"After a Workplace Violence Incident: Your 72-Hour Checklist"

A workplace violence incident just happened at your facility.

Maybe it was a physical altercation between two employees. Maybe a customer threatened a frontline worker. Maybe a terminated employee showed up making threats. Maybe it was something worse.

Whatever it was, the clock is now running. And what you do in the next 72 hours will determine whether this incident is a manageable HR event or the beginning of a regulatory and legal disaster that follows your company for years.

Most business owners freeze. They call their attorney. The attorney says "don't say anything to anyone" and charges them $500 for that advice. Two weeks go by. Nothing gets documented. Witnesses' memories fade. Regulatory deadlines pass. And now you have an undocumented incident that Cal/OSHA will eventually ask about, and you will have nothing to show them.

Here is what you should do instead. Hour by hour. Step by step. No ambiguity.

Hour 0-1: Immediate Safety and Scene Control

**Priority: Protect people. Everything else is secondary.**

• [ ] **Ensure the immediate threat is neutralized.** If the perpetrator is still on-site, call 911. Do not attempt to physically intervene unless someone's life is in immediate danger and no other option exists.
• [ ] **Account for all employees in the affected area.** Do a headcount. If anyone is missing, communicate that to law enforcement immediately.
• [ ] **Administer first aid or call EMS.** If anyone is injured, treat what you can and transport what you cannot. Do not wait to see if injuries "get better."
• [ ] **Secure the scene.** If law enforcement is involved, the scene is theirs. If law enforcement is not involved, restrict access to the area where the incident occurred. Do not clean up, rearrange, or "get things back to normal" until the scene has been documented.
• [ ] **Designate a single point of contact.** One person manages all communication about the incident — with law enforcement, with employees, with corporate, with media if applicable. Everyone else refers inquiries to this person.
• [ ] **Separate involved parties.** The individuals directly involved in the incident should not be in the same area. If the perpetrator is an employee, send them home with a directive to have no contact with the victim or witnesses until the investigation is complete.

Do not skip any of these steps. Do not assume the situation is "not that serious." The moment you make that judgment call, you have created a documentation gap that an attorney or an inspector will drive a truck through.

Hour 1-4: Initial Documentation and Notifications

**Priority: Capture facts while they are fresh. Notify who needs to be notified.**

• [ ] **Write down what happened.** The designated point of contact should create a preliminary incident summary within four hours. This is not the formal incident log entry — it is a raw chronological account of what occurred, written while memories are fresh. Include: what happened, approximate timeline, who was present, what actions were taken, current status of involved individuals.
• [ ] **Identify witnesses.** Make a list of every person who was present or who has direct knowledge of the incident. You will need their accounts for the investigation.
• [ ] **Determine if Cal/OSHA reporting is required.** Under California law, you must report to Cal/OSHA within 8 hours if the incident resulted in hospitalization, amputation, or loss of an eye. You must report immediately if the incident resulted in a fatality. If neither applies, you are not required to make an immediate report — but you are still required to log the incident. Do not confuse "not required to report immediately" with "not required to document."
• [ ] **Notify your workers compensation carrier.** If any injury occurred, notify your carrier. Even if the employee says they are fine. Even if they refuse medical treatment. Report it. An unreported workplace injury that surfaces later as a workers comp claim is a nightmare you do not want.
• [ ] **Notify HR leadership.** If you have an HR department, corporate HR, or a PEO, notify them now. They need to be involved in the investigation and any disciplinary decisions.
• [ ] **Preserve any physical or electronic evidence.** Security camera footage, access logs, text messages, emails, voicemails — anything related to the incident. If your security cameras overwrite after 72 hours, pull the footage now. Not tomorrow. Now.

Hour 4-8: Cal/OSHA Reporting Decision and Incident Log Entry

**Priority: Meet mandatory reporting deadlines and create the formal record.**

• [ ] **Make the Cal/OSHA reporting call.** If the incident involved a fatality, you should have already called. If it involved hospitalization, amputation, or loss of an eye, you have an 8-hour window from the time you knew or should have known about the event. Call Cal/OSHA at (800) 321-OSHA (6742) or report through the OSHA website. Document the time of your call, who you spoke with, what you reported, and any reference number provided.
• [ ] **Create the formal incident log entry.** This is the SB 553 violent incident log entry — the official record. It must include date, time, location, incident description, violence classification (Type 1-4), type of violence, circumstances, consequences, law enforcement involvement, and corrective actions. It must NOT include any personally identifiable information. Use anonymized identifiers (Employee A, Employee B) throughout. Review the entry for any functional PII — details that identify someone even without using their name — before finalizing.
• [ ] **Document who created the log entry and when.** The log entry should carry a creation timestamp and the identity of the person who created it (this metadata is about the log creator, not the incident participants — it is not PII of a person involved in the incident).

Hour 8-24: Investigation Launch

**Priority: Formalize the investigation while memories are still reliable.**

• [ ] **Assign an investigator.** This should be someone who was NOT involved in the incident and does NOT have a reporting relationship with the involved parties. If you do not have anyone internal who meets this criteria, engage an outside investigator. Do not let the perpetrator's direct supervisor run the investigation.
• [ ] **Conduct witness interviews.** Interview each witness separately and promptly. Use consistent questions: What did you see? What did you hear? What happened before the incident? What happened after? Were there any warning signs in the days or weeks before? Document each interview in writing and have the witness review and sign the statement.
• [ ] **Interview involved parties.** Interview the victim and the perpetrator separately. Inform them that the interview is part of a formal investigation. Inform them of any relevant rights (union representation, etc.). Document statements.
• [ ] **Collect and catalog all evidence.** Security footage, emails, texts, prior complaints, disciplinary records, schedule records, access logs. Create an evidence inventory with dates and sources.
• [ ] **Open a confidential investigation file.** This is separate from the incident log. The investigation file contains names, witness statements, evidence, and analysis. It is confidential and access-restricted. Assign it a case number that you can reference in the incident log without exposing the contents of the investigation.
• [ ] **Determine interim protective measures.** Does the victim need schedule changes, location changes, or security escorts? Does the perpetrator need to be placed on administrative leave pending investigation? Act now — do not wait for the investigation to conclude.

Hour 24-48: WVPP Review Trigger and Corrective Action Planning

**Priority: Connect the incident to your prevention plan and identify systemic gaps.**

• [ ] **Trigger an off-cycle WVPP review.** SB 553 requires that your Workplace Violence Prevention Plan be reviewed after a workplace violence incident. This is not optional. Pull out your WVPP and evaluate whether the incident reveals a gap in the plan. Was the hazard assessment accurate? Did the response procedures work as documented? Was training adequate?
• [ ] **Identify root causes.** Go beyond the immediate trigger. Why did this happen? Was it a scheduling conflict that management knew about? Was it an understaffed shift? Was it an employee with documented behavioral issues that were never addressed? Was it a security gap — an unlocked door, a blind spot in camera coverage, a reception area without a barrier?
• [ ] **Draft corrective actions.** Be specific. "Improve security" is not a corrective action. "Install panic buttons at the front desk and loading dock by April 30" is a corrective action. "Provide additional training" is not a corrective action. "Conduct refresher training on de-escalation techniques for all warehouse supervisors by May 15, with documented attendance" is a corrective action.
• [ ] **Assign corrective action owners and deadlines.** Every corrective action gets an owner (by role, not just "management") and a deadline. If it does not have a deadline, it does not exist.
• [ ] **Update the incident log with corrective actions.** Add the corrective actions to the incident log entry. This demonstrates to Cal/OSHA that you responded to the incident with specific remedial steps.

Hour 48-72: Employee Communication and Support

**Priority: Address the workforce. Demonstrate that you are taking this seriously.**

• [ ] **Communicate with the broader workforce.** Employees know something happened. Silence from management is not discretion — it is negligence. Issue a communication that acknowledges the incident occurred (without PII or details that could identify individuals), states that the company is investigating, reaffirms the company's commitment to workplace safety, and reminds employees of available resources.
• [ ] **Activate Employee Assistance Program (EAP).** If you have an EAP, push information about it to all employees, not just those directly involved. Witnesses and bystanders are affected too. If you do not have an EAP, find a crisis counseling resource and make it available.
• [ ] **Conduct a follow-up check with the victim.** Is the victim safe? Do they feel safe returning to work? Do they need additional accommodations? Document this conversation.
• [ ] **Conduct a follow-up check with witnesses.** Some witnesses may be more traumatized than the victim. Check in. Document.
• [ ] **Brief supervisors and managers.** Front-line managers need to know what to say and what not to say if employees ask questions. Give them talking points. Tell them what is confidential. Tell them to refer anything they are unsure about to the designated point of contact.
• [ ] **Document everything you just did.** Every communication, every EAP referral, every follow-up check, every supervisor briefing. Document it. Date it. File it. This is your evidence that you responded comprehensively and in good faith.

Beyond 72 Hours: What Happens Next

The 72-hour window gets you through the crisis. It does not get you through the aftermath.

**Within 2 weeks:**
- Complete the investigation and issue findings
- Implement immediate corrective actions
- Schedule any training triggered by the incident
- Complete the off-cycle WVPP review and document changes

**Within 30 days:**
- Conduct any required follow-up training
- Verify that corrective actions have been implemented
- Update the incident log with implementation status
- Close the investigation file

**Within 90 days:**
- Verify long-term corrective actions (facility modifications, policy changes, etc.)
- Evaluate whether the incident pattern suggests a systemic issue
- Update hazard assessment if needed

The Mistake That Makes All of This Useless

You can follow every step on this checklist and still fail if you make one mistake: not having the checklist before the incident happens.

If you are reading this article because an incident just occurred and you are scrambling for guidance, you are already behind. You are making decisions under stress with incomplete information and no established protocol.

The time to build your post-incident response protocol is before you need it. The time to train your supervisors on it is before an incident tests them. The time to verify that your incident log system works is before an inspector asks to see it.

This checklist should already be in your WVPP. Your supervisors should already know where to find it. Your HR team should already know how to execute it.

If none of that is true, today is the day you fix it. Not tomorrow. Not next quarter. Today.

The next incident does not care about your timeline.