California IIPP Requirements: The Eight Elements of 8 CCR 3203

Every employer in California has to have an Injury and Illness Prevention Program. Not most employers, not employers over a certain size, and not only contractors. If you have one employee in this state, section 3203 of Title 8 applies to you, and it has since July 1, 1991.

It is also the single most cited standard in California. Cal/OSHA publishes its most frequently cited standards by calendar year, and section 3203 has held the number one position in general industry every year on that list. When I open a new client's safety binder the first document I look for is the IIPP, and what I usually find is a purchased template with the blanks half filled, sometimes with another company's name still sitting in a section nobody read. That document fails the first question an inspector will ask about it, because the standard does not require you to own an IIPP. It requires you to run one.

This guide covers what section 3203 actually says, the eight required elements quoted from the regulation rather than from memory, the records you have to keep, the additional duties construction employers pick up under section 1509, and an honest answer on whether a template will do. Every citation on this page was checked against the operative text at dir.ca.gov before it was written.

Written by Matthew Horovitz, M Squared Safety. Twenty plus years managing contractor and general industry safety programs on live job sites. Call 949-954-6581.

What is an IIPP, and does my business need one?

The Injury and Illness Prevention Program is California's universal safety program requirement. Section 3203(a) opens: Effective July 1, 1991, every employer shall establish, implement and maintain an effective Injury and Illness Prevention Program (Program). The Program shall be in writing and, shall, at a minimum do the eight things listed below.

Read the verbs, because all four of them are enforceable. Establish is the document. Implement is doing the things the document describes. Maintain is keeping it true as the business changes. Effective is the one that decides citations, and it is judged against your workplace rather than against a checklist.

The obligation reaches every industry. An office, a machine shop, a restaurant group, a distribution center, a landscaping crew, a medical practice and a general contractor are all covered by the same section. Construction employers do not get a different program, they get the same program plus additions, which is covered further down.

Federal OSHA has no equivalent rule. There is no nationwide requirement that every employer maintain a written safety program, which is why employers moving into California from federal OSHA states get caught flat. A program bought from a national provider is built to the federal baseline and leaves the California specific gaps for you to discover during an inspection. More on how the two systems relate is in federal OSHA and state plans, explained.

What are the eight required elements of 8 CCR 3203(a)?

Here they are, each one with the regulation's own language and then what it means in practice.

1. Responsibility, 3203(a)(1). Identify the person or persons with authority and responsibility for implementing the Program. Authority is the operative word and it is the one people skip. Naming a coordinator who cannot stop work, cannot spend money and cannot overrule a production decision names a scapegoat, not a program administrator. The name in that blank is also the first thing an inspector will ask to speak to.

2. Compliance, 3203(a)(2). A system for ensuring that employees comply with safe and healthy work practices. The regulation says substantial compliance includes recognition of employees who follow safe and healthful work practices, training and retraining programs, disciplinary actions, or any other such means. Whatever mix you pick has to function, which means your discipline records and your recognition practices are evidence either way.

3. Communication, 3203(a)(3). A system for communicating with employees in a form readily understandable by all affected employees on matters relating to occupational safety and health, including provisions designed to encourage employees to inform the employer of hazards at the worksite without fear of reprisal. Meetings, training, postings, written communications, anonymous notification and safety committees all qualify. On a bilingual workforce, English only communication does not meet readily understandable by all affected employees. Employers with fewer than 10 employees may communicate and instruct orally under the exception to this subsection.

4. Hazard assessment, 3203(a)(4). Procedures for identifying and evaluating work place hazards including scheduled periodic inspections to identify unsafe conditions and work practices. Inspections are required when the Program is first established, whenever new substances, processes, procedures, or equipment are introduced to the workplace that represent a new occupational safety and health hazard, and whenever the employer is made aware of a new or previously unrecognized hazard. Note what the regulation does not do: it never sets a frequency. You set the schedule, in writing, and then you are held to it.

5. Accident and exposure investigation, 3203(a)(5). Include a procedure to investigate occupational injury or occupational illness. That is the entire subsection. The standard hands you no form and no format. It requires that investigations happen, that you have a procedure for them, and in practice that what you learn feeds back into element six.

6. Hazard correction, 3203(a)(6). Methods for correcting unsafe conditions, work practices and work procedures in a timely manner based on the severity of the hazard, both when observed or discovered and when an imminent hazard exists. For imminent hazards the regulation is specific: remove all exposed personnel from the area except those necessary to correct the existing condition, and those employees shall be provided the necessary safeguards.

7. Training and instruction, 3203(a)(7). Required when the program is first established, to all new employees, to all employees given new job assignments for which training has not previously been received, whenever new substances, processes, procedures or equipment introduce a new hazard, whenever you are made aware of a previously unrecognized hazard, and for supervisors to familiarize themselves with the safety and health hazards to which employees under their immediate direction and control may be exposed. That last line deserves underlining. Supervisors promoted for production skill routinely never receive it, and it is a clean finding for an inspector who asks a foreman what hazards his crew faces.

8. Employee access to the Program, 3203(a)(8). Allow employee access to the Program. This is the element most published lists still get wrong, because it was added to the regulation in 2020 and became operative on July 1, 2020. The regulation defines access as the right and opportunity to examine and receive a copy, and it sets a deadline: you must provide access in a reasonable time, place, and manner, but in no event later than five (5) business days after the request for access is received from an employee or designated representative. One printed copy is free. A collective bargaining agent is automatically treated as a designated representative. Alternatively you may provide unobstructed access through a company server or website, but the regulation defines that narrowly, as electronic means the employee predictably and routinely uses for work. Finally, 3203(a)(8)(E) requires that you communicate the right and procedure to access the Program to all employees, so the access element has its own communication duty attached to it.

Why your template probably lists recordkeeping as element eight

This is worth a section of its own, because it is the most common defect I find in otherwise reasonable programs.

Cal/OSHA's model program for non-high-hazard employers, last revised in August 1995, lists eight elements ending in recordkeeping, and templates built from it do the same. That model predates the 2020 amendment. In the current regulation, recordkeeping is not in the (a) list at all. It sits in section 3203(b), and the eighth item in (a) is employee access. Cal/OSHA's current guide to developing an IIPP, dated June 2024, has caught up: it lists employee access as the eighth item and recordkeeping and documentation as a ninth.

Both duties are real and both are enforceable, so nothing is lost by a program that covers recordkeeping. What is lost is the access element, because a document built from a pre-2020 list has no section on it, no five business day procedure, and nothing telling employees the right exists. If your IIPP has eight numbered sections and the last one is called Recordkeeping, that is the tell. Check whether employee access appears anywhere in it.

Who has to be named as the person with authority and responsibility?

Section 3203(a)(1) says the person or persons, so it can be one name or several, and larger organizations usually need several: an executive who owns the program, and named individuals who own it at each site or division.

Three practical tests before you write a name in that blank:

• Can this person stop work? If the answer is that they would have to ask someone, they have responsibility without authority, which is the specific thing the subsection is written against.
• Can this person spend money to correct a hazard? Element six requires timely correction based on severity. Correction usually costs something.
• Do they still work here? A named administrator who left two years ago is the most common single defect I see, and it undermines the whole document, because it proves nobody has read it since.

Naming an outside consultant does not transfer the duty. The employer holds the obligation. What a consultant can be is the person who builds and runs the program alongside a named internal owner, which is how our fractional EHS service is structured.

What records does section 3203(b) require, and for how long?

Recordkeeping is where solid field programs get cited anyway, because the work happened and the paper did not. Section 3203(b) requires records of the steps taken to implement and maintain the Program in two categories.

• Inspection records under 3203(b)(1): the scheduled and periodic inspections required by (a)(4), including person(s) conducting the inspection, the unsafe conditions and work practices that have been identified and action taken to correct the identified unsafe conditions and work practices. Maintained at least one year. Employers with fewer than 10 employees may elect to keep them only until the hazard is corrected.
• Training documentation under 3203(b)(2): for each employee, employee name or other identifier, training dates, type(s) of training, and training providers. Maintained at least one year.

Three exceptions are worth knowing. Employers with fewer than 10 employees may substitute a log of instructions given to each employee. Training records for employees who worked less than a year need not be retained past the term of employment if they are given to the employee on termination. And employers with fewer than 20 employees, in industries not on the Department's high hazard list and carrying a workers' compensation experience modification rate of 1.1 or less, or in industries on the Department's low hazard list, may limit written documentation to three things: who is responsible under (a)(1), the scheduled periodic inspections under (a)(4), and the training and instruction under (a)(7).

If you use a labor management safety and health committee to satisfy the communication element, section 3203(c) sets its own conditions: meet at least quarterly, keep written records of the issues discussed for at least one year, review inspection results and accident investigations, and verify abatement to the Division on request.

One thing IIPP records are not: your Cal/OSHA Form 300 injury log. Those run in parallel under their own rules and retention periods. Keeping one does not satisfy the other.

What extra IIPP requirements apply to construction companies?

Construction employers pick up the IIPP through section 1509(a) of the Construction Safety Orders, which reads: Every employer shall establish, implement and maintain an effective Injury and Illness Prevention Program in accordance with section 3203 of the General Industry Safety Orders. Same eight elements, same records. Section 1509 then adds four duties on top.

A written Code of Safe Practices, 1509(b). Every employer shall adopt a written Code of Safe Practices which relates to the employer's operations. The Code shall contain language equivalent to the relevant parts of Plate A-3 of the Appendix. Two things people miss. It has to relate to your operations, so a Code covering trenching when you hang drywall is not a Code. And Plate A-3 is a real document in the Appendix to the Construction Safety Orders, so there is a benchmark for what equivalent language means.

Posting or distribution of the Code, 1509(c). The Code of Safe Practices shall be posted at a conspicuous location at each job site office or be provided to each supervisory employee who shall have it readily available. Read that carefully, because it is commonly restated wrong. The posting location is the job site office, and the alternative is distribution to each supervisory employee, not to every employee.

Supervisory safety meetings, 1509(d). Periodic meetings of supervisory employees shall be held under the direction of management for the discussion of safety problems and accidents that have occurred. This is a separate obligation from tailgate meetings and it is the one contractors most often have no records for at all, because everyone remembers the crew meeting and nobody documents the supervisor meeting.

Tailgate meetings, 1509(e). Supervisory employees shall conduct "toolbox" or "tailgate" safety meetings, or equivalent, with their crews at least every 10 working days to emphasize safety. Every 10 working days is the floor. Weekly is the common practice and the one I recommend, because it beats the minimum comfortably and produces a clean documentation trail without anyone tracking working days.

Two neighboring sections belong in the same binder. Section 1511(b) requires that, before employees are on site, the employer shall make a thorough survey of the conditions of the site to determine, so far as practicable, the predictable hazards to employees in accordance with Plate A-2. Section 1512 covers emergency medical services, including the first aid kit requirement at 1512(c) and the trained person requirement at 1512(b).

Between the written program, the Code of Safe Practices, the site survey and a stack of dated meeting records, a prepared contractor can answer most of an inspector's opening document request out of one binder.

Is a California IIPP template good enough?

People search for an IIPP template because they want a document, and that is a reasonable thing to want. So here is the straight answer rather than a sales pitch.

Cal/OSHA publishes free model programs. There is a model IIPP for non high hazard employers and a model IIPP for high hazard employers, from the agency that enforces the standard. If you are going to start from a template, start from one of those rather than from a paid download, and then check it against the eight elements above, because the models predate the employee access element.

There is a real incentive attached to the model program too. Under section 336(d)(11), no civil penalty is assessed against an employer who adopts, posts, and implements in good faith the Model Injury and Illness Prevention Program for Non-High-Hazard Employment prepared by the Division for a first violation of the IIPP standard. And under 336(d)(10), a new employer gets one year from establishing a business in the state with no civil penalty for a regulatory or general IIPP violation, again conditioned on a good faith effort to comply.

Now the honest part. A template is a starting point and stopping there is where the citation comes from. Cal/OSHA's own model program says the administrator must carefully review the requirements for each of the eight IIP Program elements found in this model program, fill in the appropriate blank spaces and check those items that are applicable to your workplace. The state hands you the document and tells you it is not finished.

The reason is structural. Section 3203 requires an effective program that is implemented. Effectiveness cannot be pre-written by someone who has never seen your workplace, because five of the eight elements only mean anything when they describe your actual operation:

• Element 1 needs a real name with real authority in your organization.
• Element 3 needs a communication method your workforce actually uses, in a language they actually understand.
• Element 4 needs an inspection schedule you actually keep and hazards that actually exist at your site.
• Element 7 needs training that matches the jobs your people actually do.
• Element 8 needs a procedure your employees have actually been told about.

So use a template for the structure and the required language. Then do the part that cannot be downloaded: walk your operation, list your real hazards, set an inspection schedule you can keep, name someone who can stop work, and start generating the records in 3203(b). The gap Cal/OSHA cites is almost never a missing document. It is a document that describes a company nobody works at.

What a deficient IIPP looks like

From my own site work in California, in rough order of how often I find them:

• The named responsible person no longer works there, or has no authority to stop work or spend money.
• The document promises an inspection frequency that nobody performs, so the program documents its own violation.
• No inspection records, or records that name findings without naming the corrective action, which 3203(b)(1) requires explicitly.
• Training records missing the training provider or the type of training, both of which 3203(b)(2) names.
• No supervisor training under 3203(a)(7)(F), discovered the moment an inspector asks a foreman what hazards his crew faces.
• No employee access procedure at all, because the template predates 2020.
• English only communication on a workforce that is not.
• Construction: a Code of Safe Practices copied from another trade, or no records for the 1509(d) supervisory meetings.
• The document is current. Nothing else in the binder has a date on it from this year.

The pattern underneath all of these is the same. An inspector does not evaluate the document in isolation. They read it, then walk the workplace and talk to employees, and every promise in the document is a claim they can test.

What happens if Cal/OSHA cites your IIPP

Penalties are set by section 336. A general violation may be assessed up to $16,285 for each such violation under 336(b). A serious violation carries an initial base penalty of $18,000 and a maximum of $25,000 under 336(c)(1). Those figures are then adjusted for size, good faith and history under 336(d).

The quieter consequence is the expensive one. Section 336(d)(8) provides that the penalty for any serious violation shall not be subject to adjustment pursuant to this subsection other than for Size where the employer does not have an operative injury prevention program. Good faith and history reductions that would have cut a serious penalty substantially come off the table, and they come off across every serious citation on the inspection, not just the IIPP citation. When something goes wrong on your site, the IIPP is the difference between an adjusted penalty and a full freight one.

The other written plan California now requires

Worth knowing while you have the binder open. Since July 1, 2024, Labor Code section 6401.9 requires covered employers to establish, implement and maintain an effective written Workplace Violence Prevention Plan. Cal/OSHA states that employers may include it as a separate section in their IIPP or maintain it as its own document. It is a distinct plan with its own required contents, training and records, so folding it into your IIPP does not reduce what it has to contain.

California also runs several standards with no federal counterpart that your IIPP has to sit alongside: heat illness outdoors under 8 CCR 3395 and indoors under 8 CCR 3396, covered in the California heat illness standards, indoor and outdoor, explained, and wildfire smoke under 8 CCR 5141.1. More short answers on Cal/OSHA questions are on safety answers.

Have someone read your IIPP before Cal/OSHA does

If your IIPP is a template you never implemented, if the responsible person named in it has left, or if you cannot remember the last time anyone updated it, that is a fixable problem and it is much cheaper to fix before an inspection than after one.

Send us what you have. We read it against the eight elements of 3203(a), the records in 3203(b), and, if you are a contractor, the 1509 additions, and we tell you the specific gaps in plain language. We work with general industry employers and construction contractors across Southern California, from Ventura County to the Mexico border: Orange, Los Angeles, San Diego, Riverside, San Bernardino and Ventura counties. If you would rather hand the whole program to someone, that is what our Fractional EHS retainer covers.

If the phone is faster, call 949-954-6581 and describe your operation on the call. You can also book a call and put it on the calendar, or read how the ongoing version works under fractional EHS and safety consulting.

Frequently asked questions

Does every California employer need an IIPP?

Yes. Section 3203(a) requires every employer in California to establish, implement and maintain an effective, written Injury and Illness Prevention Program, effective July 1, 1991. The threshold is one or more employees. There is no industry exemption and no small-company exemption from the program itself.

Does a California IIPP have to be in writing?

Yes. Section 3203(a) says the Program "shall be in writing." Two provisions in section 3203 narrow what has to be written down. Under Exception No. 3, an employer with fewer than 20 employees, in an industry that is not on the Department of Industrial Relations high hazard list and with a workers' compensation experience modification rate of 1.1 or less, or in an industry on its low hazard list, may limit the written documentation to the person responsible under (a)(1), the scheduled periodic inspections under (a)(4), and the training and instruction under (a)(7). And under Note 1, an employer the Division has determined historically uses seasonal or intermittent employees is treated as meeting the written program requirement if it adopts and follows the Division's Model Program. Cal/OSHA's June 2024 guide puts the general rule plainly: your IIPP must be a written plan that includes procedures and is put into practice.

What are the eight required elements of an IIPP?

Under 8 CCR 3203(a) they are: (1) identify the person or persons with authority and responsibility for implementing the Program; (2) a system for ensuring employees comply with safe and healthy work practices; (3) a system for communicating with employees in a form readily understandable by all affected employees; (4) procedures for identifying and evaluating workplace hazards, including scheduled periodic inspections; (5) a procedure to investigate occupational injury or occupational illness; (6) methods for correcting unsafe conditions in a timely manner based on the severity of the hazard; (7) training and instruction; and (8) allow employee access to the Program.

Is recordkeeping one of the eight elements of section 3203(a)?

No, and this is where most published lists are out of date. Recordkeeping sits in section 3203(b), not in the (a) list. The eighth item in 3203(a) is employee access to the Program, which was added to the regulation in 2020 and became operative on July 1, 2020. Cal/OSHA's model program for non-high-hazard employers, last revised in 1995, still lists recordkeeping as element eight, so a template built from it can be missing the access element entirely. Cal/OSHA's current guide, dated June 2024, lists access eighth and recordkeeping ninth. Both duties apply either way.

Does federal OSHA require an IIPP?

No. There is no federal rule requiring every employer to maintain a written safety program. The IIPP obligation in section 3203 is a California rule, which is one reason employers expanding into California from federal OSHA states get cited early.

Is a downloadable IIPP template enough for Cal/OSHA?

A template is a legitimate starting point. Cal/OSHA itself publishes free model programs. The problem is that section 3203 requires an effective program that is implemented, and effectiveness is tested against your actual operation. An inspector reads the document, then walks the site and interviews employees to see whether the two match. A template that names nobody real, describes inspections you do not perform, or covers hazards you do not have documents its own violation.

How long do I have to keep IIPP records?

At least one year for both categories in section 3203(b): inspection records naming the person who conducted the inspection, the unsafe conditions and work practices identified, and the action taken to correct them; and training documentation showing employee name or other identifier, training dates, types of training, and training providers. Labor management safety committee records under 3203(c) are also kept at least one year.

Is my company exempt if I have fewer than 10 employees?

No. The written program and all eight elements still apply. Employers with fewer than 10 employees get narrower relief: under the exception to 3203(a)(3) they may communicate and instruct orally, under the exception to 3203(b)(1) they may keep inspection records only until the hazard is corrected, and under Exception No. 1 to 3203(b)(2) they may substitute a log of instructions for full training documentation.

Do construction employers have to comply with both 3203 and 1509?

Yes, and they nest. Section 1509(a) requires every construction employer to run an IIPP in accordance with section 3203, then adds four construction duties: a written Code of Safe Practices under 1509(b), posting or distribution of that Code under 1509(c), periodic safety meetings of supervisory employees under 1509(d), and toolbox or tailgate meetings with crews at least every 10 working days under 1509(e).

How often do tailgate meetings have to happen?

At least every 10 working days, under section 1509(e). Supervisory employees conduct them with their crews. Most contractors run them weekly, which comfortably beats the minimum and builds the documentation trail at the same time.

How often should an IIPP be updated?

The standard sets triggers rather than a calendar. Section 3203(a)(4) requires inspections when the Program is first established, whenever new substances, processes, procedures or equipment introduce a new hazard, and whenever you are made aware of a new or previously unrecognized hazard. Section 3203(a)(7) sets matching training triggers. Update the document whenever one of those fires, and whenever the responsible person named in it changes.

What happens to Cal/OSHA penalties if I do not have an operative IIPP?

Under section 336(d)(8), an employer without an operative injury prevention program loses the penalty adjustments on any serious violation other than the adjustment for size. The good faith and history reductions come off the table across every serious citation on that inspection, not just the IIPP citation.