The Part of SB 553 Most Businesses Get Wrong: Incident Reporting

Ask a California employer whether they have a Workplace Violence Prevention Plan and many will say yes. Ask them to show you their violent incident log and the conversation usually stops.

Incident reporting is the most overlooked element of SB 553 compliance. Employers focus on the written plan and the training requirement, which are visible and tangible. But the reporting infrastructure (the mechanism for employees to report concerns and the structured log for documenting incidents) is equally mandatory and far more commonly deficient.

What the Law Actually Requires

SB 553 establishes two distinct incident reporting obligations under Labor Code Section 6401.9:

1. A Reporting Mechanism

Every employer must provide employees with a way to report workplace violence hazards, threats, and incidents. The statute specifies that this mechanism must allow for anonymous reporting if the employee requests it.

This is not a vague suggestion. The law requires that the reporting mechanism be described in your WVPP and that employees be trained on how to use it. If an inspector asks an employee how to report a workplace violence concern and the employee cannot answer, that is a training deficiency. If the employee can answer but the mechanism does not exist, that is a plan deficiency.

What qualifies as a reporting mechanism:

• A designated person (by name) who receives reports, with a clear contact method
• An anonymous submission form (physical or digital)
• A dedicated email address or phone line for workplace violence reports
• A digital reporting portal accessible to all employees

What does not qualify:

• A general suggestion box with no defined process for reviewing submissions
• Telling employees to "talk to their manager" with no formal procedure
• An HR email that is not specifically designated for workplace violence reporting
• No mechanism at all (more common than you would expect)

2. A Violent Incident Log

Separate from general incident reporting, SB 553 requires employers to maintain a violent incident log. This log must be completed for every workplace violence incident and must contain eight specific fields defined by the statute:

1. Date, time, and location of the incident
2. The type of workplace violence (Type 1, 2, 3, or 4)
3. A detailed description of the incident
4. A classification of who committed the violence (customer, coworker, etc.)
5. The circumstances at the time of the incident (working alone, handling cash, etc.)
6. Whether the incident involved a physical attack, threat, or other
7. Consequences of the incident (injury, psychological impact, lost work time)
8. What actions were taken in response to the incident

All eight fields are required for each logged incident. A partial entry, such as a note that says "fight in break room, Tuesday," does not satisfy the requirement.

The log must be retained for a minimum of five years, regardless of whether the business changes ownership or the employee involved leaves the company.

The Mistakes Most Businesses Make

Based on enforcement trends and compliance assessments, these are the most common incident reporting failures:

No Mechanism Exists

The most basic failure. The WVPP says employees can report concerns but does not describe how. No form exists. No person is designated. No system is in place. The plan describes a process that does not exist in reality.

The Mechanism Is Not Anonymous

SB 553 specifically requires that employees be able to report anonymously. Many employers designate a single person, often an HR manager or supervisor, as the point of contact for reports. That is fine as one option, but if it is the only option, employees who need to report concerns about that person, or who fear retaliation, have no path forward. Anonymous reporting must be available.

The Log Uses the Wrong Format

Some employers repurpose their general workplace injury log (OSHA 300) or their HR complaint tracking system as the violent incident log. These do not contain the eight required fields. The violent incident log is a distinct document with specific statutory requirements.

The Log Does Not Exist

Many employers have not experienced a workplace violence incident and therefore have not created a log. This is a deficiency. The log structure must exist before an incident occurs. It is a form, a template, a system ready to be filled out when needed. Not having the log because you have not needed it yet is like not having a fire extinguisher because there has not been a fire.

Employees Have Not Been Trained on Reporting

Even when a reporting mechanism and log exist, employees frequently do not know about them. Training on the WVPP must include specific instruction on how to report incidents, what happens when a report is made, and the prohibition against retaliation for reporting.

Why This Matters Beyond Compliance

A robust incident reporting system does more than satisfy Cal/OSHA. It serves three additional functions that directly protect the business:

Litigation defense. If a workplace violence incident leads to a civil lawsuit, one of the first things plaintiff's counsel will request is your incident log and reporting history. A well-maintained log demonstrates that the employer took workplace violence seriously, investigated reports, and took corrective action. The absence of a log, or a log that is incomplete, informal, or started after the lawsuit was filed, is devastating in litigation.

Pattern identification. Individual incidents may appear isolated. A structured log reveals patterns: a specific location, a specific shift, a specific customer, a recurring interpersonal conflict. These patterns enable preventive action before an incident escalates into something serious.

Insurance and risk management. Workers' compensation carriers and general liability insurers increasingly evaluate workplace violence prevention practices during underwriting. Documented reporting and incident management can influence premium calculations and coverage decisions.

How to Fix This Now

If your incident reporting system is missing or deficient, here is how to address it:

1. Designate a responsible person. By name and title. Include their contact information in the WVPP.
2. Establish anonymous reporting. This can be as simple as a physical form with a sealed drop box, or as robust as a digital portal. It must be accessible to all employees.
3. Create the log template. Build a form or spreadsheet with all eight required fields. Have it ready before you need it.
4. Train employees. Every employee must know how to report an incident and where to find the reporting mechanism. Include this in your annual WVPP training.
5. Set a retention policy. Five years minimum. Store logs securely with restricted access.

Cynserus includes a built-in incident reporting portal and pre-formatted violent incident log for every client. Employees access a digital form, reports are logged with all eight required fields, and anonymous submission is supported by default. The log is maintained in the client portal with automatic five-year retention.

The reporting system is not the glamorous part of SB 553 compliance. But it is where inspectors look first, where litigation risk concentrates, and where most employers fall short. Getting it right is not difficult. It just requires doing it.