- Safety comes before paperwork. Separate involved people, follow emergency procedures, get medical or law-enforcement help when needed, and stop any continuing danger before polishing records.
- Threats can trigger SB 553 records. Cal/OSHA describes workplace violence as including threats of violence at a place of employment, not only assaults or injuries.
- Use two records, not one catch-all file. Put prevention facts in the non-identifying violent incident log; keep names, statements, sensitive facts, and counsel-directed analysis in a separate investigation file.
- Review hazards after the threat. Cal/OSHA guidance connects incident response to investigation, hazard correction, and review of the written workplace violence prevention plan.
- Preserve evidence before systems overwrite it. Save messages, witness statements, video-retention notes, security or law-enforcement contacts, hazard fixes, and training records.
Direct answer: threat response checklist for HR and legal
- First action: protect people, separate involved employees or visitors, follow emergency procedures, and call for medical, security, or law-enforcement help when needed.
- First record: open a confidential investigation file for names, witness statements, sensitive facts, messages, photos, video-retention notes, and counsel-directed analysis.
- SB 553 record: create a non-identifying violent incident log entry if the threat meets the workplace violence definition.
- Follow-up record: document hazard review, corrective actions, plan review, training or retraining, and employee communication.
- Do not combine everything: the shareable incident log and the confidential investigation file should not be the same document.
The first 30 minutes
This checklist is not emergency-response training. If there is an active or imminent threat, follow your emergency procedures and contact law enforcement or emergency services as appropriate. Once people are safe, HR and legal should make sure the first half hour produces a clean record trail.
- Assign one response owner. Name who is coordinating site leadership, HR, security, legal, and follow-up records.
- Separate and protect. Move people away from the threat, arrange medical help if needed, and avoid forcing witnesses to debate facts before statements are taken.
- Preserve evidence immediately. Save texts, emails, chat messages, voicemails, visitor logs, photos, video-retention notes, security reports, and law-enforcement contact details.
- Start the investigation file. Use it for names, witness statements, source documents, chronology, personnel follow-up, and sensitive facts.
- Start the SB 553 log entry. Use non-identifying facts while details are fresh, then complete the required fields as the investigation develops.
HR/legal response checklist
| Step | What to do | Record to create or preserve |
|---|---|---|
| 1. Safety response | Follow emergency procedures, separate involved people, call for help when needed, and protect employees from continuing danger. | Emergency response notes, security or law-enforcement contact, medical-response note if applicable. |
| 2. Initial fact capture | Record date, time, location, reporter, immediate witnesses, and where relevant messages or video may exist. | Confidential investigation intake, preservation checklist, source list. |
| 3. Log classification | Decide whether the event is Type 1, 2, 3, or 4 workplace violence and whether it involved a threat of physical force or weapon use. | Violent incident log entry without names or identifying detail. |
| 4. Employee and witness input | Ask affected employees and witnesses for information instead of waiting for volunteered reports. | Witness statements, employee statements, interview notes in the investigation file. |
| 5. Continuing-threat control | Decide what is needed now to prevent further exposure: staffing, access control, security, schedule changes, communications, or other controls. | Action-owner list, temporary-control record, hazard correction record. |
| 6. Plan and hazard review | Check whether the written WVPP, reporting path, emergency procedures, training, and employee communication worked. | Post-incident plan-review note and any revised plan or training materials. |
| 7. Closeout cadence | Calendar unresolved fixes, retraining, communication updates, evidence-retention dates, and review deadlines. | Task list, completion records, training records, annual-review file. |
What goes in the log versus the investigation file
The common mistake is combining everything into one incident document. SB 553 points in the other direction: keep a violent incident log that can be produced without exposing personal identifying information, and keep a separate investigation file for the sensitive details HR and legal need.
Use the violent incident log guide for every required log field, the SB 553 compliance checklist for the full records set, and the penalties guide for what missing records can cost during an enforcement review. If the threat shows that the written plan is stale, update the California WVPP template before the next training or annual review.
| Violent incident log | Confidential investigation file |
|---|---|
| Date, time, location, and workplace violence type. | Names, roles, contact details, witness list, and chronology. |
| Non-identifying description of what happened. | Full narrative, interview notes, statements, and source documents. |
| Circumstances, consequences, and actions taken to protect employees from continuing threat. | Threat messages, screenshots, voicemails, video-retention notes, and source-preservation notes. |
| Name/job title/date of the person completing the log entry. | Legal analysis, personnel follow-up, leave or accommodation notes, and discipline or separation records. |
| Shareable prevention facts that omit personal identifying information. | Sensitive law-enforcement details, medical-adjacent information, and confidential communications. |
Need your SB 553 response packet cleaned up this week?
Get a guided setup and audit-packet review to organize the plan, training records, incident log, hazard fixes, investigation records, and exportable packet after a threat or near miss.
When to review hazards and the WVPP
Cal/OSHA guidance connects workplace violence response to investigation, hazard correction, and review of the written workplace violence prevention plan. A threat response should therefore close with a short plan-and-hazard review, not just an HR note that the matter was handled.
- Look for the failed control. Did reporting, staffing, lighting, access control, communication, de-escalation, or emergency notification fail or work as designed?
- Update the hazard record. If a new hazard or pattern appears, create or update the hazard identification, evaluation, and correction record.
- Retrain only where needed. Additional training may be limited to the new or changed hazard, but document the topic, date, trainer, attendees, and job titles.
- Close the loop with employees. Explain what changed without exposing confidential personnel or investigation details.
If an inspection or employee-record request is already likely, use the SB 553 inspection checklist and the 15-calendar-day record request guide to assemble the packet before deadlines compress the response.
What HR and legal should preserve
Preserve the raw material before systems overwrite it or people forget details:
- Non-identifying violent incident log entry and later completion date.
- Employee and witness statements, including who was asked for information and when.
- Threat communications: email, text, chat, voicemail, social media message, letter, or note.
- Video-retention note: where footage may exist, who preserved it, and the relevant time window.
- Security, law-enforcement, or emergency-services contact and response details.
- Hazard assessment and correction records created because of the threat.
- Training or retraining records tied to the threat or newly identified hazard.
- Plan-review note showing what was reviewed, who participated, and what changed.
Internal routing after the threat
After the immediate response is stable, route the work through the rest of the SB 553 packet:
- Use the violent incident log guide to keep the log non-identifying and complete.
- Use the WVPP template to update stale plan roles, procedures, or hazard controls.
- Use the inspection checklist to assemble a desk-ready packet.
- Use the SB 553 penalties guide if the threat may lead to an employee complaint, Cal/OSHA inspection, or records request.
- Use the healthcare comparison if the worksite is healthcare-adjacent and may belong under Title 8 section 3342 instead.
Sources
- California Labor Code Section 6401.9 - statutory text for workplace violence definitions, violent incident logs, post-incident response, training, recordkeeping, and plan-review requirements.
- Cal/OSHA Workplace Violence Prevention for General Industry - agency guidance on threats of violence, written WVPP elements, post-incident investigation, hazard correction, records, retention, and access.
- Cal/OSHA Workplace Violence Prevention FAQ - agency answers on SB 553 coverage, effective date, incident logs, training, and implementation questions.
Frequently asked questions
What should HR and legal do first after a workplace violence threat?
Protect people first: separate involved people, follow emergency procedures, get medical or law-enforcement help when needed, and assign one response owner. Then preserve evidence, open the confidential investigation file, and start the non-identifying SB 553 incident log entry.
Does a workplace violence threat go in the SB 553 incident log?
It can. Labor Code Section 6401.9 and Cal/OSHA guidance define workplace violence to include threats of violence at a place of employment, except lawful self-defense or defense of others. If the facts meet that definition, create a log entry.
What goes in the incident log versus the investigation file?
The incident log should contain non-identifying prevention facts: date, time, location, workplace violence type, circumstances, consequences, and completion details. Names, witness statements, sensitive facts, legal analysis, personnel follow-up, and source documents belong in the confidential investigation file.
What records should be preserved after a threat?
Preserve the log entry, investigation notes, statements, threat communications, video-retention notes, security or law-enforcement contacts, photos, hazard review notes, corrective-action records, training records, and plan-review documentation.
When should the workplace violence prevention plan be reviewed after a threat?
Review the plan after a workplace violence incident, when a deficiency becomes apparent, and at least annually. A threat should trigger a short review of reporting, emergency response, communication, hazard controls, training, and corrective actions.
How we research & review these guides →
This article is general information about California workplace violence prevention requirements, not legal advice. Threat response can involve urgent safety, employment, privacy, and legal issues; confirm your response with qualified counsel or a workplace safety professional.