Here is something that happens to California business owners approximately 14,000 times per year: a Cal/OSHA inspector walks through the door and asks to see your records.
Not your most recent records. Not just the ones from this year. Records from three years ago. Five years ago. In some cases, thirty years ago.
And the business owner who thought "we'll deal with it when we need to" suddenly realizes that "dealing with it" means standing in front of a government inspector with nothing to show.
Recordkeeping is not the glamorous part of compliance. Nobody starts a business because they are passionate about document retention schedules. But recordkeeping failures are the single easiest citations for inspectors to write. The document either exists or it does not. There is no gray area. There is no judgment call. There is no "well, we meant to."
Let me walk you through exactly what you need to keep, for how long, and how to store it so that when the inspector shows up — and eventually, the inspector will show up — you are not scrambling.
The Master Retention Schedule
Every compliance program has its own retention requirements. These are not suggestions. They are regulatory mandates, and violating them is a citable offense independent of whatever underlying hazard the record was supposed to document.
Here is the complete table:
OSHA 300 Logs and Related Forms
| Document | Retention Period | Authority |
|----------|-----------------|-----------|
| OSHA 300 Log (Log of Work-Related Injuries and Illnesses) | 5 years following the year the records cover | 29 CFR 1904.33 |
| OSHA 300A Summary | 5 years following the year the records cover | 29 CFR 1904.33 |
| OSHA 301 Incident Report (or equivalent) | 5 years following the year the records cover | 29 CFR 1904.33 |
Five years. Not five years from the date of the incident — five years following the end of the calendar year the log covers. A log for 2024 must be retained through December 31, 2029. Destroy it on January 1, 2030, and you are in compliance. Destroy it on December 30, 2029, and you are citable.
The five-year clock matters because OSHA can audit your injury and illness trends over a multi-year window. They are not just looking at last quarter. They are looking at whether your injury rate is climbing, whether the same types of incidents keep recurring, and whether your corrective actions are actually correcting anything.
Training Records
| Document | Retention Period | Authority |
|----------|-----------------|-----------|
| General safety training (IIPP) | Duration of employment + 3 years | 8 CCR 3203 |
| Hazard communication training | Duration of employment + 3 years | 8 CCR 5194 |
| Heat illness prevention training | Duration of employment + 3 years | 8 CCR 3395 |
| SB 553 workplace violence prevention training | Duration of employment + 3 years | Labor Code 6401.9 |
| Forklift operator certification | 3 years from date of evaluation | 29 CFR 1910.178 |
| Lockout/tagout training | Duration of employment (current cert) | 29 CFR 1910.147 |
| Bloodborne pathogens training | 3 years | 29 CFR 1910.1030 |
| Respiratory protection training | Duration of employment | 29 CFR 1910.134 |
"Duration of employment plus three years" is the standard that trips people up. When an employee leaves your company, you cannot shred their training records on their last day. You must retain those records for three additional years after separation.
Why? Because if that former employee develops a work-related condition, or if an inspector is investigating an incident that occurred during their tenure, the training records are evidence. Evidence of what you taught them, when you taught them, and whether the training was adequate.
For a company with moderate turnover — say, 15 to 20 percent annually — this means you are maintaining training records for dozens of former employees at any given time. This is not optional.
Safety Data Sheets (SDS)
| Document | Retention Period | Authority |
|----------|-----------------|-----------|
| Current SDS for chemicals in use | Must be accessible during each work shift | 8 CCR 5194 |
| SDS for chemicals no longer in use but with exposure potential | 30 years from last date of use | 8 CCR 5194 |
| SDS for chemicals no longer in use, no exposure | No federal/state mandate, but recommended 5 years | Best practice |
Thirty years. That is not a typo. If employees were exposed to a chemical — meaning it was present in the workplace in a manner that could result in inhalation, skin contact, or ingestion — you must retain the Safety Data Sheet for thirty years after the last date of use.
This requirement exists because occupational diseases can take decades to manifest. Mesothelioma from asbestos exposure has a latency period of 20 to 50 years. Certain chemical exposures produce cancers that do not appear for 15 to 25 years. The SDS is the evidence that connects the exposure to the substance.
Thirty years means that a chemical you stopped using in 2024 requires SDS retention through 2054. If your business changes hands, moves locations, or transitions ownership, those records must follow.
Incident and Investigation Records
| Document | Retention Period | Authority |
|----------|-----------------|-----------|
| Incident investigation reports | 5 years | 8 CCR 3203 |
| Near-miss documentation | 5 years (recommended; aligns with 300 Log) | Best practice |
| Corrective action documentation | 5 years or linked to related program | Best practice / 8 CCR 3203 |
| Workers' compensation first reports | 5 years (check insurer requirements — may be longer) | State regs + insurer |
Incident investigation records are particularly important because they demonstrate two things inspectors care about deeply: that you identified root causes, and that you implemented corrective actions. A five-year retention window means an inspector can pull your investigation from three years ago and ask, "Did you actually fix this? Show me."
If the corrective action was "retrain employees," the inspector will cross-reference your training records. If the corrective action was "install machine guarding," the inspector will walk to the machine. This is why your investigation records and your corrective action records must tell a consistent, verifiable story.
Workplace Violence Prevention Plan (WVPP) Records
| Document | Retention Period | Authority |
|----------|-----------------|-----------|
| WVPP violent incident log | 5 years | Labor Code 6401.9 |
| WVPP training records | See training records above (employment + 3 years) | Labor Code 6401.9 |
| WVPP hazard assessments | Duration of plan + retain for reference | Best practice |
| WVPP plan versions (revision history) | Retain all versions for audit trail | Best practice |
The SB 553 violent incident log carries a five-year retention requirement. This log is separate from your OSHA 300 Log. A workplace violence incident may or may not result in a recordable injury, but it must be logged in the WVPP incident log regardless.
Digital vs Paper: What the Regulations Actually Say
Here is the good news: Cal/OSHA and federal OSHA both accept digital records. You do not need binders. You do not need filing cabinets. You do not need a storage room full of paper that nobody can find anything in.
But digital storage is not "save it to a folder on the desktop and hope the computer does not crash." Digital records must meet three requirements:
Requirement 1: Printable on Demand
Every digital record must be producible as a paper copy upon request. When an inspector asks for your OSHA 300 Log, "it's in our cloud system" is an acceptable answer only if you can print it right then and there. "I'll email it to you next week" is not acceptable.
This means your digital system must be accessible from the workplace during normal business hours. Records stored exclusively on a home computer, a personal laptop that the owner takes on vacation, or a cloud system that requires credentials nobody at the facility has — these do not meet the requirement.
Requirement 2: Audit Trail
Digital records must maintain integrity. This means you need to demonstrate that the record has not been altered after the fact — or if it has been updated, there is a documented revision history showing what changed, when, and by whom.
A Word document on a shared drive does not have an audit trail. A PDF in a compliance management system with version control does. This distinction matters more than most businesses realize.
Requirement 3: Backup and Recovery
Digital records must be backed up. The retention period does not pause because your hard drive failed, your server was ransomware'd, or your office flooded.
Minimum backup requirements for compliance records:
| Backup Element | Minimum Standard |
|----------------|-----------------|
| Frequency | Daily for active records |
| Location | Off-site or cloud (separate from primary) |
| Testing | Restore test at least annually |
| Encryption | Required for records containing employee PII |
| Retention of backups | Must match or exceed source document retention |
If your backup retention is shorter than your document retention, you do not have a backup — you have a temporary copy.
Organizing for Inspection Retrieval
An inspector will not wait while you search. The expectation is that records requested during an inspection are produced within a reasonable timeframe — typically minutes for current documents, hours for archived records. Not days. Not "after we call our IT guy."
The practical organization system that works:
Active Records (Current Year + 1)
Keep immediately accessible at the workplace:
- Current OSHA 300 Log and 300A Summary
- Current SDS binder or digital index
- Current training records for all active employees
- Current IIPP, WVPP, EAP, and other plan documents
- Active incident investigation files
Archive Records (Years 2-5)
Keep retrievable within 4 hours:
- Prior year OSHA 300 Logs and summaries
- Training records for separated employees (within 3-year post-employment window)
- Closed incident investigations
- Superseded plan versions
Long-Term Archive (5+ Years)
Keep retrievable within 24 hours:
- SDS records for chemicals no longer in use (30-year retention)
- Historical exposure monitoring data
- Superseded medical surveillance records
The Cost of Getting This Wrong
A recordkeeping citation is a paperwork violation. It does not sound dramatic. It does not make the news. But here is what it costs:
| Violation Type | Per-Instance Penalty (2024) |
|---------------|---------------------------|
| Other-than-serious (missing record) | Up to $16,131 |
| Serious (missing record that masks a hazard) | Up to $16,131 |
| Willful (knowingly failing to maintain records) | Up to $161,323 |
| Repeat (same recordkeeping failure within 5 years) | Up to $161,323 |
A single missing OSHA 300 Log is one citation. Missing training records can be cited per employee — ten employees without documented training is ten violations. At $16,131 each, that is $161,310 for a paperwork failure.
And that is before the secondary consequences. Missing records during an inspection shift the burden of proof. If you cannot demonstrate compliance through documentation, the inspector assumes non-compliance. A missing training record is not just a recordkeeping citation — it is evidence supporting a training violation citation on top of it.
What a Managed System Handles for You
The reason most SMBs fail at recordkeeping is not because the rules are complicated. The rules are straightforward. The failure is operational: someone has to actually maintain the system, enforce the retention schedule, run the backups, and keep the index current. Every month. Every year. For thirty years in some cases.
A managed compliance platform handles:
- Automatic retention scheduling with destruction dates
- Version-controlled document storage with audit trails
- Cloud backup with geographic redundancy
- Inspection-ready retrieval with role-based access
- Automated alerts when retention periods are approaching expiration
- Training record tracking linked to employee records with post-separation timers
You can build this yourself. You can maintain it yourself. But you will not. Not because you are lazy — because you are busy running a business, and compliance recordkeeping is the thing that gets pushed to tomorrow until tomorrow becomes a citation.
The records exist or they do not. The retention period was met or it was not. There is no partial credit in a Cal/OSHA inspection.
Keep the records. Keep them long enough. Keep them where you can find them.
Or keep writing checks to the state.
