Most manufacturing sites have clear rules for guarding, lockout and forklifts, but far fewer have a clear plan for threats, harassment or a tense confrontation at the gate. A workplace violence prevention plan fills that gap. It sets out how people report concerns, how the site assesses risk, how supervisors respond and what gets written down. In California it has been a legal requirement for most employers since July 2024. To see confidential reporting and the incident log working together, book a short security log walkthrough.
A Workplace Violence Prevention Plan People Will Actually Use
iFactory Security Incident Log takes confidential reports by app or voice, guides your security risk assessment and tracks training. Every incident lands in a log built around state rules, with no personal identifying details in the entry.
Three Layers of Workplace Violence Rules to Know
There is no specific federal OSHA standard for workplace violence. OSHA instead uses the General Duty Clause, Section 5(a)(1) of the OSH Act, which requires a workplace free from recognised hazards likely to cause death or serious harm. A site that has had incidents or warning signs is on notice. California goes further with Labor Code §6401.9, added by SB 553, and a dedicated Cal/OSHA standard is on the way. Our support team can help you map which layer applies to each of your sites.
Several newer state laws look similar but don't reach most factories. New York's Retail Worker Safety Act covers retail stores, and laws such as California's 8 CCR 3342 cover health care settings. This page is general guidance, not legal advice. Check your state rules with counsel.
Four Types of Workplace Violence, Seen From a Plant Floor
Safety guidance sorts workplace violence into four types by who is involved, and California's law uses the same four. The type matters because each one has different warning signs and controls. A gate visitor needs access control, while tension between coworkers needs supervisors who notice early and know how to step in. The examples below are typical of manufacturing sites. Map your own risks in a short planning session.
What a Written Plan Must Cover
Under §6401.9, the plan can stand alone or sit inside your Injury and Illness Prevention Program, but it must be specific to your site and kept up to date in practice. The matrix lists the elements the law names and what each one looks like at a manufacturing site. Ask our support team for a blank version you can fill in.
Where the Risk Sits on a Typical Site
A security risk assessment looks at places and times, not people. Who can reach this area? Do people work alone here? Is it dark, remote or busy at shift change? The heat-map below is an illustration of how a plant might score its own areas. Your scores will differ, and they should come from site walks, past reports and the people who work there. Build your own map in a risk assessment demo.
Reports in Seconds, Patterns in One View
People report more when it is quick and private. iFactory takes a spoken or typed report from any handheld, reads it back for confirmation and files it in the log. EHS sees where and when concerns cluster, so fixes go where they matter.
One Report, Three Roles, No Dead Ends
A reporting channel only works if people trust it. That means more than one way in, a clear owner, a fast first response and visible protection from retaliation, which §6401.9 requires the plan to state. Confidential reporting helps most with Type 3 and Type 4 concerns, where people fear making things worse. The lanes show how a report moves. Our support team can help you set owners and response steps.
What Goes in Each Log Entry, and What Stays Out
California requires a violent incident log entry for every workplace violence incident, including threats. The law lists the details to record and says the employer must leave out any personal identifying information that could identify the people involved. That makes the log safe to share, because employees and their representatives can ask for it and must receive it within 15 calendar days. See a sample entry in a log demo.
Training That Happens on Time and Feels Real
Under §6401.9, training must happen when the plan starts, every year after that, and again when a new hazard appears or the plan changes. It must suit people's language and literacy and include live questions and answers with someone who knows the plan. De-escalation skills are not named in the law, but most sites add them because supervisors and guards use them most. Track sessions with our support team.
How Long Each Record Must Be Kept
California sets minimum retention periods for each type of record. Investigation records must not hold medical information, and most records must be made available to employees and their representatives at no cost. Keeping everything in one log with automatic retention dates stops records from disappearing in a shared drive. See retention tracking in a records demo.
A Plan on the Shelf Versus a Plan in Use
Most plans fall short not because a section is missing but because nobody uses them. The difference shows in small habits: who people call, how fast they hear back and whether the plan changes after an incident. Talk through your current plan with our support team.
- Written once for an audit, then filed
- One reporting route, often the direct supervisor
- Reports in emails with names in them
- Training is a slide deck with no questions
- No review after incidents
- Owned by named roles and reviewed every year
- Several routes in, including confidential voice reports
- One log with identifiers left out by design
- Interactive training with de-escalation practice
- Each incident leads to a hazard fix and a plan check
Confidential Reporting That Stays on Your Own Server
Workplace violence reports are sensitive, so iFactory runs the voice and log features on site. A pre-configured NVIDIA AI server ships racked and ready with speech recognition and the Security Incident Log loaded, so spoken reports are transcribed without leaving your network. You rack it, plug in power and Ethernet, and the AI is live. Scope it for your sites in a deployment call.
- Pre-configured NVIDIA AI server, racked and ready
- Security Incident Log with fields aligned to state rules
- Confidential reporting by app and voice
- Security risk assessment templates by area
- Training tracker with due dates and records
- Retention dates set for each record type
- Remote monitoring and support for the server
Server installed, plan owners named, first site risk assessment loaded.
App and voice reporting opened, interactive training sessions scheduled and tracked.
Log in daily use, first trend review with EHS, HR and worker representatives.
One Log From First Report to Plan Review
iFactory brings reporting, risk assessment, training and the incident log into one place, so the plan is something people use every shift. Our support team can show how it fits your current EHS tools.
What Plant Managers Ask About Workplace Violence Plans
Make the Plan Part of Every Shift
Give every worker a private way to report, give supervisors a clear response path and give EHS one log that holds up to review. iFactory is delivered turnkey and goes live in 6 to 12 weeks.
