checklist, source list.
3. Log classificationClassify the incident as Type 1, 2, 3, or 4 workplace violence, and note whether it involved a threat of physical force or weapon use.Violent incident log entry without names or identifying detail.
4. Witness and employee inputSolicit information from affected employees and witnesses instead of waiting for volunteered reports.Witness statements, employee statements, interview notes in the investigation file.
5. Consequences and correctionsDocument what was done to protect employees from a continuing threat and what hazard controls changed afterward.Log consequences field, hazard correction record, action-owner list.
6. Plan reviewReview whether the written WVPP, training, reporting path, emergency procedures, and employee communication worked.Post-incident plan review note and any revised plan/training materials.
7. Follow-up cadenceCalendar unresolved items, training or retraining, facility fixes, communication updates, and legal review deadlines.Task list, completion records, training records, annual-review file.

What goes in the log vs. the investigation file

The common mistake is combining everything into one incident document. SB 553 points in the other direction: keep a violent incident log that can be produced without exposing personal identifying information, and keep a separate investigation file for the sensitive details HR and legal need. See the violent incident log guide for every required field, the SB 553 compliance checklist for the full records set, and the penalties guide for what missing records can cost during an enforcement review.

Violent incident logConfidential investigation file
Date, time, and location.Names, roles, contact details, and witness list.
Workplace violence type and incident category.Full narrative, interview notes, statements, and source documents.
Non-identifying description of what happened.Threat messages, screenshots, voicemails, video-retention notes, and chain-of-custody notes.
Circumstances, where it occurred, and consequences.Legal analysis, personnel follow-up, leave/accommodation notes, and discipline or separation records.
Actions taken to protect employees from continuing threat.Medical-adjacent information, privileged communications, and sensitive law-enforcement details.
Name/job title/date of the person completing the log entry.Who approved each corrective action and how completion was verified.

Need your SB 553 packet cleaned up this week?

Get a $299-$499 guided setup and audit-packet review to organize your plan, training records, incident log, hazard fixes, and exportable packet. Then keep the workflow current in SB553Ready for $59/mo.

Get a setup review Software workflow and record organization only; not legal advice or attorney review.

When to review hazards and the plan

Labor Code Section 6401.9 requires the plan to be reviewed at least annually, when a deficiency is observed or becomes apparent, and after a workplace violence incident. A threat response should therefore close with a short plan-and-hazard review, not just an HR note that the matter was handled.

  • Look for the failed control. Did reporting, staffing, lighting, access control, communication, de-escalation, or emergency notification fail or work as designed?
  • Update the hazard record. If a new hazard or pattern appears, create or update the hazard identification and correction record.
  • Retrain only where needed. Additional training may be limited to the new or changed hazard, but document the topic, date, trainer, attendees, and job titles.
  • Close the loop with employees. Explain what changed without exposing confidential personnel or investigation details.

If this review is happening because an inspection or employee-record request is already likely, use the SB 553 inspection checklist to assemble the full packet before deadlines compress the response.

What HR and legal should preserve

Preserve the raw material before systems overwrite it or people forget details. A practical preservation list:

  • The non-identifying violent incident log entry and later completion date.
  • Employee and witness statements, including who was asked for information and when.
  • Threat communications: email, text, chat, voicemail, social media message, letter, or note.
  • Video-retention note: where footage may exist, who preserved it, and the relevant time window.
  • Security, law-enforcement, or emergency-services contact and response details.
  • Hazard assessment and correction records created because of the threat.
  • Training or retraining records tied to the threat or newly identified hazard.
  • Plan-review note showing what was reviewed, who participated, and what changed.

Sources

Primary sources & further reading

Frequently asked questions

Does a workplace violence threat go in the SB 553 violent incident log?

Yes, if it is a threat of violence that occurs in a place of employment and is not lawful self-defense or defense of others. The law requires a log entry for every workplace violence incident, not only physical attacks or police-involved events.

What goes in the violent incident log versus the investigation file?

The log gets the non-identifying incident facts, classification, circumstances, consequences, and completion details. Names, witness notes, medical information, legal analysis, and sensitive follow-up belong in the separate confidential investigation file.

When should the workplace violence prevention plan be reviewed after a threat?

Review the plan after a workplace violence incident, when a deficiency is observed or becomes apparent, and at least annually. A threat response should trigger a review of hazards, corrective measures, training, and communication procedures.

What records should HR and legal preserve after a threat?

Preserve the incident log entry, confidential investigation notes, witness statements, communications, security or law-enforcement contacts, photos or video retention notes, hazard correction records, training or retraining records, and plan-review documentation.

How we research & review these guides →