At 9:40 on a Tuesday night, a customer leaned across the will-call window of a distribution center and told the clerk he would be waiting for her in the parking lot. She finished the shift, walked out with a coworker, and said nothing the next morning. Nobody was hurt, nothing was damaged, and no police report was filed. Most safety programs produce no record of that night.
For a covered California employer, it produces one anyway. Most of what goes into that entry describes the shift, the lighting, and the staffing level.
The violent incident log is a record of conditions
California Labor Code section 6401.9, operative for covered employers since July 1, 2024, requires a violent incident log entry for every workplace violence incident. The trigger is wider than most people assume. It covers any act or threat of violence at a place of employment, including a statement or conduct that conveys, or is reasonably perceived to convey, an intent to cause physical harm or to place someone in fear of it, serving no legitimate purpose, whether or not the employee is injured.
The part worth studying is the fifth required field. Alongside date, time and location, the workplace violence type, a description, and a classification of who committed the violence, the employer must record a classification of circumstances at the time of the incident, “including, but not limited to, whether the employee was completing usual job duties, working in poorly lit areas, rushed, working during a low staffing level, isolated or alone, unable to get help or assistance, working in a community setting, or working in an unfamiliar or new location.”
Poor lighting, time pressure, thin staffing, isolation, and no route to help are not things a worker selects on the way in. They are the residue of scheduling decisions, staffing models, facility layouts, and capital budgets set months earlier by people nowhere near that window at 9:40. The statute is telling employers to write down the conditions they built, and the list ends with a catch-all, so those eight circumstances are a floor.
Worked through honestly, the required fields produce a description of a system. The log carries a five-year retention.
THE NINE FIELDS OF A CALIFORNIA VIOLENT INCIDENT LOG
| Required field | What goes in it |
|---|---|
| Date, time, and location | When and where the incident happened |
| Workplace violence type | Which of the four statutory types applied |
| Detailed description | What happened, in detail |
| Who committed the violence | Client or customer, family or friend of one, stranger with criminal intent, coworker, supervisor or manager, partner or spouse, parent or relative, or other |
| Circumstances at the time | Usual job duties, poorly lit area, rushed, low staffing level, isolated or alone, unable to get help, community setting, unfamiliar or new location, and others |
| Where it occurred | In the workplace, in a parking lot or other area outside it, or elsewhere |
| Type of incident | Physical attack without a weapon, attack with a weapon or object, threat of force, sexual assault or threat, animal attack, or other |
| Consequences | Whether security or law enforcement was contacted and how they responded, what was done about a continuing threat or other hazards the incident revealed, and more |
| Who completed the log | Name, job title, and the date it was completed |
Several categories are open lists. Every entry must be based on information from the employees who experienced the violence, on witness statements, and on investigation findings, and personal identifying information for anyone involved must be omitted. Source: California Labor Code section 6401.9(d)(2)
Federal OSHA has no standard for this, and cites it anyway
OSHA says so directly: there are currently no specific OSHA standards for workplace violence. Enforcement runs through the General Duty Clause, section 5(a)(1) of the OSH Act, which requires a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm.
The agency sets out when that duty attaches. An employer that has experienced acts of workplace violence, or that becomes aware of threats, intimidation, or other indicators showing the potential for violence exists, “would be on notice of the risk of workplace violence and should implement a workplace violence prevention program combined with engineering controls, administrative controls, and training.”
Notice is the hinge. A threat at a will-call window is notice whether or not it reaches a form, and an employer that never captured it cannot show what it did next. OSHA’s list of risk factors is heavy on conditions an employer sets: exchanging money with the public, working alone or in isolated areas, working late at night, and working in areas with high crime rates.
Zero
Federal OSHA standards that specifically address workplace violence. Enforcement runs through the General Duty Clause.
Most programs size this hazard wrong
The Bureau of Labor Statistics counted 5,070 fatal work injuries in 2024. Violent acts accounted for 733, down slightly from 740 in 2023. Homicides made up 64.1 percent of that category with 470 deaths, up from 458, and suicides the remaining 263. Women were 8.1 percent of all worker fatalities and 15.3 percent of the homicides.
FATAL WORK INJURIES BY EVENT, 2024
Four largest event categories, United States, calendar year 2024, all ownerships
Source: U.S. Bureau of Labor Statistics, Census of Fatal Occupational Injuries Summary, 2024
Ranked against every other fatal event category, violence came fourth in 2024, twenty-three deaths behind contact incidents and ahead of exposure to harmful substances and environments. Few EHS programs treat it as a top-five hazard.
Why a California rule should interest employers outside California
Cal/OSHA posted a revised draft standard for general industry, title 8 section 3343, on July 22, 2026, and is taking comment until August 17. Section 6401.9 directs the standards board to adopt a standard no later than December 31, 2026. Six categories of employer, employee, and workplace are exempt today, including health care operations already covered by section 3342, and non-public worksites with fewer than ten employees working there at any given time that also comply with the injury and illness prevention program standard, section 3203. The division can still order an exempt employer to comply.
Running one safety program in California and a thinner one everywhere else is expensive to maintain, and raising the floor is usually cheaper than running two. Heat illness, injury reporting, and chemical right-to-know all took that path. A written violence prevention plan with a maintained log is defensible whichever agency shows up.
Five things to do about it
- Inspect at the hours the risk exists. A daytime walkthrough of a site whose exposure is at 10 pm tells you very little. Send someone at closing, at shift change, and on a weekend, and look at lighting, sightlines, exits, parking, and how far a lone worker stands from help.
- Change the built environment first. Lighting, barriers, controlled entry, a clear sightline from the counter to the door, and duress alarms that reach someone who will actually respond. The statute defines an engineering control as an aspect of the built space, or a device, that removes the hazard or creates a barrier between the worker and it.
- Redesign the work that creates the exposure. Cash on hand, solo closing shifts, unaccompanied client visits, and queue design during thin hours are all schedulable. Fix them at the roster, because a worker cannot decide to stop being alone.
- Make reporting cost nothing. If reporting a threat takes a login, a supervisor conversation, and a paper form, verbal threats stay unreported and the notice trail stays empty. Give people a route from their own phone, and make the no-retaliation position explicit.
- Log every event with its circumstances, then re-inspect. Section 6401.9 requires inspections when the plan is first established, after each incident, and whenever a new or previously unrecognized hazard surfaces. Hazard identification, evaluation, and correction records carry the same five-year retention as the log.
How Q-Inspection Can Help
Steps one and five are the ones software performs. Q-Inspection runs scheduled and ad-hoc inspections from a phone, with forms built per site, role, or task type, so a night-hours violence walkthrough becomes its own recurring form asking about lighting, exits, lone-worker positions, and alarm coverage. Findings raise corrective actions that are assigned automatically and tracked through verification to closure, and completed inspections stay in the system as dated records you can produce later.
Deciding what counts as a threat, and noticing that your Tuesday closing shift is one person short, stays with people who know the site. Step four lives in Q-Hazard, where a worker files from a QR code without a login, and documented events belong in Q-Incident, whose report form captures incident date and time, with an option to flag the time as unknown. Each of those is a separate module keeping its own records.
