IIPP California: Keep Your Injury and Illness Prevention Program Audit-Ready
For California employers who already have an IIPP document from Cal/OSHA's model program or State Fund's builder: the records side — training documentation, inspection records, corrections — is where §3203 compliance is actually decided.
If you run a business in California, IIPP compliance is not optional. Every employer with at least one W-2 employee needs a written Injury and Illness Prevention Program under 8 CCR §3203. Most employers already have the plan document. What many can’t do is produce the records behind it — the training documentation and inspection records §3203(b) requires — at the moment someone asks.
The plan document itself is a solved problem, free from three directions: Cal/OSHA’s model program, State Fund’s IIPP Builder℠, and our own fill-in IIPP template. This page is about the other half — running the program those documents describe.
Why IIPP Compliance in California Is an Operating Problem, Not a Template Problem
Every California employer with one or more employees needs an IIPP. See our Cal/OSHA IIPP guide for the full breakdown of §3203 and its eight required elements.
The hard part isn’t writing the plan. The hard part is what comes after: keeping training records, hazard inspection records, and investigation records current, so you can produce them when asked.
The enforcement data points the same way. §3203 has been the single most frequently cited Cal/OSHA standard — first on the agency’s own top-10 list — every year from 2015 through 2025. In CompliantCA’s own analysis of the federal enforcement data, §3203 is the most-cited or second most-cited standard in every industry and at every employer size, from one-person shops to 250-plus-employee facilities. The document is the easy half. What the regulation demands is a program that is established, implemented, and maintained: inspections on a schedule, training at the six triggers §3203(a)(7) lists, hazards corrected and the correction recorded. A plan in a binder can’t show any of that.
The Records That Keep a Program Alive
Four kinds of records, each one §3203 names or implies, each checkable today:
- Training documentation — §3203(b)(2): the employee, the date, the type of training, and who provided it, for each of the six training triggers in §3203(a)(7). New hire, new job assignment, new substance or process, newly recognized hazard, program establishment, and supervisors on their employees’ hazards.
- Inspection records — §3203(b)(1): who inspected, what unsafe conditions and work practices were found, and what was done about them. Employers with fewer than 10 employees may keep each record only until the hazard is corrected.
- Corrections, closed out on the record — a finding with no recorded fix leaves the inspection record incomplete.
- Investigation records — §3203(a)(5) requires a procedure to investigate occupational injury or illness; a record is how you show it ran.
Free IIPP Audit Checklist. Every record §3203 requires, one question about each — can you produce it today? A write-in line for where each record lives, and a gaps table with owners and dates. PDF, no account. Request the checklist →
Injury and Illness Prevention Program California: The Full Statutory Picture
Under §3203, the written plan is just the starting point. Every California IIPP must also name a person responsible for the program, document how safe practices are enforced, establish two-way communication with employees — in a form readily understandable by all of them — run hazard inspections on a schedule, investigate occupational injuries and illnesses, correct hazards in a timely manner based on severity, train employees at the six triggers §3203(a)(7) lists, and give any employee access to the Program within five business days of a request.
The regulation’s own verbs are “establish, implement and maintain” — a program that runs, not a document that exists. For the line-by-line breakdown of what each element requires, see our Cal/OSHA IIPP pillar guide.
Already Have an IIPP from Cal/OSHA or State Fund?
Good — the plan is done, and there is no reason to redo it. Cal/OSHA’s model program and State Fund’s IIPP Builder℠ both produce a solid written plan, free. What neither ships is the records side: the training log, the inspection records, the investigation files, and a habit of closing corrections out on paper.
The cheapest next step is an hour with the audit checklist: walk your existing plan’s records item by item, write down where each one lives, and carry anything you can’t produce to the gaps table with an owner and a date.
The Five-Business-Day Question
One kind of request comes with a deadline the regulation sets itself: under §3203(a)(8), an employee who asks for the written Program must get access within five business days. A program whose records live in a specific, named place — a binder is fine, if everyone knows which binder — answers that request in minutes. A program scattered across a shared drive, an old laptop, and the memory of whoever does HR does not. Naming where each record lives is most of the fix, and it is exactly what the checklist’s write-in lines are for.
Free IIPP template. One section for each of the eight elements listed in §3203(a), plus the inspection and training record forms §3203(b) requires. PDF, no account. Request the template →
Sources & References
- 8 CCR §3203 — Injury and Illness Prevention Program — California Code of Regulations
- Most Frequently Cited Standards — Cal/OSHA citation statistics
- Cal/OSHA IIPP Guide and Model Program — Cal/OSHA
- IIPP Builder℠ — State Compensation Insurance Fund
Frequently asked questions
Do I need an IIPP if I have fewer than 10 employees?
Yes. 8 CCR §3203 applies to every California employer with at least one W-2 employee. There is no headcount threshold for the IIPP requirement.
Is CompliantCA legal advice?
No. CompliantCA publishes plain-language guides and free record-keeping documents built from Cal/OSHA-published requirements. We are not a law firm and do not provide legal advice. Review your IIPP with your safety officer or attorney before adoption.
I already have an IIPP from Cal/OSHA or State Fund — what am I missing?
Usually the records, not the plan. 8 CCR §3203(b) requires inspection records and training documentation, and §3203(a) requires a program that is established, implemented, and maintained — hazards corrected on the record, training at each of the six triggers §3203(a)(7) lists. The free IIPP Audit Checklist walks each required record and asks one question: can you produce it today?
What records does §3203 require an employer to keep?
Two kinds, under §3203(b): inspection records — who inspected, the unsafe conditions found, and the action taken to correct them — and training documentation with the employee, date, type of training, and provider. Both must be kept for at least one year, with exceptions for employers with fewer than 10 employees. The written Program itself must be made available to any employee within five business days of a request.