California Wants a Workplace Violence Plan Per Site. Your Corporate Policy Isn't One.

A multi-state retail operator with a mature corporate security policy — active-shooter training, a threat-reporting hotline, de-escalation modules baked into onboarding — assumes its California stores are covered along with everywhere else. Then a California location gets an inspection request tied to Title 8 of the California Code of Regulations, Section 3342, and the request isn't for the corporate policy. It's for a written Workplace Violence Prevention Plan specific to that establishment, built around a hazard evaluation conducted at that site, with a log of violent incidents at that address, and training records tied to that plan rather than the general corporate curriculum.

The corporate program is not wrong. It's just answering a different question than the one California is asking, and the gap between the two is exactly the kind of thing that shows up only when someone checks a specific location against a specific state's specific rule — which is the recurring problem for any employer running the same brand across a footprint where the rules underneath it are not actually the same.

What Section 3342 requires that a general policy doesn't

California's rule, which took effect for general industry in mid-2024, requires covered employers to establish, implement, and maintain a written Workplace Violence Prevention Plan — not a statement of values or a training deck, but a plan with defined structural elements. It has to name who is responsible for implementation. It has to include a system for employees to report violent incidents or concerns without fear of reprisal. It has to describe procedures for responding to an active incident, including how employees can obtain help. It requires a documented process for identifying and evaluating workplace violence hazards specific to that worksite, on a recurring schedule rather than once. It requires a violent incident log, maintained per the regulation's format, distinct from the general OSHA 300 log. And it requires that employees be trained on the plan itself, not just on violence prevention in the abstract.

The hazard evaluation piece is the one that most exposes a corporate-only approach. A hazard evaluation conducted at headquarters, or rolled out as a template across every location, is not what the regulation describes. It calls for an assessment of that site: the layout, the entry points, the hours, the cash handling, the history of incidents at that address or comparable ones nearby. A retail store in a strip mall and a distribution center three states away do not have the same hazard profile, and a plan that reads identically for both is evidence the site-specific evaluation didn't happen the way the rule assumes it will.

The multi-site version of a familiar problem

This is structurally the same trap as OSHA's general "at least as effective" doctrine for state plans: a program built to a national or lowest-common-denominator standard will systematically under-comply wherever a state has gone further, and workplace violence prevention is one of the sharpest current examples because so few states have anything comparable yet. That asymmetry is what makes it a portfolio problem rather than a single-site one. An employer with twelve California locations among two hundred nationally cannot solve this by deciding whether the company, in general, has a workplace violence policy. The question has to be answered location by location: which sites are in a jurisdiction with a specific statutory plan requirement, and does that site's documentation actually reflect what the statute asks for, as opposed to what the corporate template provides everywhere.

California is presently the clearest and most detailed example, but it is not obviously the last. Other states have begun moving in the same direction for specific sectors, particularly retail and healthcare, where workplace violence exposure is higher and more visible. An employer that treats California's requirement as a one-time, one-state carve-out is setting up the same gap to reopen the next time a different state adopts its own version with its own particular documentation requirements.

Retail and healthcare feel this first, but the exposure travels

The sectors where this is surfacing fastest are the ones where workplace violence risk was already visible before any statute named it: retail, where late hours and cash handling drive a large share of reported incidents, and healthcare, where patient and visitor behavior has long been a recognized hazard distinct from anything in a general industrial safety program. It's not a coincidence that California's rule, and the sector-specific attention following it in other states, has concentrated there first.

But the statutory language in Section 3342 is not written narrowly to those two sectors — it applies to covered employers generally, with limited exceptions. A logistics company, a hospitality operator, or a professional services firm with a California office is not exempt because its risk profile looks different from a pharmacy counter or a big-box register. The obligation to produce a site-specific plan and hazard evaluation applies regardless of how low that location's perceived risk is, which means the gap between "we have a mature security program" and "we have a compliant plan at this address" shows up even in portfolios where workplace violence was never treated as a top-tier hazard category to begin with.

Why the corporate program usually looks compliant until someone checks

The reason this gap persists inside otherwise well-run security programs is that the corporate policy genuinely covers most of what a reasonable person would consider workplace violence prevention — training exists, a reporting channel exists, a response protocol exists. What's missing is procedural: the site-specific hazard evaluation, the plan document with the regulation's named elements, the violent-incident log in the required format, and training records that tie back to that specific plan rather than to a general corporate module. None of those gaps are visible from a dashboard showing "100% of locations have completed violence prevention training." They only surface when a regulator, or an internal auditor working from the actual statutory text, asks for the plan document itself at a named address.

That's also why this doesn't get caught by the metrics most security and EHS functions already track. Training completion rates, incident counts, and policy attestation are all real signals, and all of them can look uniformly good across every site while the underlying plan documentation is present at some locations and absent at others, simply because the requirement to have a site-specific document at all didn't exist when the corporate program was designed.

What to actually track across the portfolio

The practical fix isn't rewriting the corporate security policy — it's adding a jurisdictional layer underneath it that most multi-site compliance functions don't currently maintain for this particular hazard. That means knowing, per establishment, whether it sits in a jurisdiction with a specific written workplace violence plan requirement; whether a plan document exists for that address with the elements the statute names, not just a copy of the corporate policy with the address changed; when the site-specific hazard evaluation was last performed and by whom; whether the violent incident log for that site is being maintained in the format the regulation expects, separately from general recordkeeping; and whether the training records on file tie back to that plan rather than to the general onboarding curriculum.

None of that replaces the corporate program. It sits underneath it, site by site, tracking the one variable that a single national policy structurally cannot capture: that the legal floor for workplace violence prevention is no longer the same in every state where the company operates, and the places where it differs are exactly the places a uniform template will not show its own gaps.