- Protect people first. Separate involved people, get help, preserve immediate safety, and follow emergency procedures before polishing records.
- Threats can be loggable. SB 553 covers threats of violence, not only physical attacks or police-involved events.
- Keep the log non-identifying. The violent incident log omits personal identifying information; HR/legal details stay in the separate investigation file.
- Review hazards after the incident. A threat should feed plan review, hazard correction, communication, and training decisions.
- Preserve before editing. Save messages, witness statements, video-retention notes, law-enforcement contacts, and corrective-action records before memories and systems change.
The first hour: stabilize and preserve
This checklist is not emergency-response training. If there is an active or imminent threat, follow your emergency procedures and contact law enforcement or emergency services as appropriate. Once people are safe, HR and legal should make sure the first hour produces a clean record trail.
- Separate and protect. Move employees away from the threat, arrange medical help if needed, and keep witnesses from debating facts before statements are taken.
- Identify the response owner. Name one person to coordinate HR, site leadership, security, and legal follow-up so no one assumes someone else opened the file.
- Capture time-sensitive evidence. Preserve texts, emails, voicemails, chat screenshots, incident reports, visitor logs, video-retention notes, photos, and law-enforcement or security call details.
- Start the confidential investigation file. Use it for names, witness statements, sensitive facts, medical-adjacent information, legal notes, and case chronology.
- Open the SB 553 log entry. Start the non-identifying violent incident log entry while the basic facts are fresh, then complete it as witness and investigation facts come in.
Threat response checklist
| Step | What to do | Record to create or preserve |
|---|---|---|
| 1. Safety response | Follow emergency procedures, separate involved people, call for help when needed, and protect employees from continuing danger. | Emergency response notes, security or law-enforcement contact, medical-response note if applicable. |
| 2. Initial fact capture | Record date, time, location, who reported the threat, immediate witnesses, and where relevant messages or video may exist. | Confidential investigation intake, preservation checklist, source list. |
| 3. Log classification | Classify the incident as Type 1, 2, 3, or 4 workplace violence, and note whether it involved a threat of physical force or weapon use. | Violent incident log entry without names or identifying detail. |
| 4. Witness and employee input | Solicit information from affected employees and witnesses instead of waiting for volunteered reports. | Witness statements, employee statements, interview notes in the investigation file. |
| 5. Consequences and corrections | Document what was done to protect employees from a continuing threat and what hazard controls changed afterward. | Log consequences field, hazard correction record, action-owner list. |
| 6. Plan review | Review whether the written WVPP, training, reporting path, emergency procedures, and employee communication worked. | Post-incident plan review note and any revised plan/training materials. |
| 7. Follow-up cadence | Calendar unresolved items, training or retraining, facility fixes, communication updates, and legal review deadlines. | Task list, completion records, training records, annual-review file. |
What goes in the log vs. the investigation file
The common mistake is combining everything into one incident document. SB 553 points in the other direction: keep a violent incident log that can be produced without exposing personal identifying information, and keep a separate investigation file for the sensitive details HR and legal need. See the violent incident log guide for every required field, the SB 553 compliance checklist for the full records set, and the penalties guide for what missing records can cost during an enforcement review.
| Violent incident log | Confidential investigation file |
|---|---|
| Date, time, and location. | Names, roles, contact details, and witness list. |
| Workplace violence type and incident category. | Full narrative, interview notes, statements, and source documents. |
| Non-identifying description of what happened. | Threat messages, screenshots, voicemails, video-retention notes, and chain-of-custody notes. |
| Circumstances, where it occurred, and consequences. | Legal analysis, personnel follow-up, leave/accommodation notes, and discipline or separation records. |
| Actions taken to protect employees from continuing threat. | Medical-adjacent information, privileged communications, and sensitive law-enforcement details. |
| Name/job title/date of the person completing the log entry. | Who approved each corrective action and how completion was verified. |
Need your SB 553 packet cleaned up this week?
Get a $299-$499 guided setup and audit-packet review to organize your plan, training records, incident log, hazard fixes, and exportable packet. Then keep the workflow current in SB553Ready for $59/mo.
When to review hazards and the plan
Labor Code Section 6401.9 requires the plan to be reviewed at least annually, when a deficiency is observed or becomes apparent, and after a workplace violence incident. A threat response should therefore close with a short plan-and-hazard review, not just an HR note that the matter was handled.
- Look for the failed control. Did reporting, staffing, lighting, access control, communication, de-escalation, or emergency notification fail or work as designed?
- Update the hazard record. If a new hazard or pattern appears, create or update the hazard identification and correction record.
- Retrain only where needed. Additional training may be limited to the new or changed hazard, but document the topic, date, trainer, attendees, and job titles.
- Close the loop with employees. Explain what changed without exposing confidential personnel or investigation details.
If this review is happening because an inspection or employee-record request is already likely, use the SB 553 inspection checklist to assemble the full packet before deadlines compress the response.
What HR and legal should preserve
Preserve the raw material before systems overwrite it or people forget details. A practical preservation list:
- The non-identifying violent incident log entry and later completion date.
- Employee and witness statements, including who was asked for information and when.
- Threat communications: email, text, chat, voicemail, social media message, letter, or note.
- Video-retention note: where footage may exist, who preserved it, and the relevant time window.
- Security, law-enforcement, or emergency-services contact and response details.
- Hazard assessment and correction records created because of the threat.
- Training or retraining records tied to the threat or newly identified hazard.
- Plan-review note showing what was reviewed, who participated, and what changed.
Sources
- Labor Code Section 6401.9 - definitions, written plan, violent incident log, training, recordkeeping, and plan-review requirements.
- Cal/OSHA Workplace Violence Prevention for General Industry - employer guidance on identifying hazards, responding to incidents, investigations, recordkeeping, and access.
- Cal/OSHA Workplace Violence Prevention FAQ - violent incident log, training, and implementation guidance.
Frequently asked questions
Does a workplace violence threat go in the SB 553 violent incident log?
Yes, if it is a threat of violence that occurs in a place of employment and is not lawful self-defense or defense of others. The law requires a log entry for every workplace violence incident, not only physical attacks or police-involved events.
What goes in the violent incident log versus the investigation file?
The log gets the non-identifying incident facts, classification, circumstances, consequences, and completion details. Names, witness notes, medical information, legal analysis, and sensitive follow-up belong in the separate confidential investigation file.
When should the workplace violence prevention plan be reviewed after a threat?
Review the plan after a workplace violence incident, when a deficiency is observed or becomes apparent, and at least annually. A threat response should trigger a review of hazards, corrective measures, training, and communication procedures.
What records should HR and legal preserve after a threat?
Preserve the incident log entry, confidential investigation notes, witness statements, communications, security or law-enforcement contacts, photos or video retention notes, hazard correction records, training or retraining records, and plan-review documentation.
How we research & review these guides →
This article is general information about California law, not legal advice, and SB553Ready is a software tool, not a law firm. Threat response can involve urgent safety, employment, privacy, and legal issues; confirm your response with qualified counsel or a safety professional.