Cal/OSHA IIPP: The California Employer's Guide to §3203 Compliance

The Cal/OSHA IIPP requirement is Title 8, Section 3203 of the California Code of Regulations — a written Injury and Illness Prevention Program that every California employer must establish, implement, and maintain. It has been mandatory for virtually every CA employer since 1991, and §3203 has been the most frequently cited standard Cal/OSHA enforces every year from 2015 through 2025.

An IIPP is not a binder you write once and forget. It is an active program built around eight required elements: responsibility, compliance, communication, hazard assessment, accident investigation, hazard correction, training, and employee access to the Program. This guide walks through what §3203 actually requires, who it applies to, and how to keep your program audit-ready.

What Is an Injury and Illness Prevention Program (IIPP)?

An Injury and Illness Prevention Program is a written, workplace-specific safety program required by 8 CCR §3203. The goal is simple: identify the hazards in your workplace before they injure someone, fix them, train employees on safe work practices, and keep records that prove you did it.

The regulation’s own verbs are “establish, implement and maintain” — three ongoing actions, not one writing task. You write the plan, but the plan only matters if the inspections, training, and recordkeeping behind it are actually happening.

Who Must Have an IIPP in California?

Every California employer with at least one W-2 employee. There is no small-employer exemption. A two-person office needs an IIPP. A 400-person manufacturer needs an IIPP. Construction employers get a second layer on top of this one — §1509’s Code of Safe Practices and tailgate meetings — covered in our construction IIPP guide.

This is different from some other California safety rules. SB 553, for example, generally applies at 10 employees (or to any employer whose workplace is open to the public). §3203 has no such threshold — if you have one employee, you need a program.

The 8 Required Elements of a Cal/OSHA IIPP

§3203(a) lists eight elements and requires a program to address all of them — the regulation’s words are “at a minimum.”

1. Responsibility

The Program must identify the person — or persons — with authority and responsibility for implementing it. For a small business that is the owner, an office manager, or an HR lead, named or identified by job title. If that person leaves and the plan isn’t updated, the Program identifies no one.

2. Compliance

§3203(a)(2) requires a system for ensuring that employees comply with safe and healthy work practices, and accepts recognition of safe work, training and retraining, and disciplinary action as substantial compliance. “We tell people to be careful” is not a system.

3. Communication

Establish a system for communicating with employees on safety matters, in a form readily understandable by all affected employees — if part of your crew reads or speaks Spanish, that includes them — with provisions designed to encourage employees to report hazards without fear of reprisal. The regulation accepts meetings, training programs, posting, written communications, anonymous notification, or a labor-management safety committee as substantial compliance. Employers with fewer than 10 employees may communicate and instruct orally instead.

4. Hazard Assessment

Include procedures for identifying and evaluating workplace hazards, including scheduled periodic inspections. §3203(a)(4) also names three specific occasions for inspection: when the Program is first established, whenever new substances, processes, procedures, or equipment introduce a new hazard, and whenever the employer is made aware of a new or previously unrecognized hazard. §3203(b)(1) requires each scheduled inspection to be recorded — who inspected, what they found, and the action taken to correct it.

5. Accident and Exposure Investigation

§3203(a)(5) requires a procedure to investigate occupational injury and occupational illness. An investigation record worth keeping answers what happened, what caused it, and what changed so it doesn’t repeat.

6. Hazard Correction

Unsafe or unhealthy conditions must be corrected in a timely manner based on the severity of the hazard — §3203(a)(6)’s own words. For an imminent hazard, the regulation requires removing all exposed employees from the area, except those needed to correct the condition. And because §3203(b)(1) requires the inspection record to show the action taken, a hazard logged with no correction recorded leaves that record incomplete.

7. Training

§3203(a)(7) lists six triggers for training: when the Program is first established, every new employee, every employee given a new job assignment without prior training, whenever new substances, processes, procedures, or equipment introduce a new hazard, whenever the employer is made aware of a new or previously unrecognized hazard, and supervisors — on the hazards their employees are exposed to. None of the six is an annual date; §3203 sets no annual training requirement. See our sibling guide on SB 553 training requirements for how workplace-violence training fits alongside your IIPP training.

8. Employee Access to the Program

§3203(a)(8) requires giving an employee, or their designated representative, access to the written Program — in no event later than five business days after the request. This subsection is newer than the rest of the standard: it took effect July 1, 2020, so it may postdate your written plan. If your IIPP doesn’t say where the Program is kept and who hands over a copy, add it.

Many summaries of §3203 list “recordkeeping” as the eighth element. It isn’t — the records requirements are subdivision (b), covered next.

The Recordkeeping Rules: §3203(b)

Separate from the eight elements, §3203(b) requires two kinds of records:

• Inspection records — who conducted each scheduled inspection, the unsafe conditions and work practices found, and the action taken to correct them. Keep for at least one year; employers with fewer than 10 employees may keep them only until the hazard is corrected.
• Training documentation — the employee’s name or other identifier, the training date, the type of training, and who provided it. Keep for at least one year, with further exceptions §3203(b)(2) spells out for the smallest employers.

These two records are where a program shows it is running. A plan can be written in an afternoon; the records only exist if the inspections and training actually happened.

Why Cal/OSHA IIPP Compliance Matters

§3203 tops Cal/OSHA’s most-frequently-cited list — number one, every year from 2015 through 2025. The standard has many parts that all have to exist at once: a named administrator, a communication system, current training documentation, inspection records that show corrections. A missing training record, a stale inspection log, or an unnamed program administrator is each a gap in a required element.

Cal/OSHA publishes current penalty amounts on its Citation Statistics page, and the amounts are indexed annually. Rather than memorize numbers, treat the IIPP as an operational program: the inspections, the training, and the records are the part you control.

Free IIPP Audit Checklist. Every record §3203 requires, one question about each — can you produce it today? A cite per item, a “where it lives” line, and a gaps table at the back. PDF, no account. Request the checklist →

How to Build (or Maintain) Your IIPP

There are two starting points, depending on where you are today.

Starting from scratch

Use one of the free templates. Cal/OSHA publishes an IIPP guide and model program, and State Compensation Insurance Fund offers a free IIPP Builder℠ that’s open to guests, not just policyholders. Our own free IIPP template is a fill-in-the-blanks PDF with the §3203(b) record forms in the same document. Any of the three gets you a written plan to start from.

Already have a plan

Most California employers already have something in a binder. The ongoing work is the records side: the training documentation §3203(b)(2) requires, the inspection records §3203(b)(1) requires, incident investigations, and retraining at the §3203(a)(7) triggers. That’s the operating layer State Fund’s IIPP Builder doesn’t ship, and it’s what CompliantCA is built to handle: import your existing plan, track who’s been trained on what, log hazards and incidents, and export an audit packet when Cal/OSHA asks.

Common IIPP Compliance Mistakes

“We have a plan, it’s in the binder”

A plan written in 2014 and untouched since describes a workplace that no longer exists. §3203 requires an effective program that is implemented and maintained. If you’ve added equipment, moved locations, or hired a new crew, the plan has to catch up.

No proof of training

§3203(b)(2) requires documentation of training: the employee, the date, the type of training, and the provider. Training that happened but was never recorded cannot be shown — to an inspector or to anyone else.

Hazard inspections not documented

Walk-throughs count only if they’re written down. §3203(b)(1) requires the record to name who inspected, the unsafe conditions found, and the action taken to correct them. A simple log carries all of that — but the log has to exist.

Missing the five-business-day access rule

If an employee or their representative requests access to the Program, §3203(a)(8) allows five business days, no more. The rule took effect July 1, 2020, so it may postdate your written plan — if yours doesn’t name who hands over a copy, add it.

Free IIPP template. One section for each of the eight elements listed in §3203(a), plus the inspection and training record forms §3203(b) requires. PDF, no account. Request the template →

Sources & References

• 8 CCR §3203 — Injury and Illness Prevention Program — California Code of Regulations
• Most Frequently Cited Standards — Cal/OSHA citation statistics
• Cal/OSHA IIPP Guide and Model Program — Cal/OSHA
• Cal/OSHA Citation Statistics — Cal/OSHA
• IIPP Builder℠ — State Compensation Insurance Fund