The California IIPP: the safety program Cal/OSHA requires (2026)

In most of the country a written safety program is strongly recommended but not, by itself, legally mandated. California is different. Under Cal/OSHA's Title 8 regulations, nearly every employer in the state must have a written Injury and Illness Prevention Program — an IIPP — and it is one of the first things a Cal/OSHA inspector asks to see. This guide explains what an IIPP is, who needs one, the eight required elements, and how to keep it from becoming the stale document that earns a citation.

Who has to have an IIPP

The requirement comes from California Code of Regulations, Title 8, Section 3203, in effect since July 1, 1991. It states that every employer shall establish, implement and maintain an effective IIPP. There is no small-business exemption from having one — a business with a single employee needs an IIPP just as a large one does, though some administrative requirements (like how communication and recordkeeping work) are lighter for very small employers. If you employ anyone in California, this applies to you.

The eight required elements

A compliant IIPP must address eight specific components. Cal/OSHA looks for each:

1. Responsibility. Name the person or people with authority and responsibility for implementing the program. A real name and role, not "management."

2. Compliance. How you ensure employees follow safe work practices — recognition, training and, where needed, disciplinary procedures.

3. Communication. A system for two-way communication with employees about safety in a form they understand — meetings, postings, or an anonymous hazard-reporting channel. Employers with fewer than 10 employees may communicate orally.

4. Hazard assessment. Scheduled inspections to identify and evaluate workplace hazards — when the program is first established, when new substances, processes or equipment are introduced, and when new hazards come to light.

5. Accident/exposure investigation. A procedure to investigate occupational injuries and illnesses and near misses, so you learn from them.

6. Hazard correction. Methods and procedures for correcting unsafe conditions in a timely manner, with the urgency matched to the severity, and immediate action for imminent hazards.

7. Training. Training when the program starts, for all new hires, for anyone given a new assignment, whenever new hazards are introduced, and for supervisors on the hazards their teams face.

8. Recordkeeping. Records of scheduled inspections and of safety training. Employees have the right to see and receive copies of their IIPP within five business days of asking.

Recordkeeping in practice

Two records matter most. Inspection records — documenting who inspected, when, and the unsafe conditions found and how they were corrected — must generally be kept for at least one year (very small employers may keep them only until the hazard is fixed). Training records — the employee's name, the training dates, the type of training, and the trainer — must be kept for at least one year. These are exactly the records an inspector will ask for, and the absence of them is a common finding even when the underlying safety practices are sound.

Why "written once" fails a Cal/OSHA visit

The most common IIPP failure is not the absence of a document but a document that does not match the business. A generic template with the company name typed in, describing hazards you do not have and omitting the ones you do, tells an inspector that safety here is a paperwork exercise. A compliant IIPP is specific to your operations, names real people, reflects your actual hazards, and — crucially — is backed by current inspection and training records that prove it is being implemented, not just written. Cal/OSHA judges an IIPP on effectiveness, not on whether a binder exists.

Keeping it live

Because the IIPP has to be maintained, kept current, and evidenced with dated records, it is a poor fit for a static document and a natural fit for a system. Complys builds your written program around these eight elements, keeps your inspections, training and certifications current with reminders, and holds the records Cal/OSHA asks for — so an inspection is a matter of showing a live, in-date program rather than reconstructing one under pressure. If you also work outside California, see our overview of OSHA State Plans for how requirements shift by state.