Cal/OSHA IIPP Requirements: What Every PEO Client Should Have on File

When a Cal/OSHA inspector walks into a California workplace, the first document they ask for is the Injury and Illness Prevention Program. Not the OSHA 300 log, not the hazard communication binder, not the forklift certifications. The IIPP. It has been required of every California employer since 1991, and employment law firms writing on the subject, citing RAND Corporation research, have described it as the most frequently cited standard in Cal/OSHA inspections in nearly every year since, because a large number of employers either do not have one or have a template they downloaded and never implemented.

For a PEO with California clients, the IIPP is a compliance obligation the PEO is usually contractually involved in, a safety tool that reduces the losses the PEO's workers' comp program pays for, and a piece of evidence that a carrier underwriter will weigh. This post covers what the regulation actually requires, drawing directly from Title 8 of the California Code of Regulations, section 3203, as published by the Department of Industrial Relations, and then what a PEO should do with it.

The seven required elements

Section 3203(a) requires every employer to establish, implement, and maintain an effective written IIPP. The regulation then lists what the program must include at a minimum. There are seven elements.

The first is responsibility. The program must identify the person or persons with authority and responsibility for implementing it. This sounds trivial and is the element most often done badly: a template that says "management" is responsible has not identified anyone.

The second is a system for ensuring compliance with safe work practices. The regulation offers examples: recognition of employees who follow the rules, training and retraining, and disciplinary action. The employer gets to choose the mix, but there has to be a mechanism, and it has to be real.

The third is communication. The employer must have a system for communicating with employees on safety and health matters in a form they can readily understand, and that system must include a way for employees to report hazards without fear of reprisal. The regulation lists acceptable methods: meetings, training programs, postings, written communications, anonymous notification procedures, and labor-management safety committees. Employers with fewer than 10 employees may communicate and instruct orally.

The fourth is hazard identification and evaluation. The program must include procedures for identifying and evaluating workplace hazards, including scheduled periodic inspections. Inspections are specifically required when the program is first established, whenever new substances, processes, procedures, or equipment introduce a new hazard, and whenever the employer becomes aware of a new or previously unrecognized hazard.

The fifth is accident investigation. The program must include a procedure to investigate occupational injuries and illnesses.

The sixth is hazard correction. Unsafe or unhealthy conditions, practices, or procedures must be corrected in a timely manner based on the severity of the hazard. Where an imminent hazard cannot be immediately abated, exposed employees must be removed from the area, except those needed to correct the condition, who must be given the necessary safeguards.

The seventh is training and instruction. The program must provide training when it is first established, to all new employees, to all employees given a new job assignment for which they have not previously been trained, whenever new substances, processes, procedures, or equipment introduce a new hazard, and whenever the employer is made aware of a new or previously unrecognized hazard. Supervisors must be trained to understand the hazards to which the employees under their direction may be exposed.

An IIPP that addresses all seven in writing, and that the employer can show it actually operates, is compliant. An IIPP that addresses them in writing only is a document, not a program, and inspectors know the difference.

The records that prove it

Section 3203(b) is the part most employers skip, and it is the part that matters in an inspection and in a claim.

Inspection records must identify who conducted each inspection, the unsafe conditions and work practices identified, and the corrective action taken. They must be kept for at least one year, except that employers with fewer than 10 employees may keep them only until the hazard is corrected.

Training records must document each employee's name or other identifier, the training dates, the type of training, and who provided it. They too must be kept for at least one year.

The regulation provides several exceptions. Employers with fewer than 10 employees may substantially comply with the training documentation requirement by keeping a log of the hazard-specific instruction given to each employee at hire or reassignment. Training records for employees with less than a year of service need not be retained after termination if they are given to the employee. And employers with fewer than 20 employees that are in a low-hazard industry, or that are not in a high-hazard industry and have an experience modification of 1.1 or less, may limit their written documentation to the responsible-person designation, the inspection records, and the training records.

Section 3203(c) adds that an employer using a labor-management safety committee is presumed to substantially comply with the communication requirement if the committee meets at least quarterly, keeps written records of its meetings for one year, and performs the reviews the regulation lists.

The recordkeeping exceptions are worth knowing, but a PEO should not design client programs around them. A client with 15 employees and a 1.05 mod can legally keep less paper. The same client, if it wants its PEO's underwriter to believe its safety story, should keep all of it anyway.

Why the IIPP is the first thing asked for

Cal/OSHA inspections begin with an opening conference and a document request, and the IIPP is at the top of the list because it is the framework every other standard hangs on. An inspector who finds a hazard will cite the specific standard it violates, and will then look at whether the IIPP's inspection procedure should have caught it, whether the training element covered it, and whether the correction procedure was followed. A weak IIPP turns one citation into several.

The IIPP also comes up after an injury. The accident investigation element means the employer is supposed to have investigated, documented, and corrected; a serious injury with no investigation on file is both a citation and an admission.

For a PEO, this is the practical point. The PEO's co-employment agreement typically allocates safety responsibilities between the parties, and in many arrangements the PEO provides the IIPP framework while the client is responsible for operating it. If the client does not operate it, the PEO's workers' comp program pays the claims that result. The IIPP is not the client's paperwork problem; it is the PEO's loss experience.

How a PEO turns the IIPP into an advantage

In our own PEO, the IIPP conversation moved from onboarding paperwork to a sales and underwriting tool once we started treating it as evidence rather than compliance.

At underwriting, a prospect that has a working IIPP, with dated inspection records, training rosters, and investigation reports, is a measurably different risk from one that has a binder on a shelf. The mod will eventually reflect that difference, but the mod lags by years; the records show it now. A carrier underwriter reviewing a PEO's submission for a client with hazardous class codes will ask about the safety program, and a PEO that can produce the client's actual inspection and training records, rather than a statement that a program exists, gets a better hearing on pricing and on tier.

At onboarding, the IIPP is the first deliverable that makes the PEO relationship tangible. A client that receives a program built for its operations, with its named responsible person, its actual hazards, and a training schedule, has gotten something it did not have, and has a reason to keep the records the PEO will later need.

At renewal, the records are the loss-control story. A client whose claims went down after the PEO implemented the program has a narrative, and the PEO has data to support a better rate from its carrier.

What should be on file

For a California client, the PEO should be able to produce, on request, the written IIPP with all seven elements addressed and the responsible person named; the schedule of periodic inspections and the completed inspection records for at least the past year; training records by employee, including new-hire and reassignment training and any hazard-specific training; investigation reports for every recorded injury; and documentation of hazard corrections with dates. If the client uses a safety committee, the meeting minutes for the past year.

That is the file an inspector wants, and it is the file an underwriter wants. They are the same file.

Where SafetyIQ fits

We built SafetyIQ's IIPP creator to produce a program that addresses each element of section 3203 for the client's specific operations rather than a generic template, and to keep the inspection, training, and investigation records in the same place so the file exists before anyone asks for it. The SDS chemical inventory covers the hazard communication piece that sits alongside the IIPP, and the OSHA data sync pulls the client's public inspection history into the same view. Next week's post covers the module in detail.

The regulation has been on the books for decades. The employers who treat it as a program rather than a document have fewer injuries, better mods, and easier inspections. A PEO that makes that happen for its clients is doing the thing a PEO is for.