IIPP: Does OSHA Require an Injury and Illness Prevention Program?

Does OSHA require a written safety program?

Not as a general rule. OSHA put it in writing in 2016: "There is no general OSHA requirement for employers to establish or maintain a written, comprehensive safety plan or program." OSHA's written program requirements come with specific standards, such as hazard communication (1910.1200(e)), lockout/tagout (1910.147(c)) and respiratory protection (1910.134(c)), three of its ten most cited standards in fiscal 2026 (preliminary).

And its 2016 Recommended Practices for Safety and Health Programs call themselves "recommendations only."

Who needs an IIPP in California?

Every employer, since July 1, 1991, and the program "shall be in writing," §3203(a).

Size changes only the paperwork: under 20 employees, outside the state's high-hazard list and with an experience modifier of 1.1 or less, the written part can shrink to the responsible person, inspections and training. Cal/OSHA's 2024 guide lists nine required elements; the eighth, employee access, entered the rule in 2020.

What must an injury and illness prevention program include?

The four that weigh most:

• Responsible person: one "with authority and responsibility for implementing the Program," (a)(1), with no title or certification required.
• Hazard evaluation: scheduled inspections, plus one at the start and with each new hazard, (a)(4), and corrections timed to "the severity of the hazard," (a)(6).
• Training: at the start, at hire, at each new assignment, with each new hazard, and for supervisors, (a)(7).
• Records: who inspected, what they found and what was done, (b)(1), and each employee's training with dates, type and provider, (b)(2), kept at least one year.

§3203 sets no method, scale or format for the evaluation.

Which other states require a program or committee?

As read in official state sources on October 30, 2026:

• Washington: a written accident prevention program for all employers, and a committee from 11 employees per shift and site.
• Oregon: a committee or safety meetings; above 10 employees at a site, a committee, with exceptions.
• Minnesota: a written AWAIR program, reviewed yearly, for employers in listed NAICS codes (168 in manufacturing); a committee above 25 employees, or at any size under AWAIR.
• Hawaii: a safety and health program from 10 employees.
• Montana: a safety program for all, and a committee above five employees.
• Connecticut: a committee from 25 employees, or with an injury rate above the state average.
• North Carolina: a written program and a committee with an experience modifier of 1.5 or more.

What does OSHA cite if you have no program?

A specific standard, or the hazard itself under the General Duty Clause, Section 5(a)(1). For a typical plant, no standard requires the program as such.

PPE does carry a federal assessment, 1910.132(d), certified in a document that names the workplace, the person certifying and the date, and calls itself a certification of hazard assessment. The assessment need not be a formal document, OSHA accepted in 1994, but inspectors ask for the certification.

The program pays off in the penalty. OSHA's Field Operations Manual allows up to 25% off for good faith, which "normally requires a written safety and health management system"; with none, "No reduction shall be given." In California, without an operative IIPP, a serious penalty can only be reduced for size, §336(d)(8).

OSHA penalties were not adjusted for 2026 (OSHA memo, May 21, 2026): the maximums stay at $16,550 per serious violation and $165,514 per willful or repeat one, 29 CFR 1903.15(d).

Where VR fits in IIPP training

§3203(a)(7) ties training to moments of change, which is where practice pays. OSHA's guide notes that effective training "can be provided outside a formal classroom setting," and our post on hands-on PPE training covers the demonstration 1910.132(f)(2) requires.

Fyware Safe puts four plant risks in a standalone Meta Quest 3: fire, PPE, forklifts and pedestrian crossings. It adds practice, and the training record stays with your company. For your own process, we build custom VR training for industry.

Our free risk assessment matrix template in Excel was built for plants in Mexico and cites Mexican law, but its editable 5 by 5 severity and probability scale works the same in a US plant, and it counts the people exposed, a third factor in OSHA's guide. OSHA prices a serious violation on those two axes: from $7,093 for low severity and lesser probability to $16,550 for high and greater.

Frequently asked questions

Does OSHA require a safety officer?

No federal general industry standard does. Specific rules name people, like the respiratory protection "program administrator," 1910.134(c)(3).

Does OSHA require a safety committee?

Federal OSHA does not. Washington, Oregon, Minnesota, Montana, Connecticut and North Carolina do, for some or all employers; California makes it optional.

How often does an IIPP need to be updated?

§3203 sets no calendar: scheduled inspections, plus new ones whenever a new hazard appears. Minnesota's AWAIR requires a yearly review.