Here is a question that should bother you: if every California employer has different hazards, why do most compliance providers sell the same package to everyone?
A dental office and a construction company and a warehouse and a restaurant walk into the same compliance platform, and they all get the same IIPP, the same WVPP, the same EAP, the same training modules. The dentist gets a lockout/tagout program they do not need. The construction company gets a workplace violence plan that never mentions job site access control. The warehouse gets a HazCom program that does not address the specific chemicals in their cleaning products. And the restaurant gets an emergency action plan that does not mention cooking fire procedures.
Everyone gets something. Nobody gets what they actually need.
This is the fundamental problem with one-size-fits-all compliance: it fits nobody. It meets the minimum documentation threshold — you have a piece of paper that says "IIPP" on it — but it does not address the actual hazards in your actual workplace. And when an inspector shows up and asks about your specific hazards, a generic template will not save you.
Let me explain how a proper compliance framework is structured and why the distinction between baseline and vertical-specific matters more than most business owners realize.
The 8 Baseline Templates: What Every Business Needs
There are eight compliance programs that apply to virtually every California employer regardless of industry. These are the foundation. Skip any of these, and you have a gap that Cal/OSHA can cite on a routine inspection of any business in any sector.
1. Injury and Illness Prevention Program (IIPP)
**Authority:** 8 CCR 3203
**Why it is universal:** California requires every employer to have a written IIPP. No exceptions. No size threshold. No industry carveout. This is the master safety program that identifies hazards, establishes correction procedures, provides training, and documents your safety management system.
**What it covers:** Management commitment, hazard identification, hazard correction, employee training, recordkeeping, communication procedures, incident investigation.
2. Workplace Violence Prevention Plan (WVPP)
**Authority:** Labor Code 6401.9 (SB 553)
**Why it is universal:** Effective July 1, 2024, every California employer must have a WVPP. The narrow exemptions (healthcare under 3342, law enforcement, CDCR, equivalent CBA) exclude very few employers. If you have one employee in California, you almost certainly need this.
**What it covers:** Four types of workplace violence, hazard assessment, reporting procedures, incident response, training, violent incident log.
3. Emergency Action Plan (EAP)
**Authority:** 8 CCR 3220
**Why it is universal:** Every workplace needs a plan for emergencies — fire, earthquake, active threat, medical emergency, utility failure. California's seismic reality alone makes this non-optional.
**What it covers:** Evacuation procedures, assembly points, emergency contacts, fire extinguisher locations, alarm systems, employee roles during emergencies, accounting for personnel after evacuation.
4. Hazard Communication Program (HazCom)
**Authority:** 8 CCR 5194
**Why it is universal:** Virtually every workplace uses chemicals. Cleaning products count. Office supply chemicals count. Toner counts. If you have a Safety Data Sheet for anything in your workplace — and you should — you need a HazCom program.
**What it covers:** Chemical inventory, SDS management, container labeling, employee training on chemical hazards, written program documentation.
5. Heat Illness Prevention Plan
**Authority:** 8 CCR 3395
**Why it is universal in California:** Any employer with employees who work outdoors when temperatures exceed 80 degrees Fahrenheit. In California, that is most of the state for most of the year. Even businesses that are primarily indoor operations may have employees who work outside — loading docks, parking lot maintenance, outdoor events, deliveries.
**What it covers:** Water provision (one quart per employee per hour), shade access, rest breaks, high-heat procedures (above 95 degrees), acclimatization for new employees, emergency response for heat-related illness, training.
6. OSHA 300 Log and Recordkeeping Program
**Authority:** 29 CFR 1904
**Why it is universal:** All employers with 11 or more employees must maintain OSHA 300 Logs (some high-hazard industries must maintain them at any size). The log records work-related injuries and illnesses and must be posted annually (300A Summary, February 1 through April 30).
**What it covers:** Recordable injury/illness criteria, log maintenance, annual summary posting, five-year retention, employee access rights.
7. Training Records Management Program
**Authority:** Multiple (8 CCR 3203, 5194, 3395, Labor Code 6401.9, and others)
**Why it is universal:** Every compliance program requires training. And every training requirement requires documentation. A training records management program is the system that tracks who was trained, on what, when, by whom, and when retraining is due.
**What it covers:** Training matrix by job title, training schedule, attendance documentation, competency verification, retraining triggers, retention periods (typically employment + 3 years).
8. Incident Investigation and Documentation Program
**Authority:** 8 CCR 3203 (IIPP requirement)
**Why it is universal:** The IIPP requires investigation of work-related injuries, illnesses, and near-miss incidents. A standalone incident investigation program provides the framework for how those investigations are conducted, documented, and how corrective actions are tracked to completion.
**What it covers:** Incident reporting procedures, investigation methodology (root cause analysis), corrective action tracking, follow-up verification, documentation standards, integration with OSHA 300 Log.
---
These eight programs are the platform. They apply to all 27 industry verticals that the framework covers. A technology company needs them. A restaurant needs them. A construction company needs them. A dental office needs them.
But here is where it gets interesting: eleven of those 27 verticals need more.
The 11 Verticals With Extras
Certain industries have hazards that the eight baseline programs do not adequately address. These are industries where workers encounter specific dangers — chemicals, machines, biological agents, height, confined spaces, specialized equipment — that require dedicated compliance programs beyond the baseline.
Here are the eleven, with their specific extra requirements:
1. Agriculture
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Pesticide Safety Training | 3 CCR 6724 (DPR) | Farmworkers handle and are exposed to agricultural pesticides |
| Field Sanitation | 8 CCR 3457 | Outdoor field workers need water, toilets, and handwashing in locations without facilities |
| Wildfire Smoke Protection | 8 CCR 5141.1 | Extended outdoor exposure in fire-prone agricultural regions |
2. Automotive Services
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Spray Booth / Paint Operations Safety | 8 CCR 5415-5416 | Auto body shops use spray booths with flammable materials and hazardous fumes |
3. Construction
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Fall Protection Program | 8 CCR 1669-1670 | Falls are the #1 cause of death in construction nationwide |
| Silica Exposure Control | 8 CCR 1532.3 | Concrete cutting, grinding, and demolition generate respirable crystalline silica |
| Confined Space Entry | 8 CCR 5157-5158 | Manholes, tanks, vaults, and excavations |
4. Healthcare
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Bloodborne Pathogens Exposure Control | 8 CCR 5193 | Patient contact, needle sticks, blood and body fluid exposure |
| Aerosol Transmissible Diseases (ATD) | 8 CCR 5199 | Tuberculosis, COVID-19, and other airborne infectious diseases |
| HIPAA Security and Privacy (if applicable) | 45 CFR 160-164 | Protected health information handling (federal, not Cal/OSHA, but overlaps with workplace safety) |
5. Hospitality
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Food Safety / Slip-Trip-Fall Prevention | 8 CCR 3231 + Health & Safety Code | Kitchen environments with grease, water, sharp objects, hot surfaces |
6. Manufacturing
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Lockout/Tagout (LOTO) | 8 CCR 3314 | Servicing and maintenance of machines with hazardous energy |
| Machine Guarding | 8 CCR 4002-4007 | Moving parts, pinch points, cutting blades, rotating shafts |
| Hearing Conservation | 8 CCR 5095-5100 | Noise levels exceeding 85 dB TWA in production environments |
| Confined Space Entry | 8 CCR 5157-5158 | Tanks, silos, hoppers, and process vessels |
7. Real Estate / Property Management
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Rent Control Compliance / Tenant Safety | Local ordinances | Property managers responsible for safe conditions in managed properties |
8. Staffing and Employment Services
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Multi-Employer Worksite Program | 8 CCR 336.10 | Staffing agencies share safety responsibility with host employers — dual liability |
9. Transportation and Logistics
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Driver Qualification and DOT Compliance | 49 CFR 391 | Commercial drivers require medical certificates, driving records, drug testing |
| Forklift Operator Certification | 8 CCR 3668 | Powered industrial truck operation in warehouses and distribution centers |
10. Utilities
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Electrical Safety / Arc Flash Prevention | 8 CCR 2299-2599 | Working on or near energized electrical systems |
| Confined Space Entry | 8 CCR 5157-5158 | Utility vaults, manholes, underground installations |
11. Warehouse and Distribution
| Extra Program | Authority | Why This Vertical |
|---------------|-----------|-------------------|
| Forklift Operator Certification | 8 CCR 3668 | Powered industrial trucks are present in virtually every warehouse |
| Ergonomic Assessment Program | 8 CCR 5110 | Repetitive lifting, order picking, packing — musculoskeletal hazards |
The Phase 1 / Phase 2 Assessment Funnel
Understanding what programs you need is only useful if you have a systematic way to determine your current compliance status against those requirements. That is what the two-phase assessment framework does.
Phase 1: Baseline Assessment (All 27 Verticals)
Phase 1 scores your compliance against the 8 baseline templates. Every business takes Phase 1 regardless of industry.
**What Phase 1 evaluates:**
| Baseline Program | Assessment Questions |
|-----------------|---------------------|
| IIPP | Does it exist? Is it written? Is it current? Does it name responsible persons? Does it include hazard identification procedures? Has it been communicated to employees? |
| WVPP | Does it exist? Does it address all four violence types? Is the incident log maintained? Have employees been trained? Is training documented? |
| EAP | Does it exist? Are evacuation routes posted? Are assembly points designated? Have drills been conducted? Are employee roles assigned? |
| HazCom | Does a chemical inventory exist? Are SDSs accessible? Are containers labeled? Have employees been trained on chemical hazards? |
| Heat Illness | Is there a written plan (if outdoor work)? Is water provided? Is shade available? Are employees trained? Are high-heat procedures defined? |
| OSHA 300 Log | Are logs maintained (if 11+ employees)? Was the 300A Summary posted? Are logs retained for 5 years? |
| Training Records | Is there a training matrix? Are records maintained per employee? Are retraining dates tracked? Are records retained for employment + 3 years? |
| Incident Investigation | Are incidents investigated? Are root causes documented? Are corrective actions tracked? Are investigations retained for 5 years? |
Phase 1 produces a baseline compliance score. A score of 100 percent means all 8 programs are documented, current, and verifiable. Most SMBs score between 40 and 65 percent on their first Phase 1 assessment, with the most common gaps in training documentation, incident investigation procedures, and WVPP compliance.
Phase 2: Vertical-Specific Assessment (11 Verticals With Extras)
If your business is in one of the 11 verticals with extra requirements, Phase 2 adds the vertical-specific programs to the assessment.
**How Phase 2 is triggered:** During Phase 1, the assessment identifies your primary NAICS code and industry vertical. If your vertical is one of the 11 with extras, Phase 2 questions are automatically added.
**What Phase 2 evaluates:** The specific extra programs for your vertical. A manufacturing company gets assessed on lockout/tagout, machine guarding, hearing conservation, and confined space. A healthcare provider gets assessed on bloodborne pathogens, ATD, and HIPAA. A construction company gets assessed on fall protection, silica, and confined space.
Phase 2 produces a vertical-specific compliance score that is combined with Phase 1 for an overall compliance rating.
Why the Two-Phase Approach Matters
The funnel structure prevents two common failures:
**Failure 1: Missing the baseline.** Businesses in specialized industries sometimes focus so heavily on their industry-specific requirements that they neglect the universal baseline. A construction company that has an excellent fall protection program but no WVPP is still non-compliant. Phase 1 catches this.
**Failure 2: Missing the extras.** Businesses in the 11 verticals that use generic compliance templates get the baseline but miss the vertical-specific requirements entirely. A manufacturing company with a solid IIPP but no lockout/tagout program has a gap that could kill someone. Phase 2 catches this.
How Vertical Extras Are Determined: NAICS-Based Hazard Analysis
The assignment of extra programs to verticals is not arbitrary. It is based on NAICS code hazard analysis — a systematic evaluation of the hazards inherent to each industry classification as documented by Cal/OSHA enforcement data, injury and illness statistics, and regulatory requirements.
The process:
- **NAICS mapping:** Each of the 27 verticals maps to a range of NAICS codes. Manufacturing maps to NAICS 31-33. Construction maps to NAICS 23. Healthcare maps to NAICS 62.
- **Hazard profile extraction:** For each NAICS range, historical enforcement data reveals which standards are most frequently cited, which hazards cause the most injuries, and which regulatory requirements apply beyond the baseline.
- **Extra program assignment:** When a NAICS-based hazard analysis shows that a vertical has regulatory requirements beyond the 8 baseline programs, those requirements are assigned as extras.
- **Threshold validation:** An extra program is assigned to a vertical only when the hazard is present in the majority of businesses within that vertical. Lockout/tagout is assigned to manufacturing because most manufacturing operations have equipment requiring energy isolation. It is not assigned to professional services because most professional services firms do not.
This means the 16 verticals that do not have extras — technology, professional services, finance, education (K-12 and higher ed), and others — are not being shortchanged. They are verticals where the 8 baseline programs genuinely cover the regulatory requirements. The NAICS data confirms it.
Why One-Size-Fits-All Templates Miss Industry Hazards
A generic IIPP template asks you to "identify and evaluate workplace hazards." That is correct. But it does not tell a manufacturing plant owner that "workplace hazards" includes point-of-operation guarding on their metal press, or that the noise level on their production floor requires a hearing conservation program with annual audiometric testing.
A generic HazCom program tells you to maintain SDSs. But it does not tell an auto body shop that their spray booth operations have specific ventilation, PPE, and fire safety requirements under 8 CCR 5415-5416 that go far beyond standard chemical safety.
A generic EAP tells you to plan for emergencies. But it does not tell a construction company that their emergency plan must account for trench rescue, crane-related emergencies, and fall rescue procedures that require specialized equipment and training.
The gap between "generic template" and "industry-specific compliance" is the gap between "we have a document" and "we are actually protected." The document exists in both cases. But in one case, it addresses your real hazards. In the other, it addresses someone else's hazards — or nobody's.
What This Means for Your Business
If you are in one of the 16 verticals that only needs the baseline, the 8 programs are your complete compliance framework. Get them right, keep them current, and you are covered.
If you are in one of the 11 verticals with extras, you need the baseline plus your vertical-specific programs. A baseline-only approach leaves gaps that inspectors in your industry know to look for — because those extras exist precisely because your industry has a history of injuries and citations in those areas.
The assessment framework — Phase 1 for baseline, Phase 2 for vertical extras — gives you a structured way to evaluate where you stand and what you need. No guessing. No hoping. No discovering the gap when the inspector points it out.
Know your vertical. Know your extras. Know your score.
Then close the gaps before someone else finds them.
